Business Continuity Statement

When resilience matters more than speed. Built for good times and bad.

This statement explains how The NeoBankers Group Limited (the “Company”) prepares for, responds to and recovers from a significant disruption, so that it can keep its obligations to regulators, counterparties, partners and the people whose data it holds.

1. Scope

This statement applies to the Company. Neo Bankers sp. z o.o. is a separate legal entity that carries on its own business independently, under its own management and Polish law. The Company holds a shareholding in it and does not direct its operational, business or commercial activities. It maintains its own arrangements.

2. Legal and regulatory basis

• UK GDPR, Article 5(1)(f) and Article 32(1)(b)–(d): the confidentiality, integrity, availability and resilience of systems, the ability to restore access to personal data in a timely manner after an incident, and regular testing of those measures;
• UK GDPR, Articles 33 and 34: notification of personal data breaches;
• Companies Act 2006, sections 386–388 and the provisions on statutory registers: keeping accounting records and registers and preserving them for the required periods;
• the Company’s contracts with partners, suppliers and counterparties.

The Company is not authorised or regulated by the FCA or the PRA, and the operational-resilience rules for regulated firms do not apply to it. It nevertheless draws on their principles — identifying what matters most, setting tolerances for disruption and testing against severe but plausible scenarios — and on the structure of ISO 22301. It does not claim certification to that standard.

3. Responsibility

The Board is responsible for this statement and approves the Company’s recovery priorities. The Executive Committee maintains the arrangements day to day. Every person working for the Company knows how to report an incident and whom to tell.

4. What the Company protects first

1. Statutory records and registers, and the Company’s corporate documents.
2. Its intellectual property: source code, protocols, designs, documentation and trade-mark records.
3. Personal data entrusted to it.
4. Its ability to answer regulators, counterparties, partners and data subjects through the forms on this website.
5. This website and its official channels, as the place where genuine information is published.

5. Arrangements

• Backups — data and records are backed up, encrypted and held in more than one location; restoration is tested.
• Access — multi-factor authentication and least privilege, as set out in the Information Security Statement.
• Alternative working — the Company’s people can work from other locations without loss of access or security.
• Suppliers — critical suppliers are identified, and are expected to maintain their own continuity arrangements under the Supplier Code of Conduct.
• Recovery objectives — for each critical activity the Board sets how long a disruption can be tolerated and how much data may be lost, and the arrangements are designed to meet those limits.

6. When something goes wrong

The Company follows five steps: detect, contain, assess, recover, learn. Where an incident is a personal data breach, the Company notifies the Information Commissioner’s Office within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals, and informs the people affected without undue delay where the risk to them is high. Counterparties and partners are told where the law or a contract requires it.

7. Testing and review

The arrangements are tested at least once a year, including a restoration test and an exercise against a severe but plausible scenario. Results and lessons are recorded and reported to the Board. This statement is reviewed every year and after any significant incident.

8. What this means for you

• During a disruption, replies to forms may take longer than the times stated in Enquiry channels.
• Any change to how the Group can be reached is announced in Statements and nowhere else.
• The Group will never use a disruption as a reason to ask you to use a different channel, pay into a different account or change bank details. A message that does so is fraudulent — see Official channels.