Barclays (BCS) Risk Factors

The COVID-19 pandemic has had, and continues to have, a material impact on businesses around the world and the economic environments in which they operate. Additionally, the impacts of the economic downturn resulting from the COVID-19 pandemic and post-recovery environment, from a commercial, regulatory and risk perspective could be significantly different to past crises and persist for a prolonged period. As a result, there are a number of factors associated with the COVID-19 pandemic and its impact on global economies that have had and could continue to have a material adverse effect on the profitability, capital and liquidity of the Group. The COVID-19 pandemic has caused disruption to the Group’s customers, suppliers and staff globally. Most jurisdictions in which the Group operates, implemented severe restrictions on the movement of their respective populations, with a resultant significant impact on economic activity in those jurisdictions. While a number of restrictions have been eased with the roll-out of COVID-19 vaccination programmes, others still remain in place and future developments are highly uncertain. In some jurisdictions, restrictions that had been previously lifted were re-imposed in response to a resurgence in cases. These decisions are being taken by the governments of individual jurisdictions (including through the implementation of emergency powers) and impacts (including any subsequent lifting, extension or reimposition of restrictions) may vary from jurisdiction to jurisdiction and/or within jurisdictions. It remains unclear how the COVID-19 pandemic will evolve through 2022 (including whether there will be further waves of the COVID-19 pandemic, whether COVID-19 vaccines continue to prove effective, whether further new strains of COVID-19 will emerge and whether, and in what manner, additional restrictions will be imposed and/or existing restrictions extended) and the Group continues to monitor the situation closely. However, despite the COVID-19 contingency plans established by the Group, the ability to conduct business may be adversely affected by disruptions to infrastructure and supply chains, business processes and technology services, resulting from the unavailability of staff due to illness or the failure of third parties to supply services. This may cause significant customer detriment, costs to reimburse losses incurred by the Group’s customers, potential litigation costs (including regulatory fines, penalties and other sanctions), and reputational damage. In many of the jurisdictions in which the Group operates, schemes were initiated by central banks, national governments and regulators to provide financial support to parts of the economy most impacted by the COVID-19 pandemic. The rapid introduction and varying nature of these support schemes, as well as customer expectations, required the Group to implement large-scale changes in a short period of time, leading to an increase in certain risks faced by the Group, including operational risk, conduct risk, reputation risk and fraud risk. These risks are likely to be heightened further as and when those government and other support schemes expire, are withdrawn or are no longer supported. Furthermore, the impact from participating in government and central bank-supported loan and other financing schemes may be exacerbated if the Group is required by any government or regulator to offer forbearance or additional financial relief to borrowers or if the Group is unable to rely on guarantees provided by governments in connection with financial support schemes. As these schemes and other financial support schemes provided by national governments (such as job retention and furlough schemes, payment deferrals and mass lending schemes) expire, are withdrawn or are no longer supported, there is a risk that economic growth and employment may be negatively impacted which may, in turn, impact the Group’s results of operations and profitability. In addition, the Group may experience a higher volume of defaults and delinquencies in certain portfolios which may negatively impact the Group’s RWAs, level of impairment and, in turn, capital position, and may initiate collection and enforcement actions to recover defaulted debts. The inception of large-scale collections and recovery programmes (including the use of third party debt collection agents) may also create significant risk if (because of the complexity, speed and scale of these programmes) defaulting borrowers are harmed by the Group’s conduct, which may also give rise to civil legal proceedings, including class actions, regulatory censure, potentially significant fines and other sanctions, and reputational damage. Other legal disputes may also arise between the Group and defaulting borrowers relating to matters such as breaches or enforcement of legal rights or obligations arising under loan and other credit agreements. Adverse findings in any such matters may result in the Group’s rights not being enforced as intended. Changes in macroeconomic variables such as gross domestic product (GDP) and unemployment have a significant impact on the modelling of expected credit losses (ECLs) by the Group. As a result, the Group experienced higher ECLs in 2020 compared to prior periods though this trend was reversed in 2021 as economic conditions partially recovered. The economic environment remains uncertain and future impairment charges may be subject to further volatility (including from changes to macroeconomic variable forecasts) depending on the longevity of the COVID-19 pandemic and related containment measures and the continued efficacy of any COVID-19 vaccines, as well as the longer- term effectiveness of central bank, government and other support measures. For further details on macroeconomic variables used in the calculation of ECLs, refer to the credit risk performance section. In addition, ECLs may be adversely impacted by increased levels of default for single name exposures in certain sectors directly impacted by the COVID-19 pandemic (such as the retail, airline, and hospitality and leisure sectors). Furthermore, the Group relies on models to support a broad range of business and risk management activities, including informing business decisions and strategies, measuring and limiting risk, valuing exposures (including the calculation of impairment), conducting stress testing and assessing capital adequacy. Models are, by their nature, imperfect and incomplete representations of reality because they rely on assumptions and inputs, and so they may be subject to errors affecting the accuracy of their outputs and/or misused. This may be exacerbated when dealing with unprecedented scenarios, such as the COVID-19 pandemic, due to the lack of reliable historical reference points and data. For further details on model risk, refer to ‘vi) Model risk’ below. There can be no assurance that economic activity will return to pre-pandemic levels and, accordingly, there could be further adverse impacts on the Group’s income and profitability caused by lower lending and transaction volumes due to volatility or weakness in the capital markets. Furthermore, in order to support lending activity to promote economic growth, governments and/or regulators may limit management’s flexibility in managing its business, require the deployment of capital in particular business lines or otherwise restrict or limit capital distributions and capital allocation. Any and all such events mentioned above could have a material adverse effect on the Group’s business, results of operations, financial condition, prospects, liquidity, capital position and credit ratings (including potential credit rating agency changes of outlooks or ratings), as well as on the Group’s customers, employees and suppliers.

Operational risk is the risk of loss to the Group from inadequate or failed processes or systems, human factors or due to external events where the root cause is not due to credit or market risks. Examples include: a) Operational resilience The Group functions in a highly competitive market, with market participants that expect consistent and smooth business processes. The loss of or disruption to business processing is a material inherent risk within the Group and across the financial services industry, whether arising through impacts on the Group’s technology systems, real estate services including its retail branch network, or availability of personnel or services supplied by third parties. Failure to build resilience and recovery capabilities into business processes or into the services of technology, real estate or suppliers on which the Group’s business processes depend, may result in significant customer detriment, costs to reimburse losses incurred by the Group’s customers, and reputational damage. b) Cyberattacks Cyberattacks continue to be a global threat that is inherent across all industries, with the number and severity of attacks continuing to rise. The financial sector remains a primary target for cybercriminals, hostile nation states, opportunists and hacktivists. The Group, like other financial institutions, experiences numerous attempts to compromise its cybersecurity. The Group dedicates significant resources to reducing cybersecurity risks, but it cannot provide absolute security against cyberattacks. Malicious actors are increasingly sophisticated in their methods, seeking to steal money, gain unauthorised access to, destroy or manipulate data, and disrupt operations, and some of their attacks may not be recognised until launched, such as zero-day attacks that are launched before patches and defences can be readied. Cyberattacks can originate from a wide variety of sources and target the Group in numerous ways, including attacks on networks, systems, or devices used by the Group or parties such as service providers and other suppliers, counterparties, employees, contractors, customers or clients, presenting the Group with a vast and complex defence perimeter. Moreover, the Group does not have direct control over the cybersecurity of the systems of its clients, customers, counterparties and third party service providers and suppliers, limiting the Group’s ability to effectively defend against certain threats. Some of the Group’s third party service providers and suppliers have experienced successful attempts to compromise their cybersecurity. These included ransomware attacks that disrupted the service providers’ or suppliers’ operations and, in some cases, had a limited impact on the Group’s operations. Such cyberattacks are likely to continue. A failure in the Group’s adherence to its cybersecurity policies, procedures or controls, employee malfeasance, and human, governance or technological error could also compromise the Group’s ability to successfully defend against cyberattacks. Furthermore, certain legacy technologies that are at or approaching end-of-life may not be able to maintain acceptable levels of security. The Group has experienced cybersecurity incidents and near-misses in the past, and it is inevitable that additional incidents will occur in the future. Cybersecurity risks will continue to increase, due to factors such as the increasing demand across the industry and customer expectations for continued expansion of services delivered over the internet; increasing reliance on internet-based products, applications and data storage; and changes in ways of working by the Group’s employees, contractors, and third party service providers and suppliers and their subcontractors as a potentially long-term consequence of the COVID-19 pandemic. Bad actors have taken advantage of remote working practices and modified customer behaviours that have taken hold during the COVID-19 pandemic, exploiting the situation in novel ways that may elude defences. Common types of cyberattacks include deployment of malware to obtain covert access to systems and data; ransomware attacks that render systems and data unavailable through encryption; denial of service and distributed denial of service (DDoS) attacks; infiltration via business email compromise; social engineering, including phishing, vishing and smishing; automated attacks using botnets; and credential validation or stuffing attacks using login and password pairs from unrelated breaches. A successful cyberattack of any type has the potential to cause serious harm to the Group or its clients and customers, including exposure to potential contractual liability, litigation, regulatory or other government action, loss of existing or potential customers, damage to the Group’s brand and reputation, and other financial loss. The impact of a successful cyberattack is also likely to include operational consequences (such as unavailability of services, networks, systems, devices or data), remediation of which could come at significant cost. Regulators worldwide continue to recognise cybersecurity as an increasing systemic risk to the financial sector and have highlighted the need for financial institutions to improve their monitoring and control of, and resilience to cyberattacks. A successful cyberattack may, therefore, result in significant regulatory fines for the Group. For further details on the Group’s approach to cyberattacks, refer to the operational risk performance section. For further details on cyber security regulation applicable to the Group, refer to the Supervision and regulation section. c) New and emergent technology Technology is fundamental to the Group’s business and the financial services industry. Technological advancements present opportunities to develop new and innovative ways of doing business across the Group, with new solutions being developed both in-house and in association with third party companies. For example, payment services and securities, futures and options trading are increasingly occurring electronically, both on the Group’s own systems and through other alternative systems, and becoming automated. Whilst increased use of electronic payment and trading systems and direct electronic access to trading markets could significantly reduce the Group’s cost base, it may, conversely, reduce the commissions, fees and margins made by the Group on these transactions which could have a material adverse effect on the Group’s business, results of operations, financial condition and prospects. Introducing new forms of technology, however, has the potential to increase inherent risk. Failure to evaluate, actively manage and closely monitor risk exposure during all phases of business development could introduce new vulnerabilities and security flaws and have a material adverse effect on the Group’s business, results of operations, financial condition and prospects. d) External fraud The nature of fraud is wide-ranging and continues to evolve, as criminals continually seek opportunities to target the Group’s business activities and exploit changes to customer behaviour and product and channel use (such as the increased use of digital products and enhanced online services) or exploit new products. Fraud attacks can be very sophisticated and are often orchestrated by highly organised crime groups who use ever more sophisticated techniques to target customers and clients directly to obtain confidential or personal information that can be used to commit fraud. The UK market has also seen significant growth in ‘scams’ where the Group takes increased levels of liability as part of a voluntary code to provide additional safeguards to customers and clients who are tricked into making payments to fraudsters. The impact from fraud can lead to customer detriment, financial losses (including the reimbursement of losses incurred by customers), loss of business, missed business opportunities and reputational damage, all of which could have a material adverse impact on the Group’s business, results of operations, financial condition and prospects. e) Data management and information protection The Group holds and processes large volumes of data, including personal information, intellectual property, and financial data and the Group’s businesses are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals. The protected parties can include: (i) the Group’s clients and customers, and prospective clients and customers; (ii) clients and customers of the Group’s clients and customers; (iii) employees and prospective employees; and (iv) employees of the Group’s suppliers, counterparties and other external parties. The international nature of both the Group’s business and its IT infrastructure also means that personal information may be available in countries other than those from where it originated. Accordingly, the Group needs to ensure that its collection, use, transfer and storage of personal information complies with all applicable laws and regulations in all relevant jurisdictions (including as such new and existing regulations continue to be implemented, interpreted and applied), which could: (i) increase the Group’s compliance and operating costs, particularly in the context of ensuring that adequate data protection and data transfer mechanisms are in place; (ii) impact the development of new products or services, impact the offering of existing products or services, or affect how products and services are offered to clients and customers; (iii) demand significant oversight by the Group’s management; and (iv) require the Group to review some elements of the structure of its businesses, operations and systems in less efficient ways. Concerns regarding the effectiveness of the Group’s measures to safeguard personal information, or even the perception that those measures are inadequate, could expose the Group to the risk of loss or unavailability of data or data integrity issues and/or cause the Group to lose existing or potential clients and customers, and thereby reduce the Group’s revenues. Furthermore, any failure or perceived failure by the Group to comply with applicable privacy or data protection laws and regulations (and the evolving standards imposed by data protection authorities in connection therewith) may subject it to potential contractual liability, litigation, regulatory or other government investigation or action (including significant regulatory fines) and require changes to certain operations or practices which could also inhibit the Group’s development or marketing of certain products or services, or increase the costs of offering them to customers. Any of these events could damage the Group’s reputation, subject the Group to material fines or other monetary penalties, make the Group liable to the payment of compensatory damages, divert management's time and attention, lead to enhanced regulatory oversight and otherwise materially adversely affect its business, results of operations, financial condition and prospects. For further details on data protection regulation applicable to the Group, refer to the supervision and regulation section. f) Algorithmic trading In some areas of the investment banking business, trading algorithms are used to price and risk manage client and principal transactions. An algorithmic error could result in erroneous or duplicated transactions, a system outage, or impact the Group’s pricing abilities, which could have a material adverse effect on the Group’s business, results of operations, financial condition, prospects and reputation. g) Processing errors The Group’s businesses are highly dependent on its ability to process and monitor, on a daily basis, a very large number of transactions, many of which are highly complex and occur at high volumes and frequencies, across numerous and diverse markets in many currencies. As the Group’s customer base and geographical reach expand and the volume, speed, frequency and complexity of transactions, especially electronic transactions (as well as the requirements to report such transactions on a real-time basis to clients, regulators and exchanges) increase, developing, maintaining and upgrading operational systems and infrastructure becomes more challenging, and the risk of systems or human error in connection with such transactions increases, as well as the potential consequences of such errors due to the speed and volume of transactions involved and the potential difficulty associated with discovering errors quickly enough to limit the resulting consequences. Furthermore, events that are wholly or partially beyond the Group’s control, such as a spike in transaction volume, could adversely affect the Group’s ability to process transactions or provide banking and payment services. Processing errors could result in the Group, among other things: (i) failing to provide information, services and liquidity to clients and counterparties in a timely manner; (ii) failing to settle and/or confirm transactions; (iii) causing funds transfers, capital markets trades and/or other transactions to be executed erroneously, illegally or with unintended consequences; and (iv) adversely affecting financial, trading or currency markets. Any of these events could materially disadvantage the Group’s customers, clients and counterparties (including them suffering financial loss) and/or result in a loss of confidence in the Group which, in turn, could have a material adverse effect on the Group’s business, results of operations, financial condition and prospects. h) Supplier exposure The Group depends on suppliers for the provision of many of its services and the development of technology. Whilst the Group depends on suppliers, it remains fully accountable for any risk arising from the actions of suppliers. The dependency on suppliers and sub-contracting of outsourced services introduces concentration risk where the failure of specific suppliers could have an impact on the Group’s ability to continue to provide material services to its customers. Failure to adequately manage supplier risk could have a material adverse effect on the Group’s business, results of operations, financial condition and prospects. i) Estimates and judgements relating to critical accounting policies and regulatory disclosures The preparation of financial statements requires the application of accounting policies and judgements to be made in accordance with IFRS. Regulatory returns and capital disclosures are prepared in accordance with the relevant capital reporting requirements and also require assumptions and estimates to be made. The key areas involving a higher degree of judgement or complexity, or areas where assumptions are significant to the consolidated and individual financial statements, include credit impairment provisions, taxes, fair value of financial instruments, goodwill and intangible assets, pensions and post-retirement benefits, and provisions including conduct and legal, competition and regulatory matters (refer to the notes to the audited financial statements for further details). There is a risk that if the judgement exercised, or the estimates or assumptions used, subsequently turn out to be incorrect, this could result in material losses to the Group, beyond what was anticipated or provided for. Further development of accounting standards and regulatory interpretations could also materially impact the Group’s results of operations, financial condition and prospects. j) Tax risk The Group is required to comply with the domestic and international tax laws and practice of all countries in which it has business operations. There is a risk that the Group could suffer losses due to additional tax charges, other financial costs or reputational damage as a result of failing to comply with such laws and practice, or by failing to manage its tax affairs in an appropriate manner, with much of this risk attributable to the international structure of the Group. In addition, increasing tax authority focus on reporting and disclosure requirements around the world and the digitisation of the administration of tax has potential to increase the Group’s tax compliance obligations further. For example, the OECD and G20 Inclusive Framework on Base Erosion and Profit Shifting has announced plans to introduce a global minimum tax from 2023 which, if enacted, will increase the Group’s tax compliance obligations. In addition, the proposed Build Back Better Act includes proposals to implement changes to US international tax provisions which may require systems and process changes if enacted. Any systems and process changes associated with these changes introduce additional operational risk. k) Ability to hire and retain appropriately qualified employees As a regulated financial institution, the Group requires diversified and specialist skilled colleagues. The Group’s ability to attract, develop and retain a diverse mix of talent is key to the delivery of its core business activity and strategy. This is impacted by a range of external and internal factors, such as potential effects on employee engagement and wellbeing from long-term periods of working remotely. Failure to attract or prevent the departure of appropriately qualified and skilled employees could have a material adverse effect on the Group’s business, results of operations, financial condition and prospects. Additionally, this may result in disruption to service which could in turn lead to disenfranchising certain customer groups, customer detriment and reputational damage. For further details on the Group’s approach to operational risk, refer to the operational risk management and operational risk performance sections.