Mitigating activities and other considerations

·   Market risk is managed by the Group's Treasury function and is overseen by the ALCO. The Group and Bank do not take significant unmatched positions and do not operate trading books.

·   The Group and Bank use interest rate sensitivity gap analysis to inform the Group and Bank of any significant unmatched positions.

·   The interest rate risk position is reported on a monthly basis to the ALCO and includes risk appetite metrics set for both earnings at risk (EaR) and market value sensitivity (MVS). These are assessed against a 100bps and 200bps parallel shift in rates respectively.

·   The Group and Bank also monitor their exposure to economic value of equity (EVE), against a 200bps parallel shock in interest rates, as well as the six standardised shocks prescribed by the Basel Committee on Banking Supervision (BCBS).

·   Throughout 2022, a significant amount of work has been undertaken to validate the interest rate risk position on a behavioural basis and introduce the capability to transact interest rate derivatives to manage the residual interest rate risk position. This culminated in the transaction of interest rate derivatives (SONIA linked) in the second half of the year.

·   The Group and Bank monitor their exposure to basis risk, with Bank of England base rate and SONIA the only external reference rates used. The Group does not have any exposure to LIBOR.

·   The Group continues to monitor potential implications for the strategy in response to financial market turbulence and undertakes reviews of product pricing to ensure it is consistent with markets and cost of funds.

Mitigating activities and other considerations

·   Credit risk remains a key focus for the Group given the current macroeconomic environment.

·   The Group continues to monitor the impact of the cost of living crisis on portfolio performance, and internal measures have been put in place to help mitigate potential risks. These include, but are not limited to, alignment of creditworthiness assessments to the latest official inflationary outlook, production of targeted management information, and enhanced forbearance programmes. Ongoing executive focus is maintained through a Cost of Living Forum, jointly chaired by the CRO and the COO, together with standard Risk Committee reporting.

·   The Group's credit risk appetite is under regular review by the Credit Committee and Risk Committee to ensure that it remains aligned to current market and economic conditions.

·   A cross-functional working group is in place to create a centre of excellence for calculation of provisions under IFRS 9. The working group ensures that there are suitably skilled resources with clear accountabilities, effective governance arrangements, optimised models, aligned activities and effective management information and insights across the Group.

·   Performance of risk models is being closely monitored by the Group, with adjustments implemented where any continued deviation from expected performance is evidenced.

·   The Group continues to pursue opportunities to supplement existing data sources to enhance both credit and affordability risk, i.e. open banking.

Mitigating activities and other considerations

·   The Board and its sub-committees make risk-based decisions in the formulation of their business strategy, in line with their Delegated Authority Framework and Risk Appetite Framework and subject to independent oversight from the Risk function.

·   Board Governance Manual and Delegated Authorities Matrix (DAM) is in place to provide a framework for key decision making at all levels across the Group.

·   Executive director scorecards are in place, with reward incentives based on a combination of financial and non-financial measures.

·   Group Risk Appetite Framework is in place with agreed metrics and thresholds approved by the Board.

·   Strategic and emerging risks are reported to the GEC and GRC on any areas of concern.

·   Risk overlay is completed annually by the Group CRO on behalf of the Remuneration Committee (RemCo) to provide recommendations on adjustments to variable reward where governance has failed.

Mitigating activities and other considerations

·   Group-wide Climate Strategy and Policy is in place to ensure appropriate governance, controls and processes are in place to support compliance with TCFD requirements and broader ESG strategy (including net-zero targets).

·   Climate Risk Committee is in operation, supported by Climate Risk and Environmental Working Groups, facilitating the integration of climate considerations into the Group's broader Risk Management Framework through its reporting lines into the Customer, Culture and Ethics Committee and Group Executive Committee.

·   Quantitative Climate Risk Scenario Analysis and Stress Testing Framework is in place to inform forward-looking strategy, with scenarios proposed to identify potential financial impacts of transition and physical climate-related risks. ICAAP activity continues to take account of material climate-related financial impacts, meeting PRA requirements.

·   The Group continues to offset its direct operational carbon footprint via sustainable development projects and all main Group premises maintain ISO 14001:2015 compliant status.

Mitigating activities and other considerations

·   The Group simplified and strengthened its governance structure by collapsing and consolidating the Vanquis Banking Group and VBL Board executive structures.

·   Board Governance Manual and Group Delegated Authorities Framework is in place, setting out key decision making at all levels across the Group.

·   Board effectiveness is assessed on an annual basis with action plans in place to promote a culture of continuous improvement.

·   Explicit approval from the Board is required before any decisions and actions are made that could result in risks materialising outside of appetite.

·   Conflicts of Interest Policy and processes are in place to ensure all employees meet their fiduciary responsibilities.

·   All regulatory interactions are recorded and tracked, with regular reporting through the executive and Board committees to ensure consistency and read across through a Group lens.

·   The Group proactively engages with regulatory authorities and industry bodies on forthcoming regulatory changes.

·   Governance arrangements are continuously reviewed to ensure they are designed and operating effectively to meet the Group's objectives.

Mitigating activities and other considerations

·   The Group is committed to operating a strong and risk-proportionate set of systems and controls to manage the risk within appetite.

·   The second line Financial Crime Oversight team has been significantly enhanced with regards to capacity and capability.

·   A revised Group-wide financial crime assessment approach established to set control requirements which define the standards by which financial crime risk will be managed.

·   New AML, CTF and Sanctions Policy has been implemented which sets out control standards and requirements in line with the Group's Financial Crime Risk Assessment Methodology.

·   Regulatory actions and notifications are monitored and managed in line with relevant timescales, and regular horizon scanning takes place to identify relevant and significant regulatory change.

·   A Customer Lookback Project was successfully completed in March 2022, whereby 100,000 alerts were manually reviewed. This gave the Group confidence of Politically Exposed Person (PEP) records and that no relationships exist with individuals subject to economic sanctions.

Mitigating activities and other considerations

·   A Group-wide Conduct Risk Framework has been developed, with plans in place to further embed its requirements across the Group. This enables the Group to demonstrate adherence to the requirements set out within the FCA's three-year Strategy and Annual Business Plan and includes improved monitoring of customer outcomes across all high-risk interactions such as lending, forbearance, vulnerability and complaints.

·   A programme of activity has been established to meet the requirements of the FCA's Consumer Duty regulations coming into force 2023-2024. The Board and Risk Committee are provided with regular updates to support their oversight.

·   As part of risk harmonisation, the legacy divisional Conduct and Compliance teams have been centralised and report to the Group's Chief Conduct and Compliance Officer who continues to consolidate consistent and best practices.

·   Conduct Policies and Procedures are in place to ensure the Group has appropriate controls and processes to deliver fair customer outcomes.

·   Group Complaints Forum and reporting were established to ensure the Group is learning from complaints trends across products, including any FOS referrals or upholds and actions of claims management companies. This has resulted in a number of strategic changes outlined in the Group's emerging risks: 'Threats to our business model' and 'Responsible lending'.

·   As part of the Group's response to the cost of living crisis (COLC), a number of steps have been taken, including reviewing the range of support available to customers and setting up a Cost of Living Forum, which closely monitors for early indicators of cost of living pressures in the Group's book performance, to enable any remedial action to be taken as required. The Group has proactively liaised with regulators to share insights on the COLC impact, providing updates on the outcome of the Group's monitoring and adjustments to its credit risk approach throughout the year. The FCA have concluded a review of Cost-of-Living Crisis Forbearance Outcomes which Moneybarn were selected to be part of. The findings, received on 3 February 2023, were consistent with an internal review performed during 2022 which initiated a programme of work to enhance the effectiveness of operational areas to deliver improved customers outcomes. This in-flight programme will be further enhanced to reflect any additional areas of concern raised by the FCA.

·   A Compliance Monitoring Programme is in place, supported by a robust methodology and approved by the Risk Committee, to assess the adequacy and effectiveness of the control frameworks in place and supporting fair customer outcomes and regulatory compliance.

·   The Group proactively engages with regulatory authorities on a frequent basis.

Mitigating activities and other considerations

·   People and HR function centralised to streamline critical people management activities across the Group.

·   People Risk Forum to support the management of key people-related risks.

·   Operational Effectiveness Steering Group (OESG) implemented to govern and manage the risks associated with structural changes.

·   Succession plans completed and in place for all Executive and Senior Management.

·   Communications have and continue to be shared with colleagues across the Group to keep them apprised of business changes and to support wellbeing.

·   Full health and safety risk assessment completed of all our key work locations with mitigating actions completed.

·   Recruitment, onboarding, training and exit processes have been strengthened across the Group.

·   Consistent frameworks have been developed and embedded for Group reward, performance management (Be Better) and talent management.

Mitigating activities and other considerations

·   An IT shared service operating model has been implemented to seek commercial and cost opportunities and manage associated risks effectively and efficiently across all product lines.

·   An IT Strategic Programme is in place to deliver new architecture to embrace modern principles of open architecture, supporting easy addition, upgrade and replacement of components and the use of scalable cloud services, while continuing to address key areas of technical debt.

·   A cyber security strategy has been developed to align security across the Group and implement a consistent and robust service which supports the delivery of the overall business and IT strategies.

·   Continued progress with the IT First Line Controls Review (FLCR), enhancing IT control effectiveness and risk maturity across the Group and transitioning risk and control ownership into business as usual (BAU) activity.

Mitigating activities and other considerations

·   The Group's three lines of defence model ensures there are clear lines of accountability between management which owns the risks, oversight by the Risk function and independent assurance provided by Internal Audit.

·   The Risk Harmonisation Programme, which provides a more consistent and integrated approach to risk management across the Group, has moved from implementation to embedding stage. The programme is delivering a single Enterprise Risk Management Framework, consolidated Risk Policies and methodologies, and risk reporting capability.

·   An integrated Risk Management System (Riskonnect) has been implemented which provides a central and secure repository of risk information across the Group's three lines of defence. Implementation of the system significantly enhances the Group's risk management capability, improved risk and control effectiveness, and realised resource efficiencies with the automation of processes and reporting.

·   The Risk and Control Self-Assessment (RCSA) process has been subject to a budgeted programme of improvement activity, jointly sponsored by the Chief Operations Officer, Chief Information Officer and Chief Risk Officer. This programme has enhanced the accuracy, completeness and reliability of risk and control data.

·   A fully standardised model for supplier management is being embedded, which includes the implementation of a new Supplier Relationship Management (SRM) Framework, Change Governance Framework, Portfolio Working Group and Transformation Executive Committee, and alignment of the Operational Resilience and Supplier and Third-Party Risk Management Frameworks.

·   Work is progressing on the implementation and embedding of a harmonised change management control environment across the Group.

Mitigating activities and other considerations

·   Model Risk Management Framework and Policy, Target Operating Model and supporting modelling standards are in place.

·   Material models across the Group are independently validated as required in the policy.

·   Group model inventory, containing key models across the Group, is reviewed and updated on a regular basis and has all the necessary information to enable effective model risk reporting and planning.

·   High-risk issues and findings on material models are addressed urgently and outstanding model risk issues and findings are monitored and reported to relevant governance forums across the Group.

·   Group Model Governance Forum meets regularly and effectively provides model risk oversight, driving a standardised approach to model development and governance across the Group.

·   Existing Group Model Risk Management Framework has been assessed against the PRA's proposed Model Risk Management Principles (CP6/22) and found no material gaps.

·   Enhancements made to the existing IFRS 9 models with further improvements planned on the governance, performance monitoring and methodology of these models.