Professional Services, Governance & Institutional Readiness Risk Disclosure

1. Purpose

Afilcorp’s work can improve structure, evidence, responsibility and coordination. It cannot remove legal, regulatory, tax, commercial, operational or human uncertainty.

This disclosure identifies principal risk categories. It is not exhaustive and does not replace advice or Engagement Terms.

2. Information and instruction risk

Afilcorp relies on information supplied by clients and other persons.

Risks include:

• incomplete or inaccurate ownership information;
• inconsistent documents;
• outdated instructions;
• undisclosed conflicts;
• omitted jurisdictions;
• unreliable valuations;
• unauthorised instructions;
• contradictory provider records.

A governance output may be defective if its factual basis is defective.

3. Governance-design risk

A charter, authority map or policy does not ensure that people will follow it.

Risks include:

• informal decision-making;
• founder override;
• ineffective challenge;
• unclear quorum;
• undocumented exceptions;
• authority outside legal documents;
• poor closure;
• failure to update after change.

4. Family, succession and incapacity risk

Family circumstances and personal law can affect ownership, control, confidentiality and continuity.

Risks include:

• incapacity;
• death;
• dispute;
• divorce;
• forced heirship;
• contested authority;
• next-generation readiness;
• key-person dependence;
• loss of knowledge or access.

Local legal advice and tested continuity arrangements may be required.

5. Legal and regulatory change

Law, official guidance, enforcement priorities and licence conditions may change.

A structure acceptable at one time may require review.

Afilcorp does not guarantee continuity of legal or regulatory treatment.

6. Cross-border risk

A common governance framework cannot make different legal systems identical.

Risks include:

• conflicting laws;
• tax residence;
• permanent establishment;
• regulatory nexus;
• data transfer;
• sanctions;
• trust validity;
• succession;
• ownership registers;
• recognition and enforceability;
• translation and execution formalities.

Local advice remains necessary.

7. Corporate and beneficial-ownership risk

Risks include:

• inaccurate registers;
• unreported control changes;
• inconsistent beneficial-ownership records;
• unauthorised directors or signatories;
• dormant or non-compliant entities;
• filing default;
• unclear entity purpose;
• mismatch between legal and practical control.

8. TCSP and AML/CFT risk

Afilcorp may be required to conduct CDD, understand purpose and ownership, maintain records, monitor changes, screen risk and decline or terminate work.

Afilcorp may not be able to explain the precise reason for every risk decision where law, confidentiality or security prevents disclosure.

A TCSP licence does not eliminate client AML/CFT, sanctions or reporting responsibilities.

9. Licensing and registration risk

Whether an activity requires permission depends on facts, activity, location, client, remuneration, discretion and law.

Risks include:

• misclassification;
• scope creep;
• holding out;
• unlicensed conduct;
• incomplete application evidence;
• changes during review;
• regulator questions;
• refusal, delay or conditions.

Afilcorp does not make the licensing decision.

10. Bank, EMI and provider risk

Banks and providers make independent legal, risk and commercial decisions.

They may:

• seek further information;
• refuse or delay onboarding;
• restrict services;
• change pricing;
• close or freeze an account where legally permitted;
• change jurisdiction or product appetite;
• rely on group policy.

Readiness support cannot guarantee acceptance or continuity.

11. Tax risk

Tax outcomes depend on law, residence, ownership, management, control, substance, activities, assets, transactions and anti-avoidance rules.

Risks include:

• loss of concession;
• reclassification;
• reporting default;
• valuation disputes;
• permanent establishment;
• withholding;
• penalties;
• retrospective assessment.

Afilcorp does not provide a tax opinion.

12. Accounting, audit and valuation risk

Risks include:

• incorrect consolidation;
• classification;
• related-party treatment;
• functional currency;
• valuation uncertainty;
• private-market data;
• impairment;
• audit evidence gaps;
• going-concern or liquidity issues.

Afilcorp does not issue accounts, an audit opinion, assurance conclusion or valuation unless separately and lawfully provided by an authorised professional.

13. Investment-governance risk

Governance of investment decision-making is not investment advice.

Risks include:

• concentration;
• leverage;
• illiquidity;
• valuation;
• commitment pacing;
• manager risk;
• related parties;
• conflicts;
• currency exposure;
• key-person risk;
• inadequate reporting.

The family or appointed investment decision-maker remains responsible.

14. Third-party and referral risk

A Third-Party Provider may fail, delay, breach, change terms or cease service.

Afilcorp may receive or pay a referral fee only where lawfully permitted and appropriately disclosed.

A referral does not guarantee quality or acceptance.

15. Implementation and remediation risk

A recommendation has no effect until implemented.

Risks include:

• delay;
• insufficient resources;
• unclear ownership;
• dependent actions;
• interim exposure;
• ineffective control;
• lack of evidence;
• premature closure;
• residual risk.

16. Data, cyber and technology risk

Family-office and private-capital information is highly sensitive.

Risks include:

• cyberattack;
• phishing;
• credential theft;
• unauthorised access;
• data loss;
• provider breach;
• insecure transfer;
• inadequate backup;
• model or system error;
• unapproved AI use;
• loss of audit trail.

No system is completely secure.

17. Electronic communications and fraud

Email and messaging may be intercepted, spoofed or altered.

Never rely solely on an email to verify a change of payment, bank account or authorised person.

Use official domains and independent verification.

18. Confidentiality and privilege

Before an engagement is accepted, unsolicited information may not be protected as confidential or privileged.

Cross-border or third-party disclosure may be required for an accepted scope, law, risk review or service delivery, subject to proper notice and safeguards.

19. Conflict risk

Afilcorp may identify an actual or potential conflict and may decline, restrict or terminate work.

The existence of a conflict process does not eliminate all perceived conflicts.

20. Timing and dependency risk

Timelines depend on:

• complete information;
• client decisions;
• advisers;
• providers;
• public authorities;
• translations;
• approvals;
• technology;
• law.

Indicative timings are not guarantees.

21. No outcome or risk-elimination guarantee

Afilcorp does not guarantee:

• approval;
• account opening;
• licence;
• tax treatment;
• legal effectiveness;
• investment outcome;
• absence of loss;
• absence of fraud;
• complete compliance;
• completion time.

22. Client responsibility

The client must:

• provide accurate and timely information;
• make decisions through authorised persons;
• obtain specialist advice;
• implement agreed actions;
• monitor providers;
• maintain records;
• notify changes;
• comply with law.

23. Engagement-specific risk

Accepted work may involve additional risks and assumptions stated in Engagement Terms, a scope letter, risk memorandum or deliverable.

Those documents prevail for that engagement.