Worldpay's acquiring business model is dependent on licences and the continuing support from the payment franchises such as Visa and MasterCard. Any infringement by Worldpay of the franchise rules and regulations, or the inability to correctly implement mandatory changes, could result in the loss of the card franchise support. This could result in a curtailment of Worldpay's business and/or strategic plans, financial penalties or reputational damage.

Risk categories:

·      Compliance and regulatory

·      Reputational

Risk appetite

Worldpay will always seek to remain current and adhere to all franchise rules unless we are prevented from doing so by our system infrastructure. Where this is the case, Worldpay will apply for specific waivers pending full compliance.

Risk indicators

·      Success in influencing industry developments. Lobbying for rule changes to benefit the industry and bespoke models accommodating non-standard business

·      Non-compliance assessments from payment franchises when in breach of franchise rules, guidelines and regulations

·      Waiver log tolerance - detailing recommendations to the business; payment franchise waivers; interaction with payment franchises confirming arrangements

Potential impacts

·      Failure to meet payment franchise requirements for products and services may lead to reputational damage and to financial penalties from the payment franchises

·      As a last resort, payment franchises may revoke Worldpay's franchise licence in existing markets or not grant new licences in prospective markets

·      Failure to operate franchise licences to required specifications may lead to lower acceptance rates and therefore potential reputational damage and customer impact

Mitigants

·      Specific team dedicated to support implementation of payment franchise requirements and central relationship management

·      Board level engagement with the card franchises to help engagement and influence the franchise approach

·      Internal process to capture, review and implement payment franchise changes

·      Regular meetings with payment franchises and attendance at payment franchise forums/training, e.g. the UK Acquirer Forum

·      Ongoing monitoring and oversight of our merchants to ensure compliance

·      Participation in industry forums

Actions in 2016

·      Went live with Worldpay's own franchise licences for Visa and Mastercard in Hong Kong, Singapore and Australia eliminating the need for a sponsor and removing their risk appetite from our operations

·      Continued work with the regulators and payment franchises to understand and influence the direction of travel of new legislation and requirements

·      Embedded the Regulatory and Industry Affairs Group to review and assess EU and UK governmental initiatives

·      Developed a franchise management strategy

Legal, compliance and regulatory (Risk movement in the year: risk increased)

Worldpay fails to adhere to legal requirements or fails to design, resource and implement a risk-based regulatory and financial crime compliance programme.

In the Compliance and Regulatory landscape, a number of new regulations for the payments industry have been enacted or proposed in 2016 by various regulators around the world. Given the timing and details of their implementation are inherently uncertain, this has resulted in an increase in risk.

Risk categories:

·      Compliance and regulatory

·      Reputational

Risk appetite

Worldpay has no appetite to knowingly breach the spirit and letter of the laws that apply to us. In areas of uncertainty or ambiguity, we will have a robust justification and clear rationale for the choices we make.

Risk indicators

·      Engagement with regulators

·      Results of mandatory legal and compliance training

·      Number of complaints (General/Ombudsman)

·      Compliance monitoring results

·      Policy breaches

·      Suspicious Activity Reports (SARs) produced and submitted to the National Crime Agency when suspicious activity is detected

·      The results of reviews, audits on policy and gambling blacklist monitoring

Potential impacts

·      Failure may result in Worldpay or its customers breaching laws, resulting in reputational damage, loss of customers and financial penalties

·      Non-compliance may result in loss of business licence

·      Worldpay may be used to facilitate financial crime

Mitigants

·      Dedicated Legal and Compliance functions and a network of external advisors who maintain a constant review of current and future legal developments and their potential impacts

·      Policies and procedures implemented and mandatory training for all colleagues on anti-bribery and corruption, competition, data protection, anti-money laundering and sanctions

·      Legal risk appetite heat maps supported by transaction monitoring and blocking of cards from countries where the activity is illegal

·      Regular business meetings incorporating the Legal and Compliance teams to advise on the changes required to address identified risks

·      At Board level, Worldpay actively engages with regulators and Government bodies to support and suggest the direction of future regulatory developments

·      Proactive engagement with regulators and relevant government agencies to educate and support their thinking and policy in the payments industry

Actions in 2016

·      Produced an enhanced Gambling product heat map and extended our external specialist Gambling Counsel alert service

·      Continued to build a trusted relationship with the regulators via regular meetings and the timely and accurate delivery of mandatory information requests

Settlement (Risk movement in the year: no risk movement)

Failure to settle with merchants due to lack of availability of funds as a result of card scheme or systemic bank failure, or funds not processed correctly, resulting in financial loss (compensation) and severe reputational damage.

Risk categories:

·      Liquidity

·      Operational

·      Reputational

Risk appetite

Worldpay has no appetite for the failure to settle with merchants.

Risk indicators

·      Payments and settlements processed outside of service level agreements

·      Average time to resolve investigation queries

·      Number of unreconciled items

Potential impacts

·      Failure or delay to customer payments

·      Severe reputational damage and/or financial loss

Mitigants

·      Undrawn bank facilities in place ready to be utilised in the event of non-receipt of funds from card franchises

·      Card franchise balances are monitored daily to ensure that funds are received and sufficient cash flow is available for us to pay merchants

·      Daily reconciliation of all Worldpay merchant specific bank accounts

·      Daily cash management

Actions in 2016

·      Enhanced monitoring and reporting

·      The US settlement system is in the process of being re-platformed with a complete review of associated controls, processes and reporting

Credit (Risk movement in the year: risk increased)

Potential loss outside of agreed appetite arising from the failure of a merchant, card franchise, partner bank or alternative payments provider to meet its obligations in accordance with agreed terms.

Certain external events, for example the EU referendum, have created uncertainty in the UK economic environment. In addition there is increased uncertainty in the global economic environment which may have an impact on the financial performance of Worldpay's customers and lead to increased credit risk.

Risk categories:

·      Credit

Risk appetite

Worldpay budgets for credit loss on an annual basis, however our risk appetite seeks to optimise a high level of return whilst achieving appropriate risk versus reward performance in line with Worldpay's growth strategy.

Risk indicators

·      Customer approval rates

·      Movements in the aggregated credit bureau portfolio scores

·      The proportion of adverse actions undertaken after a credit investigation has been conducted

·      The distribution of the portfolio across the various credit grades

·      The financial performance of the Group's top exposures

·      Credit Watch List

·      Partner bank solvency ratios

Potential impacts

·      Increase in credit exposure leading to increase in financial loss

·      Rejection of applications leading to a decrease in profitability

·      Merchant fails to provide goods or services to their customers leading to an increase in chargebacks that cannot be passed on to a failed merchant, resulting in financial loss

Mitigants

·      Each application from a merchant or proposed partnership with a bank or alternative payment provider is risk assessed

·      Where approval is not automatic, the case is referred for a secondary review

·      A transaction monitoring system equipped with credit-specific rules and models scans each transaction and aggregates merchant behaviour

·      A Credit Watch List is used to identify at-risk merchants that may result in financial loss. Monthly review defines action plans to mitigate exposure and potential loss

·      Merchant Holding File maintained to assist in delaying/deferring settlement to merchants when there is a risk of loss to Worldpay

Actions in 2016        

·      The acceptance criteria utilised in our underwriting department has continued to be reviewed and refined throughout the year

·      The automated monitoring system rules and models were redesigned in the US to improve the accuracy of alerts. Quarterly service reviews of the system performance were conducted

·      Risk mitigation products have been developed and implemented to facilitate the replacement of cash as a primary source of security

·      The Worldpay sector risk appetites were reviewed and the stance re-approved

Data security (Risk movement in the year: no risk movement)

Financial loss and reputational damage due to a breach of confidential data or technology disruption caused by internal/external attack on Worldpay or its third-party suppliers/merchants.

Risk categories:

·      Operational

·      Reputational

Risk appetite

Worldpay has no tolerance for the loss of, or otherwise unauthorised or accidental disclosure of, customer or other sensitive information.

Risk indicators

·      Number of attempted security breaches

·      Number of actual security breaches

·      Number of breaches to policy

·      Penetration testing results

·      Independent security reviews

·      Ethical hacking results

·      Number of identified security risks outstanding

Potential impacts

·      The loss of confidentiality, integrity or availability of customer or other sensitive information could result in regulatory or legal sanctions and/or significant reputational damage

·      Increased costs for remediation and reduced ability to deliver strategic objectives

·      Additional costs by way of compensation, litigation, fines, loss of sponsorship and loss of productivity as resources are redirected to manage incidents

Mitigants

·      A suite of security tools and processes to ensure that only authorised users and devices have access to Worldpay systems and data

·      Dedicated teams proactively monitor the environment for potential incidents and carry out security investigations

·      Security updates identified and remediated in a timely manner

·      Vulnerability identification and remediation

·      Anti-malware software

·      Distributed Denial of Service (DDoS) protection

·      Supplier security risk assessments

·      PCI compliance programme

Actions in 2016

·      ISO certification of key security domains

·      Established an independent Security Advisory Board to review and advise on Worldpay's approach to security

·      Created a bug-bounty scheme which provides financial rewards to individuals identifying system errors or vulnerabilities

·      Enhanced the Company-wide phishing security awareness campaign

·      Improved communication channels with government and law enforcement agencies

Technology (Risk movement in the year: no risk movement)

Unscheduled system downtime impacts our service to merchants, causing reputational damage and financial loss.

Risk categories:

·      Strategic and business

·      Operational

·      Reputational

Risk appetite

Worldpay is not willing to accept risks which compromise our ability to process merchant transactions.

Risk indicators

·      Availability of services

·      Number and severity of incidents

·      Time to resolve incidents

Potential impacts

·      Any disruption to the availability of Worldpay's global payments platform or network could result in interruption of service to customers, loss of business and revenue and significant additional costs by way of contractual damages and operating expenses

·      Increased costs for remediation and reduced ability to deliver strategic objectives

Mitigants

·      Worldpay operates a full suite of monitoring tools to minimise system downtime

·      Dedicated support teams exist to support Worldpay's core systems

·      Service-orientated operating models ensures appropriate response and resolution of incidents

·      Data centres are paired, providing fail over capability

·      Disaster recovery plans are documented and regularly tested

Actions in 2016

·      Development and initiation of roll-out of global desktop solution and enterprise collaboration tools

·      Expansion of core data centre capacity to support strategic platform growth

·      Simplification of core network to improve resilience, reliability and performance

·      Consolidation of platforms into core data centres

·      Increased redundancy of network links

·      Remediation of the High Capacity Gateway (HCG) resulting in a more stable and robust platform

Scale of change (Risk movement in the year: no risk movement)

The risk of loss of profit, opportunity, reputation or disruption to business activities as a result of our inability to manage the magnitude of change being undertaken.

Risk categories:

·      Operational

Risk appetite

Worldpay has no appetite for the failure to deliver high-priority projects on time, to budget, to expected quality and in a way that safeguards the wellbeing of the colleagues working on the project.

Risk indicators

·      Ratio monitoring of permanent colleagues versus temporary/contractors to ensure key knowledge is retained in the business following implementation of changes

·      Monitoring of completion of the new technology platform training to ensure all colleagues have undergone role specific and general training ahead of phased releases

·      Tracking of actual cost versus budget costs of projects and on-time delivery

·      Number of projects

·      Review of the resourcing available to complete projects

Potential impacts

·      Failure to deliver high-priority projects impacting customer and/or reputation

·      Disruption to normal business activities

·      Development of single points of failure

·      Increased attrition rates amongst colleagues

Mitigants

·      Governance structure in place to manage information and decision making across the senior management. This includes local project meetings, steering committees and senior management reporting

·      An analysis of the impact on resources of business as usual change requests compared to large technology project plans is conducted to identify resource constraints

·      An engagement survey is carried out to identify areas where colleagues are under pressure

Actions in 2016

·      Continuing development of Organisational and Readiness dashboards to track the new technology platform project at divisional level and Group level

·      Identified key roles

·      Timeline and delivery plan established to provide Group with both soft skills training to prepare colleagues for change in addition to specific technical training to manage changes brought about by the delivery of the new technology platform. This is being managed in-house and bolstered by the appointment of an external training partner

Third Parties (Risk movement in the year: no risk movement)

The risk of loss as a result of reliance on third parties carrying out core business activities.

Risk categories:

·      Operational

·      Compliance and regulatory

·      Reputational

Risk appetite

Worldpay is willing to accept the risk of working with third parties for core business activities. However, contracts and relationships with critical suppliers must be well-monitored, value for money and regularly reviewed. In addition, regulatory requirements relating to sourcing must be met.

Risk indicators

·      Number of breaches of the Supplier Management Policy

·      Performance of core suppliers against agreed service levels

·      Issues identified in quarterly service reviews with the business and suppliers

Potential impacts

·      Suppliers critical to Worldpay's success are unable to meet the capability and service levels required

·      Non-compliance with legal or regulatory requirements relating to supplier management

·      Inconsistent and/or undesirable approach to the sourcing and management of key suppliers resulting in poor relationships and poor levels of service

Mitigants

·      Dedicated Strategic Supplier Management team maintains oversight of Worldpay's portfolio of suppliers

·      The in-house legal team is involved in all contractual discussions and Worldpay establishes legally binding contracts with its suppliers

·      When potential 'Important Outsourced Functions/Managed Supply' engagements are identified Regulatory Compliance is engaged

·      We regularly monitor performance of core suppliers against agreed service levels

Actions in 2016

·      Created a centralised contracts database

·      Contracts renegotiated, on service levels and terms and conditions, with strategically significant suppliers

·      Engaged Strategic Supplier Management and Procurement in all Worldpay sourcing activity

·      Sourcing regulatory requirements identified and communicated

·      Supplier Security Risk reviews undertaken by Enterprise Security

People (new risk)

Worldpay fails to sufficiently recruit, retain and develop its people leading to poor colleague engagement and the inability to create a high-performing culture.

Risk categories:

·      Strategic and business

·      Operational

·      Reputational

Risk appetite

We seek to create a great place to work, powered by great people. We balance the costs and risk to ensure that our colleagues are engaged and have the capability to deliver our strategy.

Risk indicators

·      Annual attrition rates

·      Leavers with less than one year of service

·      Colleague engagement scores

·      Leadership stability

·      Succession cover

·      Single point of failure risk

·      Internal promotion rates

·      Labour cost changes

Potential impacts

·      Colleague capability does not meet the needs of the organisation

·      Poor culture leading to ineffective performance and inappropriate behaviours

·      Low colleague engagement leading to increased attrition

·      Unable to retain colleagues and potential loss of key single points of failure

Mitigants

·      Worldpay has established a common set of values and behaviours known as the 'Worldpay Way'

·      Candidates are subject to thorough recruitment processes by trained recruiters

·      Group annual engagement survey used as a tool to monitor engagement

·      Annual mandatory regulatory training for all colleagues

·      Leadership training

Actions in 2016

·      Introduction of the Worldpay Academy to provide better access to training and encourage colleague development

·      Continued embedding of the 'Worldpay Way' values

·      Continuation of the colleague engagement survey

·      Introduction of a Save As You Earn scheme for colleagues in the UK and an Employee Stock Purchase Plan for those in the US

Competitive landscape (new risk)

The risk that competitors move faster than Worldpay or the industry consolidates, leading to lower margins and loss of customers.

Risk categories:

·      Strategic and business

·      Market

Risk appetite

We have no appetite to lose our competitive position.

Risk indicators

·      Market developments versus Worldpay product offerings

·      Developments in the payments industry against the development activities underway in Worldpay

·      Customer feedback from sales opportunities on Worldpay offering and positioning

·      Market announcements from competitors

Potential impacts

·      New players disintermediate Worldpay

·      Loss of customers because competitors innovate and develop new enhanced products

·      Pricing and margin pressure

Mitigants

·      Market Trends and Disintermediation Framework

·      Each Business Unit has a dedicated product development team to identify customer needs

·      Innovation team evaluates technology trends

·      Group and Business Unit M&A strategies

Actions in 2016

·      A new Strategy team has been created whose objectives include the monitoring of the payments industry and technology trends