This week's edition of Risk & Compliance weekly highlights includes the government’s updated guidance on AML information sharing under the Economic Crime and Corporate Transparency Act 2023.

Construction analysis: The Technology and Construction Court (TCC) considered the interpretation of a JCT Design and Build Contract 2016 which contained complex bespoke amendments and clarifications relating to the risk allocation for existing structures at a construction site. The TCC found that under the contract the risk of additional cost or delay being incurred as a result of the state of the existing structures, including their being unable to support or facilitate the proposed works, lay with the employer.

Introduction During the due diligence exercise, any issue raising concerns is flagged up in the relevant due diligence reports by the specific team (legal, technical, financial) and recommendations are made as to how to best deal with it. For more details on due diligence issues in oil and gas transaction, see Practice Note: Due diligence and warranties in oil and gas M&A transactions. Typically, the principal ways to address specific concerns in the underlying sale and purchase agreement (SPA) and allocate risk between the parties include the following: • warranties • indemnities; and • interim period covenants The due diligence process is crucial to the underlying proposed acquisition since the relevant findings (legal, financial and/or technical) will directly impact upon the type of specific warranties and indemnities (as well as any particular purchase price adjustments and interim period covenants) which the parties will seek to incorporate in the SPA. Equally, the first draft of the SPA issued by the seller to prospective buyers will also determine the scope of the due diligence required. There

1 Overall risk appetite [Insert organisation name] has a [low OR medium OR high] risk appetite overall. [Insert organisation name] will act in accordance with this risk appetite statement to achieve its strategic objectives. 2 Risk appetite by category Risk category and description Examples Overall appetite for this category of risk Strategic Risks that could cause the business to fail or impede achievement of its strategic objectives Business development, corporate governance, inadequate succession planning, mergers and acquisitions, new business lines, future-proofing, business location.Responsiveness to changes in the internal and external operating environments.Terrorism, pandemics, floods, fires, severe weather, earthquakes or volcanic activity at a key business location.Political, geo-political or external stakeholder events affecting the organisation’s ability to achieve objectives.Customer-facing issues, eg changes in consumer preferences, competitor innovation, product liability,

An assessment of health and safety risks carried out by employers and organisations.

Is the risk assessment overseen at the highest level in the company? In order to show top level commitment to anti-bribery measures, a company officer or Board member should be appointed to oversee the anti-bribery and risk assessment process. See Practice Note: Anti-bribery and corruption policy. Consider: • Does the company's senior management or Board have overall responsibility for the risk assessment process? • Have anti-bribery and corruption responsibilities been delegated and if so to whom and on what basis? • How is this documented? • Has the company assigned risk assessment for bribery to employees (for example a compliance officer) who reports directly to the Board? • How has the company ensured that the risk assessment is fit for purpose and would stand up to scrutiny? • Has the company’s senior management

This Practice Note explains the obligation on employers to carry out a risk assessment, under regulation 16 of the Management of Health and Safety at Work Regulations 1999 (MHSW Regs 1999), where they employ women of child-bearing age and when they are notified in writing by an individual worker of her pregnancy, that she has given birth within the previous six months or that she is breastfeeding. It looks at when this duty applies, the steps to be taken to avoid any risks identified and, where that is not possible, a move to alternative work or suspension. It looks at the potential claims that an employee could pursue following a failure to comply with the duty in respect of risk assessments and related action under the Employment Rights Act 1996 (ERA 1996) and the Equality Act 2010 (EqA 2010), such as direct discrimination, indirect discrimination and pregnancy and maternity discrimination. It also considers the position of agency workers, and the obligations that apply to hirers and temporary work agencies. Directive

1 General Date of audit [insert date of audit] Person completing audit [state name and position of person completing audit] 2 External risks Complete the following table with external risk factors that may affect the business. Any external risks you identify should be added to the risk register. Category of external risk Specific risk(s) identified Date added to risk register Sector-specific risks [insert risk, eg downturn in housing market] [insert date] Domestic political risks [insert risk, eg government policy to reduce spending on public sector housing, reduction in skilled migrant labour] [insert date] International political risks [insert risk, eg expected reduction in foreign property purchasers] [insert date] Currency risks [insert risk, eg reduction in value of sterling affecting cost of imported materials] [insert date] Other financial risks [insert risk, eg anticipated increase in interest rates depressing demand for new building] [insert date] [insert other external risk category that may be relevant to your business, eg funding] [insert risk] [insert date] 3 Departmental risk questionnaires Before you complete this audit, you should request the heads of each department within your business complete a risk questionnaire. Departments that have completed a risk questionnaire [insert department and date completed][insert department and date completed][insert department and date completed][insert department and date completed][insert

This Practice Note examines the rules and guidance on risk control (the risk control rules) which apply to firms as set out in the Senior Management Arrangements, Systems and Controls sourcebook in the Financial Conduct Authority (FCA) Handbook (SYSC), and the Prudential Regulation Authority (PRA) Rulebook, including provisions which replace Commission Delegated Assimilated Regulation (EU) 2017/565 (the UK MiFID II Organisational Regulation) with effect from its revocation on 23 October 2025. Risk control rules applying to UK financial services firms The rules and guidance on risk control (the risk control rules) which apply to firms are set out in: • the general requirement to have effective risk control processes in SYSC 4.1.1R • SYSC 7 Risk control • SYSC 21 Risk control: guidance on governance arrangements Dual-regulated firms should also take note of the parallel rules in the following parts of the PRA Rulebook: • Risk Control (which applies to CRR firms, as defined in the PRA Rulebook Glossary) • Group Risk Systems (which applies to CRR firms), and • Credit Unions—11 General organisational requirements (which

1 General information Review period [Insert review period] Date of review [Insert date] Person(s) conducting review [Insert name(s)] 2 Complaints Number of complaints received [Insert number] Number of complaints referred to the Legal Ombudsman (LeO) [Insert number] Number of complaints resolved [Insert number] Trends/patterns identified [Insert details] 3 Indemnity claims Number of potential indemnity claims received [Insert number] Number of potential claims notified to professional indemnity insurer [Insert number] Number of outstanding claims [Insert number] Potential

ARCHIVED: Lexis+® UK Corporate conducted research to examine current market trends in respect of equity capital markets (ECM) transactions in 2019. Background and approach For this review of risk factor disclosure, we looked at 38 prospectuses in relation to 2019 Main Market IPOs or new admissions and ten AIM admission documents published in 2019. It forms part of our annual trend report which aims to provide insight into the current dynamics of ECM activity in the UK. The other parts of our 2019 trend report comprise: • IPOs in 2019—Main Market and AIM [Archived] • Secondary Offers in 2019—Main Market and AIM [Archived] • Standard listings in 2019 [Archived] • Legal and regulatory developments in Equity Capital Markets 2019 [Archived] Prospectus Regulation risk factor disclosure requirements The Prospectus Regulation (EU) 2017/1129 introduced more prescriptive requirements relating to risk factor disclosure in prospectuses from 21 July 2019. The primary purpose of the new requirements is to ensure that investors can assess all relevant risks and make an informed decision about investing in the issuer’s securities. Article

In the context of the UK prospectus regime, risks which are specific to an issuer and/or its securities and which are material for taking investment decisions. The UK Prospectus Regulation prescribes the risk factors which must be disclosed in a prospectus and how they should be presented.