Paypoint : Annual Report & Notice of 2017 AGM

Risk area

Potential Impact

Mitigation strategies

Cyber, technology & process and Fraud

Loss or inappropriate usage of data

The Group's business requires the appropriate and secure use of consumer and other sensitive information. Electronic commerce requires the secure transmission of confidential information over public networks. Increasingly, internal systems make use of third party hosted services (cloud services) and several of our products are accessed through the internet. Fraudulent activity, cyber-crime or security breaches in connection with maintaining data and the delivery of our products and services could harm our reputation, business and operating results.

The Group has established physical security controls at its data centres and rigorous cyber security, anti-fraud and whistleblowing standards, procedures, and recruitment and training schemes, which are embedded throughout its business operations. The Group also screens new employees carefully. Continued investments are made in cyber security, including the significant use of data and communications encryption technology, improvements in e-mail and web filtering and testing and removal of system vulnerabilities. We have also developed plans for responding to a breach of security.

Interruptions in business processes or systems

The Group's ability to provide reliable services largely depends on the efficient and uninterrupted operation of our computer network systems, financial settlement systems, data and call centres, as well as maintaining sufficient staffing levels. System or network interruptions, recovery from fraud or security incidents or the unavailability of key staff or management resulting from a pandemic outbreak could delay and disrupt our ability to develop, deliver or maintain our products and services, causing harm to our business and reputation and resulting in loss of customers or revenue.

Comprehensive business continuity plans and incident management programmes are maintained to minimise business and operational disruptions, including fraudulent activity, system failure or pandemic incidents. Support arrangements have been established with third party vendors and there are strict standards, procedures and training schemes for business continuity.

Clients, agents & other third parties

Dependence upon third parties to provide data and certain operational services

The Group's business model is dependent upon third parties to provide operational services, the loss of which could significantly impact the quality of our services. Similarly, if one of our outsource providers, including third parties with whom we have strategic relationships, were to experience financial or operational difficulties, their services to us would suffer or they may no longer be able to provide services to us at all, significantly impacting delivery of our products or services.

The Group selects and negotiates agreements with strategic suppliers and agents based on criteria such as delivery assurance and reliability. Single points of failure are avoided, where practicable and economically feasible. Controls are regularly reviewed and improved to minimise risk of retailer churn caused by financial loss to retailers through fraudulent third party activity.

Consolidation among clients and markets

Consolidation of retailers and clients could result in reductions in the Group's revenue and profits through price compression from combined service agreements or through a reduced number of clients.

The Group monitors client and retailer concentration risk to ensure that no one client or retailer accounts for a disproportionate share of the Group's net revenue. In addition, the Group continues to acquire new clients and retailers to reduce reliance on existing sources of revenue.

Legal, regulatory & compliance

Legislation or regulatory reforms and risk of non-compliance

The Group is largely unregulated by financial services regulations, although in the UK we have Payment Institution status (through PayPoint Payment Services Limited), which enables the provision of regulated payment services, under the Payment Services
Regulations 2009, including certain CashOut services. The Group's agents which offer money transfer on behalf of third party clients are licensed as Money Service Businesses by HMRC. We are subject to Payment Card
Industry Data Security Standards regulated by the card schemes. Regulatory reform could increase the cost of the Group's operations or deny access to certain territories in the provision of certain services. Non-compliance with law, regulation, privacy or information security laws could have serious implications in cost and reputational damage to the Group.

The Group's legal department works closely with senior management to adopt strategies to educate legislature, regulators, consumer and privacy advocates and other stakeholders to support the public policy debate, where appropriate, to ensure regulation does not have unintended consequences over the Group's services. The Group has in place a business ethics policy which requires compliance with local legislation in all the territories in which the Group operates. A central compliance department co-ordinates all compliance monitoring and reporting.

Subsidiary managing and finance directors are required to sign annual compliance statements. A review is underway to ensure that the Group is compliant with the requirements of the General Data Protection Regulations prior to the May 2018 deadline.

Materially adverse litigation

The Group contracts with a number of large service organisations for which it provides services essential to their customers. Failure to perform in accordance with contractual terms could give rise to litigation.

The Group seeks to limit exposure in its contracts. Mitigating actions are taken where contractual exposures are above the norm, including insurance coverage, where appropriate and economically sustainable.

Loss or infringement of intellectual property rights

The Group's success depends, in part, upon proprietary technology and related intellectual property rights. Some protection can be achieved but in many cases, little protection can be secured. Third parties may claim that the Group is infringing their intellectual property rights or our intellectual property rights could be infringed by third parties. If we do not enforce or defend the Group's intellectual property rights successfully, our competitive position may suffer, which could harm our operating results.

The Group, where appropriate and feasible, relies upon a combination of patent, copyright, trademark and trade secret laws, as well as various contractual restrictions, to protect our proprietary technology and continues to monitor this situation. The Group also defends vigorously all third party infringement claims.

HR/Personnel

Dependence on recruitment and retention of highly skilled personnel

The ability of the Group to meet the demands of the market and compete effectively is, to a large extent, dependent on the skills, experience and performance of its personnel. Demand is high for individuals with appropriate knowledge and experience in payments, IT and support services. The inability to attract, motivate or retain key talent could have a serious consequence on the Group's ability to service client commitments and grow our business.

Effective recruitment programmes are on-going across all business areas, as well as personal and career development initiatives.

The executive management reviews talent potential twice a year and retention plans are put in place for individuals identified at risk of leaving. Compensation and benefits programmes are competitive and also reviewed regularly.

Economic Growth

Brexit

The effect on inter-company transactions and the Group's international expansion plans may be adversely affected by the outcomes of the negotiations between the UK government and the other member countries during the UK's exit from the European Union.

Due to the current uncertainties with the Brexit negotiations the Group is still considering appropriate mitigation strategies.

However, the bulk of the Group's operations and revenues are UK-based. Romania and Ireland will remain within the EU and are unlikely to be significantly affected by Brexit.

Foreign exchange fluctuations

As the Group operates in Romania and Ireland, it is exposed to the risk of currency fluctuations and the unpredictability of financial markets in which it operates.

The Group's financial risk management seeks to minimise potentially adverse effects on the Group's financial performance.

Product/project management

Technological changes and increasing competition

The Group operates in a number of geographic, product and service markets that are highly competitive and subject to rapid technological changes, for example the introduction of smart meters, new payment solutions and the movement of UK consumers away from cash payments. Competitors may develop products and services that are superior to ours or that achieve greater market acceptance than our products and services, which could result in the loss of clients, merchants and retailers or a reduction in revenue.

The Group is committed to continued research and investment in new data sources, people, technology and products to support its strategic plan. IT development resource is directed at a Group level and developments are in hand to ensure the Group has relevant products in place to meet the demands brought about by changing technology. For smart meters, MultiPay has been launched.