Risk governance
INTRODUCTION
As a financial services provider, managing risk is a core part of our day-to-day activities. To be able to manage our business effectively, it is critical that we
understand and control risk in everything we do. We aim to use a prudent approach, underpinned by advanced risk management techniques to help us deliver
robust financial performance, withstand stresses, and build sustainable value for our stakeholders. We aim to keep a predictable medium-low risk profile,
consistent with our business model. This is key to achieving our strategic objectives.
RISK FRAMEWORK
How we define risk
Key risk types
Our key risk types help us define the risks to which we are exposed. For definitions of our key risk types, see ‘How we define risk’ in the 2023 Annual Report.
30 June 2024 compared to 31 December 2023
In H124, our key risk types remained as described in the 2023 Annual report, except for that Operational risk and resilience is now referred to as Operational risk.
Top and emerging risks
Several of our risk types also have top and/or emerging risks associated with them. For more, see 'Top and emerging risks' in the 2023 Annual Report.
30 June 2024 compared to 31 December 2023
In H124, there were no significant changes in our risk governance and our top and emerging risks, as described in the 2023 Annual Report, except as follows:
Top risks
In H124, our focus shifted away from Inflationary and Supply Chain pressures to Margin Compression risk. UK headline inflation reduced towards the 2% UK
government target and markets indicated a peak in the bank rate. Our Asset & Liability Committee approved and implemented a strategy to manage and mitigate
the risks of margin compression. We also introduced Resiliency, Payments Transformation and Artificial Intelligence (AI) / Machine Learning risks as new specific
top risks, although these were already monitored within the existing risk types and through our Emerging Risks assessment. We removed People risk as a top
risk, though this continues to be monitored as part of our strategic transformation programme.
Other Top risk profile movements
We continued maturing our Financial Crime (FC) oversight capabilities and our Centre of Excellence operations to further integrate FC risk management across
the business. We continued to review our operations and processes to maintain an appropriate response to the fluidity and complexity of global sanctions
regimes and deploying supplemental technology in our screening processes. Enhancements in fraud prevention, delivered by our Fraud Transformation
Programme, led to a reduction in fraud losses in H124 compared to the same period in 2023. Our planning is progressing well to meet the Payment Systems
Regulator (PSR) new mandatory reimbursement requirement implementation date of 7 October 2024.
We continued to focus on Conduct and Regulatory risk matters, with significant regulatory engagement across a number of areas. These include FC, Technology,
Regulatory models, Outsourcing and Third-Party Risk Management, Data Privacy, and Operational Resiliency. We maintained our focus and attention on the
Consumer Duty, with a significant number of enhancements realised for on-sale and off-sale products and services across business and support areas, aligned
to the requirements of the Duty. Additionally, we enhanced and implemented processes and tools to evolve our monitoring and delivery of good customer
outcomes.
Technology remains at the centre of our non financial risk activities, and we continued to progress our bank-wide programme to address key risks in our IT
estate, including platform obsolescence. The programme continues to deliver risk reduction, with improvements being monitored closely through our risk
governance framework. There was elevated media coverage relating to a Banco Santander Group cybersecurity incident, including access of certain information.
Updates on root cause analysis are being finalised with the PRA and FCA. The incident did not have a material effect on Santander UK. The cybersecurity threat
remains elevated given heightened geopolitical tensions, with additional risks presented by advances in technology (including AI).
Risks associated with our strategic transformation plans include execution risks, funding prioritisation, and risks from ongoing cost reduction and efficiency
focused initiatives. We have robust governance oversight and continuous change portfolio reviews to ensure appropriate strategic and risk-based prioritisation
whilst ensuring that we have the capacity and sequencing in place to deliver.
In H124 we introduced three new specific top risks. Resiliency risk reflects the importance of complying with operational resiliency requirements by the regulatory
deadline of March 2025. Payment Transformation risk addresses the rapidly-evolving payments industry landscape with new regulatory requirements and
scheme changes and adoption of new technology and standards. Thirdly, AI / Machine Learning risk considers our preparedness to safely manage and respond
to AI developments given the pace and scale of change anticipated in this space.
Emerging risks
Macroeconomic and geopolitical risks remain in our top areas of focus with the potential to reignite inflationary pressures and impact the UK economy and the
financial services industry. Geopolitical tensions could also escalate further and increase operational resilience risks via cybersecurity attacks. We continued to
enhance our threat prevention controls and test our business area recovery plans against a range of scenarios. In the UK, political risks to the banking sector are
in focus, driven by potential risks from changes in government policy following the 2024 General Election, which could impact our business plans. We monitor the
political landscape closely, and our Public Affairs team gives specialist insights and analysis which we use to assess potential impacts to Santander UK.
Other Emerging risk profile movements
Complex regulatory agenda and fast technological change remain our other top ranked emerging risks. In H124 the Bank of England and HM Treasury published
their response to the Digital Pound consultation. We monitor progress related to this initiative via our Regulatory Liaison team and will review the potential
impacts on us and the wider industry, such as risks of loss of customer deposits and higher wholesale funding costs.
Our risk culture programme
In H124, we enhanced our approach to how we think about risk by formally introducing Risk Pro. Risk Pro is how we think and behave when it comes to risk, and
builds on the focus on processes and risk management of I AM Risk. Risk Pro will help build our risk-related skills and capabilities, so everyone has the bravery
and belief in their ability to do the right thing, using our TEAMS behaviours as described in the 2023 Annual Report. Risk Pro also aligns our approach more
closely with the wider Banco Santander group. To help develop a Risk Pro mindset, we re-designed our risk mandatory training to focus on the risk mindset and
behaviours.