▪ Credit rating changes and impact on funding costs: any reductions in a credit rating (in particular, any downgrade below investment grade) may
affect the Barclays Bank Group’s access to money or capital markets and/or the terms on which the Barclays Bank Group is able to obtain market
funding (for example, this could lead to increased costs of funding and wider credit spreads, the triggering of additional collateral or other
requirements in derivative contracts and other secured funding arrangements, or limits on the range of counterparties who are willing to enter into
transactions with the Barclays Bank Group).
c) Interest rate risk in the banking book
Interest rate risk in the banking book is the risk that the Barclays Bank Group is exposed to capital or income volatility because of a mismatch between
the interest rate exposures of its (non-traded) assets and liabilities. The Barclays Bank Group’s hedging programmes for interest rate risk in the banking
book rely on behavioural assumptions and, as a result, the effectiveness of the hedging strategy cannot be guaranteed. A potential mismatch in the
balance or duration of the hedging assumptions could lead to earnings deterioration if there are interest rate movements which are not adequately
hedged. A decline in interest rates may also compress net interest margin on retail and corporate portfolios. In addition, the Barclays Bank Group’s liquid
asset portfolio is exposed to potential capital and/or income volatility due to movements in market rates and prices which may have a material adverse
effect on the capital position of the Barclays Bank Group.
For further details on the Barclays Bank Group’s approach to treasury and capital risk, refer to the treasury and capital risk management and treasury
and capital risk performance sections.
v) Operational risk
Operational risk is the risk of loss to the Group from inadequate or failed processes or systems, human factors or due to external events where the root
cause is not due to credit or market risks. Examples include:
a) Operational resilience
The Group functions in a highly competitive market, with customers and clients that expect consistent and smooth business processes. The loss of or
disruption to business processing is a material inherent risk within the Group and across the financial services industry, whether arising through failures
in the Group’s technology systems, cyber and/or data integrity disruptions, unavailability of a Group site, closure of real estate services provided
through its retail branch network, or unavailability of personnel or services supplied by third parties, and there are particular challenges with recovering
from a major cyberattack. Failure to build resilience and recovery capabilities into business processes, or into the services on which the Group’s business
processes depend, may result in significant customer detriment, costs to reimburse losses incurred by the Group’s customers and clients, and
reputational damage.
b) Cyberattacks
Cyberattacks continue to be a global threat inherent across all industries, with the number and severity of attacks continuing to rise. The financial sector
remains a primary target for cybercriminals, hostile nation states, opportunists and hacktivists. The Group, like other financial institutions, experiences
numerous attempts to compromise its cybersecurity protections. In 2023, cybersecurity incidents experienced by Barclays included distributed denial of
service (DDoS), phishing, credential stuffing, and exploitation of software vulnerabilities.
The Group cannot provide absolute security against cyberattacks. Malicious actors, who are increasingly sophisticated in their methods, tactics,
techniques and procedures, seek to steal money, gain unauthorised access to, destroy or manipulate data, and disrupt operations. Further, some of their
attacks may not be recognised or discovered until launched or after initial entry into the environment, such as novel or zero-day attacks that are
launched before patches are available and defences can be readied. Other attacks may take advantage of the window during which patching or the
deployment of other defences is underway, but not yet complete. Malicious actors are also increasingly developing methods to avoid prevention,
detection and alerting capabilities, including employing counter-forensic tactics making response activities more difficult. Cyberattacks can originate
from a wide variety of sources and target the Group in numerous ways, including attacks on networks, systems, applications or devices used by the
Group or parties such as service providers and other suppliers, counterparties, employees, contractors, customers or clients, presenting the Group with
a vast and complex defence perimeter. Moreover, the Group does not have direct control over the cybersecurity of the systems of its clients, customers,
counterparties and third party service providers and suppliers, limiting the Group’s ability to effectively protect and defend against certain threats. Some
of the Group’s third party service providers and suppliers have experienced successful attempts to compromise their cybersecurity. These have included
ransomware attacks that have disrupted the service providers’ or suppliers’ operations and, in some cases, have had impacts on the Group's operations.
Such cyberattacks are likely to continue.
A failure in the Group’s adherence to its cybersecurity policies, procedures or controls, employee malfeasance, and human, governance or technological
error could also compromise the Group’s ability to successfully prevent and defend against cyberattacks. Furthermore, certain legacy technologies that
are at or approaching end-of-life may not be able to maintain acceptable levels of security. The Group has experienced cybersecurity incidents and
near-misses in the past, and it is inevitable that additional incidents will occur in the future. Cybersecurity risks are expected to increase, due to factors
such as the increasing demand across the industry and customer expectations for continued expansion of services delivered over the Internet;
increasing reliance on Internet-based products, applications and data storage; the onset of AI, which may be used to facilitate increasingly sophisticated
attacks; and changes in ways of working by the Group’s employees, contractors, and third party service providers and suppliers and their
subcontractors as a long-term consequence of the COVID-19 pandemic. Bad actors have taken advantage of remote working practices and modified
customer behaviours, exploiting the situation in novel ways that may elude defences. Additionally, geopolitical turmoil may serve to increase the risk of
a cyberattack that could impact Barclays directly, or indirectly through its critical suppliers or national infrastructure. In recent years, the Group has
faced a heightened risk of cyberattack as a result of the conflicts in Eastern Europe and the Middle East.
Common types of cyberattacks include deployment of malware to obtain covert access to systems and data; ransomware attacks that render systems
and data unavailable through encryption and attempts to leverage business interruption or stolen data for extortion; novel or zero-day exploits; denial of
service and distributed denial of service attacks; infiltration via business email compromise; social engineering, including phishing, vishing and smishing;
automated attacks using botnets; third party customer, vendor, service provider and supplier account takeover; malicious activity facilitated by an
insider; and credential validation or stuffing attacks using login and password pairs from unrelated breaches. A successful cyberattack of any type has
the potential to cause serious harm to the Group or its clients and customers, including exposure to potential contractual liability, claims, litigation,
regulatory or other government action, loss of existing or potential customers, damage to the Group’s brand and reputation, and other financial loss.
The impact of a successful cyberattack is also likely to include operational consequences (such as unavailability of services, networks, systems, devices
or data), remediation of which could come at significant cost.
