Guildwell maintains a risk management framework designed to identify, assess and manage the financial, operational, regulatory and third-party risks arising from its activities.
Risk is assessed according to the legal entity, service, transaction, jurisdiction and operating model involved.
Each regulated entity remains responsible for the risks and obligations arising from its own activities.
Risk management
Guildwell applies a documented risk-based approach across its operations.
Relevant risks may include:
- regulatory and compliance risk
- operational risk
- payment and settlement risk
- safeguarding risk
- cybersecurity and technology risk
- liquidity and market-related risk
- data and recordkeeping risk
- conflicts of interest
- third-party and outsourcing risk
Material changes to products, services, providers or operating models are assessed before implementation where required.
The purpose of this framework is not to eliminate all risk, but to ensure that risks are understood, controlled and kept within the limits appropriate to the relevant entity and activity.
Regulatory perimeter
A core part of risk management is ensuring that activities remain within the permissions, registrations and operating boundaries applicable to the entity providing the service.
A product or service is not treated as authorised simply because another Guildwell entity is permitted to provide a similar activity.
New or materially changed activities are subject to appropriate review before launch, including regulatory, operational and control considerations where applicable.
Third-party oversight
Guildwell relies on external financial institutions, technology providers and specialist service providers as part of its operating model.
Material providers are subject to proportionate due diligence and ongoing oversight.
Assessment may consider factors such as:
- regulatory status where relevant
- financial and operational resilience
- security and data protection
- service quality and reliability
- contractual protections
- business continuity
- concentration and dependency risk
- ability to support applicable regulatory obligations
The level of oversight reflects the importance and risk of the service being provided.
Outsourcing does not transfer responsibility
Where Guildwell outsources a function or relies on shared Group infrastructure, the responsible entity retains accountability for the obligations that remain applicable to it.
Outsourcing does not remove responsibility for areas such as client protection, safeguarding, compliance, records, risk management or regulatory reporting.
The same principle applies where services are supported by affiliates or shared personnel.
Concentration and dependency risk
Guildwell assesses the risks created by reliance on material providers and infrastructure.
Where a dependency is considered significant, the Group may apply additional controls, alternatives or contingency arrangements appropriate to that dependency.
Material service failures, control concerns or changes in a provider's circumstances may trigger reassessment of the relationship.
Provider transition and contingency
For material or critical dependencies, Guildwell maintains proportionate arrangements for continuity, transition or replacement where continued reliance on a provider is no longer appropriate.
These arrangements are intended to support continuity of service, preservation of records and data, client protection and applicable regulatory obligations during a transition.
Detailed provider contingency and exit procedures are maintained internally.
Governance and monitoring
Material risks, provider dependencies and control issues are monitored through the relevant governance framework.
Significant matters are escalated according to their nature and impact, and remediation is tracked where required.
The Board of the responsible regulated entity retains ultimate oversight of the risk framework applicable to its activities.