Annual Financial Report

Victoria Mellor

Group Head of Marketing and Communications

Tel: + 44 20 7029 9074

Alex Dee

Head of Investor Relations

Tel: + 44 20 7050 7420

Liquidity risk

The risk that NEX will have insufficient funds to meet its obligations under ordinary and reasonably stressed conditions.

Nature of risk and appetite

This risk occurs within the BrokerTec US matched principal business, where it serves as a fully matched counterparty to offsetting positions entered into by clients of its electronic trading platform to facilitate anonymity and access to clearing and settlement.

In the course of using a central clearing house as well as a third-party clearing bank for the settlement of transactions, BrokerTec is required to post twice-daily short-term margin based on the size of executed but unsettled transactions and any adverse market moves. Without sufficient funds to meet its obligations, BrokerTec could be exposed to breach of contract claims, a reluctance of clients to continue using the platform, and an inability to continue as a member of the central clearing house.

The board's risk appetite provides for NEX to maintain access to sufficient funding to meet its obligations during ordinary and stressed market conditions.

Trend

This risk remains largely unchanged.

Certain developments have increased the risk somewhat, particularly that the clearing house (FICC) increased its margin requirement industry wide in response to more aggressive stress scenarios, and announced a change in methodology that will further increase requirements later this year. In addition, the beginning of the calendar year saw periods of significantly higher volatility compared with recent years. If those trends continue, increased business volumes and volatility have the potential to generate higher margin calls.

Other developments have helped reduce this risk. During this past year BrokerTec began operating under k(2)i exemption, which eliminates the obligation to lock up funds in connection with certain fails. The firm is also seeing its peak margin requirements starting to trend lower in response to some of its mitigation efforts, including encouraging more clients to net at FICC and the reduction of certain client limits.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- periodic reviews, including going concern assessments;

- membership in the clearing house netting group by additional BrokerTec clients;

- £350 million revolving credit facility, of which a $200 million swingline is available for same-day utilisation;

- contingency funding arrangements and procedures in place;

- daily monitoring and escalation to executive management and Group risk of funding requirements; and

- pro-active reduction of client trading limits where advisable due to near-term market conditions (e.g. during US Treasury auction extended duration when-issued settlement periods).

Counterparty credit risk

The risk of loss from the failure of a matched principal counterparty to settle its trades.

Nature of risk and appetite

This risk occurs within the BrokerTec US matched principal business, where it serves as a fully matched counterparty to offsetting positions entered into by clients of its electronic trading platform to facilitate anonymity and access to clearing and settlement.

Transactions with clearing house members are typically confirmed and novated shortly after execution, at which point the clearing house assumes the risk of settlement. For transactions with counterparties that are not members of the clearing house, however, settlement typically occurs on the day following execution and, prior to settlement, BrokerTec is exposed to the risk of loss in the event a counterparty fails to meet its obligations. If that were to occur, BrokerTec would have the right to cover or liquidate the open position, but could incur a loss as a result of market movements.

The board's risk appetite provides for the establishment and administration of counterparty credit limits and other risk management tools reasonably designed to avoid any significant credit loss.

Trend

This risk has remained relatively constant over the past year.

In lieu of collateral, NEX now receives letters of credit from certain of its counterparties from which it would benefit in the event of a credit event involving that counterparty.

The instruments that are the subject of settlement risk remain exclusively high-quality sovereign instruments, with a short-dated settlement cycle.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- membership in the clearing house netting group;

- establishment and administration of a board-approved credit limit matrix;

- enhancements to the credit risk system which improve underlying analytics and provide for real-time monitoring of client exposure levels;

- regular review of client financial position and trading activity, including ongoing discussion with client risk personnel and on-site visits;

- collection of client credit enhancement (e.g. letters of credit); and

- system-administered blocks on the entry of orders that would result in transactions in excess of notional limits.

Legal and regulatory risk

The risk of breaching regulatory requirements, general laws and/or contractual commitments.

Nature of risk and appetite

This risk generally applies to all NEX businesses, though in different ways. BrokerTec, TriOptima and NEX Exchange operate regulated introducing or trading platforms, and NEX Regulatory Reporting's reporting service is an approved reporting and publication entity. These businesses are subject to various types of regulations, including adherence to specific rules and standards, regulatory exams and inquiries, monitoring and surveillance, and creation and maintenance of required records. All NEX businesses utilise, to a significant degree, client contracts that set forth mutual obligations to be adhered to in the course of the provision of products and services. A breach of those obligations by NEX could result in damages, as well as harm to its reputation and loss of clients. In addition to the risks associated with existing NEX businesses, it may also

be exposed to legacy risks from the voice broking business sold to TP ICAP pursuant to indemnities and warranties agreed to as part of the sale.

The board's risk appetite provides for NEX to materially operate at all times in accordance with its legal, regulatory and contractual obligations.

Trend

This risk remains largely unchanged.

Over the past year, subsequent to the sale of the voice broking business (which the Group believes reduced its overall regulatory risk), the number of regulated entities, their volume of regulated activities and the staff members engaging in regulated activities have all remained relatively stable. The risk of breaching contractual commitments remains elevated, not because of a greater likelihood of breaches, but because of the consequences of a breach, as the business continues to assist its clients with satisfaction of their regulatory obligations.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- an internal legal and compliance department which acts as an independent advisory and investigation function to enable and defend the Group's strategic aims;

- utilisation of standard contracts for baseline services that have been reviewed by both the legal department and commercial management to properly allocate risks;

- regular advice from appropriately qualified external advisors and professionals;

- documented policies and procedures communicated to all relevant staff; and

- regular and ongoing staff training.

Information security risk

The risk of confidential client information being improperly shared or accessed.

Nature of risk and appetite

This risk generally applies to all NEX businesses. The NEX Markets business will routinely have access to information about the trading activity of its clients on its platforms, and the NEX Optimisation business provides a variety of services that necessitate access to its clients' trading, settlement, margining and risk activity. The failure to protect this information effectively could result in damages for breach of contract, breach of data protection requirements in certain jurisdictions and a loss of client trust.

The board's risk appetite provides for the Group to maintain robust policies, procedures and systems reasonably designed to protect the confidentiality of client information.

Trend

This risk has increased as the incidence of cyber security threats and attacks continues to increase in the financial sector and in the markets generally.

The risk is also likely to increase in light of two regulatory developments. One is the implementation of GDPR which increases both the obligations associated with protecting confidential information and the penalties associated with failing to do so. The other is the implementation of MiFID II, which took effect on 1 January 2018, and which requires specified new monitoring of the Group's EU-based EBS and BrokerTec trading platforms that will necessitate collection and proper handling of individual trader information.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- timely escalation and mitigation of risk events;

- information security breach monitoring;

- security incident response procedures, including regulatory notification, as appropriate;

- cyber security programme, including penetration testing;

- contractual liability limitations;

- restrictions on physical access to Company facilities; and

- staff training, awareness and accountability.

Business resiliency risk

The risk that key operating and control systems are unavailable.

Nature of risk and appetite

This risk applies to all NEX businesses.

Clients of NEX use the Group to provide essential execution and optimisation services and, as such, rely on the services being available and operating as intended. A failure to maintain this availability could result in disruption and loss for clients, as well as increase their interest in using competitor service providers. This is a particularly significant risk for NEX Markets' trading platforms which have established well-regarded levels of liquidity that encourage continued use, but could face difficulty replicating those same levels of liquidity if clients were to make a significant and sustained switch to alternative venues. Certain NEX Optimisation businesses also rely on the network effects of multiple participants using a service at the same time, so a service disruption that prompted client defections could also have a pronounced negative affect on certain of these businesses.

In certain instances, vendors provide critical services to NEX. Upstream difficulties encountered by these vendors could have a deleterious impact on business resiliency risk, with potential for the negative outcomes described above.

The board's risk appetite provides for the Group to maintain robust policies, procedures and systems reasonably designed to ensure the availability of key systems.

Trend

This risk has increased over the past year, as the incidence and complexity of cyber threats continues to increase, and to target not only the theft of information but also the disruption of the operations of market participants.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- dedicated 24/7 monitoring of system performance levels;

- enhanced product release and change management processes;

- security event monitoring and triggering of alarms;

- key vendor reviews;

- cyber security programme, including penetration testing;

- timely escalation and mitigation of risk events;

- provision of training and guidance;

- continuous technology investment;

- contractual liability limitations; and

- a documented and tested business recovery programme.

Cyber security risk

The risk that an external or internal party gains or exploits access to NEX electronic assets, with the intent of compromising and/or disseminating confidential data, impacting system operations or otherwise disrupting conduct of normal NEX business activities.

Nature of risk and appetite

This risk applies to all NEX businesses, although its potential impact may be more pronounced for NEX Markets, given the necessity for and client expectation of continuous, real-time, 24/5 system availability.

There are numerous means by which parties - internal as well as external - can attempt to infiltrate a technology environment and, if successful, the impact can manifest in a variety of manners and with varying degrees of disruption and severity. These risks can also manifest themselves through clients, vendors and any other parties with potential on-line or physical access into our technology, as any weakness of theirs can potentially be used as a gateway into our environment.

Cyber risk has previously been identified as a major potential source of risk to both Information Security and Business Resiliency, and that remains the case. However, it can also be a potential source of substantial risk for other areas of importance to the firm's operations, including liquidity needs and regulatory compliance, and is an area of considerable focus by senior management and board members. For these reasons, cyber security risk has this year been identified as a stand-alone principal risk.

The board's risk appetite provides for a highly effective cyber security risk prevention programme in order to minimise the likelihood and impact of any successful cyber interruption.

Trend

This risk has increased over the past year, as cyber security events are occurring more frequently and attacks are designed with greater complexity and sophistication, focused not only on the theft of information but also on disrupting the operations of market participants. In addition, certain of our businesses use or are considering using cloud-based services, which could alter the nature and source of our cyber security risk.

We also saw highlighted this past year the potential impact of security enhancements on operational performance. This was manifested in connection with security flaws associated with standardised industry chips, where certain remedial measures had the potential to negatively impact software performance, speed and latency, all of which are materially important to the operation of the firm's trading platforms. There is also a growing trend to introduce security flaws through the supplier chain by contaminating trusted software patches and updates.

NEX has a team of staff in place across the firm focused on prevention and mitigation activities. The firm's current federated governance model means controls can be applied differently and we are working to create greater consistency across the firm. This is an area of high focus for senior management across the enterprise with progress closely monitored by the Risk Committee.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- a clearly delineated set of policies, standards and procedures;

- a centralised, corporate group responsible for independent oversight and coordination of security protection efforts and responses to breaches;

- periodic reviews by independent consultants, including penetration testing and application testing;

- participation in industry-wide groups seeking to enhance the quality and rigour of collective cyber security efforts;

- aggressive and timely patching;

- monitoring of all incoming and outgoing data connections;

- multi-factor authentication; and

- staff training and awareness.

External change risk

The risk that NEX does not effectively respond to significant political and regulatory changes pertinent to its business.

Nature of risk and appetite

This risk applies to all NEX businesses.

NEX businesses are either themselves regulated, or serving financial institutions that are. As such, developments in the regulatory environment have the potential to significantly affect NEX business.

Over the past five years or so, the firm has needed to address substantial changes to the regulatory environment, most notably the implementation of the Dodd-Frank Act and MiFID II.

The board's risk appetite provides for sufficient resources and expertise to be allocated to the identification, analysis, monitoring and response to such changes.

Trend

This risk has decreased somewhat, as the potential regulatory changes on the horizon appear less impactful than those that needed to be addressed in recent years.

For example, MiFID II required major changes to certain of our businesses and the need for associated change management efforts, but the requirements are now in effect and we are operating on a business-as-usual basis.

Similarly, while the UK's vote to leave the European Union continues to create a number of uncertainties for the financial services sector, we have in the past year identified Amsterdam as a future operating location for our affected businesses. This new location will permit us to continue to conduct our business in a properly licensed manner following Brexit, and as such we do not currently anticipate a material impact from this change.

There are, however, upcoming changes which we are working to make sure we properly address. One is the implementation of GDPR, set to take effect in May 2018, which has required us to do a comprehensive review of our data privacy policies and processes and to put in place certain requirements specifically mandated by GDPR. While much of that work has been completed, additional work remains to ensure complete readiness and ongoing compliance.

Another pending change is the implementation of the Senior Managers and Certification Regime for certain of our UK businesses. While not expected to take effect until 2019, we anticipate reviewing and preparing our businesses and executives for these new requirements.

Lastly, in the US, while the bulk of regulatory change following the 2008 financial crisis has now occurred through the implementation of the Dodd-Frank Act, policymakers continue to consider potential reforms that could impact the firm. Certain government officials, for example, have called for further study of the evolving structure of the US Treasury market and whether its current regulation and infrastructure are appropriately designed. As a provider of one of the leading trading platforms for US Treasuries, any such changes could have an impact on the firm.

Mitigating controls

The Group seeks to mitigate and control this risk through the following:

- maintenance of internal and external regulatory affairs advisors to provide updates on regulatory developments and convey the Group's perspective on legislative and regulatory issues to policymakers;

- internal committees tasked with monitoring, analysing and implementing change necessitated by regulatory developments; and

- regular reporting and discussion of key and emerging risks at the board Risk Committee.

AcadiaSoft, Inc. (AcadiaSoft)

TriOptima has a service share agreement with AcadiaSoft, an associate company. During the year ended 31 March 2018, the Group recognised income of £4 million (2016/17: £1 million) in relation to this arrangement. As at 31 March 2018, the outstanding balance due from AcadiaSoft to the Group was £nil (2016/17: £nil).

BSN Holdings Limited and BSN Capital Partners Limited (BSN)

The Group provides BSN, an associate company, with office space and facility services and also has a preferred brokerage agreement with BSN. During the year ended 31 March 2018, the Group received income of £4 million (2016/17: £3 million) in relation to these arrangements. As at 31 March 2018, the outstanding balance due to the Group from BSN was £4 million (2016/17: £4 million).

Capital Shipbrokers Limited (Capital Shipbrokers)

The Group is responsible for the debtor management of Capital Shipbrokers, an associate company. As at 31 March 2018, the outstanding balance due from the Group to Capital Shipbrokers was £0.1 million (2016/17: £1 million).

CLS Aggregation Services LLC (CLSAS)

The Group re-charged CLSAS, an associate company, £1 million (2016/17: £3 million) as compensation for technical services during the year. As at 31 March 2018 the total outstanding balance due to the Group was £0.2 million (2016/17: £0.4 million).

Duco Technology Limited (Duco)

The Group provided Duco, an associate company, with convertible loans which converted to shares in Duco during the year. During the year ended 31 March 2018, the Group recognised finance income and a gain on conversion of these loans totalling £0.6 million (2016/17: £nil). Duco also provided the Group with reconciliation services totalling £0.3 million in the year (2016/17: £0.1 million). As at 31 March 2018, the outstanding balance due from Duco to the Group was £nil (2016/17: £1 million).

Exotix Holdings Limited, Exotix (1) Ltd, Exotix Partners LLP and Exotix Investment Partners LLP (Exotix)

As part of the disposal of Exotix to the Group headed by IPGL (a company controlled by Michael Spencer, the Group Chief Executive Officer) in 2007, the Group loaned employees of Exotix, £1.5 million to enable them to purchase a shareholding. During the year ended 31 March 2018, the Group provided Exotix with another loan for £0.5 million and the Group collected revenue of £nil (2016/17: £6 million) on behalf of Exotix. As at 31 March 2018, there was a balance due from Exotix to the Group of £2 million (2016/17: £1 million).

Howe Robinson Partners Pte. Limited (Howe Robinson)

The Group collects revenue for Howe Robinson, an associate company. The Group received £1 million during the year (2016/17: £2 million). The Group also provides Howe Robinson with a loan. As at 31 March 2018, the outstanding balance due from Howe Robinson to the Group was £3 million (2016/17: £1 million).

Research Exchange Limited (RSRCHX)

The Group provided RSRCHX with a convertible loan in the year ended 31 March 2018. As at 31 March 2018, the outstanding balance due from RSRCHX to the Group was £2 million (2016/17: £nil).