Jtc Plc Regulatory News (JTC)

LEVEL 1

LEVEL 2

Primary, overarching risk elements, containing SIX components

Represents the cohorts of specific risks JTC is exposed to

Principal risk

1. STRATEGIC

Acquisition

P

Competitor and client demand

P

Strategy

P

2. FINANCIAL

Performance of business

P

Earnings (fx)

Impairment

Financing

3. OPERATIONAL

Client & process

P

Business continuity

Data security

P

4. POLITICAL/REGULATORY

Listing rules

Political/regulation

P

Financial crime

P

5. LEGAL

Litigation/contractual

Fiduciary

P

6. HUMAN RESOURCES

Adequate resources

P

Retention

Key person

STRATEGIC RISK

1 Acquisition

2 Competitor & Client demand 3 Strategy

OPERATIONAL RISK

5 Client & Process

6 Data Security

LEGAL RISK

9 Fiduciary

FINANCIAL

4 Performance of Business

POLITICAL & REGULATORY RISK

7 Political Regulation

8 Financial Crime

HUMAN RESOURCES RISK

10 Adequate Resources

1

ACQUISITION RISK

(Group Chief Executive Officer)

The risk that acquisitions do not achieve intended objectives, give rise to ongoing or previously unidentified liabilities, disrupt operations and divert senior management time and attention.

Inorganic growth in 2022 was limited to the acquisition of New York Private Trust Company.

·  Inadequate due diligence

·  Economic misjudgement

·  Lack of strategic clarity

·  Ineffective or delayed integration

·  Unpredicted changes to external environment

·  Strict due-diligence process, including JTC subject-matter experts and third-party assessments by experienced external advisors

·  Appropriate scrutiny and challenge from Group Development Committee, Group Holdings Board and Non-Executive Directors

·  Established and tested integration strategy agreed prior to acquisition with robust post-acquisition governance

·  Experienced management team

·  Shared ownership to align interests and deferred consideration

·  Insurance run-off cover

·  Vendor representations and warranties (backed by insurance where appropriate)

This risk will diminish over time as each acquisition is integrated, but current strategic intentions are likely to cause this risk category to remain as a principal risk.

2

COMPETITOR AND CLIENT DEMAND RISK

(Group Chief Executive Officer)

The risk of failing to anticipate client demand or to innovate in line with key competitors, or advancing technology or regulatory/political change may lead to significant loss of potential or existing business.

JTC operates in a competitive and fast-paced global market requiring a responsive approach to client demand and behaviour, competitor activity, innovation, economic and regulatory changes and geopolitical events.

·  'Black swan' events (e.g. pandemic)

·  Competitor actions

·  Political trends

·  Economic conditions

·  Market conditions

·  Regulatory changes

·  Technological changes

·  Chief Commercial Officer appointed to Group Holdings Board

·  Group Holdings Board responsibility for identifying forthcoming requirements in respect of digital and business systems investment and continually considering emerging threats due to market conditions, taking mitigating action as appropriate

·  Group Holdings Board responsibility for identifying and prioritising product innovation

·  Commercial Enterprise Forum to assess, prioritise, de-risk and commercialise opportunities

This risk is largely influenced by external factors and is therefore likely to remain a continuous principal risk.

3

STRATEGY RISK

(Group Chief Executive Officer)

The risk that inadequate strategic decisions or failure to execute the set strategy has a detrimental impact on Group operations, clients and market confidence. Alternatively, the Group's strategy brings excessive risks to the business or does not sufficiently align to changing market conditions or client requirements, such that sustainable growth, market share or profitability is affected.

The Group continues to pursue its strategy of organic and inorganic growth with a particular focus on building our presence in the United States, Ireland, Luxembourg and the UK.

·  Operation outside of risk appetite

·  Product or service failure

·  Senior management or leadership changes

·  Legal or regulatory challenges

·  Lack of understanding of a new jurisdiction

·  Overarching strategy is set every three to five years and progress is periodically re-examined

·  Strategy regularly reviewed and challenged by Board and, as a listed entity, subject to investor and third-party scrutiny

·  Strategy drives annual business planning process and performance-based targets

·  Risk-taking and aversion in pursuit of strategic objectives is balanced through the setting and overseeing of the Group Risk Appetite

Strategic risk is an ongoing risk for any business and therefore is likely to remain as a continuous principal risk.

4

BUSINESS PERFORMANCE RISK

(Group Chief Executive Officer)

The risk that the Group does not meet its financial forecasts or does not achieve the provided market guidance.

JTC is listed on the London Stock Exchange and subject to market consensus expectations that can influence shareholder value.

·  Inadequate budgeting and forecasting

·  Unpredicted costs or losses

·  Lack of information provided to brokers and analysts

·  Budgets set annually and agreed with Divisional Heads, Jurisdictional Managing Directors and P&L account owners

·  Monthly reporting and KPIs that help monitor performance against performance assumptions and targets. Active review by Group Holdings Board together with PLC Board

·  CEO and CFO regular engagement with analysts to inform external market guidance

·  Insurance cover for losses

Business performance risk is an ongoing risk for a business, especially for a quoted business. This risk is therefore likely to remain as a continuous principal risk.

5

CLIENT AND PROCESS RISK

(Group Divisional Heads)

The risk of the Group taking on the wrong type of clients, or the Group or the client's actions during the client life-cycle leads to losses, failed strategic objectives, reputational damage, poor customer service and employee frustration and potentially regulatory censure. The risk of failing to clearly define service provision or fulfil a role expertly. The risk that lack of relevant process or incorrect, inconsistent, or untimely execution of processes or internal change leads to a material operational error and the consequential adverse impact.

·  Failure to apply policies and follow procedures

·  Failure to follow codes of conduct

·  Failure of managerial oversight

·  Failure to adequately train and develop employees

·  Failure to identify and remediate identified issues promptly

·  Inadequate policies and procedures

·  Strict adherence to policy and procedures including business acceptance and periodic reviews, with appropriate escalation for higher-risk clients

·  Established Terms of Business, template customer agreements and Legal review of tailored agreements

·  Regular staff training and awareness initiatives

·  Established reporting and escalation process with review by boards and committees as appropriate

·  Independent client and Compliance monitoring review programme

·  Promoting a robust risk and compliance culture across the Group

·  Ensuring quality administration and compliance resource in each jurisdiction plus internal legal counsel support as appropriate

·  Well established Recommendation for Signing process

·  Three-lines model for assurance and controls including Internal Audit ("IA")

·  Well understood and defined Risk Escalation processes

·  Accessible policy and procedure framework

Client and process risk remains a continuous principal risk for the business.

6

DATA SECURITY RISK

(Group Chief Executive Officer)

The risk of a security breach including cyber-attacks by destructive forces from both internal and external sources, leading to loss of confidentiality and integrity of data.

The sophistication of cyber threats is constantly evolving; criminals will seek to exploit changes in working environments e.g. remote-working practices. A substantial cyber event could be detrimental to JTC's clients as well as erode market and regulator confidence.

·  Unauthorised data transfer

·  Malware

·  Financial theft

·  Denial-of-service attacks

·  Cyber phishing attacks

·  Network service failures

·  Employee error

·  Malicious employee intent

·  Security breach of client data or systems

·  Defined and audited IT procedures

·  External security assessment conducted annually

·  System access controls including least privilege access model

·  Dedicated Senior IT Security Manager and Team

·  Training including compulsory online Security Awareness courses for all employees

·  Alignment to industry security standards

·  Review of data security procedures and controls as part of the annual ISAE 3402 Report

·  Access to group systems and data is granted on a need-to-know basis and least privileged

·  Industry-leading solutions for end-point management, anti-virus, data loss prevention, Privilege Access Management and secure email communications

Data security risk remains a continuous principal risk for the business.

7

POLITICAL/REGULATION RISK

(Group Chief Executive Officer)

The risk that the JTC business operating model is adversely affected by political or regulatory changes which affect the markets or services we offer together with our client base.

Risk of exposure to regulatory sanction and subsequent reputational damage given a failure to follow regulatory laws, orders and codes of practice requirements.

As the regulatory environment continues to develop, we expect a continuing global trend of increased regulatory scrutiny and intervention for all regulated businesses including trustee, fund and corporate service providers. The Group is well positioned to comply with relevant requirements and to be able to operate in this changing regulatory environment.

·  Geopolitical uncertainty

·  Regional or global standards or requirements with disproportionate impact

·  Political reaction to wide-scale data leaks and associated negative press coverage

·  Balancing increased transparency requirements with increased data protection legislation

·  Challenge and cost of measuring, monitoring and demonstrating good conduct as well as meeting new requirements

·  Keeping pace with rapid regulatory change and reporting requirements

·  Specialist risk and compliance staff with the skills needed to monitor and report on strategic outlook and the impact of change

·  Review by appropriate boards and committees, and scanning of horizon for potential changes

·  Comprehensive policies, procedures and processes in operation within the Group that align to the appropriate regulatory regimes.

·  Embed (and continue to promote) a robust risk and compliance culture across the Group from PLC Board down through the organisation.

·  Ensuring appropriate compliance resource in each jurisdiction

·  Compliance monitoring programme in place

·  Training employees to be aware of changing regulations

·  Involvement with trade associations and government bodies to understand direction and influence outcome

Political and regulation risk is expected to remain a continuous principal risk for the business.

8

FINANCIAL CRIME RISK

(Group Divisional Heads)

The risk of the Group operating inadequate systems, procedures and controls that fail to prevent the administration of client structures that are exposed to financial crime.

(NOTE: Financial Crime Risk includes money laundering, terrorist and proliferation financing, sanctions, fraud, bribery and corruption and tax evasion risks).

This is an area where there is intense regulatory attention and scrutiny. The Group is committed to the highest standards of ethical behaviour and operates in a manner designed to deter and prevent financial crime risk. There is focused oversight and monitoring of financial crime risks, and adherence to both internal financial crime policies and regulatory obligations.

·  Poor culture

·  Inadequate awareness training

·  Poor Know Your Client processes

·  Inadequate record keeping

·  Deficient screening processes

·  Lack of a risk-based approach

·  AML/CFT arrangements not tailored to business profile/characteristics

·  Procedural failures

·  Failure to report suspicious activity on a timely basis

·  Comprehensive policies, procedures and processes in operation within the Group that are specifically drafted for AML/CFT purposes

·  The hiring of capable employees in each jurisdiction that undertake the key person roles (e.g. Compliance Officer and Money Laundering Reporting Officer)

·  Frequent mandatory staff training and awareness initiatives and CPD requirements

·  Compliance monitoring testing programme in place

·  Access to external consultants and databases to enable daily ongoing monitoring and in depth enquiries on clients as appropriate

·  Established Business Risk Assessment (BRA) process which is subject to periodic Board review

Financial crime risk is expected to remain a continuous principal risk for the business.

9

FIDUCIARY RISK

(Group Divisional Heads)

The risk of breaching fiduciary duties, including failing to safeguard client assets, can be harmful to the Group's reputation and could become subject to high-value litigation. There is also the risk in failing to clearly define the Group's role in providing services to a client structure or service vehicle or a failure to fulfil the role expertly.

JTC operates a comprehensive set of controls to prevent risk materialising in relation to its fiduciary duties. A change in the market conditions causing lower valuations of higher-risk investments, could change risk exposures and fiduciaries may begin to experience increased regulatory scrutiny and litigation with regard to responsibilities.

·  Breach of duty

·  Failure to act in accordance with constitutional documents or service agreement

·  Failing to exercise reasonable care, skill and diligence

·  Failure to declare interests of manage conflicts

·  Making impartial judgements

·  Strict policies, procedures and processes in operation within the Group (particularly risk escalation and recommendation for signing policy)

·  Qualified and experienced staff operating within'4-eyes' control parameter

·  Continuous training programme and CPD requirement

·  JTC does not provide legal or tax advice to its clients

·  Significant insurance cover

Fiduciary risk is an endemic feature of JTC business operations and is expected to remain a continuous principal risk.

10

ADEQUATE RESOURCES RISK

(Group Chief Operating Officer)

The risk of failure to attract or retain the best people with the right capabilities across all levels and jurisdictions.

The repercussions of the global pandemic have significantly altered the workplace and the employment market in many jurisdictions. Remote-working practices initiated during early lockdown measures have been embraced into business-as-usual flexible working arrangements utilising the Group's existing strong technology capabilities.

Regretted attrition is carefully monitored in view of changes in employee attitudes, skills shortages and inflationary pressures that have the potential to be disruptive to the Group's workforce.

JTC continues to focus on employee satisfaction (launching an employee survey during 2022), succession planning and personal development, including supporting professional qualifications.

·  Uncompetitive remuneration

·  Unappealing working environment and inadequate support

·  Lack of adequate succession planning

·  Failure to invest in appropriate and timely talent development

·  Failure to identify roles most important to achieving strategic aims

·  Failure to identify the required skills for key roles

·  Insufficient focus on attitude and motivation and alignment with JTC's vision and values

·  Dedicated in-house human-resource recruitment capability with detailed understanding of business needs and local market environment

·  Recruitment strategy to enhance and bolster teams, succession planning and employee value proposition

·  JTC ensures that the remuneration package is competitive in the marketplace and benchmarks with peer group

·  Management monitoring of capacity and work loads

·  Shared ownership scheme embedded across the business

·  JTC encourages a strong management culture where talent management and people development is a core focus

·  Pre-employment screening

·  Internal and PLC Remuneration committee

·  Staff access to Academy (Training), Gateway (International Transfers) and wellbeing programs

·  Flexible working arrangements

Adequate resourcing risk is expected to be a continuous principal risk.