PRA fines The Bank of London and Oplyse Holdings £2m for failing to act with integrity and misleading the PRA over capital position

FINAL NOTICE To: The Bank of London Group Limited (FRN 930379) Oplyse Holdings Limited (formerly The Bank of London Group Holdings Limited) (RN 957968) Date: 23 March 2026

1. Action 1.1. For the reasons set out in this Notice, the Prudential Regulation Authority (“PRA”) imposes a financial penalty of £2 million on The Bank of London Group Limited (the “Firm”) and Oplyse Holdings Limited (the “Parent FHC”) pursuant to section 206 of the Act in the case of the Firm and section 192Y of the Act in the case of the Parent FHC for: in respect of the Firm only, breaching: 1.1.1. PRA Fundamental Rule 1 (a firm must conduct its business with integrity); 1.1.2. PRA Fundamental Rule 3 (a firm must act in a prudent manner); 1.1.3. PRA Fundamental Rule 4 (a firm must at all times maintain adequate financial resources); 1.1.4. PRA Fundamental Rule 7 (a firm must deal with its regulators in an open and cooperative way and must disclose to the PRA appropriately

Bank of England | Prudential Regulation Authority Page 2 anything relating to the firm of which the PRA would reasonably expect notice); 1.1.5. Chapter 3, Article 5 (requirement to report own funds on an individual basis), Reporting (CRR) Part of the PRA Rulebook; 1.1.6. Article 393 Capacity to Identify and Manage Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.7. Article 394 Reporting Requirements, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.8. Article 395 Limits to Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.9. Rule 2.3 of the Notifications Part of the PRA Rulebook; 1.1.10. Rule 2.1 of the Related Party Transaction Risk Part of the PRA Rulebook; 1.1.11. Rule 2.3 of the Related Party Transaction Risk Part of the PRA Rulebook; and in respect of the Parent FHC only, breaching: 1.1.12. Chapter 3, Article 7 (requirement for reporting own funds on a consolidated basis), Reporting (CRR) Part of the PRA Rulebook; and in respect of the Firm and the Parent FHC, breaching: 1.1.13. Rule 7A of the Definition of Capital Part of the PRA Rulebook; between 7 October 2021 and 22 May 2024 (the “Relevant Period”) or parts thereof. 1.2. The PRA, the Firm and the Parent FHC agreed to settle this matter. The serious failings in this case warrant a financial penalty of £12 million. However, the Firm and the Parent FHC have provided evidence to the PRA that payment of such a penalty would cause them serious financial hardship. As a result, the financial penalty was reduced to £2 million.

Bank of England | Prudential Regulation Authority Page 3 2. Summary of reasons for the action 2.1. The Firm was authorised by the PRA on 7 October 2021. It was regulated by the PRA for prudential purposes and by the Financial Conduct Authority (the “FCA”) for conduct matters following authorisation. The Firm is a Category 3 deposit taker, meaning it has the capacity to cause minor disruption to the UK financial system if it were to fail or by carrying on its business in an unsafe manner. 2.2. Pursuant to section 192R(2) of the Act, the PRA approved the Parent FHC as a Parent Financial Holding Company with effect from 7 October 2021. The Firm is a wholly owned subsidiary of the Parent FHC. The Parent FHC is not authorised to undertake regulated activities but is required to comply with certain provisions of the PRA Rulebook, including consolidated capital requirements as applicable to the Parent FHC and the Firm. 2.3. Further information about the Firm and the Parent FHC is set out in Annex A. 2.4. The breaches giving rise to this Notice arose between October 2021 and May 2024. There has since been a material change in ownership of the Firm and the Parent FHC, with new investors providing additional capital to seek to improve the capital position of the Firm and the Parent FHC, who have subsequently replaced most of their senior management, invested heavily in processes and controls and engaged third parties to assist in their remediation activity. 3. Breaches and failings 3.1. The PRA’s investigation identified serious failings in how the Firm and the Parent FHC recognised capital during the Relevant Period. Further, the Firm and the Parent FHC repeatedly misled the PRA during the Relevant Period as to their actual capital positions, failing to be open and transparent with the regulator. 3.2. The PRA has established the Firm was not capitalised in accordance with applicable requirements upon its exit from mobilisation (a short period after authorisation for final set-up, as explained in Annex A). The Firm failed to notify the PRA of its capital shortfall and instead characterised itself as being

Bank of England | Prudential Regulation Authority Page 4 in ‘self-mobilisation’ until a capital injection was received from the Parent FHC, as a construct to avoid reporting to the PRA that it lacked the required regulatory capital. 3.3. While numerous matters contributed to the breaches set out above and detailed in Annex B, the PRA considers the following matters to be particularly serious: 3.3.1. The Firm and the Parent FHC repeatedly recognised capital as CET1 qualifying in circumstances where they knew this was not the case, in many cases because the monies had not in fact yet been received. Most seriously, a then senior manager falsified a series of documents in order to mislead the PRA as to the true capital position; 3.3.2. The Firm exited mobilisation on 3 February 2023 after a then member of its senior management represented to the PRA that it had the required capital. However, the Firm did not, in fact, have that capital. Of the necessary £21.5 million, £20.5 million cash was down-streamed from the Parent FHC to the Firm weeks later, on 28 February 2023, with the corresponding shares allotted 1 March 2023, and not in January 2023 as the Firm represented to the PRA at the time; 3.3.3. Certain former members of the senior management team intentionally misled the PRA as to the true capital position, both at the consolidated Group level and at the solo Firm level. This included submitting to the PRA a false account of the consolidated and solo capital position in a report of the Firm’s capital requested by the PRA, the ‘Capital History Report’; and 3.3.4. The Firm failed to act in a prudent manner as a consequence of increases to the ‘Intercompany Receivable’ during the Relevant Period, an on-going loan from the Firm to the Parent FHC which was undocumented and which constituted a large proportion of the Firm’s regulatory capital. Additionally, the Firm was aware of breaching large exposure rules, as a result of the Intercompany Receivable, but failed to take the steps necessary to address this.

Bank of England | Prudential Regulation Authority Page 5 4. Sanction 4.1. Taking into account the facts and matters in Annex A and the relevant factors set out in the PRA Penalty Policy, the PRA has concluded the Firm and the Parent FHC’s breaches, as summarised above and set out more fully in Annex B, justified the imposition of a financial penalty of £12 million. 4.2. However, the Firm and the Parent FHC have provided evidence to the PRA that payment of such a penalty would cause them serious financial hardship. The PRA therefore considers it is appropriate to reduce the financial penalty to £2 million. 4.3. The PRA is responsible for the prudential regulation and supervision of banks, building societies, credit unions, insurers and major investment firms. The PRA’s role is to promote the safety and soundness of those firms. 4.4. The action which the PRA has taken emphasises the importance of ensuring regulated firms are open and transparent with the PRA, and that regulated firms take all appropriate steps to plan and adequately manage capital. Further, they must provide complete, accurate and timely information to the PRA in respect of regulatory reporting; including returns concerning both capital and large exposures. 5. The PRA’s expectations 5.1. The PRA expects regulated firms to submit complete, timely and accurate regulatory returns. The PRA also expects firms to have robust validation and governance processes which ensure regulatory reporting is consistently of a high standard. These expectations apply in the case of monitoring and reporting of large exposures and in respect of all other applicable regulatory returns. Where firms do not meet these expectations, there is an increased risk of misstatements or inaccurate reporting, which affects the PRA’s advancement of its primary objective to promote the safety and soundness of PRA regulated firms. 5.2. In promoting the safety and soundness of firms which it regulates, the PRA recognises the importance of competition in the banking sector. The PRA seeks to be proportionate in its requirements for new banks to facilitate

Bank of England | Prudential Regulation Authority Page 6 greater competition, in line with the PRA’s secondary competition objective. However, the PRA expects that new banks should mature rapidly across all areas of their business, including investing significantly in developing governance, controls and capabilities. The PRA expects new banks to understand and adhere to all applicable rules, policies and regulatory expectations. 5.3. The PRA understands that new banks may be loss making initially and rely on capital injections to maintain their capital adequacy. However, this creates a vulnerability to capital not being available when needed. The PRA expects firms to have a credible capital plan which will ensure new capital is injected in good time. A failure to adequately manage capital may be indicative of a firm not managing its resources in a prudent way or may evidence failures by a firm to maintain adequate financial resources. 5.4. The PRA expects firms to maintain appropriate capital resources, both in terms of quantity and quality, consistent with their safety and soundness and taking into account the risks to which they are exposed. Having enough capital of sufficiently high quality reduces the risk of a firm becoming unable to meet the claims of its creditors and is crucial for maintaining the safety and soundness of a firm. 5.5. The PRA requires firms to be open and straightforward in their dealings with it, taking the initiative to raise issues of possible concern at an early stage. The PRA is clear that it expects firms to promptly disclose any information relating to the firm of which the PRA would reasonably expect notice. This is especially important when such information relates to specific enquiries that the PRA has put to a regulated firm. The PRA expects to be promptly notified at an early stage of any potentially material emerging issues relating to the accuracy and status of a firm’s capital position given the centrality of this to the safety and soundness of a firm. Firms must not deliberately mislead the PRA. 5.6. A key area of risk for firms can arise from large exposures to individual counterparties or groups of connected counterparties, as a failure in one entity or group of connected entities can result in the firm incurring disproportionately large losses, undermining its safety and soundness.

Bank of England | Prudential Regulation Authority Page 7 5.7. Where a firm is part of a wider group, there may be risks that the interconnectedness and other dependencies between the firm and that wider group introduce potential risks which may impact adversely on a firm’s safety and soundness. The PRA expects that firms should be able to identify, evaluate and manage potential or actual risks relating from large exposures including those to other entities in the same group as the firm. The PRA expects firms wishing to apply a 0% risk weighting to relevant group exposures should make a formal application to the PRA. This is set out in Supervisory Statement SS16/13 Large Exposures July 2021. 5.8. It is essential that each firm has adequate policies, systems and controls in place to ensure large exposure risks are identified both before its entry into a transaction, and thereafter while it retains an exposure in respect of it, and that a firm operates within prudent regulatory limits in respect of large exposures. This includes ensuring the nature of this risk is widely and fully understood by the firm’s risk, governance and oversight functions and other relevant areas of the business and is reflected in the firm’s compliance policies, and that there are effective mechanisms for ensuring large exposures are captured in the firm’s reporting to the PRA. The PRA also expects that appropriate governance exists for the upwards reporting of large exposures and related risks including, where appropriate, to the board of the firm. 5.9. The PRA expects that entities which are parent financial holding companies and are approved by the PRA pursuant to Part 12B of the Act have in place internal arrangements which are adequate for the purposes of complying with the requirements imposed by the CRR rules. The PRA requires that effective governance and controls be in place to ensure the robustness of these internal arrangements. While parent financial holding companies are not subject to the PRA’s Fundamental Rules, the PRA expects openness and transparency from parent financial holding companies to the extent that the same is required to enable the PRA to monitor parent financial holding companies to the extent set out in the Act.

Bank of England | Prudential Regulation Authority Page 8 6. Annexes, appendices and procedural matters 6.1. The full particulars of the facts and matters relied on by the PRA in its decision-making process regarding the Firm and the Parent FHC can be found in Annex A. The Firm’s and the Parent FHC’s breaches and failings are detailed in Annex B and the basis for the sanction the PRA has imposed is set out in Annex C. The procedural matters set out in Annex D are important. The definitions used in this Notice are set out in Appendix 1 and the relevant statutory, regulatory and policy provisions applicable during the relevant period are set out in Appendix 2. David Chaplin Head of Legal, Enforcement and Litigation Division For and on behalf of the PRA

Bank of England | Prudential Regulation Authority Page 9 ANNEX A: FACTS AND MATTERS RELIED UPON

1. Background 1.1. On 7 October 2021, the PRA, with the consent of the FCA, authorised the Firm. The Firm was granted Authorisation with Restriction, also known as mobilisation; a stage which allows new banks time to finalise and deliver on such matters as IT system development, staff recruitment, and investment. The Firm was advised, in addition to the PRA Rules, of a regulatory expectation to demonstrate effective capital management and forward plan appropriately where further capital injections became necessary. Additionally, the Firm was told that capital planning should be sufficiently forward looking such that there was limited risk of entry into the PRA Buffer (the “PRA Buffer”), which, along with the “CRD IV Buffers”, and the Total Capital Requirement (“TCR”), was one of the types of regulatory capital required to be held by the Firm. 1.2. The PRA communicated capital requirement calculations to the Firm and the Parent FHC (responsible for the consolidated Group reporting) in a letter sent on 8 September 2021. This included a calculation methodology for TCR in mobilisation and post-mobilisation, and a calculation methodology for the PRA Buffer. The PRA advised the Firm that use of the PRA Buffer is not in itself a breach of capital requirements, however, a firm should notify the PRA as early as possible when it has identified it may need to use its PRA Buffer and explain how it plans to restore its PRA Buffer in a timely manner. 1.3. The Firm was required to meet its regulatory capital requirement through holding Common Equity Tier 1 capital (“CET1”). To qualify as CET1 the capital must be available for unrestricted and immediate use to cover risks or losses as soon as they occur. Conditions for capital instruments to be eligible as CET1 were set out in Article 28 of the Capital Requirements Regulation (“CRR”). The capital instruments must be issued directly by the institution with the prior approval of the owners, or management body, of the institution, and be: a. fully paid up;

Bank of England | Prudential Regulation Authority Page 10 b. classified as equity instruments; c. perpetual; d. non-preferential; and e. rank below all other claims in the event of insolvency or liquidation of the institution. 1.4. The Firm applied for, and on 14 October 2021 was granted, permission under Article 26(3) CRR. This approved the instrument the Firm intended to issue as CET1 capital and, further, extended to all future issuance of capital instruments of the same type and characteristics as the permitted issuance. On the same date, 14 October 2021, the Parent FHC was approved by the PRA as a Financial Holding Company, with effect from 7 October 2021. Additionally, Article 26(3) CRR permission was granted to the Parent FHC on this date. 1.5. The Firm’s authorisation letter of 7 October 2021 set out the requirements for the Firm to exit mobilisation, known as the “Authorisation Conditions”. Authorisation Condition 8 was: ‘provision of evidence of sufficient CRR compliant capital to operate for one fully [sic] year after exit from mobilisation without any further injections needed to support the business plan in this period.’ On 5 July 2022, the Firm emailed the PRA with responses to the Authorisation Conditions articulated in the 7 October 2021 approval letter. Addressing Authorisation Condition 8, the Firm submitted a requirement to hold £38 million of CET1 capital prior to the point at which it exits mobilisation. This was based on the sum of: (1) a post-mobilisation capital requirement of £19 million; (2) an 11% Board approved management buffer of £2.1 million; and (3) a projected loss for the first-year post mobilisation of £16.9 million. The Firm was required to have CET1 capital to cover the sum of those three items prior to the PRA permitting the Firm to exit mobilisation. 1.6. On 5 January 2023, the PRA emailed the Firm approving the Firm’s exit from mobilisation, subject to confirmation of the required capital being in place. To evidence the necessary capital, the Firm was required to provide the following to the PRA:

Bank of England | Prudential Regulation Authority Page 11 a. Copy of a bank statement showing the funds in place; b. An SH01 ‘Return of allotment of shares’ Form from Companies House, which is required to give notice of the issuance of shares; and c. Board minutes evidencing agreement to issue the share capital. 1.7. On receiving proof of the required regulatory capital (£38 million), the PRA would formally communicate the lifting of the mobilisation restrictions and update the Financial Services Register. 2. £30.5 million fundraise & £21.5 million capital injection to Firm 2.1. On 20 January 2023, a then senior executive of the Firm responded to the PRA email of 5 January 2023, confirming the necessary capital to exit mobilisation. The email stated a capital injection had been transferred or ‘down-streamed’ from the Parent FHC to the Firm, supplementing the existing capital at the Firm. Attached to the email was what was described as a ‘copy of a bank statement(s) showing the new invested funds.’ This was, in fact, a statement of the client account at the Firm’s lawyers, showing £20.5 million held as payment for subscription of shares. The funds were from four existing investors and were split as follows: a. £4 million received on 11 January 2023; b. £6 million received 11 January 2023; c. £0.5 million received 16 January 2023; and d. £10 million received 18 January 2023. 2.2. Additionally, an unaudited, but certified, Firm balance sheet as of 31 December 2022 was provided, showing £17.75 million capital. Consequently, summing those figures, the PRA was led to believe the Firm had approximately £38.25 million in CET1, not accounting for any capital erosion in January 2023, against a Day 1 (day of exiting mobilisation) requirement of £38 million. 2.3. On 26 January 2023, a then senior executive of the Firm replied to the PRA with evidence of the necessary capital at the consolidated level. A certified

Bank of England | Prudential Regulation Authority Page 12 consolidated balance sheet as of 31 January 2023 was produced, showing available regulatory capital of £41 million, which was above the required level of £39.1 million. A capital injection of £30.5 million was included in the calculation. Therefore, in addition to the £20.5 million capital raised by the Parent FHC which had been down-streamed to the Firm, an additional injection of £10 million new capital to Parent FHC was included. Again, a statement of the lawyer’s client account was produced and referred to as a ‘bank statement’. This showed a receipt of £10 million on 16 January 2023, from an investor called ‘GP S.A.R.L’. It was subsequently determined, during the PRA’s investigation, that the client account statement showing the £10 million investment from GP S.A.R.L. which had been provided to the PRA had been falsified. In the same communication, a then senior executive of the Firm attached a signed Pre Issuance Notification (“PIN”) form for a £30.5 million issuance in Parent FHC and a signed SH01 (as required for a share issuance) for a £30.5 million allotment in Parent FHC. Consequently, it appeared at the time that the necessary Day 1 capital, with the associated paperwork for the capital injection, was in place to exit mobilisation at the consolidated Group level. 2.4. On 27 January 2023, the PRA held a call with two then senior executives of the Firm to discuss proof of capital. The PRA is recorded as highlighting the policy requirement for evidence of sufficient capital, to operate the first 12 months of the business plan while remaining above capital requirements plus buffers, prior to granting approval to exit mobilisation. The PRA noted additional capital would be required to offset any capital erosion in January 2023 which might have brought the Firm’s capital level below the required £38 million level. The Firm and the Parent FHC advised that the Parent FHC had agreed to inject an additional £1 million to cover this capital burn and committed to provide evidence of this injection. 2.5. An email from a then senior executive of the Firm to the PRA, on 27 January 2023, sought to address all of the matters raised on the day’s earlier call. A copy of the Parent FHC’s board minutes, dated 18 January 2023, was attached confirming approval for the additional injection of £1 million into the Firm. A copy of emailed instructions, dated 27 January 2023, to the Firm’s lawyers requesting all funds held by the lawyers in the client account be wired

Bank of England | Prudential Regulation Authority Page 13 to the Firm’s bank account, was also attached. The email stated this transfer of funds was ‘now in process.’ However, it was subsequently determined, during the PRA’s investigation, that the copy of the emailed instructions to the Firm’s lawyers had in fact been falsified. The email to the PRA also attached a document entitled ‘Consolidated Day 1 Capital Requirement’. Day 1 actual capital, at the consolidated level, was shown as £40.998 million, a surplus of £1.896 million to the requirement of £39.1 million. Consequently, this matched the certified consolidated balance sheet sent to the PRA on 26 January 2023, and necessarily contained a capital injection of £30.5 million. This £30.5 million was composed of the £20.5 million, shown in the statement sent to the PRA on 20 January 2023, and the £10 million shown in the statement sent to the PRA on 26 January 2023. 2.6. On 30 January 2023, a then senior executive of the Firm emailed the PRA with further evidence of the £1 million capital injection, from the Parent FHC to the Firm, to cover the January capital burn. Attached was a PIN form, an SH01 form, a Subscription Letter, Written Resolution, and a statement of the client account at the Firm’s lawyers showing a £1 million wire payment for subscription of shares in the Firm. However, the statement of the client account was, it was determined during the PRA’s investigation, also falsified. 2.7. On the basis of the documents and submissions made on behalf of the Firm to the PRA; the PRA believed £30.5 million in CET1 capital had been injected into Parent FHC in January 2023, with £21.5 million being down-streamed into the Firm. Thus, the PRA was satisfied the Firm and the Parent FHC held the Day 1 CET1 capital required to exit mobilisation; £38 million or greater for the Firm, and £39.1 million or greater on a consolidated basis for Group. Consequently, on 3 February 2023, the PRA approved the Firm’s application to exit mobilisation and the Financial Services Register was accordingly updated. £6 million Recognised in December 2022 2.8. The Firm submitted its Q3 2022 Consolidated Common Reporting of Own Funds (“COREP”) regulatory return on 12 November 2022. This showed a closing CET1 position as of end-September 2022 of £22.867 million, against

Bank of England | Prudential Regulation Authority Page 14 a capital requirement of £18.899 million, and thus, a capital surplus of £3.969 million. Capital burn, due to losses, was roughly £3.5 million per month at this time. Consequently, without a further capital injection, the Group would fall below consolidated capital requirement in November 2022. This was subsequently reported, with the consolidated Group entering buffers in November 2022 by £2.9 million. The Q4 2022 consolidated COREP was submitted to the PRA on 14 February 2023. This showed a £6 million capital injection, such that the consolidated Group had finished Q4 with a closing CET1 of £19.208 million, against a requirement of £18.852 million, and thus a surplus of £0.356 million. 2.9. In the course of the PRA’s investigation, the Firm notified the PRA that the £6 million recognised as CET1 capital in December 2022 was the £6 million shown in the client account statement sent to the PRA on 20 January 2023. This £6 million had been recognised as CET1 capital by the Parent FHC in December 2022 on the basis of a letter from the investor stating the funds were ‘held to account, committed, and to be invested’ in Parent FHC and were fully and freely available to the Parent FHC without condition or restrictions from 28 December 2022, a letter from the Firm’s lawyers stating on such basis the Parent FHC had title to the funds from 28 December 2022, and an email from a regulatory consultant stating that as the Parent FHC had title to the funds they could recognise them as CET1 capital from 28 December 2022. It was determined during the PRA’s investigation that the email from the regulatory consultant and the letter from the investor had both, in fact, been falsified. All of these documents were dated 13 February 2023, the day before the COREP return was submitted. Actuality 2.10. The Subscription Agreement for the Series C+ investment round - the investment round which raised funds to meet the Day 1 capital requirements at Group and Firm - included a clause that completion could only take place when the Firm’s solicitor’s client account had received £35 million, the aggregate amount of the investment round. Further, the Agreement included a Longstop Date of 30 January 2023, meaning the Agreement would automatically terminate by 11.59pm on 30 January 2023 if all of the

Bank of England | Prudential Regulation Authority Page 15 completion terms had not occurred (including the Firm’s lawyers receiving £35 million into its client account). If all completion terms had not been fulfilled, all funds were to be returned to the subscribers. However, on 30 January 2023, a Deed of Amendment of the Subscription Agreement was executed. This amended the amount required to be raised from £35 million to £30.5 million, and the Longstop Date to 13 February 2023. The Subscription Agreement and the Deed of Amendment were shared with the PRA for the first time during the course of the PRA’s investigation. 2.11. Internal emails reveal that then senior executives at the Firm were aware in February 2023 that the Firm had not received any of the funds which the PRA had been informed it held as CET1 capital in January 2023. On 10 February 2023, then senior executives at the Firm were informed that £20.5 million was being held in the law firm’s client account to the investors’ order. Therefore, the funds were not being held on behalf of the Firm. Further, as the release of each of the investor’s funds was interconditional, the final £10 million from the investment round had to be received, or else consent from the investors whose funds had been received, before the law firm could release the funds to the Firm. 2.12. On 28 February 2023, the existing investors agreed to waive all completion conditions in the Subscription Agreement and complete their share subscription, including making payment of the £20.5 million. That same day, internal emails recorded that the Firm had now taken receipt of the £20.5 million. However, they were unclear as to whether they would receive the additional £1 million; which the PRA had previously been informed had already been down-streamed to cover the January capital burn. The same day, then senior executives of the Firm discussed having received the £20.5 million stating: ‘From a regulatory perspective, my read is that UK Bank was expected to hold £38m in Day 1 Capital from the point of departing mobilisation. While the letter was dated 3rd February, I recall we both agreed that we were in a form of self-imposed mobilisation. As such, we both felt it reasonable that go-live was the back stop date by which the Bank achieved the Day 1 Capital position.’

Bank of England | Prudential Regulation Authority Page 16 2.13. The records at Companies House show that the Parent FHC received an investment of £10 million on 29 March 2023 (and not in January 2023, as the PRA had been told). A table maintained by the Parent FHC of all share transactions, shared with the PRA in the course of the investigation, also showed Parent FHC received the investment of £10 million on 29 March 2023. However, this investment was not from ‘GP S.A.R.L’, as the PRA had been informed on 26 January 2023, but from one of the existing shareholders. The Firm is unable to identify any email or other communications which evidence the PRA was informed of the investment of £10 million by the existing shareholder on 29 March 2023; the PRA was not provided with a PIN form, subscription agreement, SH01 form, nor any email advising them of the investment. 2.14. In summary then, at this stage, the following falsified documents had been provided to the PRA: a. Client account statement showing £10 million from ‘GP S.A.R.L’ for payment of subscription of shares; b. Client account statement showing £1 million injection from Parent FHC to the Firm; c. Copy of emails, dated 27 January 2023, instructing the Firm’s lawyers, and their subsequent acknowledgement, to wire all funds held in the client account to the Firm’s bank account; d. Letter from investor stating £6 million had been held fully and freely available to the Parent FHC as of 28 December 2022; and e. Email from regulatory consultant stating that the Parent FHC could recognise £6 million as CET1 in December 2022. 2.15. Consequently, the representations made by then senior executives on behalf of the Firm and the Parent FHC to the PRA in January 2023, concerning capital, were false. There was neither the capital required at the Firm level, nor the consolidated Group level, to meet the requirements to exit mobilisation. Falsified documents were produced to the PRA and the true capital positions of the Firm and Group were knowingly misrepresented.

Bank of England | Prudential Regulation Authority Page 17 However, the PRA accepted these documents and representations in good faith when they were provided and, as such, approved the Firm’s application to exit mobilisation on 3 February 2023. 3. Capital History Report – November 2023 3.1. On 25 September 2023, the PRA sent the Firm a 2023 Mid-Point Review (“MPR”) Letter. The MPR is a firm-specific review which reviews the assessment of the risks a firm poses to the PRA’s objectives, challenges and validates the supervisory strategy, and assesses progress against the work plan agreed at the previous Periodic Summary Meeting (“PSM”), or in the Firm’s case, the Post-Mobilisation Review meeting which approved the Firm’s exit from mobilisation. The PRA does not normally write to firms detailing the outcome of the MPR; however, the PRA considered it necessary to communicate increasing supervisory concerns regarding the risks which the Firm posed to the PRA’s objectives. The PRA noted a number of troubling themes: the PRA’s concerns regarding the effectiveness of the Firm’s governance and culture, a lack of clarity and oversight of both the solo and consolidated financial information and capital resources and concerns regarding the efficacy of the relationship between the Firm and the wider Group. Under ‘Key Risk 3: Capital Adequacy & Reporting’, the PRA stated, ‘We also request that TBOL submits a report to the PRA, outlining the firm’s capital history at both UK Bank and Group level. This should include a timeline of capital injections and downstreaming, available resources, and ongoing compliance with capital requirements. This should be a comprehensive report, with verified data and cover the time period from firm authorisation to the present day.’ 3.2. On 30 November 2023, the Firm replied to the PRA with responses to the requirements from the MPR. This included a document entitled ‘TBOL Capital History Report’ (the “Capital History Report”), which was in response to ‘Key Risk 3: Capital Adequacy & Reporting’ of the MPR. The Capital History Report addressed the following areas: a. Funding History – Capital raised at Parent FHC level; b. Capital down-streamed into the Firm;

Bank of England | Prudential Regulation Authority Page 18 c. Consolidated and UK Bank Own Funds and Capital Requirements; d. Analysis of available resources and compliance with capital requirements; e. Ongoing monitoring of capital resources; and f. Current position and outlook at both Firm and Consolidated level. 3.3. A consolidated capital walk chart was produced showing Group capital resources against capital requirement. The chart also detailed cash utilisation (‘P&L Burn’) and capital injections. Additionally, a quarterly table was produced showing opening CET1, capital injections, cash utilisation, and closing CET1 against capital requirement. Both the chart and the table showed a £6 million investment in Q4 2022 (the £6 million recognised on the basis of the falsified letter and advice), and a £24.5 million investment ahead of exiting mobilisation on 3 February 2023. The accompanying narrative stated, ‘During December 2022, £6m of the Series C+ funding was injected to restore capital levels to a surplus over requirements’. It further stated, ‘A £39.1m requirement on an exit date in January or February 2023 was agreed. Confirmation of AWR exit allowed us to complete the raise of £30.5m to support a c. £41m CET1 exit position. The UK Bank exited mobilisation 3rd February 2023.’ Consequently, the Capital History Report corroborated what the Firm had submitted to the PRA in January 2023 and in the Q4 2022 COREP. The PRA was, again, informed that the Parent FHC had received a total capital investment of £30.5 million in December 2022 and January 2023, such that the consolidated capital position met the requirement of £39.1 million to exit mobilisation. This was despite the Parent FHC receiving funds, as correctly and contemporaneously filed on Companies House, of £20.5 million on 28 February 2023 and £10 million on 29 March 2023. 3.4. A similar capital walk chart and quarterly table was produced for the Firm. This also corroborated what the PRA had been told by a then senior executive of the Firm in January 2023; a capital injection from Parent FHC of £20.5 million was shown ahead of 3 February 2023. The accompanying narrative stated, ‘The UK Bank was capitalised with a further £20.5m in January 2023, bringing total CET1 to £37.5m.’ This was despite the £20.5

Bank of England | Prudential Regulation Authority Page 19 million cash in fact being down-streamed on 28 February 2023 and the shares, as correctly and contemporaneously filed on Companies House, allotted on 1 March 2023. No mention was made of a ‘self-imposed mobilisation’ or a change to the go-live date. 3.5. Therefore, the Capital History Report, which was required to provide the PRA with a comprehensive account, with verified data, of the capital history of the Firm and the Parent FHC, endorsed the false information the PRA had been given in January 2023. An internal email on 15 November 2023 shows those responsible for producing the Capital History Report, were instructed by a then senior executive of the Group to check what had been communicated to the PRA on capital and the dates of those communications. A meeting was held on 22 November 2023, at 2.30pm to 3pm, between those involved in drafting and reviewing the Capital History Report. At 2.56pm, 3.10pm, and 3.13pm, the emails and attachments which were sent to the PRA in January 2023 were circulated to those attending the meeting. These were the emails and attachments which purported to provide proof of £30.5 million being injected into the Parent FHC, and £21.5 million being down-streamed into Firm to meet the Firm’s overall capital requirement of £38 million plus the January 2023 capital burn. The Capital History Report was drafted between 15 November and 30 November 2023. 3.6. There was one subject on which the Capital History Report did differ from that advised to the PRA in January 2023: the £1 million said to have been down￾streamed from the Parent FHC to the Firm to cover the January 2023 capital burn. On 30 January 2023, the Firm informed the PRA this had been completed and provided various documents in support, some of which had been falsified. However, the Capital History Report advised this injection had never taken place. 3.7. There is no record of any formal decision in March 2023 to suspend the down-streaming of £1 million to the Firm, as the Capital History Report had asserted. The reason the Firm had been required to down-stream an additional £1 million in January 2023 was to fulfil Authorisation Condition 8, as set out in the authorisation letter of 7 October 2021 (pursuant to which the Firm was authorised). As an internal Firm email on 26 January 2023

Bank of England | Prudential Regulation Authority Page 20 explained, capital burn at the Firm in January 2023 was £910,000. Therefore, a capital injection of £21.5 million (rather than £20.5 million) was necessary for a Firm capital position in excess of £38 million at the end of January 2023. The PRA had been informed, on 30 January 2023, that this had been done and, as a consequence, the Firm had been granted permission to exit mobilisation. The first time the PRA was informed of the £1 million injection having not taken place was in the Capital History Report. 3.8. Finally, the Capital History Report advised on a fresh capital raise: ‘We have recently raised £25m funding to bolster our consolidated capital’. It stated: ‘Originally, it was anticipated that the first investment of £8m would arrive in October, however, this was delayed which resulted in use of the PRA Buffer (£3.8m) in October 2023. This was notified to the PRA on 1st November 2023. The investment is now expected in early December. This will increase the buffer usage to c.£7m. The delayed November injection of £8m and second injection of £8m on 30th December improves the projected surplus to £5.4m. The final injection of £9m on 30th January increases the surplus, currently forecasted at approximately £10m.’ Therefore, the Capital History Report advised the PRA of Group having entered their PRA Buffer in October 2023 and having moved deeper into Buffer in November 2023. However, the Parent FHC, the PRA was being told, had secured a £25 million investment and should have received tranches in October and November 2023, such that they never would have needed to enter the PRA Buffer. The PRA was advised tranches would be received in December 2023 to take Group back above capital buffers. This £25 million fundraise was not in fact received. 4. Client A 4.1. Of the £4.8 million revenue in the Group August 2023 accounts, £4.7 million was revenue recognised on the Firm signing Client A. This was the only month during the Relevant Period when the Firm reported a profit. The £4.7 million was for the provision of planning, scoping and design (“PS&D”) services. The full value of the £4.7 million “PS&D Fee” was recognised as revenue in the Group accounts on signing and represented half of the total revenue for 2023. The funds associated with the £4.7 million revenue have never been received, Client A no longer exists as a corporate entity, and thus,

Bank of England | Prudential Regulation Authority Page 21 all revenues have been retrospectively zeroed. However, the £4.7 million PS&D Fee remained in the accounts as recognised revenue throughout the Relevant Period. Full-Year 2023 Fee Revenue, as reported by the Firm in January 2024, was £5.175 million and thus, the PS&D Fee accounted for 90% of all fees recorded by the Firm in 2023. 5. £9 million from existing investors 5.1. On 22 December 2023, the Parent FHC emailed the November 2023 Consolidated Account Summary to the PRA. The accounts revealed Group had moved further into buffers at the consolidated level by the end of November 2023. However, the PRA was informed current investors had agreed that day to immediately draw down £9 million, such that £9 million new capital would be injected into the Parent FHC before the end of December 2023. On 15 January 2024, two then senior executives of the Firm held a call with the PRA to discuss capital. They are recorded as advising the PRA that the Parent FHC had received £9 million from existing investors in December 2023 and the Group had, therefore, finished 2023 £2.8 million above buffers at the consolidated level. However, the Parent FHC had not in fact received an injection of capital of £9 million at this time. It was only later in 2024 that the Parent FHC received three separate injections of £3 million, as explained below, on 25 January 2024, 2 April 2024 and 19 April 2024. £3 million injection 5.2. On 12 February 2024, the Parent FHC emailed the December 2023 Consolidated Account Summary to the PRA. The accounts revealed Group was £9.36 million below Capital Requirement (inclusive of buffers), equal to 53% of its PRA Buffer. There had been no injection of £9 million; instead, an equity injection of £3 million is recorded, described as ‘freely available capital in transit at year end.’ This £3 million was recognised as CET1, under ‘Cash at Bank (Other)’, to produce a Group CET1 position of £14.72 million. 5.3. Internal emails from the morning of 23 January 2024 show payments due in January which Group did not have cash to make. Further emails referred to a proposal for a £3 million investment, from an existing investor, but financed by a different existing investor, and that the funds would be received without a

Bank of England | Prudential Regulation Authority Page 22 signed subscription agreement, appropriate board resolutions, shareholder resolutions, nor investor director consent. Shortly after, the relevant investor entered into a loan agreement with the existing investor for £3 million. On 1 March 2024, a then senior executive of the Firm sent an email to other senior executives stating that board resolutions needed to be signed so that the shares for the £3 million investment could be issued, concluding, ‘We are exposed on the capital recognition without so very keen to get everything in place.’ A PIN form dated 1 May 2024, amalgamating this investment with several later investments, was sent to the PRA on 2 May 2024. The Parent FHC’s internal share transaction history table lists this issuance taking place on 25 January 2024. An SH01 filing on Companies House, filed 2 May 2024, details a £3 million allotment on 25 January 2024. 5.4. Therefore, a loan agreement for the £3 million was entered into on 23 January 2024, the funds were sent and received on 25 January 2024, written resolutions of the directors were signed on 4 March 2024 and the PRA was provided with a PIN Form on 2 May 2024. The Firm now accepts the £3 million (as part of the £9 million recognised) was incorrectly recognised in December 2023. Consequently, the consolidated COREP return for Q4 2023, submitted on 14 February 2024, showing CET1 of £14.72 million, was also incorrect. £6 million injection (in fact two £3 million injections) 5.5. On 23 February 2024, the PRA requested the Firm and Parent FHC confirm capital numbers at both the consolidated Group and solo Firm level. The PRA required a review of current capital levels, forecast levels, regulatory requirement changes (from March 2024) and use of buffers for the upcoming months. On 1 March 2024, the Parent FHC replied with a document titled ‘TBOL Group & UK Bank Capital Analysis Feb 2024’ (the “Capital Analysis”). This stated that in January 2024, the Parent FHC received no capital injections and Group made a loss of £3.3 million. Therefore, at month end January 2024, Group was £12 million (equal to 67%) into buffers. A £6 million capital injection was reported for February 2024, in addition to another loss of £3.3 million. Therefore, the £6 million capital injection roughly offset the losses for January and February 2024 and returned Group to the same

Bank of England | Prudential Regulation Authority Page 23 financial basis as of the end of 2023, £9.38 million into buffers. However, an internal email reveals the then senior executive who sent the Capital Analysis to the PRA had, prior to sending the document to the PRA, emailed other then senior executives and queried whether the £6 million should be recognised as CET1 given that the ‘only confirmation’ of the investment was that board resolutions would be signed that day (and accordingly, the funds had not been received and there was no signed subscription agreement). The £6 million was, in fact, recognised as CET1 capital notwithstanding that lack of ‘confirmation’. Without the £6 million injection the Capital Analysis would have shown Group £15.375 million within buffers and £2.69 million from entering CRD IV Buffers, which was less than an average month of losses. 5.6. The PRA emailed the Firm and Parent FHC on 7 March 2024 asking for confirmation the £6 million had been received and would appear in the end￾February 2024 numbers once finalised. A then senior executive replied the following day, 8 March 2024, to confirm this was correct. On 26 March 2024, the PRA emailed the Firm and Parent FHC on the subject of the £6 million capital injection. The Firm’s February 2024 PRA 110 Group submission (a regulatory submission concerning, inter alia, liquidity and cash flows), submitted on 21 March 2024, did not match the Capital Analysis provided on 1 March 2024. Specifically, the PRA 110 regulatory return detailed the £6 million tranche of capital arriving by end-March 2024. However, the Parent FHC had recognised the capital as having been received in February 2024. The Firm and the Parent FHC replied that same day, affirming the capital position at the end of February was correct as reported, ‘We recognised the £6m capital at the end of February as fully signed up and feely [sic] available. We triggered the drawdown of the cash to land in March as planned, so have included in the PRA 110 as capital in transit, not cash on the balance sheet in February.’ The PRA did not recognise such an interpretation of CET1 and thus, requested an explanation of this, in addition to the required PIN form and the date on which the injection was received. The Parent FHC replied, defining ‘fully signed up and freely available’ as meaning they had a shareholder agreement, board approval, and confirmation from the investor that the funds were free for the Parent FHC to draw down. The Parent FHC

Bank of England | Prudential Regulation Authority Page 24 stated they had ‘drawn the cash to arrive before the end of March’ and they would seek to provide a PIN form. 5.7. On 28 March 2024, the PRA informed the Parent FHC its approach was not compliant with CRR nor in line with the PRA’s expectations on capital recognition. The PRA explained that under Article 28(1)(b) of the CRR, the requirement is that instruments are ‘fully paid up’ and thus a firm must be in receipt of funds before qualifying it as CET1. The PRA repeated its concerns as to the Firm’s capital position, capital management, and timeliness and openness of capital planning and fund-raising updates. Group was required to re-run its end-February 2024 capital numbers without recognising the £6 million, which was yet to be received, and to explain the implication for the upcoming end-March 2024 capital position. The Parent FHC sent through the February 2024 Group capital position, excluding the £6 million which had not been received, on 29 March 2024. This revealed a total consolidated CET1 position of £9.25 million: £14.2 million into the PRA Buffer, £3.87 million above CRD IV Buffers and £4.97 million above TCR. The forecast for end￾March 2024 now showed only £3 million of new capital, rather than the £6 million which the PRA had previously been advised had been drawn down to land in March. 5.8. On 2 April 2024, the PRA informed the Firm it had been added to the PRA Watchlist effective immediately. The PRA uses a Watchlist process in relation to those firms which the PRA is most concerned about from the perspective of its statutory objectives. The PRA’s immediate initial focus was to understand Group’s capital conservation plan, additional fundraising options, and downside planning to understand the Firm’s dependencies on the Parent FHC both for continued operations and in a Bank Solvent Wind Down (“SWD”) scenario in the event that Parent FHC was insolvent. 5.9. On Friday 5 April 2024, a then senior executive of the Firm emailed the PRA to inform it that ‘we’ve just had confirmation of the £3m.’ The £6 million which the Firm and Parent FHC had, on 15 January 2024, advised as having been received in December 2023 (as part of the £9 million reported as received from existing investors), which was subsequently reported as injected capital in February 2024 (in the Capital Analysis sent to the PRA on 1 March 2024),

Bank of England | Prudential Regulation Authority Page 25 was now reported as having been received in two separate tranches of £3 million; the first on 28 March 2024 and the second on 5 April 2024 (but, as discussed below, the first £3 million was not received until 2 April 2024 and the second £3 million was not in fact received until 19 April 2024). The first tranche of £3 million was particularly important as it had been included in the forecast for the end-March 2024 consolidated capital position sent by the Parent FHC to the PRA on 29 March 2024. Even with this £3 million, Group was forecast to have entered its CRD IV Buffers. Without it, Group would also be £2.5 million below TCR with a consolidated CET1 of just £7.5 million. 5.10. The PRA replied to the Firm and Parent FHC’s email of 5 April 2024 by requesting proof of funds for both tranches of £3 million. The PRA chased on 8 April 2024. A then senior executive of the Firm answered, stating they had proof of funds for the first £3 million and proof the second £3 million was sent on 5 April 2024; however, they could only provide proof of funds for the second tranche when it was credited to their account, which was yet to happen. The PRA replied, expressing its disappointment and sense of having been misled on 5 April when informed the second £3 million was confirmed, having been informed on 2 April 2024 that the Firm and Parent FHC were in possession of the SWIFT code and would inform the PRA when they received the funds, which they expected by the 5 April 2024. A then senior executive responded, stating there had been a misunderstanding and that the SWIFT transfer was sent on 5 April 2024 and the Parent FHC was chasing its bank for the funds to be applied to their account. The PRA replied, articulating the sequence of events from the previous week and how this did not match with what it was now being told by the Firm and Parent FHC. 5.11. On 10 April 2024, the PRA requested an update from the Firm and Parent FHC on the second £3 million capital injection. A then senior executive replied later that day, explaining the £3 million had still not been credited to Parent FHC’s account. On a call with the Firm and Parent FHC on 12 April 2024, the PRA was informed the £3 million had still not been received. A then senior executive emailed the PRA on 14 April 2024 advising the £3 million had still not been credited to the account as the same investor had ‘sent an identical amount the previous week (the first £3m) with the same payment reference around the same time the previous week, which means it’s been caught up in

Bank of England | Prudential Regulation Authority Page 26 compliance hell!’ The PRA replied, asking when the Firm and Parent FHC expected the funds to be released, as Group had now been in CRD IV Buffers for over two weeks. Further, the PRA noted additional capital injections were required after month-end to keep Group above TCR. 5.12. On 15 April 2024, the PRA emailed the Firm and Parent FHC inquiring when the £3 million, held up in compliance, was expected. Later that same day, the PRA also requested proof of funds for the first tranche of £3 million. The SWIFT message and transaction confirmation for the first tranche of £3 million was sent later that day. The SWIFT message revealed a transfer time, from Luxembourg, of 5.21pm on 28 March 2024. 29 March 2024 was a bank holiday for Good Friday, 1 April 2024 was a bank holiday for Easter Monday. The bank transaction revealed the Parent FHC’s account was credited on 2 April 2024. The PRA replied an hour later, noting the transaction date of 2 April 2024 and querying that the Firm only received the funds into its bank account on this date. A then senior executive responded, informing the PRA that the funds had been received by the Parent FHC’s bank on 28 March, but only applied to its account on 2 April due to the Bank Holiday weekend. On 18 April 2024, the PRA emailed the Firm and Parent FHC asking for confirmation from the Parent FHC’s bank that the first tranche of £3 million was received on 28 March 2024 and for the UETR for the transaction. Additionally, the PRA requested confirmation from the Parent FHC’s bank on when the second tranche of £3 million was received. A SWIFT message for the second tranche of £3 million was provided, showing the funds had been sent at 4.05pm on 5 April 2024. The Firm subsequently informed the PRA on 12 November 2024, during the course of its investigation, that the investor responsible for the two tranches of £3 million had advised that while they confirmed veracity of the SWIFT message of 28 March 2024, they did not recognise the SWIFT message dated 5 April 2024, which was therefore not likely to be a genuine document. 5.13. On 19 April 2024, a then senior executive emailed the PRA to advise that the Firm and Parent FHC had decided to formally recognise the first tranche of £3 million when it was applied to Parent FHC’s account on 2 April 2024. Later that same day, the Parent FHC advised the PRA of having received £3.6 million cash into its account, being the second tranche of £3 million and

Bank of England | Prudential Regulation Authority Page 27 £621,000 from another existing investor. Bank transaction receipts were provided for both credits, dated 19 April 2024. A PIN form dated 1 May 2024, amalgamating all three of these investments with the £3 million investment booked to December 2023, was sent to the PRA on 2 May 2024. 5.14. On 26 April 2024, the Parent FHC sent the March 2024 Consolidated Account Summary to the PRA. This revealed Group had CET1 of £6.8 million. Therefore, Group was £19.4 million below its PRA Buffer, £2.1 million below CRD IV Buffers and £52,000 below TCR. The forecast for end-April 2024 was marginally improved due to the received £6.6 million capital offsetting a further monthly loss of £3 million. The May forecast showed a deterioration, despite a forecasted £2.5 million capital injection which was not guaranteed, with a return above PRA Buffer only shown in June 2024, dependent upon a further (unguaranteed) capital injection of £33 million. Additionally, the Parent FHC anticipated the injections being toward month-end in May and June and, therefore, Group would utilise CRD IV Buffers again in both months. 5.15. Subscription agreements for the two investments of £3 million were supplied to the PRA in the course of the investigation. The first was signed on 28 March 2024, the day the funds were sent. The second was signed on 19 April 2024, the same day the Parent FHC was able to provide proof to the PRA of having received the funds. PRA letters on 1 May 2024 and April 2024 Group accounts 5.16. On 1 May 2024, the PRA formally wrote to the Parent FHC and the Firm on various issues, including the subject of Capital Requirements and Buffer Setting. The PRA expressed significant concern regarding the Group’s approach to capital management, planning and capability. Further, the Parent FHC’s track-record and ability to raise and receive capital in a timely manner was also an area of substantial concern. The letter noted Group had been operating in its PRA Buffer since October 2023, with various remediating capital injections having been delayed or not forthcoming. Group had also breached CRD IV Buffers and TCR in March 2024. The PRA reiterated that the PRA Buffer should not be subject to sustained usage. Following concerns raised in the MPR letter, dated 25 September 2023, the PRA articulated

Bank of England | Prudential Regulation Authority Page 28 intensifying concerns over the Group’s openness and honesty with the regulator. The recognition of funds as regulatory capital, prior to the funds being formally received, was cited. The PRA concluded by stating, ‘At present, the PRA deems that it is unable to place reliance and trust on the firm’s reporting and communications.’ 5.17. On 1 May 2024, the PRA also sent the Firm the Periodic Summary Meeting Feedback letter. The PRA communicated its assessment that the Firm posed a significant risk to the PRA’s objectives and was outside of its risk tolerance in several key areas, including capital adequacy. The PRA described Group’s breaches of CRD IV Buffers and Total Capital Requirements in March 2024 as ‘a significant breach of the PRA’s minimum capital regime and adds to further concerns relating to TBOL’s overarching approach to capital management, forecasting and investor relations. We also remain concerned that these breaches would have been left undetected without PRA intervention, due to inconsistencies in TBOL’s approach to capital recognition.’ The PRA continued by noting Group had recognised funds as regulatory capital prior to those funds being received, with the effect of distorting the appearance of the Group’s actual regulatory capital resources. As a consequence of the PRA’s concerns relating to the Group’s financial controls and broader management and governance, the PRA applied a Risk Management and Governance scalar, applicable to both Group and the Firm. This had the effect of requiring both the Parent FHC and the Firm to hold more regulatory capital. 6. Intercompany Receivable 6.1. An intercompany receivable existed throughout the Relevant Period, as the Firm loaned cash to the Parent FHC, which was used to pay Group expenses (the “Intercompany Receivable”). These costs were on average £2.5 million per month. The amount loaned by the Firm to the Parent FHC grew to represent a significant percentage of the Firm’s CET1 capital and at times during the Relevant Period exceeded 50% of the Firm’s CET1 capital. 6.2. The PRA has rules regarding ‘large exposures’ which set a maximum on the size of any exposure held by a firm, namely an amount greater than 25% of

Bank of England | Prudential Regulation Authority Page 29 the firm’s Tier 1 capital. The amount of the Intercompany Receivable, including as a percentage of the Firm’s Tier 1 Capital, was reported to the Firm’s board in the monthly management accounts. However, those accounts incorrectly referenced the applicable ‘large exposure limit’ as 100% of the Firm’s capital, rather than the correct 25% level. 6.3. It was acknowledged by the Firm and the Parent FHC that the terms of the Intercompany Receivable should be documented. These terms were drafted on 6 November 2023. However, by 16 May 2024 the ‘TBOL Intercompany Agreement’ was neither finalised nor entered into. 6.4. Before August 2023, increases in the Intercompany Receivable were approved by a then senior individual of the Firm. In August 2023, the PRA advised the Firm of the expectation that executive level sign-off should be part of the governance applicable to Group funding transactions. The Firm and Parent FHC, therefore, identified additional governance was desirable, including the Firm’s executive governance approving the increase and the board of the Firm being notified. 6.5. The PRA’s Mid-Point Review Letter to the Firm, dated 25 September 2023, stated ‘Having an accurate financial picture of a firm is of paramount importance, both to the PRA and also the firm’s Board, to allow them to discharge their crucial oversight functions. We therefore request that an intercompany recharging mechanism is established and implemented as a priority, and by 31 October 2023 at the latest.’ The Firm and the Parent FHC did not put in place such a mechanism during the Relevant Period. 6.6. Executives then at the Firm and Parent FHC were aware the correct applicable maximum exposure limit was 25%. These executives were also aware a waiver was required for any exposures exceeding 25% and, as such, this applied to the Intercompany Receivable from and including August 2023 onwards. The board was informed at month-end September 2023 that all large exposures had ‘significant headroom to limits’. However, internal emails between then executives of the Firm dated 8 November 2023 acknowledged that the appropriate large exposure limit was 25% and the need for a waiver was articulated. A then senior executive at the Firm then noted the conflict with what had been communicated to the board throughout the year, stating

Bank of England | Prudential Regulation Authority Page 30 ‘Having a problem now with the balance being over 25% of own funds is inconsistent with how we’ve described it to date.’ 6.7. By March 2024 the Firm was yet to seek a waiver in relation to the large exposure, despite then executives at the Firm continuing to recognise the PRA’s rules in relation to large exposures were not being complied with. During the course of April 2024, and in response to questioning from the PRA, the Parent FHC acknowledged that ‘any group-level issue’ significant enough to cause a material or full write-off of the intercompany balance was likely to trigger a solvent wind-down of the Firm. The PRA stated, on 5 April 2024, that it was disappointing this had not been highlighted proactively to the PRA given the significant impact it could have on the Firm’s solvency. 7. Project Rainbow 7.1. On Sunday 21 January 2024, the Firm and Parent FHC held a two-hour meeting, labelled ‘Scenario Planning’. Ahead of the meeting, on 20 January 2024, internal emails show a presentation, the “Bank Solvency Analysis”, was circulated to the meeting distribution list. The presentation opened by articulating the current financial position at the Firm: ‘At 17th January 2024, the Bank had £1,041k own-funds cash available to pay payroll, supplier invoices and fund client deposit interest between MPC payment cycles… The available cash of £1,042k is sufficient to cover the bank operations for the next 7 days but insufficient to pay January Bank payroll scheduled for 31st January 2024.’ The presentation explained the Firm had arrived at this position due to a combination of factors, notably Group intercompany funding (the Intercompany Receivable was £16.6 million by the end of December 2023) and the failure of Group to make an agreed repayment to the Firm of £5 million in December 2023, the failure to receive any funds from the £4.7 million recognised in August 2023 against Client A and cumulative losses since inception of £20.7 million. The presentation explained that in the preceding 48 hours, Firm finance had released £3.3 million encumbered own￾funds, such as surplus payment scheme collateral held in the Regular Collateral Account, as freely available cash. This provided the Firm with £4.28 million of available cash to operate to 1 May 2024.

Bank of England | Prudential Regulation Authority Page 31 7.2. After the meeting on 21 January 2024, a then senior executive of the Firm distributed by email the Firm’s SWD plan that had been submitted to the PRA. The SWD plan concluded the threshold of own-funds required to solvently wind down the Firm without any detriment to all stakeholders as £4.45 million. Consequently, on 21 January 2024, the Firm did not have the necessary available free cash to meet the threshold. However, the Bank Solvency Analysis presentation stated that the remaining £5.2 million of own funds encumbered in payment scheme collateral accounts might be unencumbered early in the SWD process, as the Firm would no longer require access to payment schemes, and used to cover SWD costs. On this determination, the Firm concluded that it could be deemed to remain above the SWD threshold. The presentation then considered whether the own funds runway turned the SWD Key Risk Indicator red, such that a Crisis Management Team (“CMT”), which would be required to report into the board on a daily basis, should be convened and the regulators notified. The presentation concluded on this topic, on the basis the Firm had a runway for operating cash only until 1 May 2024, ‘it is strongly recommended that CMT is invoked immediately. To be debated and concluded.’ 7.3. On 22 January 2024, it was confirmed there would be a daily meeting to discuss the management of cash and capital at the consolidated level, this would be under the name ‘Project Rainbow’, and those involved would be required to sign a Non-Disclosure Agreement. The daily Project Rainbow calls were scheduled for 10am to 10.30am for the remainder of the month. 7.4. An email dated 22 January 2024 sent pursuant to Project Rainbow, stated, ‘Important that project Rainbow is described in the correct way. Its [sic] is NOT about solvency assessment… It is about the management of cash and capital at the consolidated level.’ Group emails dated 23 January 2024 discussed the shortage of cash at Group and how they would be unable to pay, among others, any HMRC taxes due, end of month payroll in US and EU and consultant costs. A commitment by an investor to make an immediate injection of £3 million was provided as the short-term solution. 7.5. On 2 February 2024, a new ‘Project Rainbow Daily Call’ meeting invite was sent. The call was scheduled for the same time as before, occurring each

Bank of England | Prudential Regulation Authority Page 32 weekday from 2 February until 29 February 2024. On 22 February 2024, the Firm paid a £630,000 invoice on behalf of Group, the decision having been discussed at Rainbow meetings on 21 and 22 February. As a consequence, as the Firm recorded in a document of that date entitled ‘EMC Report 22nd February 2024 Own Funds Runway’ (the “EMC Report”), the Firm’s cash flow forecasting now showed a closing cash balance for February 2024 of £2.45 million, £1.99 million for March 2024, and -£199,000 for April 2024. Therefore, the Firm’s own funds available cash extended only to 30 April 2024, a two￾month runway – described in the EMC Report as a ‘significantly reduced runway vs prior week’ due to that payment. Unencumbering all of the remaining £5.2 million own funds, at that time encumbered as payment scheme collateral, would see the Firm breach the SWD threshold by 2 June 2024. On 23 February 2024, all finance papers, including the EMC Report, were pulled from the agenda for the Firm’s board of directors meeting at the end of February 2024. 7.6. The PRA was never informed of Project Rainbow or any concerns with Group or the Firm’s solvency. Further, the EMC Report was never shared. These only came to the PRA’s attention while reviewing internal Group and Firm emails as part of the PRA investigation. The PRA was not informed the Firm was below its SWD threshold on the basis of ‘freely available’ cash. Neither was the PRA informed the Firm’s runway for operating cash lasted only until 1 May 2024. Further, the Firm did not consult the PRA on its plan to rely on funds encumbered in payment scheme collateral accounts in a SWD process. These facts have only been discovered through the PRA’s investigation. 7.7. The Firm’s Annual Report and Financial Statements for the year ended 31 December 2023, filed 13 May 2025, reports CET1 for Year End 2023 of £26.686 million. The Firm had reported to the PRA, on 15 February 2024, CET1 for Year End 2023 of £31.347 million. The difference of £4.66 million was overwhelmingly attributable to the PS&D Fee erroneously recognised against Client A. The capital requirement for the Firm at this time was £20.2 million and thus, the Firm did have sufficient capital in January 2024. However, the freely available cash position was markedly different. Of the actual £26.686 million, £16.628 million had been loaned to Group through the undocumented Intercompany Receivable. Of the remaining £10 million, £8.5

Bank of England | Prudential Regulation Authority Page 33 million was encumbered as collateral. Additionally, in December 2023 Group made a second formal request for intercompany funding in the month, the Firm having already paid a £1.278 million invoice on behalf of Group earlier in the month. An email dated 19 December 2023 between then senior executives at the Firm noted: ‘funding request will deplete UK bank working capital (cash available to pay payroll and suppliers) to £3.2M at year-end.’ The decision was taken to approve the request and the Firm finished December 2023 without the available free cash to meet the SWD threshold of £4.45 million. 7.8. Group’s Annual Report and Financial Statements for the year ended 31 December 2023, filed 10 June 2025, report CET1 for Year End 2023 of -£1.957 million. Group had reported to the PRA, in February 2024, CET1 for Year End 2023 of £14.7 million. Consequently, at Year End 2023, not only was Group below TCR (£4.345 million), but it was also technically insolvent. The March 2024 Group accounts, shared with the PRA on 26 April 2024, stated a loss of £3.04 million in January 2024, a loss of £3.373 million in February 2024, and a loss of £2.389 million in March 2024. The £3 million injection received on 25 January 2024, correctly became CET1 in March 2024 when the Written Resolutions were completed. Therefore, the Group CET1 positions in Q1 2024 were; -£4.998 million in January 2024, -£8.371 million in February 2024, and -£7.76 million in March 2024. The April 2024 accounts, sent to the PRA on 22 May 2024, revealed a loss for April of £3.492 million, with capital injections of £6.621 million CET1. Therefore, the actual Group CET1 position in April 2024 was -£4.631 million. Consequently, from 1 January 2024 to 22 May 2024 (the end of the Relevant Period) Group was not only below TCR, but it was also technically insolvent. The accounts contemporaneously shared with the PRA concealed this. 7.9. The position at Group was known within Group and Firm. This is evidenced by the Firm’s decision paper for the Group Intercompany Funding Request in December 2023, dated 18 December 2023, and referred to previously. The decision to grant the request is recorded as follows: ‘Although this funding request depletes our working capital headroom to an uncomfortable level, as per previous funding requests, not funding would immediately render the

Bank of England | Prudential Regulation Authority Page 34 group insolvent, requiring either significant cost reduction or resulting in Group no longer being able to function in their capacity as primary future capital raiser. Both adverse outcomes would have a knock-on effect in rendering the UK bank non-viable.’ 8. Additional Capital Misreporting 8.1. The Firm recognised two capital injections, for £22 million and £540,000, as CET1 on 31 December 2021. These were both recognised in the 2021 financial statements as CET1 equity. However, the Firm only received the cash, for both injections, on 23 February 2022. Consequently, the injections were misreported; the Firm should have recognised the £22 million as CET1 only after receiving the cash on 23 February 2022, the directors’ resolutions having been completed prior to this date. The directors’ resolutions for the £540,000 injection were only completed on 10 November 2022. Therefore, the £540,000 should only have been recognised as CET1 after the directors’ resolutions were completed on 10 November 2022. This has been corrected within the comparative 2022 Statement of Changes in Equity in the 2023 Financial Statements. Finally, the PRA only received the PIN form for the £22 million capital injection on 7 June 2022. The PRA received the PIN form for the £540,000 capital injection on 20 January 2023. 8.2. The Firm recognised £2 million as CET1 on 31 March 2022. While the cash had been received, on 1 February 2022, the director’s resolutions were not completed until 10 November 2022. The PRA received the associated PIN form on 20 January 2023. Additionally, £5 million was recognised as CET1 on 3 August 2022, the date the Firm received the cash. However, the directors’ resolutions were not completed until 7 September 2022. The PRA received the associated PIN form on 14 September 2023. Consequently, both capital injections were misreported.

Bank of England | Prudential Regulation Authority Page 35 9. Remediation 9.1. Since the Relevant Period there has been a material change in ownership of the Firm and the Parent FHC, with new investors providing additional capital to seek to improve the Group’s financial position. 9.2. Following that change, efforts have been undertaken to address the failings identified in this Notice and remediate underlying issues. Most of the senior management team in place during the Relevant Period has been replaced. The new management team has sought to develop an improved approach to regulatory engagement. There has been investment in governance, risk management, processes and controls, including the engagement of third party advisers to assist with remediation activity.

Bank of England | Prudential Regulation Authority Page 36 ANNEX B: BREACHES AND FAILINGS

1. Breaches 1.1. During the Relevant Period, as a result of the facts and matters set out at Annex A to this Notice, the PRA has identified breaches of relevant requirements of the PRA’s Rulebook, namely: in respect of the Firm only, breaching: 1.1.1. PRA Fundamental Rule 1 (a firm must conduct its business with integrity); 1.1.2. PRA Fundamental Rule 3 (a firm must act in a prudent manner); 1.1.3. PRA Fundamental Rule 4 (a firm must at all times maintain adequate financial resources); 1.1.4. PRA Fundamental Rule 7 (a firm must deal with its regulators in an open and cooperative way and must disclose to the PRA appropriately anything relating to the firm of which the PRA would reasonably expect notice); 1.1.5. Chapter 3, Article 5 (requirement to report own funds on an individual basis), Reporting (CRR) Part of the PRA Rulebook; 1.1.6. Article 393 Capacity to Identify and Manage Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.7. Article 394 Reporting Requirements, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.8. Article 395 Limits to Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook; 1.1.9. Rule 2.3 of the Notifications Part of the PRA Rulebook; 1.1.10. Rule 2.1 of the Related Party Transaction Risk Part of the PRA Rulebook;

Bank of England | Prudential Regulation Authority Page 37 1.1.11. Rule 2.3 of the Related Party Transaction Risk Part of the PRA Rulebook; and in respect of the Firm and the Parent FHC, breaching: 1.1.12. Rule 7A of the Definition of Capital Part of the PRA Rulebook; and in respect of the Parent FHC only, breaching: 1.1.13. Chapter 3, Article 7 (requirement for reporting own funds on a consolidated basis), Reporting (CRR) Part of the PRA Rulebook. 1.2. These rules are included at Appendix 2. 2. Failings Fundamental Rule 1 2.1. During the Relevant Period, the Firm breached PRA Fundamental Rule 1 (A firm must conduct its business with integrity) for the following reasons: (a) The Firm informed the PRA £20.5 million had been injected into the Firm from Parent FHC in January 2023, such that the Firm met the £38 million minimum capital requirement (Authorisation Condition 8) to exit mobilisation. The Firm intentionally misled the PRA in this regard. (b) The Firm informed the PRA £1 million had been injected into the Firm from Parent FHC in January 2023, such that the Firm met the £38 million minimum capital requirement (Authorisation Condition 8) to exit mobilisation. The Firm intentionally misled the PRA in this regard. (c) The Firm provided the PRA with a falsified account statement purporting to show an injection of £1 million into the Firm in January 2023. (d) The Firm provided the PRA with a copy of emails, dated 27 January 2023, purporting to be instructions to the Firm’s lawyers, and their subsequent acknowledgement, to wire all funds held in the lawyer’s client account to the Firm’s bank account. These emails were falsified for the purpose of making the PRA believe the Firm had received the funds necessary to exit mobilisation.

Bank of England | Prudential Regulation Authority Page 38 (e) The Firm was required to provide the PRA with a report outlining the Firm’s capital history, including a timeline of capital injections, with verified data. The Firm produced the Capital History Report and delivered it to the PRA in November 2023. This report knowingly provided a false account of the Firm’s capital history. Specifically, the Capital History Report stated £20.5 million was injected into the Firm from Parent FHC in January 2023 such that the Firm had the necessary capital to exit Mobilisation. (f) Internally, the Firm categorised February 2023 as a period of ‘self￾mobilisation’. Further, the Firm recategorised its ‘Go Live’ date from 3 February 2023, as determined by the approval to exit mobilisation from the PRA, to whenever the Firm received the necessary capital injection from the Parent FHC. Consequently, the Firm satisfied itself it was not necessary to inform the PRA of having not received the capital necessary to satisfy Authorisation Condition 8. This was a deliberate attempt to justify not being open with the PRA and, as such, lacks integrity. (g) The Firm did not inform the PRA of having breached its freely available cash threshold to solvently wind down the Firm in December 2023, January 2024, February 2024, March 2024, April 2024 and May 2024. (h) The Firm did not inform the PRA of potential insolvency at Group in December 2023, January 2024, February 2024, March 2024, April 2024 and May 2024. This is despite Group being the sole capital raising entity for the Firm, providing critical technology and operational services for the Firm, and through the Intercompany Receivable, Group being a debtor to the Firm for an amount in excess of 50% of the Firm's Tier 1 Capital from December 2023 through to the end of the Relevant Period. Fundamental Rule 3 2.2. During the Relevant Period, the Firm breached PRA Fundamental Rule 3 (A firm must act in a prudent manner) for the following reasons: (a) The Firm included encumbered funds in assessing its current freely available cash resources against its solvent wind down threshold. By definition, encumbered assets are not ‘freely available’.

Bank of England | Prudential Regulation Authority Page 39 (b) The Firm did not demonstrate sound judgement, exercise sufficient caution, or take due account of all risks and possible consequences for the Firm before implementing and then subsequently increasing the Intercompany Receivable. (c) The Firm failed to appropriately identify, manage, monitor, report or record its exposure in respect of the Intercompany Receivable as a large exposure and, as such, exposed the Firm to financial and non-financial risks. (d) The large exposure was excessive during the Relevant Period and at times exceeded 50% of the Firm’s CET1 capital. The scale of the large exposure was inconsistent with the Firm’s responsibility to conduct its business in a prudent manner and had an adverse impact on the Firm’s financial resources. (e) The Firm failed to take reasonable steps to reduce the risks associated with the large exposure when it would have been appropriate and prudent to do so. The Firm was aware that it was breaching the PRA rules relating to large exposures and did not take adequate steps to address this. (f) The PRA had advised the Firm as to the importance of implementing an intercompany recharging mechanism. The Firm failed to do this in a timely way thereby failing to take an obvious and reasonable step to mitigate the financial and non-financial risks associated with the Intercompany Receivable. (g) The Firm failed to charge the Parent FHC interest on the Intercompany Receivable where it would have been appropriate and prudent to do so. (h) The Firm granted a request for additional funding from Group in December 2023, despite the Firm’s own analysis that granting the funding would leave Firm with just 3 months working capital runway and without the available free cash to meet the SWD threshold of £4.45 million. (i) The Firm inappropriately recognised £4.7 million as revenue in August 2023, distorting the appearance of the Firm’s financial resources. These funds were never received and were a factor in the Firm having only £1 million own-funds cash as of 17 January 2024.

Bank of England | Prudential Regulation Authority Page 40 Fundamental Rule 4 2.3. During the Relevant Period, the Firm breached PRA Fundamental Rule 4 (A firm must at all times maintain adequate financial resources) for the following reasons: (a) The Firm did not have the capital required to exit mobilisation on 3 February 2023. Of the necessary £21.5 million, £20.5 million cash was down-streamed from the Parent FHC to the Firm on 28 February 2023, with the shares allotted 1 March 2023, and not in January 2023 as the Firm advised the PRA at the time. Therefore, the Firm also did not meet minimum capital requirement at month-end February 2023, as the £20.5 million only became CET1 on 1 March 2023. Additionally, the £1 million injection to cover the January 2023 capital burn never took place. (b) Internally, the Firm categorised February 2023 as a period of ‘self￾mobilisation’. Further, the Firm re-categorised their ‘Go Live’ date from 3 February 2023, as determined by the approval to exit mobilisation from the PRA, to whenever the Firm received the necessary capital injection from the Parent FHC. The Firm demonstrably did not have adequate financial resources during this period of ‘self-mobilisation’. (c) The Firm had insufficient available free cash to meet the solvent wind down threshold in December 2023, January 2024, February 2024, March 2024, April 2024 and May 2024. (d) On 17 January 2024, the Firm had only £1.04 million own-funds cash available. This was insufficient to pay the Firm’s January payroll, scheduled for 31 January 2024. Fundamental Rule 7 2.4. During the Relevant Period, the Firm breached PRA Fundamental Rule 7 (A firm must deal with its regulators in an open and cooperative way, and must

Bank of England | Prudential Regulation Authority Page 41 disclose to the PRA appropriately anything relating to the firm of which the PRA would reasonably expect notice) for the following reasons: (a) The Firm did not inform the PRA of only receiving the £20.5 million cash, associated with the capital injection necessary to exit mobilisation, on 28 February 2023. (b) The Firm did not inform the PRA of the £20.5 million only becoming CET1, when the shares were allotted, on 1 March 2023. (c) The Firm did not inform the PRA of not receiving £1 million, agreed with the PRA in January 2023 as necessary to cover the January 2023 capital burn and to bring Firm’s capital above the £38 million necessary to exit mobilisation, until the Capital History Report, submitted on 30 November 2023. (d) The Capital History Report was misleading and wholly failed to address the PRA’s concerns in providing a comprehensive account with verified data of the capital history of the Firm. (e) The Firm did not inform the PRA in January 2024 of having, as of 17 January 2024, insufficient cash to cover bank operations beyond 7 days. (f) The Firm did not inform the PRA of having insufficient freely available cash to meet the threshold of own-funds required to solvently wind down the Firm. (g) The Firm did not inform the PRA of a potential insolvency at Group, the Firm’s sole capital raising entity and provider of critical technology and operational services. (h) The Firm failed to inform the PRA that it was applying an approach to its solvency wind down under which encumbered funds were treated as freely available cash. (i) The Firm did not inform the PRA of Project Rainbow and having established a crisis management team to prepare the Firm for an insolvency at Group.

Bank of England | Prudential Regulation Authority Page 42 (j) The Firm failed to be open and transparent with the PRA regarding Project Rainbow. Chapter 3, Article 5 of the Reporting (CRR) Part of the PRA Rulebook 2.5. During the Relevant Period, the Firm breached Chapter 3, Article 5 (requirement to report own funds on an individual basis), for the following reasons: (a) The Firm reported £22 million as CET1 in the Q4 2021 COREP return despite having received no such funds in this period. The funds were, in fact, received on 23 February 2022. (b) The Firm reported £540,000 as CET1 in the Q4 2021 COREP return despite having received no such funds in this period. The funds were, in fact, received on 23 February 2022. Further, the funds only became CET1 when the directors’ resolutions were completed on 10 November 2022. Article 393 of the Large Exposures (CRR) Part of the PRA Rulebook 2.6. During the Relevant Period, the Firm breached Article 393 (procedures and controls for identifying, managing, monitoring, reporting and recording all large exposures) because the Firm failed to appropriately identify, manage, monitor, report or record its exposure in respect of the Intercompany Receivable as a large exposure. Article 394 of the Large Exposures (CRR) Part of the PRA Rulebook 2.7. During the Relevant Period, the Firm breached Article 394 (report for each large exposure the exposure value) because the Firm fell short of the PRA’s expectations with regard to proactively reporting to the PRA the size of the Intercompany Receivable. Article 395 of the Large Exposures (CRR) Part of the PRA Rulebook 2.8. During the Relevant Period, the Firm breached Article 395 (An institution shall not incur an exposure to a non-financial institution which exceeds 25% of its

Bank of England | Prudential Regulation Authority Page 43 Tier 1 capital) because the Firm incurred an exposure to the Parent FHC, the value of which exceeded 25% of its Tier 1 capital. Rule 2.3 of the Notifications Part of the PRA Rulebook 2.9. During the Relevant Period, the Firm breached Rule 2.3 (A firm must give the PRA notice of any action which a firm proposes to take which would result in a material change in its capital adequacy or solvency) because the amount of the Intercompany Receivable by December 2023 exceeded 50% of the Firm’s Tier 1 capital. The Intercompany Receivable significantly depleted the Firm’s cash resources and had a material adverse impact on the Firm’s financial position. The Firm acknowledged its exposure to the Parent FHC was of such significance that, should Parent FHC default, the Firm would be required to execute a solvent wind-down. The Parent FHC’s capital and cash position during the Relevant Period was perilous and the Firm was aware of this. Rules 2.1 and 2.3 of the Related Party Transaction Risk Part of the PRA Rulebook 2.10. During the Relevant Period, the Firm breached Rule 2.1 (A firm must enter into transactions with related parties at market value or on terms no more favourable than would be agreed if the transaction was not with a related party) and 2.3 (A firm must establish, implement and maintain effective policies and procedures to identify, evaluate and manage risks arising out of transactions with its related parties) because the Firm did not charge the Parent FHC interest on the Intercompany Receivable and, as such, did not enter the transaction with this related party at market value. Further, the Firm did not have in place effective policies and procedures to identify, evaluate and manage risks arising out of the Intercompany Receivable. The governance and controls relating to the Intercompany Receivable were weak, and the Firm failed to address the large exposure which arose as a consequence of the related party transaction. Further, the Firm did not document the intercompany arrangement during the Relevant Period.

Bank of England | Prudential Regulation Authority Page 44 Rule 7A of the Definition of Capital Part of the PRA Rulebook 2.11. During the Relevant Period, the Firm and Parent FHC breached Rule 7A (notify the PRA with a PIN form at least one month ahead of issuing a capital instrument which it considers will qualify as Common Equity Tier 1 instruments) for the following reasons: (a) The Firm recognised a £22 million capital injection as CET1 on 31 December 2021. However, the Firm only sent the associated PIN form to the PRA on 7 June 2022. (b) The Firm recognised a £540,000 capital injection as CET1 on 31 December 2021. However, the Firm only sent the associated PIN form to the PRA on 20 January 2023. (c) The Firm recognised a £5 million capital injection as CET1 on 3 August 2022. However, the Firm only sent the associated PIN form to the PRA on 14 September 2022. (d) The Parent FHC recognised a £3 million capital injection as CET1 on 25 January 2024. However, the Firm only sent the associated PIN form to the PRA on 2 May 2024. (e) The Parent FHC recognised a £3 million capital injection as CET1 on 2 April 2024. However, the Firm only sent the associated PIN form to the PRA on 2 May 2024. (f) The Parent FHC recognised a £3 million capital injection as CET1 on 19 April 2024. However, the Firm only sent the associated PIN form to the PRA on 2 May 2024. (g) The Parent FHC recognised a £621,000 capital injection as CET1 on 19 April 2024. However, the Firm only sent the associated PIN form to the PRA on 2 May 2024.

Bank of England | Prudential Regulation Authority Page 45 Chapter 3, Article 7 of the Reporting (CRR) Part of the PRA Rulebook 2.12. During the Relevant Period, the Parent FHC breached Chapter 3, Article 7 (requirement to report own funds on a consolidated basis), for the following reasons: (a) The Parent FHC reported £6 million as CET1 in the Q4 2022 COREP return despite having received no such funds in this period. The funds were, in fact, received on 28 February 2023. (b) The Parent FHC reported £3 million as CET1 in the Q4 2023 COREP return despite having received no such funds in this period. The funds were, in fact, received on 25 January 2024. Further, the funds only became CET1 when the directors’ resolutions were completed on 4 March 2024. 3. Conclusion on failings 3.1. The PRA expects all firms, including new banks, to maintain adequate levels of regulatory capital. The PRA considers this central to the advancement of firms’ safety and soundness, and that of the UK’s wider financial system. To enable effective supervision of this aspect of firms’ businesses, the PRA places a reasonable reliance on them to provide accurate information about the amount and quality of capital they hold. Consequently, the PRA takes very seriously any instances where firms provide inaccurate information about their capital position. 3.2. Where firms knowingly misrepresent their true capital position this is considered a very serious breach of the PRA Rulebook. By repeatedly, and knowingly, providing the PRA with misleading information, including falsified documents, the PRA’s efforts to supervise the Firm and Parent FHC were deliberately frustrated and this undermined the PRA’s safety and soundness objective. 3.3. The Firm and Parent FHC had multiple opportunities to make the PRA aware of its true capital position, such as when they were asked to provide the Capital History Report. Not only did they fail to seize such opportunities, they

Bank of England | Prudential Regulation Authority Page 46 used them to reinforce earlier misrepresentations and further mislead the PRA. 3.4. The Firm did not have in place effective policies, systems and controls to monitor and manage its large exposures. Particularly concerning in this case is that the Firm was aware of the PRA’s rules in relation to large exposures and intentionally did not take the required steps to comply with them in respect of the Intercompany Receivable. Further, that the Intercompany Receivable increased at times during the Relevant Period to exceed 50% of the Firm’s capital, causing a reduction in the Firm’s financial resources. The PRA’s rules regarding large exposures are an important part of ensuring prudential risks at firms are appropriately controlled and the Firm fell short of the PRA’s expectations in this regard. 3.5. The failings are particularly serious as they were widespread, persisted throughout the Relevant Period and involved the Firm and Parent FHC acting at times intentionally and without integrity.

Bank of England | Prudential Regulation Authority Page 47 ANNEX C: SANCTION Entities on which the PRA may impose a financial penalty

1. The Firm is authorised by the PRA under Part 4A of the Act. Consequently, the PRA has the power, under section 206 of the Act, to impose on it a financial penalty for breaching PRA rules.
2. The Parent FHC owns 100% of the shares in the Firm, meaning it constitutes a “financial holding company” of a PRA-authorised firm, as defined in section 192O of the Act. Consequently, the PRA has the power, under section 192Y of the Act, to impose on the Parent FHC a financial penalty for breaching rules made under section 192XA of the Act.
3. The PRA has concluded that a single penalty calculation for all breaches by both entities is appropriate. PRA penalty policy
4. For the majority of the Relevant Period, the PRA’s policy on imposing a financial penalty was as set out in ‘The Prudential Regulation Authority's approach to enforcement: statutory statements of policy and procedure’, published September 2021 (the “Sep-21 Policy”). On 30 January 2024, the policy was updated. From that date up to and including the end of the Relevant Period, the relevant policy was as set out in ‘The Bank of England’s approach to enforcement: statements of policy and procedure’, published 30 January 2024 (the “Jan-24 Policy”), in particular: Annex 1, ‘The PRA’s approach to enforcement: statements of policy and procedure’.
5. The Jan-24 Policy states: ‘Where a breach spans two policies, two penalty calculations will be considered.’ Both policies apply a five-step framework to determine the appropriate level of financial penalty. Where the policies are distinct from one another at Step 2, separate calculations have been applied which have then apportioned accordingly with reference to the Relevant Period.

Bank of England | Prudential Regulation Authority Page 48 Step 1: Disgorgement 6. At Step 1 of both the Sep-21 Policy and Jan-24 Policy, the PRA seeks to deprive a person of any economic benefits derived from, or attributable to, the breach of its requirements, where it is practicable to ascertain and quantify them. 7. The PRA decided it was not practicable to ascertain and quantify such amounts in this case. 8. The Step 1 figure is therefore £0. Step 2: Seriousness of the breach Calculation under the Sep-21 Policy 9. At Step 2 under the Sep-21 Policy, the PRA determines a starting figure for a financial penalty having regard to the seriousness of the breach by the firm, including any threat it posed, or continues to pose, to the advancement of the PRA’s statutory objectives, and the size and financial position of the firm. The PRA would typically use a firm’s total revenue or the revenue of one or more business areas as a suitable indicator of its size and financial position to determine a starting figure. Where using revenue as a starting point, the relevant revenue is ordinarily the firm’s revenue during its last business year, that is, the financial year preceding the date when the breach ended (“Relevant Revenue”). 10. In this case, the breach period ended on 22 May 2024. Therefore, the PRA would ordinarily consider the Firm and Parent FHC’s revenue in the financial year to 31 December 2023 to constitute its Relevant Revenue. Where revenue is considered an appropriate indicator, the Sep-21 Policy provides that the PRA will apply an appropriate percentage rate (the “Seriousness Percentage”) to the Relevant Revenue to produce a figure at Step 2 which properly reflects the nature, extent, scale and gravity of the breaches. 11. The Firm’s Relevant Revenue was £3,718,000. The Parent FHC did not generate any Relevant Revenue. Therefore, the Firm and Parent FHC’s combined Relevant Revenue was £3,718,000.

Bank of England | Prudential Regulation Authority Page 49 12. The PRA has taken the following factors into account to determine the Seriousness Percentage: 12.1. The breaches set out in Annex A, in particular, the misreporting of capital and failure to maintain required levels of capital, had a significant potential effect on the advancement of the PRA’s statutory objective to promote the safety and soundness of firms. 12.2. The Firm was in breach before it had even exited mobilisation. Indeed, the Firm was only permitted to exit mobilisation because it had misled the PRA about its capital position. Thereafter, it committed several further breaches. 12.3. The conduct of the Firm and Parent FHC was egregious. As explained in Annex A, the Firm and Parent FHC misled the PRA including with regard to capital reporting and failed to be open and transparent with the PRA. In certain cases, the Firm acted without integrity and intentionally misled the PRA, thereby breaching Fundamental Rule 1. This is the first time the PRA has established a breach of Fundamental Rule 1. 12.4. The breaches persisted over the Relevant Period, in part due to systemic weaknesses in the Firm’s and in Parent FHC’s governance and internal controls. 12.5. As a Category 3 firm, the Firm had the capacity to cause minor disruption to the UK financial system. 13. The PRA has also had regard to the matters set out at Annexes A and B to this Notice. 14. Taking these factors into account, the PRA considers the seriousness of the conduct to be such that the appropriate Seriousness Percentage is 30%. The resulting Step 2 figure is therefore £1,115,400. Calculation under the Jan-24 Policy 15. Under the Jan-24 Policy: the PRA does not consider a firm’s revenue when identifying an appropriate starting figure at Step 2. Instead, it uses a matrix featuring a series of ranges, based on the firm’s size and the seriousness of its conduct to generate a Step 2 figure. Cases involving lack of integrity and/or failures to be open and transparent

Bank of England | Prudential Regulation Authority Page 50 with the regulator are serious and as such are regarded as Level 3 seriousness in the Jan 24 Policy. Having seen insufficient evidence to rebut this presumption, and having considered the factors discussed at paragraph 12 above, the PRA regards the Firm and Parent FHC’s conduct as Level 3 seriousness. 16. The Firm and Parent FHC were categorised as Category 3 throughout the Relevant Period. 17. Having considered all the facts, and having had regard to the applicable PRA penalty matrix as set out in the Jan-24 Policy, the PRA has determined the appropriate Step 2 figure is £20,000,000. Apportionment between the Sep-21 and Jan-24 Policies 18. The Sep-21 Policy was in force for 845 days of the Relevant Period. The Jan-24 Policy was in force for 114 days of the Relevant Period. Apportioning the two respective Step 2 figures above between these two time periods the PRA has determined the appropriate overall Step 2 figure is £3,381,552. Step 3: Adjustment for any aggravating, mitigating or other relevant factors 19. Both policies provide that the PRA may increase or decrease the Step 2 figure to take account of any factors which may aggravate or mitigate the breaches. Any such adjustments will normally be made by way of a percentage adjustment to the figure determined at Step 2. 20. The PRA considers that the following factors, among others, are relevant in determining whether such adjustment should be made: 20.1. Aggravating factors: 20.1.1. The Firm and Parent FHC failed to bring its misconduct to the PRA’s attention promptly. The misconduct first came to light due to supervisory probing, not because of any proactivity on the Firm and Parent FHC’s part.

Bank of England | Prudential Regulation Authority Page 51 The response of the Firm and Parent FHC to PRA supervisory intervention during the Relevant Period was thoroughly inadequate. 20.1.2. Moreover, during the initial stages of the investigation, prior to the change in ownership and management described in paragraph 2.4 above, on the occasions the Firm and Parent FHC did (reactively) inform the PRA of relevant misconduct, it did not always provide a comprehensive or accurate picture. 20.1.3. The Firm and Parent FHC’s initial co-operation during the investigation fell far short of regulatory expectations. On multiple occasions during the investigation, the Firm and Parent FHC provided late, incomplete and/or inaccurate information in response to the PRA’s Information Requirements (“IRs”) which it has subsequently had to correct. Responses to IRs were consistently late, incomplete and/or inaccurate. These errors were not corrected on the Firm and Parent FHC’s own initiative; rather they had been identified by the PRA. This delayed the investigation and the PRA had to expend resources in drafting clarificatory IRs and processing the subsequent responses. 20.1.4. The Firm and the Parent FHC had a clear disciplinary record prior to this enforcement action. However, this is not considered a mitigating factor in this case in particular given that it is evident (and as particularised in Annex A) serious breaches were committed around the point the Firm exited mobilisation and that these breaches continued during the Relevant Period. 20.2. Mitigating factors: 20.2.1. The PRA has observed an improvement in the Firm and Parent FHC’s co￾operation since investors committed to a series of significant capital injections in late 2024. The Firm has proactively shared documents including internally commissioned analysis. This has assisted the investigation. 20.2.2. Since late 2024, the Firm and Parent FHC have taken remediation steps. Among other things, it has replaced its senior management, invested

Bank of England | Prudential Regulation Authority Page 52 heavily in improved processes and controls and instructed a third-party to conduct a major governance review. While remedial action is to be properly expected of an authorised firm in these circumstances, the steps taken merit recognition as a mitigating factor in this case. 21. Having taken into account the above aggravating and mitigating factors, the PRA considers it is appropriate to increase the Step 2 figure by 20%. But for the recent co￾operation the Firm and Parent FHC has shown and remediation steps it has implemented, this figure would have been significantly higher. 22. The Step 3 figure is therefore £4,057,862. Step 4: Adjustment for deterrence 23. Both policies provide for the same approach at Step 4, namely that if the PRA considers the penalty determined following Steps 2 and 3 is insufficient effectively to deter the person who committed the breach and/or others who are subject to the PRA’s regulatory requirements from committing similar or other breaches, it may increase the penalty at Step 4 by making an appropriate adjustment for deterrence. 24. The PRA does not consider that the combined Step 3 figure of £4,057,862 represents a sufficient deterrent to the Firm and Parent FHC and others. It has therefore increased the penalty at Step 4 to £12,000,000. Step 5: Application of any applicable reductions for early settlement or serious financial hardship 25. Both of the PRA’s penalty policies provide for a reduction to the proposed penalty if a penalty would cause serious financial hardship to the firm on whom it is to be imposed. 26. The PRA is satisfied on the basis of the information provided to it that imposition of the proposed penalty at Step 4 above would cause the Firm and Parent FHC serious financial hardship. 27. The PRA therefore considers it is appropriate to reduce the penalty at Step 5 to £2,000,000.

Bank of England | Prudential Regulation Authority Page 53 28. Therefore, the Step 5 figure is £2,000,000.

Bank of England | Prudential Regulation Authority Page 54 ANNEX D: PROCEDURAL MATTERS

1. Decision maker 1.1. The settlement decision makers made the decision, which gave rise to the obligation to give this Final Notice. 1.2. This Final Notice is given under and in accordance with section 390 of the Act.
2. Manner and time for payment 2.1. The Firm and Parent FHC must pay the financial penalty in instalments as set out in the Settlement Agreement, with the final payment received by no later than 30 September 2027. 2.2. If any instalment is outstanding (whether in part or whole) on the day after it is due to be paid to the PRA, the PRA may recover the entire outstanding amount as a debt owed by the Firm and Parent FHC due to the PRA.
3. Publicity 3.1. Sections 391(4), 391(6A) and 391(7) of the Act apply to the publication of information about the matter to which this Final Notice relates. Under those provisions, the PRA must publish such information about the matter to which this Final Notice relates as the PRA considers appropriate. However, the PRA may not publish information if such publication would, in the opinion of the PRA, be unfair to the persons with respect to whom the action was taken or prejudicial to the safety and soundness of PRA-authorised persons.
4. PRA contacts 4.1. For more information concerning this matter generally, please contact Press Office (Press@BankofEngland.co.uk).

Bank of England | Prudential Regulation Authority Page 55 APPENDIX 1: DEFINITIONS The definitions below are used in this Notice:

1. “Act” means the Financial Services and Markets Act 2000 (as amended);
2. “Authorisation Conditions” means the requirements for the Firm to exit mobilisation as set out in the PRA’s letter of 7 October 2021;
3. “Bank Solvency Analysis” means the presentation shared within the Firm and Parent FHC on 20 January 2024;
4. “CRR” means the onshored UK version of the EU Capital Requirements Regulation (No 575/2013);
5. “CET1” means Common Equity Tier 1 Capital being paid-up capital, received from investors in exchange for common stock, and must be available for unrestricted and immediate use to cover risks or losses as soon as they occur. Conditions for capital instruments to be eligible as Common Equity Tier 1 are set out in Article 28 of the Capital Requirements Regulation (CRR);
6. “COREP” means common reporting of own funds;
7. “CRD IV Buffers” means the capital buffers as defined in the Capital Requirements Directive (CRD IV);
8. “EMC Report” means a report on the Firm’s own-funds runway, dated 22 February 2024;
9. “FCA” means the Financial Conduct Authority;
10. “Final Notice” means this final notice, together with its annexes and appendices;
11. “Firm” means The Bank of London Group Limited;
12. “Group” means The Bank of London Group Holdings Limited (now Oplyse Holdings Limited) and its wholly owned subsidiaries; The Bank of London Group Limited (the Firm), TBOL Inc. (a company incorporated in the US, focused on providing technology services to the Group), and TBOL (N.I.) Limited;
13. “Intercompany Receivable” means the balance of funds transferred between the Firm and Parent FHC;

Bank of England | Prudential Regulation Authority Page 56 14. “IRs” means Information Requirements issued by the PRA to the Firm and Parent FHC during the course of the PRA’s investigation; 15. “Jan-24 Policy” means the PRA’s policy on imposing financial penalties as set out in ‘The Bank of England’s approach to enforcement: statements of policy and procedure’, published 30 January 2024 and, in particular, Annex 1, ‘The PRA’s approach to enforcement: statements of policy and procedure’; 16. “MPR” means Mid-Point Review; 17. “Parent FHC” means The Bank of London Group Holdings Limited (now Oplyse Holdings Limited); 18. “PIN” means a pre-issuance notification form firms should submit to the PRA, ordinarily at least one month before the intended date of issue, before issuing or amending any capital instrument; 19. “PRA” means the Prudential Regulation Authority; 20. “PRA Buffer” (also known as “Pillar 2B”) means the firm-specific, regulatory capital the PRA expects banks to hold over and above TCR and CRD IV Buffers; 21. “PS&D” means the planning scoping and design services the Firm was to provide to Client A; 22. “PSM” means Periodic Summary Meeting; 23. “Relevant Period” means the period from 7 October 2021 to 22 May 2024 or parts thereof; 24. “Sep-21 Policy” means the PRA’s policy on imposing financial penalties as set out in ‘The Prudential Regulation Authority's approach to enforcement: statutory statements of policy and procedure’, published September 2021; 25. “SH01” means a return of allotment of shares form that limited UK companies are required to file with Companies House; 26. “SWD” means Solvent Wind Down; 27. “TCR” or “Total Capital Requirement” means the amount and quality of capital a financial institution must maintain to comply with its minimum capital requirements as required by the PRA; and

Bank of England | Prudential Regulation Authority Page 57 28. “UETR” means Unique End-to-End Transaction Reference.

Bank of England | Prudential Regulation Authority Page 58 APPENDIX 2: RELEVANT STATUTORY AND REGULATORY PROVISIONS The PRA’s objectives

1. The PRA has a general objective, set out in section 2B(2) of the Act, to promote the safety and soundness of PRA-authorised persons. Section 2B(3) of the Act provides that the PRA’s general objective is to be advanced primarily by: (a) seeking to ensure that the business of PRA-authorised persons is carried on in a way which avoids any adverse effect on the stability of the UK financial system; and (b) seeking to minimise the adverse effect that the failure of a PRA-authorised person could be expected to have on the stability of the UK financial system. Disciplinary powers
2. Section 206 of the Act provides that: ‘If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, it may impose on him a penalty, in respect of the contravention, of such amount as it considers appropriate’.
3. The Firm is an authorised person for the purposes of section 206 of the Act. Relevant requirements imposed on authorised persons include rules made under the PRA Rulebook, including the PRA’s Fundamental Rules.
4. Section 192Y of the Act provides that the PRA has power to impose penalty or issue censure where it is satisfied that a company which is or has been a financial holding company or a mixed financial holding company has contravened a requirement including the capital requirements regulation or an instrument made under that regulation.
5. Parent FHC is an approved financial holding company pursuant to Part 12B of the Act and as such section 192Y of the Act applies.

Bank of England | Prudential Regulation Authority Page 59 RELEVANT REGULATORY PROVISIONS 6. The relevant Fundamental Rules are as follows: (a) PRA Fundamental Rule 1 (a firm must conduct its business with integrity); (b) PRA Fundamental Rule 3 (a firm must act in a prudent manner); (c) PRA Fundamental Rule 4 (a firm must at all times maintain adequate financial resources); and (d) PRA Fundamental Rule 7 (a firm must deal with its regulators in an open and cooperative way and must disclose to the PRA appropriately anything relating to the firm of which the PRA would reasonably expect notice). 7. Article 393 Capacity to Identify and Manage Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook states: ‘An institution shall have sound administrative and accounting procedures and adequate internal control mechanisms for the purposes of identifying, managing, monitoring, reporting and recording all large exposures and subsequent changes to them, in accordance with this Part.’ 8. Article 394 Reporting Requirements, the Large Exposures (CRR) Part of the PRA Rulebook states: ‘Institutions shall report the following information to their competent authority for each large exposure that they hold, including large exposures exempted from the application of Article 395(1): (a) the identity of the client or the group of connected clients to which the institution has a large exposure; (b) the exposure value before taking into account the effect of the credit risk mitigation, where applicable; (c) where used, the type of funded or unfunded credit protection; (d) the exposure value, after taking into account the effect of the credit risk mitigation calculated for the purposes of Article 395(1), where applicable. Institutions that are subject to Chapter 3 of Title II of Part Three shall report their 20 largest exposures to their competent authority on a consolidated basis, excluding the exposures exempted from the application of Article 395(1).

Bank of England | Prudential Regulation Authority Page 60 Institutions shall also report exposures of a value greater than or equal to GBP 260 million but less than 10% of the institution's Tier 1 capital to their competent authority on a consolidated basis.’ 9. Article 395 Limits to Large Exposures, the Large Exposures (CRR) Part of the PRA Rulebook states: ‘An institution shall not incur an exposure, after taking into account the effect of the credit risk mitigation in accordance with Articles 399 to 403, to a client or group of connected clients the value of which exceeds 25% of its Tier 1 capital. Where that client is an institution or an investment firm or where a group of connected clients includes one or more institutions or investment firms, that value shall not exceed 25% of the institution's Tier 1 capital or GBP 130 million, whichever is higher, provided that the sum of exposure values, after taking into account the effect of the credit risk mitigation in accordance with Articles 399 to 403, to all connected clients that are not institutions does not exceed 25% of the institution's Tier 1 capital.’ 10. Rule 2.3 of the Notifications Part of the PRA Rulebook states: ‘A firm must give the PRA notice of: (1) any proposed restructuring, reorganisation or business expansion which could have a significant impact on the firm’s risk profile or resources, including, but not limited to: (a) setting up a new undertaking within a firm’s group, or a new branch (whether in the UK or not); (b) [deleted.] (c) commencing the provision of a new type of product or service (whether in the UK or not); (d) ceasing to undertake a regulated activity or ancillary activity, or significantly reducing the scope of such activities; (e) entering into, or significantly changing, a material outsourcing arrangement; (f) a substantial change or a series of changes in the governing body of an overseas firm; or

Bank of England | Prudential Regulation Authority Page 61 (g) any proposed change which limits the liability of any of the members or partners of a firm such as a general partner becoming a limited partner or re-registration as a limited liability company of a company incorporated with unlimited liability; (h) [deleted.] (2) any significant failure in the firm’s systems or controls, including those reported to the firm by the firm’s auditor; (3) any action which a firm proposes to take which would result in a material change in its capital adequacy or solvency, including, but not limited to: (a) any action which would result in a material change in the firm’s financial resources or financial resources requirement; (b) a material change resulting from the payment of a special or unusual dividend or the repayment of share capital or a subordinated loan; (c) [deleted] (d) significant trading or non-trading losses (whether recognised or unrecognised).’ 11. Rule 2.1 of the Related Party Transaction Risk Part of the PRA Rulebook states: ‘A firm must enter into transactions with related parties at market value or on terms no more favourable than would be agreed if the transaction was not with a related party.’ 12. Rule 2.3 of the Related Party Transaction Risk Part of the PRA Rulebook states: ‘A firm must establish, implement and maintain effective policies and procedures to identify, evaluate and manage risks arising out of transactions with its related parties.’ 13. Chapter 3, Article 5 (requirement to report own funds on an individual basis), Reporting (CRR) Part of the PRA Rulebook requires that in order to report information on own funds and on own funds requirements in accordance with point (a) of Article 430(1) of the Reporting (CRR) Part of the PRA Rulebook on an individual basis, institutions shall submit information as set out in paragraphs

Bank of England | Prudential Regulation Authority Page 62 2 to 15 of this Article with a quarterly frequency. Institutions shall submit information in accordance with paragraphs 2 to 15 of this Article. 14. Chapter 3, Article 7 (requirement for reporting own funds on a consolidated basis), Reporting (CRR) Part of the PRA Rulebook states: ‘In order to report information on own funds and own funds requirements in accordance with point (a) of Article 430(1) of the Reporting (CRR) Part on a consolidated basis, institutions shall submit: (a) the information specified in Articles 5 and 6 on a consolidated basis with the frequency specified therein; (b) the information specified in templates C 06.01 and C 06.02 of Annex I, in accordance with the instructions provided in point 2 of Part II of Annex II regarding entities included in the scope of consolidation, with a semi-annual frequency.’ RELEVANT POLICY Approach to the supervision of new banks 15. Overview of the PRA’s supervisory approach for new and growing banks | Prudential Regulation Authority Handbook & Rulebook sets out the PRA’s approach to supervising new and growing banks. 16. The PRA’s approach to banking supervision can be found here: The Prudential Regulation Authority’s approach to banking supervision Approach to enforcement 17. The Bank of England’s approach to enforcement: statements of policy and procedure November 2024 bankofengland.co.uk/-/media/boe/files/prudential￾regulation/publication/boe-approach-to-enforcement-sop-procedure.pdf 18. The Bank of England’s approach to enforcement: statements of policy and procedure January 2024 The Bank of England's approach to enforcement: statements of policy and procedure

Bank of England | Prudential Regulation Authority Page 63 19. Statement of Policy: The Prudential Regulation Authority's approach to enforcement: statutory statements of policy and procedure September 2021 (updating October 2019) The Prudential Regulation Authority's approach to enforcement: statutory statements of policy and procedure- superseded