Information Technology & Corporate Reporting Policy

Purpose

The Information Technology & Corporate Reporting Policy sets out how the Group governs, manages and secures its technology platforms, digital channels, information assets and corporate reporting processes. The Policy supports secure operations, reliable reporting, stakeholder data protection, regulatory compliance and integrated financial and non-financial disclosure.

Scope

The Policy applies to the Group’s technology systems, infrastructure, applications, digital channels, data and corporate reporting processes. It covers employees, contractors, consultants, third-party service providers, subsidiaries, operating entities and other parties interacting with the Group’s technology or reporting environment.

Framework

1. Technology Governance: The Group maintains Board and management oversight of technology strategy, cybersecurity, technology risk, digital transformation, policies, platforms and risk-aligned investment.
2. Technology Adoption, Architecture and Operations: Technology is adopted and managed through architecture review, risk assessment, compliance validation, change management, project governance, secure software development, service management and data governance.
3. Cybersecurity: The Group maintains a cybersecurity framework aligned with internationally recognised standards, including ISO/IEC 27001:2022, covering access management, monitoring, incident response, vulnerability management, cryptographic controls, third-party oversight and employee awareness.
4. Technology Risk and Resilience: Technology risks are managed within the enterprise risk framework and aligned to recognised risk and resilience standards, including mitigation, escalation, business continuity, disaster recovery and resilience testing.
5. Corporate Reporting and Data Integrity: Corporate reporting is supported by validated data sources, reconciliation controls and approved disclosure processes to enable timely, balanced and reliable financial and non-financial disclosure.

Roles & Responsibilities

Board of Directors: Provides oversight of technology governance, cybersecurity, technology risk, resilience, investment and corporate reporting reliability, ensuring alignment with strategy, risk appetite and regulatory obligations.

Management: Manages technology operations, cybersecurity controls, data governance, system resilience, service performance, incident response, reporting processes and third-party technology risks, while escalating material matters through appropriate governance channels.

Why It Matters

• Supports secure, resilient and reliable digital banking operations.
• Strengthens data integrity for operational, regulatory and corporate reporting.
• Enhances cybersecurity, technology risk management and resilience.
• Promotes transparency, accountability and informed Board oversight.
• Protects customers, stakeholders and the Group from technology, cyber, reporting and continuity risks.