Jtc Plc Regulatory News (JTC)

LIKELIHOOD

High

MEDIUM

CRITICAL (HIGH RISK)

Low

LOW

HIGH IMPACT (LOW RISK)

Moderate

Critical

IMPACT

Legal

· Litigation / Contractual

· Fiduciary

· Robust policies, procedures and processes in operation within the Group (particularly risk escalation policy)

· Qualified and experienced staff operating within a "6-eyes" control parameter

· Utilisation of external counsel in all disputes where appropriate

· Substantial PII cover

· The hiring of an experienced in-house legal team

· Free legal helpline with two international law firms

· Robust policies, procedures and processes in operation within the Group

· JTC does not provide legal or tax advice to its clients

· Continuous training programme

Financial

· Performance of business

· Earnings (fx)

· Impairment

· Financing

· Ongoing monthly reporting and KPIs that help monitor performance against performance assumptions and targets

· Robust annual business planning and budget process

· Ongoing review of processes

· Active cash management process including matching of cash flows where possible

· Monitoring of f/x rates

· Robust due diligence process in place prior to acquisitions being completed

· Regular impairment testing as per accounting rules

· Ongoing management and monitoring against performance assumptions

· Cash management procedures in place

· Robust monitoring of loan covenants

POLITICAL / REGULATORY

· Listing Rules

· Regulation

· AML/CFT

· Retention of specialist advisers

· Deployment of staff dedicated to ensure compliance

· Utilisation of NED expertise

· Product/jurisdictional diversification reduces impact

· Review by appropriate boards/committees and business of horizon for potential changes

· Comprehensive policies, procedures and processes in operation within the Group that align to the appropriate regulatory regimes

· Promoting a robust risk and compliance culture across the Group

· Ensuring appropriate compliance resource in each jurisdiction

· Compliance monitoring programme in place

· Comprehensive policies, procedures and processes in operation within the Group that are specifically drafted for AML/CFT purposes

· The hiring of capable employees that undertake the key person roles (e.g. Compliance Officer and Money Laundering Reporting Officer)

· Frequent staff training / awareness initiatives

HUMAN RESOURCE

· Adequate resources

· Retention

· Key person

· Comprehensive policies, procedures and processes in operation within the Group that are specifically drafted for AML/CFT purposes

· The hiring of capable employees that undertake the key person roles (e.g. Compliance Officer and Money Laundering Reporting Officer)

· Frequent staff training / awareness initiatives

· JTC ensures that the remuneration package is competitive in the market place and benchmarks against peer group

· Shared ownership scheme embedded across the business

· JTC encourages a strong management culture where talent management and people development is a core focus

· Coverage of roles - certain roles have been identified as 'key' and a robust succession plan within current staff pool is being developed

OPERATIONAL

· Client

· Process

· Business continuity

· Data Security Risk

· Robust policy and procedures including at 'take-on' subject to regular review with appropriate escalation for higher risk clients

· Frequent staff training / awareness initiatives

· Established reporting and escalation process with review by boards/committees as appropriate

· Independent client and compliance monitoring review program

· Promoting a robust risk and compliance culture across the Group

· Ensuring quality administration and compliance resource in each jurisdiction plus internal legal counsel support as appropriate

· Well established RFS process

· Evolution to a 'three lines of defence' assurance and controls model

· Comprehensive policies, procedures and processes in operation within the Group that are specifically drafted for business continuity and IT security purposes

· JTC run an active/active dual datacentre model, across the Channel Islands, with one datacentre in Jersey and another in Guernsey, this provides inter island redundancy should either datacentre suffer power or communication failure. The datacentres are connected via four diverse and redundant network links to allow for synchronous replication

· The ability to continue business in alternative location if an issue arises in one jurisdiction, as was implemented for the JTC BVI office in 2017

· Defined and audited IT procedures

· External security assessment conducted annually

· System access controls including least privilege access model

· Dedicated Senior IT Security Manager

· Training including compulsory online Security Awareness courses

· Review of data security procedures and controls as part of the annual ISAE 3402 Report

STRATEGIC

· Acquisition

· Competitor

· Strategy

· Robust acquisition due diligence process including 3rd party assessments by well regarded accounting and legal firms

· Governance and challenge from Non-Executive Directors

· Integration strategy in place prior to acquisition

· Integration committees established to manage integration process

· Group Holdings Board responsibility for identifying forthcoming requirements in respect of digital / business systems investment

· GHB responsibility for identifying and prioritising product innovation

· Strategy regularly reviewed and challenged by Board respectively

· Strategy drives annual business planning process and performance based targets

REPUTATIONAL

· Regulatory sanction

· Public litigation

· Breaching sanctions,

· Involvement in money laundering or the financing of terrorism

· Comprehensive risk management capability including controls embedded within the procedural environment

· Prompt and effective communication with all stakeholders - regulators, shareholders, employees, clients and suppliers

· Strong and consistent enforcement and testing of controls on governance, business and legal compliance

1

Risk of a security breach including cyber-attacks from destructive forces leading to loss of confidentiality and integrity of data.

· Data exfiltration

· Malware

· Financial theft

· Denial of service attacks

· Cyber-physical attacks

· Network service failures

· Employee error

· Malicious employee intent

· Defined and audited IT procedures

· External security assessment conducted annually

· System access controls including least privilege access model

· Dedicated Senior IT Security Manager

· Training including compulsory online Security Awareness courses

· Review of data security procedures and controls as part of the annual ISAE 3402 Report

· Robust business continuity planning

Critical / medium risk

2

Risk of the Group taking on the wrong type of clients, or the Group or the clients actions during the clients life cycle leading to losses, failed strategic objectives, poor customer service and employee frustration and potentially enforcement, supervision or regulatory sanction

· Failure to apply policy and follow procedures

· Failure to follow codes of conduct

· Failure to invest in appropriate and timely talent development

· Failure of managerial oversight

· Failure to adequately train and develop employees

· Robust policy and procedures including at take on subject to regular review with appropriate escalation for higher risk clients

· Frequent staff training / awareness initiatives

· Established reporting and escalation process with review by boards/committees as appropriate

· Independent client and Compliance monitoring review program

· Promoting a robust risk and compliance culture across the Group

· Ensuring quality administration and compliance resource in each jurisdiction plus internal legal counsel support as appropriate

· Well established RFS process

· Evolution to a three lines of defence assurance and controls model

Medium / low risk

3

Risk that acquisitions do not achieve intended objectives or give rise to ongoing or previously unidentified liabilities.

· Paying too much

· Lack of strategic clarity

· Slow decision making

· Lack of buy-in

· Failure to integrate swiftly

· Robust due diligence process including 3rd party assessments by well regarded accounting and legal firms

· Governance and challenge from Non-Executive Directors

· Integration strategy in place prior to acquisition

· Integration committees established to manage integration process

High / medium risk

4

Failure to retain high calibre, talented senior managers and other key roles in the business.

· Lack of adequate succession planning

· Failure to invest in appropriate & timely talent development

· JTC ensures that the remuneration package is competitive in the marketplace and benchmarks against peer group

· Shared ownership scheme embedded across the business

· JTC encourages a strong management culture where talent management and people development are a core focus

High / low risk

5

Failure to recruit or develop good quality people to achieve our strategic aims

· Failure to identify roles most essential to delivering on strategic aims

· Failure to identify what skills the position really requires

· Focus too heavily on technical skills and not enough on attitude and motivation

· Lack of adequate succession planning

· Failure to invest in appropriate and timely talent development

· Coverage of roles - certain roles have been identified as 'key' and a robust succession plan within the current staff pool is being developed

· Frequent staff training / awareness initiatives

· JTC Academy programme for all employees globally

· JTC 'LION' senior management development programme

High / low risk

6

Risk that a change in laws and regulations will materially impact the sector and / or our business.

· Disorderly Brexit

· Geopolitical uncertainty

· OECD tax reviews

· '4AMLD' / Public Beneficial Ownership Registers

· GDPR and data protection initiatives

· Challenge and cost of measuring, monitoring and demonstrating good conduct as well as meeting new requirements

· Keeping up with the rapid pace of regulatory change

· Dedicated risk and compliance resource with the requisite skills, resources to monitor and report to the Board on strategic outlook / impact of change

· Robust and sustainable regulatory change management model

· Well-hedged and positioned with a global platform and established EU operations (Luxembourg & Netherlands)

· Data-focused approach that enables continuous monitoring and real-time insight into impact on operations

· Proven track record of navigating and maximising revenue growth opportunities from regulatory change

· Minimal FX risk exposure

High / medium risk