4.The Group’s business is subject to risks related to cybercrime and technological failure
Cyber-threats are constantly evolving and increasing in terms of complexity, frequency, impact and severity. The
financial sector remains a primary target for cybercriminals. Attempts are made on a regular basis to compromise
the Group’s IT systems and services, and to steal customer and bank data. Additionally, internal and external
malicious threat actors (e.g. “hacktivists”, organised crime, nation-state or insiders) may also fraudulently attempt
to induce employees, customers, third party providers or other users who have access to Group’s systems to
disclose sensitive information in order to gain access to the Group’s data or that of customers or employees.
Moreover, the Group does not have direct control over the cybersecurity of the systems of its clients, customers,
counterparties and third party service providers and suppliers, limiting the Group’s ability to effectively defend
against certain threats. Cybersecurity and information security events can derive from groups or factors such as:
internal or external threat actors, human error, fraud or malice on the part of the Group’s employees or threat
actors, including third party providers, or may result from accidental technological failure. Additionally, remote
working arrangements, which emerged during the COVID-19 pandemic and are continuing for many of the Group’s
and third party providers’ employees, place heavy reliance on the IT systems that enable remote working and may
increase exposure to fraud, conduct, operational and other risks and may place additional pressure on the Group’s
ability to maintain effective internal controls and governance frameworks. Common types of cyber attacks include,
but are not limited to, deployment of malware to obtain covert access to systems and data; ransomware attacks
that render systems and data unavailable through encryption; denial of service and distributed denial of service
(“DDoS”) attacks; infiltration via business email compromise; social engineering, including phishing, vishing and
smishing; automated attacks using botnets; and credential validation or stuffing attacks using login and password
pairs from unrelated breaches.
A successful cyber attack or technological failure may impact the confidentiality or integrity of the Group’s or its
clients’, employees’ or counterparties’ information or the availability of services to customers. As a result of such an
event or a failure in the Group’s cybersecurity policies, the Group could experience a major disruption in
operations, material financial loss, loss of competitive position, regulatory actions, inability to deliver customer
services, breach of client contracts, loss of data or other sensitive information (including as a result of an outage),
reputational harm or legal liability, which, in turn, could have a material adverse effect on its results of operations,
financial condition or prospects.
The Group may be subject to litigation, sanctions and/or financial losses that are either not insured against fully or
not fully covered through any insurance that it maintains. The Group may be required to spend additional
resources to notify or compensate customers, modify its protective measures, investigate and remediate
vulnerabilities or other exposures, reinforce the due diligence of and revisit its working relationship with third party
providers and develop and evolve its cybersecurity controls in order to minimise the potential effect of such
attacks. Regulators in the UK, US, Europe and Asia continue to recognise cybersecurity as an important systemic
risk to the financial sector and have highlighted the need for financial institutions to improve their monitoring and
control of, and resilience (particularly of critical services) to cyber attacks, and to provide timely notification of
them, as appropriate. In accordance with the Data Protection Act 2018 and the European Union Withdrawal Act
2018, the Data Protection, Privacy and Electronic Communications (Amendments Etc.) (EU Exit) Regulations 2019,
as amended by the Data Protection, Privacy and Electronic Communications (Amendments Etc.) (EU Exit)
Regulations 2020 (“UK Data Protection Framework”), the EU General Data Protection Regulation and European
Banking Authority (“EBA”) Guidelines on ICT and Security Risk Management the Group is required to ensure it
implements timely, appropriate and effective organisational and technological safeguards against unauthorised or
unlawful access to the data of the Group, its customers and its employees. In order to meet this requirement, the
Group relies on the effectiveness of its internal policies, controls and procedures to protect the confidentiality,
integrity and availability of information held on its IT systems, networks and devices as well as with third parties
with whom the Group interacts. A failure to monitor and manage data in accordance with the UK Data Protection
Framework and EBA guidelines may result in financial losses, regulatory fines and investigations and associated
reputational damage.
The Group expects greater regulatory engagement, supervision and enforcement to continue at a high level in
relation to its overall resilience to withstand IT-related disruption, either through a cyber attack or some other
disruptive event. With increased regulatory engagement, including the EU AI Act 2024 and EU Digital Operational
Resilience Act (“DORA”), supervision and enforcement is uncertain in relation to the scope, cost, consequence and
the pace of change, which could negatively impact the Group. Due to the Group’s reliance on technology and the
increasing sophistication, frequency and impact of cyber attacks, such attacks may have a material adverse impact
on the Group, its business, results of operations and outlook.