{"url_path":"/sec/wse/10-k/2026/item-16k","section_key":"item-16k","section_title":"Item 16K Cybersecurity","topic":"sec","document":{"doc_type":"20-F","doc_date":"2026-06-25","source_url":"https://www.sec.gov/Archives/edgar/data/2099039/0001193125-26-282911-index.html","accession_number":"0001193125-26-282911","cik":"0002099039","ticker":"WSE","issuer_name":"Wise Group plc","edgar_url":"https://www.sec.gov/Archives/edgar/data/2099039/0001193125-26-282911-index.html","primary_entity_key":"0002099039","primary_entity_name":"Wise Group plc"},"word_count":766,"has_tables":true,"body_markdown":"Item 16K. Cybersecurity\n\nRisk Management and Strategy\n\nWise Group plc (the “Company”) has established a comprehensive cybersecurity program designed to protect the confidentiality, integrity, and availability of its global technology infrastructure and customer data. This program is an integral part of the Company’s Enterprise Risk Management Framework (“ERMF”), which follows a Three Lines of Defense (“3LoD”) model to ensure clear accountability, objective assessment, and independent oversight of cybersecurity risks.\n\nRisk Identification and Assessment: The Company manages cybersecurity threats through a structured Risk and Control Self-Assessment (“RCSA”) process, integrated into our Three Lines of Defense model. This ensures that risk identification is a collaborative effort between technical owners and independent oversight functions:\n\n \n\n \n•\n \n\nFirst Line Ownership: Our Engineering and Product teams, amongst a few, (the “First Line”) are responsible for identifying risks within their specific domains. They perform self-assessments to document potential vulnerabilities in our technology stack and confirm the effectiveness of the controls they operate.\n\n \n\n \n•\n \n\nSecond Line Oversight: The Tech Risk and Compliance function (the “Second Line”) defines the risk methodology and provides a “credible challenge” to these assessments. This team ensures consistent risk scoring and oversees the remediation of any identified control gaps.\n\n \n\n \n•\n \n\nContinuous Validation: To support the RCSA, the Company conducts regular technical and non technical assessments managed by internal and external independent parties. Findings are tracked in a centralized risk register, ensuring that real-time technical threats inform our broader risk profile.\n\n \n\n \n•\n \n\nReporting: High-rated residual risks identified through the RCSA process are escalated to the Operational Risk Committee and the Audit and Risk Committee, providing our board of directors with visibility into the Group’s cybersecurity posture and mitigation efforts.\n\nIntegration with Business Strategy: Cybersecurity risk management is embedded into the product development lifecycle. The Company’s security engineering teams work alongside product teams to ensure that security controls are “secure by design” and capable of mitigating threats such as unauthorized access, fraud, and data breaches.\n\nThird-Party Oversight: As the Company relies on critical third-party service providers (such as Amazon Web Services), it maintains a robust Third-Party Management & Outsourcing Policy. This includes security due diligence during onboarding, contractual security obligations, and ongoing monitoring (including continuous cycles of tracking operational, regulatory compliance, security, privacy, service, and legal risks) to ensure that vendors meet the Group’s high standards for operational resilience.\n\nIncidents: While the Company experiences cybersecurity threats and incidents in the ordinary course of business, as of the date of this Annual Report, no cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company’s business strategy, results of operations, or financial condition.\n\nGovernance\n\nBoard Oversight: The Risk Committee of the board of directors is responsible for the oversight of risks from cybersecurity threats. The Risk Committee oversees management’s implementation of the cybersecurity program\n\n \n\n126\n\n[Table of Contents](#toc)\n\nand monitors the adequacy of internal controls. The Global Chief Information Security Officer (“CISO”) provides formal reports to the Risk Committee at least annually, covering the threat landscape, security metrics, and the status of strategic security initiatives.\n\nManagement’s Role and Reporting Structure:\n\nThe CISO Role: The Global CISO is responsible for the overall Information Security Management System (ISMS). Our Global CISO has over 20 years of experience in computer science, product development, and technical leadership. He joined Wise in 2015 and has played a pivotal role in scaling the Company’s technology and security infrastructure.\n\nPrior to being appointed Global CISO in 2022, he served as Director of Engineering for the Global Product Tribe, where he led a team of over 120 engineers. Notably, he spearheaded the program to elevate Wise’s engineering compliance and security protocols to public company standards ahead of the Company’s 2021 IPO. His previous roles at Wise include Director of Engineering for the Transfer Experience and serving as the Company’s first engineering lead in London.\n\nReporting Lines: The Global CISO has a direct reporting line to the Audit and Risk Committee for governance matters and works closely with the Chief Technology Officer (CTO) on operational execution. This structure ensures that cybersecurity is elevated to the highest levels of management and the board of directors.\n\nInternal Committees: The Operational Risk Committee (ORC), which includes the Global CISO and other members of senior management, assists in overseeing technology and security risk profiles. This committee ensures that cybersecurity risks are prioritized and that mitigation efforts are adequately resourced across the Group.\n\nExpertise: The Company maintains a large, specialized team dedicated to cybersecurity and financial crime prevention. This team is provided with continuous training and professional development budgets to stay ahead of the evolving global threat environment.\n\n \n\n127\n\n##### Table of Contents\n\nPART III"}