
NatWest Group
A
nnual Repor
t and Accou
nts 2021
422
Risk and capital management
other disruptive event. Such increased
regulatory engagement, supervision and
enforcement is uncertain in relation to
the scope, cost, consequence and the
pace of change, which could negatively
impact NatWest Group. Due to NatWest
Group’s reliance on technology and the
increasing sophistication, frequency and
impact of cyberattacks, such attacks
may have a material adverse impact on
NatWest Group.
In accordance with the Data Protection
Act 2018 and the European Uni
on
Withdrawal Act 2018, the Data
Protection, Privacy and Electro
nic
Communications (Amendments Etc.) (EU
Exit) Regulations 2019, as ame
nded by
the Data Protection, Privacy and
Electronic Communications
(Amendments Etc.) (EU Exit) Regulations
2020 (‘UK Data Protection Framework’)
and European Banking Authority (‘EBA’)
Guidelines on ICT and Security Risk
Management, NatWest Group is required
to ensure it implements timely,
appropriate and effective organisational
and technological safeguards against
unauthorised or unlawful access
to the
data of NatWest Group, its cust
omers
and its employees. In order to meet this
requirement, NatWest Group re
lies on
the effectiveness of its internal policies
,
controls and procedures to protect the
confidentiality, integrity and availability
of information held on its IT sys
tems,
networks and devices as well as with
third parties with whom NatWes
t Group
interacts. A failure to monitor and
manage data in accordance with the UK
Data Protection Framework and EBA
requirements of the applicable legislation
may result in financial losses, regulatory
fines and investigations and associated
NatWest Group operations and strategy
are highly dependent on the accuracy
and effective use of data.
NatWest Group relies on the effective
use of accurate data to support
, monitor,
evaluate, manage and enhance its
operations and deliver its strategy. T
he
availability of current, complete, detailed,
accurate and, wherever possible
,
machine-readable customer segment
and sub-sector data, together with
appropriate governance and
accountability for data, is fast be
coming
a critical strategic asset, which is subjec
t
to increased regulatory focus. Failu
re to
have that data or the ineffective
use or
governance of that data could result in a
failure to manage and report important
risks and opportunities or satisfy
customers’ expectations including the
inability to deliver innovative products
and services. This could also result in a
failure to deliver NatWest Group’s
strategy and could place NatWest Group
at a competitive disadvantage
by
increasing its costs, inhibiting its
efforts
to reduce costs or its ability to improve
its systems, controls and processe
s,
which could result in a failure to deliver
NatWest Group’s strategy. These data
limitations, or the unethical or
inappropriate use of data, and/or non-
compliance with customer data
protection laws could give rise to
conduct and litigation risks and may
increase the risk of operational events,
losses or other adverse consequence
s
due to inappropriate models, systems,
processes, decisions or other actions.
NatWest Group’s operations are highly
dependent on its complex IT systems
(including those that enable remote
working) and any IT failure could
adversely affect NatWest Group.
NatWest Group’s operations are highly
dependent on the ability to proces
s a
very large number of transactions
efficiently and accurately while
complying with applicable laws and
regulations. The proper functioning of
NatWest Group’s payment syst
ems,
financial crime, fraud systems
and
controls, risk management, credit
analysis and reporting, accounting,
customer service and other IT sys
tems,
as well as the communication n
etworks
between its branches and main data
processing centres, is critical to NatWest
Group’s operations.
Individually or collectively, any critical
system failure, material loss of service
availability or material breach of data
security could cause serious damage to
NatWest Group’s ability to provide
services to its customers, which could
result in reputational damage, significant
compensation costs or regulatory
sanctions (including fines resulting from
regulatory investigations) or a breach of
applicable regulations and could affec
t
its regulatory approvals, competitive
position, business and brands, which
could undermine its ability to attract and
retain customers. This risk is heightened
as most of NatWest Group’s employees
continue to work remotely, as it
outsources certain functions and as it
continues to innovate and offer new
digital solutions to its customers as a
result of the trend towards online and
mobile banking.
In 2021, NatWest Group continued to
make considerable investments to
further simplify, upgrade and imp
rove its
IT and technology capabilities (including
migration of certain services to cloud
platforms). NatWest Group also
continues to develop and enhance digital
services for its customers and see
ks to
improve its competitive position through
enhancing controls and procedures and
strengthening the resilience of se
rvices
including cyber security. Any failure of
these investment and rationalisation
initiatives to achieve the expected
results, due to cost challenges
or
otherwise, could negatively affec
t
NatWest Group’s operations, its
reputation and ability to retain or grow
its customer business or adverse
ly
impact its competitive position,
thereby
negatively impacting NatWest Group.
Remote working may adversely affect
NatWest Group’s ability to maintain
effective internal controls.
From March 2020 to September 2021,
many of NatWest Group’s employ
ees
worked exclusively on a remot
e basis.
Following the lifting of government
restrictions, NatWest Group will
implement a new hybrid working policy
whereby many employees may work
remotely the majority of the time in the
ordinary course of their roles.
Remote working arrangements for
NatWest Group employees continues
to
place heavy reliance on the IT sy
stems
that enable remote working and
increased exposure to fraud, conduct,
operational and other risks and
may
place additional pressure on NatWest
Group’s ability to maintain effective
internal controls and governance
frameworks. Remote working
arrangements are also subject to
regulatory scrutiny to ensure adequate
recording, surveillance and supervision
of regulated activities, and compliance
with regulatory requirements and
expectations, including requirements to:
meet threshold conditions for regulated
activities; ensure the ability to oversee
functions (including any outsourced
functions); ensure no detriment is cause
d
to customers; and ensure no increased
risk of financial crime. See also, ‘
in NatWest Group’s risk management
framework could adversely affect
NatWest Group, including its abili
ty to
achieve its strategic objectives
.’
Moreover, the IT systems that enable
remote working interface with third-
party systems, and NatWest Gr
oup could
experience service denials or di
sruptions
if such systems exceed capacity
or if a
third-party system fails or experiences
any interruptions, all of which could
result in business and customer
interruption and related reputational
damage, significant compensation costs,
regulatory sanctions and/or a breach of
applicable regulations. See also,
‘
NatWest Group’s operations are highly
dependent on its complex IT systems
(including those that enable remote
working) and any IT failure could
adversely affect NatWest Group
’.
Sustained periods of remote working
may negatively affect workforce
morale.
Whilst NatWest Group has taken
measures seeking to maintain t
he health,
wellbeing and safety of its employe
es,
these measures may be ineffective. Any