��ݮ��Ƶ

^{MIFIDPRU 8 Disclosure��as of 30th June 2025}

1. Introduction

The Investment Firms Prudential Regime (“IFPR”) sets out requirements for investment firms to disclose additional information relating to their risk management approach, capital adequacy, remuneration practices and governance. This information (“MIFIDPRU disclosures”) provides an overview of Upvest Securities Ltd (“Upvest or the Firm”)’s position as at the 30th of June 2025.��

The Firm is classified under MIFIDPRU as a Non-SNI¹firm and is subject to the following standard disclosure requirements:

• Risk management objectives, policies and processes for managing material risks identified through the course of assessing Upvest’s own fund requirements (MIFIDPRU 4), concentration risk (MIFIDPRU 5) and liquidity (MIFIDPRU 6);
• Internal governance arrangements;
• Own Funds and Own Funds Requirements, including its K-Factor and Fixed Overheads Requirements; and
• The key characteristics of the Firm’s remuneration policy and practices.

1.2. Frequency of Disclosure

This disclosure has been published on an interim basis as at the 30th of June 2025 and is subject to an annual review and publication on the date the Firm publishes its annual financial statements. Upvest will reassess the need to publish some or all disclosures more frequently than annually in light of any significant changes to its business including disclosure requirements in relation to capital resources and

1.3. Upvest Background��

Upvest is a financial infrastructure provider registered in the United Kingdom with reference 15494796 and is authorised and regulated by the Financial Conduct Authority (“FCA”) under FRN 1013984.��

Upvest serves as a bridge between enterprise and fintech clients such as neo banks, neo brokers and digital wealth managers (“institutional clients”) and retail clients (“end-users” or “clients”) as well as execution venues. The Firm’s Investment API enables institutional clients to provide investment services to end-users. Its goal is to provide investment products across various asset classes (such as mutual funds, exchange traded funds or stocks) to innovative and sustainable market participants. Precisely, the Investment API enables institutional clients to easily access various asset classes and integrate them into their own product platform.

Upvest provides execution, settlement and custody services to its clients. The Firm offers two operating models to the financial services market in the UK:

1. Bring Your Own License (BYOL): Upvest is contracted directly with the institutional clients only, who operate under their own regulatory licenses;
2. Take Our License (TOL): Upvest contracts directly with the institutional client and the end users who are typically categorised as “Retail clients”.

These disclosures were approved for publication by the Firm’s Board (the Board) on the 1st of October 2025. The Board has verified that the disclosures are consistent with the Firm’s formal policies and are satisfied with the adequacy and effectiveness of the governance and risk management arrangements.

The annual reports and accounts of Upvest can be found .

2. Risk Management Objectives and Policies

2.1. Risk management framework��

The Firm’s Board has ultimate responsibility for the implementation and maintenance of internal control and risk management. The Firm’s Risk Management function ensures that risks are identified, assessed, and managed in alignment with business objectives, achieving an optimal balance between risk and reward. Recognising that risk is inherent to the Firm’s operations, the Firm has adopted a robust Three Lines of Defence (LoD) model with clearly defined roles and responsibilities:��

• First Line of Defence: Management and staff take ownership of risks in their operational areas, establishing controls within the Firm’s risk appetite and ensuring timely escalation of issues;
• Second Line of Defence: Functions such as Risk and Compliance provide oversight, guidance, and challenge to the First Line. The Risk Function monitors controls, advises the Board, and ensures regulatory requirements are met;
• Third Line of Defence: Internal Audit provides independent assurance on the design and effectiveness of controls, reporting directly to the Board.

2.2. Risk management approach

The Firm maintains a strong risk culture supported by an oversight structure and internal controls, ensuring:

• Risk strategy and culture: The Board defines the Firm’s risk strategy, ensuring alignment with business objectives, strategic plans, and risk appetite. The Firm expects every employee to act like a risk manager consistent with the risk management standards, organisation’s values and applicable laws;
• Thorough risk identification and assessment: All business lines regularly assess existing and emerging risks, including those inherent in products and arising from environmental changes. This process informs the Internal Capital Adequacy Risk Assessment (“ICARA”), which is an ongoing assessment of the harms to the clients and to the firm and the sufficiency of resources to support strategic plans;
• Internal controls: Each risk identified is logged internally. All risks are assessed on its inherent impact and likelihood and then scored on an inherent risk basis using an impact and likelihood matrix. The controls in place to mitigate the risks are then identified and logged. The controls are assessed for design and operational effectiveness. The risk is then scored on a residual basis, taking into account the effectiveness of the relevant key controls. If any controls are identified as not being fully effective or any risks are not mitigated to within the Firm’s risk appetite, a finding is recorded and an action plan is put in place to address the relevant risk or control;
• Monitoring and reporting: Risk limits are monitored through structured reporting, with emerging and actual risk positions assessed against targets. The Risk Function provides ongoing challenge and guidance to the Senior Management and the Board;
• Policies and procedures: Formal policies govern the Firm’s material risks, setting minimum control standards, escalation points, and establishing mitigation measures, including due diligence processes and approval authorities.
• Regulatory compliance: The Board and Risk Function ensure adherence to all legal and regulatory requirements, including capital adequacy, with detailed updates provided to the Board at least annually.

2.3. Risk Governance and Oversight

The Firm’s governance framework is supported by multiple layers of oversight and regular reporting:

• The regulatory committees (comprising CASS and Risk and Compliance) meet on a monthly basis with the Board meeting on a quarterly basis, ensuring that emerging risks are identified & discussed, regulatory obligations are met and client asset protections remain robust. The Committee also provides a mechanism for escalation and discussion of material issues, thereby reinforcing accountability and supporting effective decision-making;
• The Risk team reports to management on a quarterly basis, covering the overall risk profile, key limits and capital position, ensuring timely identification and effective management of risks;
• An annual report is produced and submitted to the Board including compliance with CASS 10, Compliance and MLRO regulations
• Risk Appetite Statement is reviewed and approved by the Board on an annual basis, setting clear parameters for the Firm’s risk-taking activities. ● The Firm has clearly documented policies and procedures, which are designed to minimise risks to the Firm and all staff are required to confirm that they have read and understood them.

2.4. Key Risks

The risk taxonomy sets out the key risks to which the Firm is exposed which in summary are defined as:

2.5. Statement of Risk Appetite and Methodology

Risk Appetite Statement��

The Firm’s overall risk appetite is moderately cautious. The Firm is willing to accept or tolerate a degree of risk. The Firm’s Directors’ focus is on activities where risks to clients and the Firm are controllable to a large extent.��

The Firm is focused on achieving a solid recurring income from providing investment products for different asset classes to B2B(2C) clients which will enable it to ��ݮ��Ƶ capital reserves as the Firm considers client satisfaction and regulatory compliance to be its main business considerations.��

The Firm is averse to risks which pose a significant or systemic risk to its objectives (e.g. lack of resource, undesirable business models, regulatory enforcement action).��

The Firm does have an appetite for taking well managed risks where innovation and change create opportunities for discernible benefits and clear improvement to clients and end-users.

The risk appetite statement will be reviewed and approved by the Board on an annual basis.

Harm Scoring Methodology��

The Firm has a Harm Scoring Methodology for the assessment of the various harms that it has identified. These harms are internally evaluated by the Risk team, in terms of their probability of occurrence and their aggregate financial impact on the Firm based on a five-level scoring matrix and after taking due account of management actions and the implementation of mitigating controls.��

These harms are then categorised into 4 categories of severity, being Low, Moderate, High or Critical. The scoring of each harm represents the residual score after accounting for the imposition of additional controls and/or management actions.��

Scoring harms for Impact and Probability leads to a 5 x 5 matrix (consequence score is matched with likelihood) which can be converted in the following:

Risk Severity Rating

Review and Approval

The Risk Function leads an annual review of the Firm’s risk appetite, assessing the continued appropriateness of key measures and tolerances relative to the risk exposures of the Firm.��

Additionally, as part of the annual budgeting and forecasting cycle, assessment is made of the level of risk taking proposed in the business plan and the capacity for risk taking within the overall appetite framework.��

The Firm’s risk appetite is approved by the Board on the recommendation of the Risk Function. The regular management information received by the Board and Risk Function includes a risk appetite dashboard setting out actual positions relative to the key targets and the limits set in the risk appetite.

2.6. ICARA

The Internal Capital Adequacy And Risk Assessment (“ICARA”) is a process of ongoing identification, monitoring and mitigation of the harms that a firm may pose to itself, its clients and the markets it operates in from both its ongoing business operations and those that may arise from winding down its business. It is also intended to identify the amounts and spread of types of capital and liquid assets considered adequate to cover unmitigated harms that may arise.��

The ICARA is used within the business to support decision-making processes, identify potential risk exposures and implement appropriate mitigants.

2.7. Own funds requirements��

In determining the own funds requirement, the Firm has identified, assessed, and presented mitigations against those risks to which it is exposed. This is done as part of the ICARA process where potential harm to clients and the firm is considered.��

2.8. Concentration risk��

In line with MIFIDPRU 5.2, the firm recognizes that concentration risk arises from a variety of sources, not limited to trading activities. The Firm therefore monitors, manages and mitigates concentration risk across all exposures, including cash deposits, third-party counterparties and clients’ revenue. The Firm maintains robust procedures and governance arrangements to ensure concentration risks are appropriately managed within its risk appetite.

2.9. Liquidity

As per MIFIDPRU 6.2.1R, a firm must hold an amount of core liquid assets equal to the sum of:

• one-third of the amount of its fixed overhead requirement; and
• 1.6% of the total amount of any guarantees provided to clients.

As per MIFIDPRU 4.5, the fixed overheads requirement (FOR) of a MIFIDPRU investment firm is equal to one quarter of the firm’s relevant expenditure during the preceding year. However, under MIFIDPRU 4.5.7R, where projected relevant expenditure for the current year increases by 30% or more compared to the preceding year, the FOR must instead be calculated using the higher projected expenditure. The Firm’s projected relevant expenditure for the current year is £2.74m, which represents an increase of more than 30% compared to the preceding year’s expenditure of £919k.��

The Firm has not provided any guarantees to clients. Therefore, the basic liquid assets requirement is equal to one third of the fixed overhead requirement, resulting in a requirement of £229k.��

The Firm’s basic liquid assets requirement provides a minimum level of core liquid assets that the firm must maintain at all times. The purpose of the basic liquid assets requirement is to ensure that the Firm always has a minimum stock of liquid assets to fund the initial stages of its wind-down process if wind-down becomes necessary. The Firm will not, therefore, use the value of the core liquid assets that it holds to meet the basic liquid assets requirement as liquid assets for the liquidity needs of its ongoing business.

3. Governance Arrangements

3.1. Board of Directors

The Board is responsible for promoting the long-term success of Upvest, the overall management and operation of the Firm, including the oversight of all material risks. It approves the overall strategy and business plans of the Firm and ensures that the internal control framework is appropriate for the orderly and prudent conduct of business by maintaining ongoing dialogue with the Risk and Compliance Functions.��

The Board defines the Firm’s corporate objectives and strategies, ensuring alignment with its risk profile, regulatory requirements, and stakeholder interests. It controls, evaluates, and approves the ICARA Process, ensuring that the Firm’s risk management, and its capital and liquidity planning, are proportionate and responsive to its business model and operating environment.��

In addition, the Board promotes a culture of integrity and accountability, ensuring that the Firm’s activities are conducted to the highest ethical standards and in the best interests of its clients.��

The terms of reference for the Board requires it to meet formally at least four times a year. The Board receives regular reports on its financial position, operational matters, Client Asset Sourcebook (CASS) oversight compliance and on risk and compliance matters.��

The Board is composed of two directors as at the 30th of June 2025, who carry out the Chair and Executive Director SMF roles respectively:

1. Mr Tobias Auferoth, Director (SMF3), 3 other passive, non-regulated directorships
2. Dr Khanh Dang Ngo, Director (SMF3, SMF16 and SMF17), 1 other passive, non-regulated directorship

3.2. Risk Function��

The Board has ultimate responsibility for the Firm’s Risk Management Framework, with the Risk Function acting as a critical component of the Firm’s broader risk management landscape and the responsible SMF (Senior Management Functions) for the Risk Function.��

It serves as the central point for all risk management activities within the Firm, ensuring that all aspects of risk are identified, assessed, and managed effectively. This includes embedding sound risk practices into business lines and decision-making processes, such as setting risk policies, defining risk limits, and developing controls and procedures that align with the Firm’s overall risk appetite and regulatory requirements.��

A significant responsibility of the Risk Function is to educate and train senior management and other key stakeholders on effective risk management practices. Through training programs and workshops, the Risk Function helps ensure that all parts of the firm are equipped to manage their risks effectively.��

3.3. Finance Function��

The Firm’s Finance Function plays a key role in the ICARA, given its close interconnections with the Firm’s financial budget and long-term strategic plans. It is responsible for managing the financial activities including responsibility for control and oversight of financial activities with support services provided by Upvest Securities GmbH, a regulated subsidiary within the Upvest Group.��

The Finance Function prepares the Firm’s financial projections over a three-year horizon, incorporating input from Senior Management on strategic objectives, which in turns informs projected budget and capital needs. Using the Balance Sheet, Profit & Loss account and cash flow forecasts as a foundation, the Finance Function in collaboration with the Risk function, calculates the projected capital requirements to produce a base scenario which is then subject to stress testing to assess whether the Firm will maintain adequate capital under adverse circumstances.��

Furthermore, the Finance function is responsible for day-to-day liquidity and capital monitoring, including triggering of early warning indicators. Key responsibilities in collaboration with the Risk Function include:

• The on-going monitoring of the early warning indicators as detailed in MIFIPRU7.6.11;
• Assessing and monitoring the firm has sufficient liquid assets to meet the liquid assets threshold requirement at any given time to comply with the overall financial adequacy rule;
• The formal monthly management reporting of these indicators to the Board.

3.4. CASS Committee

The Client Assets Committee “CASS committee” primary responsibility is overseeing the Firm meeting its obligations for operational effectiveness and control of the management of client money and client's safe custody assets ensuring compliance with the FCA’s Client Asset Sourcebook (CASS).��

The CASS Committee has oversight over all CASS related operations carried out by the Firm. The Committee is chaired by the Senior Manager responsible for CASS compliance (Prescribed Responsibility (z)), or suitable delegate and has members from the compliance and operations.��

The CASS Committee reports to the Board at a minimum annually in respect of the Firm’s compliance with the CASS rules.

4. Own funds

The Firm only utilises simple forms of capital in the form of Tier 1 equity and reserves. The Firm has never held Tier 2 equity instruments, and this is not forecast to change.

4.1. Composition of regulatory own funds

4.2. Reconciliation of regulatory own funds to balance sheet

4.3. Own funds assessment

Upvest’s ICARA identifies the amounts and types of capital and liquid assets required to cover unmitigated harms that may arise. The identification occurs through:

• An assessment of the Firm’s business strategy and ongoing operating activities. The extent to which this poses harm is assessed and quantified through ICARA scenarios. This process identifies the required capital needed for coverage of harms that are not fully mitigated by existing controls and processes;
• An assessment of the level of capital and liquidity required to support an orderly wind down that minimises potential harms to itself, its clients and counterparties. The ICARA approved by the Board in August 2025 sets out the business model and risk appetite of the Firm. The Board has continued to review its liquidity and capital resources against its requirements since June 2025 and as a result the Board remains satisfied that as required by MIFIDPRU 7.4.7R, the Company holds own funds and liquid assets which are adequate, both as to their amount and their quality, to ensure that:
  • (a) the firm is able to remain financially viable throughout the economic cycle, with the ability to address any material potential harm that may result from its ongoing activities; and
  • (b) the firm’s business can be wound down in an orderly manner, minimising harm to consumers or to other market participants.
• Capital and liquidity planning and stress-testing, which identifies an appropriate range of adverse circumstances of varying nature, severity and duration relevant to the business model and strategy.

As at the 30th of June 2025 and throughout the year, Upvest has complied with its individual capital requirements.

5. Own Funds Requirements (“OFR”)

5.1. OFR Methodology

The Firm is required to have at all times own funds of at least an amount which is greater of the following:

• a) Permanent Minimum Capital Requirement (PMR) under MIFIDPRU 4.4
• b) Fixed Overhead Requirements under MIFIDPRU 4.5, and��
• c) K-Factors Requirement under MIFIDPRU 4.6

As a MIFIDPRU firm, the Firm must comply with MIFIDPRU 4.3 in respect of calculating its own funds requirement. Therefore, the Firm maintains adequate own funds of at least £685.87k to cover its capital requirements. The Firm will continue to monitor the above requirements in order to ensure compliance with its own funds and capital adequacy requirements at all times.

Permanent Minimum Requirement (PMR)��

The Firm has assessed its permission profile against the rules in MIFIDPRU 4.4 to determine its permanent minimum capital requirement is £150k. The intended permission profile is as follow:

• a) dealing in investments as agent��
• b) arranging (bringing about deals in Investments)��
• c) making arrangements with a view to transactions in investments d) safeguarding and administration of assets��
• e) Arranging safeguarding and administration of assets��
• f) holding client money��
• g) agreeing to carry on a regulated activity��
• h) sending dematerialised instructions��
• i) causing dematerialised instructions to be sent

Fixed Overhead Requirement (FOR)��

As per MIFIDPRU 4.5, the fixed overheads requirement of a MIFIDPRU investment firm is an amount equal to one quarter of the Firm’s relevant expenditure during the preceding year. The Firm’s projected relevant expenditure for the current year is £2.74m, which represents an increase of more than 30% compared to the preceding year’s expenditure of £919k. Accordingly, the fixed overheads requirement is based on the current year projection, resulting in a requirement of £686k.��

K-factor Requirement (KFR)��

The Firm has assessed its obligations under MIFIDPRU 4.7 to 4.16 and confirms that, at the current reporting period, no K-factor requirement applies. While the K-factor requirement is zero, the Firm maintains a robust methodology to interpret and calculate K-factors once they become applicable in the future, consistent with GEN 2.2.1R and associated guidance.

5.2. Capital and Liquidity Adequacy

As of the reporting period, the Firm remains well capitalised and meets the regulatory own funds and liquidity requirements. The own funds amount to £ 3.07m held entirely in CET1 capital. Liquidity coverage remains above regulatory thresholds supported by a cash balance of £ 3.34m.

6. Remuneration policies and practices

6.1. Overview

This section sets out the remuneration disclosures required under the IFPR, in accordance with the provisions outlined in MIFIDPRU 8 of the IFPR. In compliance with the MIFIDPRU8 requirements, the legal entity has provided a level of detail that is appropriate to its size and internal organisation, and to the nature, scope, and complexity of its activities.��

This section sets out general principles of remuneration. The legal entity complied with the applicable remuneration requirements of the IFPR, as implemented in the Financial Conduct Authority Handbook SYSC 19G (the “Remuneration Rules”). The following additional disclosures should therefore be read in conjunction with the Remuneration Policy.

6.2. Remuneration governance and decision making

• xThe Firm’s Remuneration Committee sits within the Board of Upvest Securities Ltd;��
• The Board reviews Upvest’s remuneration policy (the “Remuneration Policy”) on an annual basis and oversees its implementation;��
• Upvest’s Risk and Compliance functions are involved in the review of the Remuneration Policy, including reviewing the Firm’s approach to the designation of those roles which could potentially have a material impact on the risk profile of the legal entity (“IFPR Identified Staff”).

Remuneration policies, principles and practices

• The remuneration policy sets out:��
  • the Firm’s approach to the remuneration of all Upvest staff;��
  • the Firm’s “compensation philosophy” that guides its remuneration policies and practice
  • the objectives underlying the Firm’s financial incentives.
• Details of the different components of remuneration, as categorised into fixed and variable and a summary of incentives created by the remuneration policies and practices applicable to staff in the Firm

Link between pay and performance

• As described in the Firm’s remuneration policy, the Firm focuses on risk-adjusted performance and rewards behaviours that generate sustained value for the Firm. The Firm compensates employees based on the overall performance of the Firm and individual performance.
• Upvest undertakes an annual review of its staff against the qualitative criteria set out in SYSC 19G.5 to identify its IFPR Identified Staff. This IFPR Identified Staff group is reviewed on an ongoing basis and IFPR Identified Staff are notified of their status and the impact on their remuneration structure. Individuals classified as IFPR Identified Staff for the legal entity under SYSC 19G.5 may include (but are not limited to):
  • a) the management body in its management and/or supervisory function; b) senior management;��
  • c) staff members with managerial responsibility for business units carrying on certain regulated activities;��
  • d) staff members with managerial responsibility for the activities of a Control Function;��
  • e) staff members with managerial responsibility for the prevention of money laundering and terrorist financing;��
  • f) staff members responsible for managing a material risk;��
  • g) staff members responsible for managing IT, information security, and/or outsourcing arrangements of certain critical or important functions; and h) staff members who have authority to take decisions approving or vetoing the introduction of new products

Quantitative Disclosures��

All firms are required to publicly disclose certain quantitative information in relation to the levels of remuneration awarded. As a Non-SNI firm and in accordance with MIFIDPRU 8.6.8, the Firm is required to disclose the total amount of remuneration awarded to all staff, split into fixed and variable remuneration.��

Total remuneration awarded for performance period Jan-June 2025 for all staff was £562K:��

Of which: fixed remuneration £537K
Of which: variable remuneration £25K��

The legal entity identified 2 members of IFPR Identified Staff with a total remuneration of £252K of which £227K is fixed and £25K is variable. No members of IFPR Identified Staff received guaranteed variable remuneration or a severance award.

7. Investment policy

In accordance with MIFIDPRU 8.7.6, the requirement is to make disclosures regarding its investment policy in the following circumstances:

1. only in respect of a company whose shares are admitted to trading on a regulated market;
2. only where the proportion of voting rights that the MIFIDPRU investment firm directly or indirectly holds in that company is greater than 5% of all voting rights attached to the shares issued by the company; and
3. only in respect of shares in that company to which voting rights are attached.

Upvest does not meet the criteria laid out in MIFIDPRU 7.1.4R and is therefore not required to include disclosures on Investment policy (MIFIDPRU 8.7).