Crown Payroll Services Ltd is a member of and supervised for anti-money laundering purposes by the Institute of Accountants and Bookkeepers (IAB), a recognised supervisory body under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). IAB membership details are set out in the parties section above.

This Letter of Engagement sets out the terms on which Crown Payroll Services Ltd ("we", "us", "our") will provide payroll processing services to the Client Firm on a subcontracted basis.

This engagement is between Crown Payroll Services Ltd and the Client Firm only. Crown Payroll Services Ltd has no direct contractual relationship with any underlying clients of the Client Firm.

For the purposes of this engagement, "the Client Firm" means the parent company named above together with the subsidiary entities listed in the parties section (together "the Group"). This engagement is entered into by the parent company on behalf of itself and each subsidiary entity named above, and the parent company warrants that it has authority to bind each such subsidiary to the terms of this letter. Crown Payroll Services Ltd has no direct contractual relationship with any underlying clients of the Client Firm or the Group entities. All instructions, data, approvals, and communications must be provided to us by the Client Firm. References to "the Client Firm" throughout this letter and the attached schedule include all Group entities named above unless the context requires otherwise.

We will provide the following payroll processing services as instructed and directed by the Client Firm:

• Processing of payroll data supplied by the Client Firm for their underlying clients
• Calculation of gross pay, statutory deductions (PAYE, NI), and net pay
• Preparation and submission of Real Time Information (RTI) returns to HMRC
• Calculation and reporting of auto-enrolment pension contributions where instructed
• Production of payroll reports, payslips, and payment schedules for onward delivery by the Client Firm
• Liaison with the Client Firm on payroll queries and corrections

Any services outside the above scope must be agreed in writing before commencement. The detailed schedule of responsibilities for both parties is set out in Appendix A.

4.1 Our regulated customer

For the purposes of MLR 2017 our customer is the Client Firm as the contracting party. Customer Due Diligence (CDD) is applied to the Client Firm.

For the purposes of MLR 2017 our customer is the Client Firm as the contracting party, being the parent company contracting on behalf of the Group. Customer Due Diligence (CDD) is applied at Group level through the parent company. We do not conduct separate CDD on each subsidiary entity, on the basis that they are owned and controlled by the same regulated parent and are covered by the parent company's own AML framework.

4.2 Underlying clients — our residual obligation

Crown Payroll Services Ltd is separately supervised under MLR 2017 and provides a defined service. Our obligation to satisfy ourselves as to the money laundering, terrorist financing and proliferation financing risk attaching to work we perform is not discharged by the Client Firm having carried out its own Customer Due Diligence.

Where we process payroll in respect of an underlying client of the Client Firm, we remain responsible for satisfying ourselves that Customer Due Diligence to a UK standard has been carried out and evidenced in respect of that underlying client. We may satisfy ourselves by such means as we consider appropriate, including by carrying out periodic checks on a sample of underlying clients, and we retain records of the checks we carry out.

4.3 Right to request CDD and risk assessment

We may at any time — on the addition of an underlying client, on periodic review, or on the occurrence of an event-driven trigger — request from the Client Firm, in respect of any underlying client whose payroll we process:

• confirmation that Customer Due Diligence has been completed, the date of completion and the date of last review;
• the identification and verification evidence held for the underlying client, its directors, and its beneficial owners;
• the excerpt of the PSC register, Trust Registration Service or Register of Overseas Entities relied upon, and confirmation that it has been reviewed for material discrepancies;
• the Client Firm's documented risk assessment and risk rating for that underlying client;
• confirmation of whether Simplified or Enhanced Due Diligence has been applied, and the basis for that determination;
• confirmation of whether the underlying client, any director or any beneficial owner is a Politically Exposed Person, a family member or known close associate of a Politically Exposed Person, or is subject to financial sanctions.

The Client Firm agrees to provide the material requested within five working days.

4.4 Our right to conduct our own CDD

Where the Client Firm does not provide the material requested under clause 4.3, provides it in incomplete form, or where we consider on reasonable grounds that the Customer Due Diligence carried out does not meet the standard required by MLR 2017, we may carry out our own Customer Due Diligence directly in respect of that underlying client.

The Client Firm agrees to facilitate that process, including by providing contact details for the underlying client and its beneficial owners and by making any introduction we reasonably require. Our reasonable costs of carrying out Customer Due Diligence under this clause are recoverable from the Client Firm at our standard rates.

4.5 Suspension and declining to act

Where Customer Due Diligence in respect of an underlying client cannot be completed to our satisfaction, we may decline to commence, suspend, or cease processing payroll in respect of that underlying client.

We may do so without giving reasons. The Client Firm agrees that we shall not be in breach of this engagement, and shall not be liable for any loss arising, by reason of our doing so. Nothing in this engagement requires us to disclose the existence or content of any internal or external report, and the Client Firm agrees not to press for reasons where none are given.

4.6 Simplified Due Diligence

Crown Payroll Services Ltd is itself supervised for AML purposes by the IAB and maintains its own AML policies, procedures and risk assessments in accordance with MLR 2017.

We may apply Simplified Due Diligence (SDD) to the Client Firm where our own risk assessment supports a determination of low risk on the basis that the Client Firm is a regulated professional firm subject to equivalent obligations under MLR 2017. SDD is a determination made by us and not an entitlement of the Client Firm. It will be set aside where we doubt the veracity or accuracy of information previously provided, where we no longer consider the risk to be low, where a suspicion arises, or where any condition requiring Enhanced Due Diligence applies. The basis for the determination is documented on our AML file and reviewed periodically.

Simplified Due Diligence applied to the Client Firm does not extend to underlying clients.

4.7 Records and data protection

Material provided under this Section is processed by us in order to comply with a legal obligation under MLR 2017, is retained for five years from the end of the engagement in accordance with Regulation 40, and will not be used for any other purpose except where permitted by legislation. The Client Firm confirms that it is able lawfully to disclose that material to us for this purpose.

4.8 Suspicious Activity Reporting

Nothing in this clause limits our obligations under Part 7 of the Proceeds of Crime Act 2002 or the Terrorism Act 2000. We remain obligated to submit a Suspicious Activity Report (SAR) to the National Crime Agency if, in the course of providing services, we become aware of or suspect money laundering or terrorist financing, regardless of the nature of our engagement.

Fees for the services described in this engagement are agreed as set out below. Where the scope of services changes — including the addition of new underlying clients, changes in payroll complexity, or variation to the services provided — fees will be reviewed and agreed between the parties prior to the change taking effect. Crown Payroll Services Ltd reserves the right to issue a revised fee schedule at any time with reasonable notice. Fees are payable within 3 days of invoice. We reserve the right to suspend services where invoices remain unpaid beyond this period.

6. Confidentiality

Both parties agree to keep confidential all information received from the other party in connection with this engagement. This obligation does not apply to information that is in the public domain, is required to be disclosed by law, or is disclosed to a regulatory or supervisory body in the proper exercise of their functions.

7. Data Protection

Both parties acknowledge their respective obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Client Firm acts as data controller for the personal data of its underlying clients and their employees. Crown Payroll Services Ltd acts as data processor in respect of employee payroll data processed on behalf of the Client Firm. A separate Data Processing Agreement (DPA) should be executed between the parties where required by UK GDPR Article 28.

8. Professional Indemnity

Crown Payroll Services Ltd maintains professional indemnity insurance in respect of the services provided under this engagement. Details are available on request.

9. Termination

Either party may terminate this engagement by giving 30 days' written notice to the other. We reserve the right to terminate immediately in the event of non-payment, material breach, or where continuation of the engagement would place us in breach of our professional or legal obligations.

10. Governing Law

This Letter of Engagement is governed by and construed in accordance with the laws of England and Wales. Any disputes arising under it shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Your Responsibilities — Payroll

You confirm that your underlying clients remain legally responsible for: ensuring payroll submissions are correct and complete; ensuring national minimum wage has been paid; completing right to work checks; making all submissions by the due date; and paying tax and NIC on time.

You agree to notify us at least 5 working days prior to each payroll date of all transactions including: time sheets, new employees (name, address, DOB, gender, NI number), leavers, changes to remuneration, pension scheme changes, and ad hoc payments.

Your Responsibilities — Auto-Enrolment

You confirm that your underlying clients remain legally responsible for pension records, contribution timings, scheme selection, re-enrolment, and declarations of compliance to The Pensions Regulator. Records must be retained for six years (four years for opt-out requests).

Our Responsibilities — Payroll

We will calculate PAYE, NIC, employer NIC, statutory payments, pension contributions, apprenticeship levy, and other deductions as instructed. We will submit RTI information online to HMRC. We will produce payroll summaries, payslips, P45s, PAYE/NIC liability reports, and pension contribution schedules. Year-end: final FPS by 19 April, P60s by 31 May.

Ad hoc queries by way of telephone and email enquiries are not routine compliance and may result in additional fees.

Our Responsibilities — Auto-Enrolment

We will calculate worker deductions and employer contributions, process refunds through payroll, and upload pension contribution files to the pension provider once the payroll has been approved by you.