Virgin Money Holdings (UK) plc (the Company ) Board Risk Committee Terms of Reference A. Purpose The role of the Board Risk Committee (the Committee ) is to review and report its conclusions to the board of directors of the Company (the Board ) on: the Company and its material subsidiaries (including the regulated subsidiaries) (together the Group ) risk appetite (the amount and type of risk that the Group targets and tolerates); the Group s risk management framework (embracing principles, policies, methodologies, systems, processes, procedures and people); (v) (vi) the Group s Individual Capital Adequacy Assessment ( ICAA ), Recovery and Resolution Planning process and Risk Assurance plans; the Group s Individual Liquidity Adequacy Assessment ( ILAA ) including the effectiveness of the Liquidity Contingency Plan (LCP); oversight of balance sheet risks, including the adequacy of liquidity and capital, and oversight of the key risk exposures including those referenced in section F.3 below; and balance sheet management strategies, whilst ensuring liquidity, capital and other balance sheet risks are suitably understood and within the Group s risk appetite. The Committee will take a forward-looking perspective, anticipating changes in business conditions. The Committee oversees management s execution of those matters outlined in the duties and responsibilities section below. Execution of such matters within the parameters set by the Board has been delegated by the Board, pursuant to the Delegated Authorities Manual, to: the Risk Management Committee ( RMC ) or senior management (pursuant to the Delegated Authorities Manual); or to the Asset and Liability Committee ( ALCO ) or senior management (pursuant to the Delegated Authorities Manual). B. Membership The Committee shall comprise at least three members all of whom shall be Independent Non- Executive Directors. The Chair of the Audit Committee shall be a member of the Committee. At least one of the Non-Executive Directors shall have recent, relevant and practical risk experience and one of the Non-Executive Directors shall have recent, relevant and practical financial services experience. Appointments to the Committee are made by the Board on the recommendation of the Nomination Committee, in consultation with the chair of the Committee (the Committee Chair ). Appointments shall be for a period of up to three years, which may be extended for further periods of up to three years, provided the member continues to meet the criteria for membership November 2017 Page 1 of 7
of the Committee. Beyond six years, any additional term for Non-Executive Directors, should be subject to rigorous review. Only the members of the Committee have the right to attend and vote at Committee meetings. However, other individuals such as the Chief Financial Officer, Chief Executive, Chief Risk Officer, Group Treasurer, Internal Audit Director, other Directors and the External Auditor may be invited to attend all or part of any meeting, as and when appropriate and necessary and with the agreement of the Committee Chair. The Chief Risk Officer shall be expected to attend all meetings. The Committee shall remain independent at all times. The Board shall appoint the Committee Chair. In the absence of the Committee Chair, the remaining members present shall elect one of their number to chair the meeting. The Company Secretary, or their nominee, shall act as the Secretary of the Committee (the Committee Secretary ) and shall ensure that where members have concerns on any matters raised or any proposed action, those concerns are recorded in the Committee minutes. C. Quorum The quorum necessary for the transaction of the business shall be two members. D. Meetings The Committee shall meet at least three times a year. Additional meetings will be held in accordance with business requirements, at such times as the Committee Chair, the Chief Risk Officer, or any member of the Committee may request. Notice of each meeting confirming the venue, time and date together with an agenda of items to be discussed and any supporting papers shall be issued to each Committee member and, as appropriate, any other person required to attend, no later than three working days before the date of the meeting. Notices, agendas and supporting papers can be sent in electronic form where the recipient has agreed to receive documents in such way. The Committee may participate in meetings by means of conference telephone or similar communications equipment whereby all persons participating in the meeting can hear each other, provided the meeting is quorate. Such meetings shall be deemed to take place where the largest group of those participating is assembled, or if there is no such group, where the Committee Chair is. The Committee shall make decisions at a meeting by a majority of the Committee members voting in favour of an action. The Committee Chair shall have a casting vote. The Committee may also make decisions outside of a meeting by way of written confirmation received by the Committee Secretary from each member of the Committee. This written confirmation shall be valid as if it had been passed at a meeting of the Committee and may be made in one or more counterparts. E. Authority The Board authorises the Committee to: investigate any activity within its Terms of Reference and make recommendations to the Board which it deems appropriate on any area within its remit where action or improvement is needed; have unrestricted access to the Group s documents and any information it requires or request the attendance at any of its meetings of any Director or employee of the Group November 2017 Page 2 of 7
and all Directors and employees are expected to co-operate with any requests made by the Committee; (vii) (viii) obtain, at the Company s expense, such external professional advice or request the attendance of external professionals at any of its meetings as it considers necessary. Such expense is to be agreed in advance with the Committee Chair and where such agreement is not reasonably given, such agreement will be sought from the Board, with details of such expense to be notified to the Company Secretary; the Committee should have consideration to the potential added value that may be gained by drawing on external input to its work as a means of taking full account of relevant experience elsewhere and in challenging its own analysis and assessment; and ensure that where members have concerns on any matters raised or any proposed action, those concerns are recorded in the Committee minutes. F. Duties and responsibilities The Committee should make available, on the Group s website, its Terms of Reference, explaining its role and the authority delegated to it by the Board. Subject to the Committee s authority (set out at E. above) the Committee shall: (1) Set risk appetite risk framework, limits and strategy consider, and recommend for approval by the Board, the Group s risk appetite, risk framework and limits as well as the metrics to be used for current and future strategy, taking account of the current and prospective macroeconomic and financial environment, drawing on financial stability assessments such as those published by the Bank of England and other authoritative sources that may be relevant for the Group s risk policies; recommend to the Board on an annual basis, the credit, market, operational and other key Pillar II, including, but not limited to IRRBB, risk appetite and related authorities, limits and mandates; and advise the Board on the current risk exposures of the Group and future risk strategy, and assist the Board in overseeing the implementation of that strategy in accordance with the Board approved risk appetite; (2) Monitor the business operation within the Group s risk appetite decide, using appropriate analysis and advice, on rigorous stress and scenario testing and have oversight and challenge of the design and execution of tests, understanding the circumstances under which the Group would fail and being satisfied with the level of risk mitigation that is built in; oversee capital planning and ensure that the approach to satisfying the requirements of the Capital Plan (under base and stressed scenarios) is adequate to meet the Group s ICAA and regulatory Individual Capital Guidance ( ICG ) requirements; review and provide challenge and oversight of the ILAA and ensure forecast and funding positions remain within internal and regulatory limits; review and provide challenge and oversight of the Recovery and Resolution Planning process and ensure plans remain appropriate for the business; November 2017 Page 3 of 7
(v) (vi) (vii) (viii) (ix) review the Group s capability, including adequacy and effectiveness of the technology infrastructure supporting the risk management framework, to identify and manage new risk types; review the adequacy of the risk management framework and the appropriateness of risk measurement systems; review and monitor the risk profile of the Group and performance against risk appetite and receive and review reports, including first line risk reporting, relating to any material breaches of risk limits and the adequacy of proposed action; review reports on any material breaches of risk limits and the adequacy of proposed action; and review performance against key metrics in relation to risk appetite and monitor the Group s current and forecast Balance Sheet growth and mix projections in relation to impact on corporate ratings; (3) Key risk exposures understand and oversee management of the key risk exposures of the Group with particular, but not exclusive, emphasis on: Credit Risk Market Risk Operational Risk Conduct and compliance Risk (v) Strategic Risk (vi) Financial Risk (vii) Funding Risk (viii) Liquidity Risk (ix) Capital Risk (4) Strategic transactions advise the Board on proposed transactions deemed to alter the strategic direction of the business of the Group including but not limited to acquisitions or disposals of any business area or product, the entry into any contract which, in the Board s opinion, is significant in terms of contract spend and/or risk or strategy (for the avoidance of doubt this will include all new critical outsourcing agreements) and any capital raising activity undertaken by the Group, ensuring that a due diligence appraisal of the proposition is undertaken, focusing in particular on risk aspects and implications for the risk appetite and tolerance of the Group, taking independent external advice where appropriate; (5) Adjustment to reward for risk determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive in order to assist in the establishment of sound remuneration policies and practices; provide qualitative and quantitative advice on an annual basis to the Remuneration Committee on considerations to be applied to performance objectives incorporated in Executive remuneration; without prejudice to the tasks of the Remuneration Committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings; November 2017 Page 4 of 7
(vi) (v) review the appropriateness of clawback recommendations prior to the release of deferred awards; and review long term incentive plan performance targets and review adequacy of risk management during the performance period prior to vesting; (6) Internal control in conjunction with the Audit Committee, agree an appropriate division of responsibilities and strategy to review the Group s internal control and risk management systems. In doing so, the Committee shall receive reports from the Internal Audit Director regarding any material risk and control matters; (7) Chief Risk Officer make recommendations to the Board on the appointment and/or removal of the Chief Risk Officer including acceptance and agreement as to the specific terms of a resignation or termination of contract; review promptly all reports on the Group from the Chief Risk Officer; review and monitor management s responsiveness to the findings and recommendations of the Chief Risk Officer; and make any recommendations regarding the remuneration arrangements of the Chief Risk Officer to the Chair of the Remuneration Committee. The Chief Risk Officer is appointed to serve the Board and has direct access to the Chair of the Board and the Committee. The Chief Risk Officer will report directly to the Chief Executive and will be supported by any duly appointed deputy; (8) Risk management function consider and approve the remit of the risk management function and ensure it has adequate resources and appropriate access to information to enable it to perform its function effectively and in accordance with the relevant professional standards; have oversight and challenge of the day-to-day risk management and oversight arrangements of the Executive; and ensure the function has adequate independence and is free from management or other restrictions; (9) Compliance and fraud review the Group s procedures for detecting fraud; review the Group s systems, controls and procedures for the prevention of bribery and receive reports on non-compliance; review regular reports from the Money Laundering Reporting Officer and the adequacy and effectiveness of the Group s anti-money laundering systems and controls; and provide advice, oversight and challenge necessary to embed and maintain a supportive risk culture throughout the Group; (10) Other matters November 2017 Page 5 of 7
review whether the value for money of products offered to customers take fully into account the Group s business model and risk strategy, and where prices do not properly reflect risks in accordance with the business model and risk strategy, present a remediation report to the Board; review and recommend to the Board on an annual basis, or more frequently if required by a material change to the Group s Business Plan, approval of the ICAAP, ILAA and LCPLCP and any modifications made thereto; review and oversee on an annual basis, or more frequently if required by a material change to the Group s Operating Plan or circumstances, the Recovery and Resolution Planning process and approve the list of recovery options; review and approve, as required, the Risk Assurance plans in respect of the Group and any modifications made thereto; and work and liaise as necessary with all other Board Committees; (11) Risk Management Committee ( RMC ) have oversight of the work and reports of the RMC (including any sub-committee of the RMC established from time to time) and recommend to the Board for approval any delegation of powers from the Committee to the RMC or senior management (pursuant to the Delegated Authorities Manual); and (12) Asset & Liability Committee ( ALCO ) have oversight of the work and reports of the ALCO (including any sub-committee of the ALCO established from time to time) and recommend to the Board for approval any delegation of powers from the Committee to the ALCO or senior management (pursuant to the Delegated Authorities Manual). G. Reporting Responsibilities The Committee shall: (v) report to the Board on its proceedings after each meeting on all matters within its duties and responsibilities; provide such recommendations to the Board as it deems appropriate on any area within its remit where action or improvement is needed; disclose in the Company s Annual Report the membership of the Committee and a description of its duties and activities during the year, together with an explanation of the Group s risk management and strategy; disclose in the Director s Report in the Company s Annual Report the Group s risk management objectives and policies including in relation to financial instruments; review and agree any risk disclosures in the quarterly financial statements and note any risk disclosures in the Annual Report; and ensure that the Committee Secretary minutes the proceedings and resolutions of all Committee meetings, including the names of those present and in attendance. Draft minutes of Committee meetings should be circulated promptly to all members of the Committee. Once approved, minutes should be circulated to all other members of the Board unless it would be inappropriate to do so. November 2017 Page 6 of 7
H. Review The Committee will conduct an annual review of its performance and review its constitution and Terms of Reference to ensure that it is operating at maximum effectiveness and recommend any changes that it considers necessary to the Board. The Committee must ensure that it is provided with sufficient resources to undertake its duties, and that sufficient training is provided to members on appointment and on an ongoing basis and recommend any changes that it considers necessary to the Company Secretary. These Terms of Reference shall be reviewed by the Committee and, where necessary, updated at least once a year. November 2017 Page 7 of 7