Risk Management & Compliance

» continued

Key strategic directions* Strategic

Pillar 1 – Growth
Preserve a high-quality portfolio of
dominant assets
Delivering on development pipeline,
positively contributing to the property
portfolio and income generation
Expanding and strengthening the
portfolio Net Operating Income
Pillar 2 – Sustainability
Foster a strong financial discipline,
including adequate liquidity,
conservative gearing, and a diverse
debt structure, to support growth
directions
Focus on ESG, to deliver on sustainable
and responsible growth
*Strategic directions have been revised by management and
external reports are currently being aligned accordingly
The Group expresses its openness to disclosing relevant
information on significant events that could challenge its
risk management framework and/or the key mitigating
actions, while reasonably preserving information
Strategic
Risk description goal Business impact
impacted
Strategy cluster
Strategic risks arise mainly from the fundamental decisions executive management makes implementing business
strategy, while keeping up with the dynamics of the political, economic and social environment. Essentially, strategic
risks lead to the Group not being able to achieve its business plan and core corporate targets or may even endanger the
going concern of the Group.
The Group may not always be able to execute its investments and divestments policy at the most opportune time, due
to unforeseen fluctuations in the real estate or financial and capital markets. Adverse market movements could also
affect the value of the Group’s portfolio, its financial position, liquidity, operating income and future prospects.
Stakeholders
sensitivity and observing confidentiality. Risk description goal Business impact Key mitigating actions
impacted
In the risk assessments performed in 2022, the Group impacted
focused on the following risk triggers:
• overall economic context (gas/oil crisis, utilities cost Market price Due to high demand, the A procedure has been Shareholders
increase, inflation, increased prices of goods and evolution in price of real estate implemented to assure the
services) real estate developments increases. best market prices for each Tenants
development construction stage.
• disruption to global supply chains
Specific risk triggers: Suppliers
• legally imposed utilities consumption restrictions
• potential utilities unavailability causing business • overlapping of more Tenders are organized for all
interruption risk triggers (raw projects.
• downsides of caps on energy prices (disturb financial materials costs increase
markets' stability, limits on supply etc.) since pandemic, FIDIC type contracts are used
• potential escalation of Ukraine crisis, risk of involving partial unavailability of - fixed prices, not impacted by
other countries. materials after pandemic sudden price increases on the
Dedicated action planning followed the risk assessment due to high demand, market.
and relevant measures were implemented to mitigate utilities cost increase,
identified risks. inflation rate increase, Fast decisional process is key.
Ukraine crisis) causing
The key risk areas listed below include the most relevant delays in delivery of
risk triggers the Group encounters, associated business materials, materials
impact and mitigating actions, as well as anticipated and services costs
increase, temporary
trends. This is not an exhaustive inventory, but instead
includes the most relevant ones to the Company’s and partial stand-by of
developments projects
ecosystem. Additional risk factors have not been reflected,
• overall 25%-30% cost
despite being monitored, as their occurrence is not likely
increase compared to
or their impact significant across the portfolio:
2021
• high delays in delivery
for specific materials
Stakeholders
Key mitigating actions Delays in execution Due to current economic A strong asset appraisal Shareholders
impacted
of assets rotation circumstances many assets policy is in place, setting out a
strategy available on the market and structured framework used in Financing partners
lack of capital make divesting the decision-making process
assets difficult (improper for disposals.
conditions, risk of not
achieving the desired pricing). The strategy on medium and
short-term is designed taking
into account the market
conditions - if attractive
pricing can be achieved for
acquisitions and/or if pricing
for assets to be disposed
reflects the assets value.

Limited new capital Limitations on new capital
injection, shortage of
financing or re-financing at
acceptable cost, adverse
changes in macroeconomic
conditions or the Group's
performance may lead to
a rating downgrade and/
or unavailability of capital,
inability to fund property
investments or development
program, increased cost of
finance.
Cash flow management is
performed daily and forecasts
for the next year are updated
several times a year.
Other measures: Spread
of sources and maturity of
facilities, committed but
undrawn facilities maintained,
continuing and extensive
capital market and bank
relationship management by
the CFO and CEO.
Shareholders Several scenarios are designed
so that no forced sale is done
Financing partners and at all times the market
is monitored and strategy
Employees adapted so that value is
preserved.
The Board monitors
compliance and performance
quarterly. Every decision
approved by Board

124 NEPI Rockcastle N.V. Annual Report 2022 125

Risk Management & Compliance
Strategic
Risk description goal Business impact Key mitigating actions
impacted
Finance cluster
The Group constantly monitors its exposure to interest rate volatility, liquidity, foreign exchange rates, equity markets,
and sets applicable management policies. The Group pays close attention to managing the inherent financial risks of its
activity and to the financial instruments it uses.
The Group’s policy on credit, liquidity, and market risks, including currency and interest rate, as well as the management
of those risks are disclosed in notes 4 and 6 to the financial statements.
The Group is subject to various taxes in the countries where it operates. In some jurisdictions, there is an increasing
burden from compliance and regulatory requirements, as well as a certain degree of unpredictability, which can lead to
lower performance.
Investors demand Decrease in investor demand Having a portfolio of prime
decrease for real estate, impacting the properties, maintaining strong
NAV and putting pressure on compliance with financial
bank covenants. covenants and performing
active asset management
is expected to mitigate the
severity of the impact on the
Group.
Liquidity risk The Group might not be In addition to its usual sound
able to meet its financial financial management,
obligations as they fall due. the Group is committed to
maintaining its conservative
gearing level and robust
liquidity.
Also, the Group uses the
following mitigation measures:
• a flexible approach
to developments (i.e.
revise pipeline, focus
on committed ongoing
projects)
• maintain enough liquidity
to meet its liabilities when
due, under normal and
stress conditions, without
incurring unacceptable
losses or risking
reputational damage
• management prepares
budgets, cash flow
analyses and forecasts,
which enable the Directors
to assess the level of
financing required for
future periods
• budgets and projections
are used to assess
any future potential
investments and compared
to existing funds held on
deposit to evaluate the
nature and extent of future
funding requirements.
126
» continued
Strategic
Stakeholders
Risk description goal Business impact
impacted
impacted
Debt and equity The invasion of Ukraine
capital markets caused turmoil in the
volatility financial markets, already
negatively impacted by the
macroeconomic tensions due
to Covid-19 pandemic.
Due to uncertainty caused
by the geopolitical crisis and
macroeconomic evolution, the
future of retail sector markets
remains reserved. These are
Shareholders rather exogenous risks, largely
outside Group's control,
Financing partners however they can significantly
influence the share price and
bond yields.
Operational cluster
Shareholders
Tenants Property development and management activities entail typical risks, such as insufficient building maintenance leading
to a degradation of portfolio, health and safety risks, business continuity improperly managed, budgets overrun,
Suppliers improper tenant relationship management, over-reliance on a single third party.
Employees Utilities cost Utilities cost increase might
increase risk trigger higher operational
Local authorities costs. Due to increasing price
of fossil fuels and electricity,
Financing partners the costs of utilities have
increased significantly
since 2021 and have been
also affected by the war in
Ukraine. This may (i) have
a direct impact on Group
NOI, (ii) cause shortfall, (iii)
increase tenants' operational
costs and create potential
issues with collection process,
(iv) negatively impact
producers/distributors/
suppliers/end-consumers
(e.g. materials, logistics cost
increase).
Legislation is expected
to change, i.e. new
responsibilities/
requirements for landlords,
to accommodate the new
market conditions.
NEPI Rockcastle N.V. Annual Report 2022
Stakeholders
Key mitigating actions
impacted
Continuous assessment of Shareholders
exposures, liquidity and
any other appropriate risk Financing partners
measures together with
independent supervision by Employees
the Risk and Compliance
Committee. The Group is
maintaining close contact with
investors and bond holders.
The Tax and Treasury Risk
Partner will ensure monitoring,
perform market research and
raise potential risk triggers
to the Executive Committee,
while the decision on
mitigation measures remains
with the Executive Committee
and the Board.
The Company implemented Shareholders
adequate budgeting, more
sustainable and cheaper Tenants
alternative energy sources
(such as photovoltaic panels), Suppliers
protective contractual clauses,
backup for existing suppliers Employees
to prevent potential outage in
case they become insolvent. Local authorities
A saving policy is being
piloted in one Romanian and
one Polish location involving
the implementation of a new
digital platform for integrating
building management systems.
A co-generation engine for
electricity and heat production
from natural gas was installed
as a pilot in one Polish
location.
127
Risk Management & Compliance
Strategic
Risk description goal Business impact
impacted
Utilities cost
increase risk
(continued)
Utilities outage risk The economic context (gas/oil
crisis, utilities cost increase,
inflation rate increase,
disruption in the global supply
chains) is challenging.
Some countries are expected
to impose mandatory heating
or cooling limits on offices
and shopping centres, in
case of severe shortage (EU
agreed to cut natural gas
consumption by 15%, aiming
to reduce reliance on Russia).
Consumption restrictions
potentially imposed by law
in some countries for non-
essential areas, protecting
domestic consumers and
essential operations. Possible
limitation or interruption of
tenants’ activity resulting in
potential rent concessions.
Potential fines for non-
compliance.
Local blackouts with impact
on energy prices.
Hungary, Serbia, Slovakia
more dependent on Russian
gas.
Some suppliers may refrain
from making firm offers due
to the legislative context,
creating uncertainty in
the budgeting and costs
management area.
No or little insurance
coverage.
128
Key mitigating actions
Specific planned actions for
2023-2024 at Group level,
aiming to increase operational
and cost efficiency:
• Closing of empty parking
levels
• Modifying HVAC,
circulation pumps, air
curtains operating hours
• HVAC set point
management.
The Group makes efforts to
secure the prices for gas and
energy for next years. Some
stability/support offered
through state aid/caps.
Technical measures
implemented and further
assessment made to address
potential energy limitation by
country (e.g. Poland).
On-site energy production
using solar panels already
installed in ten Romanian
assets.
Oil burner tanks being
installed in case of a gas
supply crisis in Croatia.
Electric air curtains and
boilers are being installed as
alternative to gas in Serbia.
» continued
Strategic
Stakeholders
Risk description goal Business impact
impacted
impacted
Information Heterogeneous equipment,
security/ management software,
cybersecurity risk in network and security
shopping centres measures in the shopping
centres may lead to
information and cybersecurity
risks.
Shareholders
Tenants
Suppliers
Employees
Local authorities
Risk of tenants’ Tenants’ default may lead
to bad debts, high vacancy,
default
depreciation of rental income
and portfolio value and
in the end a reduction in
distributable earnings.
Litigations with tenants over
rent reductions and reliefs
might trigger:
i. alteration of the relation
with tenants – decision
to reduce business in our
locations or to relocate
ii. credit risk – tenants fail
to meet their contractual
obligations – impact on
cashflows and liquidity
iii. additional subsequent
regulatory risk (as
tenants may file various
complaints with various
authorities)
NEPI Rockcastle N.V. Annual Report 2022
Stakeholders
Key mitigating actions
impacted
The Group launched a project
for the upgrade and securing
of the shopping centres Shareholders
network:
• changing/redesigning/ Tenants
upgrading network
infrastructure Employees
• installing a new Wi-Fi
system with improved
capabilities
• securing technical
equipment and enrolling
in VPN, securing vendor/
service provider access
to Group systems
• providing ticket-based
technical support
• standardisation of
network equipment and
centralised management
• installing software
updates and antivirus.
The project was launched
in 2021 and is expected to
continue over the next 3 to
4 years, due to availability
of network equipment, as
well the significant financial
investment required.
Detailed creditworthiness Shareholders
reviews are performed before
signing lease agreements with Tenants
tenants.
All tenants are required to
provide cash deposits or bank
letters of guarantee, covering
rent and operating costs,
based on exposure.
The Group maintains close
tenant relationships through
its internal leasing team,
and tenants’ performance is
monitored regularly by the
asset management team.
Various indicators such
as tenants turnovers and
occupancy cost/affordability
are assessed monthly, and
measures are implemented on
a need basis.
129
Risk Management & Compliance
Strategic
Risk description goal Business impact
impacted
Risk of tenants’ iv. financial impact – unpaid
default rents, litigations related
(continued) costs, administrative
penalties or fines
imposed by authorities
v. operational risk – high
vacancy, bad debts
vi. negative media and
reputational risk.
New risk triggers, following
Covid-19 and post-pandemic:
Ukraine crisis, utilities cost
increase, inflation rate
increase, changes in consumer
spending behaviour.
Legal, Regulatory and Compliance cluster
As an owner and manager of real estate assets, the Group must comply with relevant laws and regulations, in all
countries where it operates. Areas such as corporate law, health and safety, environment, building construction and
urban planning, commercial licensing, leases and commercial laws, personal data protection are highly regulated across
the Group’s portfolio.
Climate change risk Potential breaches of relevant
environmental, health and
safety, non-financial reporting
legislation and regulations
might trigger financial and
reputation loss, sanctions,
negative media, damage to
third parties.
Neglecting assets’ climate
adaptation plan may trigger
financial and reputational loss. potential ESG risks in new
130
Key mitigating actions
The Group has an experienced
cash collection team,
that follows standardized
procedures.
The Group’s reliable and
steady OCR level of 12.1% (for
2022) allows it to maintain a
healthy tenant relationship
and materially mitigate the
risk at portfolio level.
The Group developed an
ESG Strategy, aiming to
adapt to and mitigate climate
risks, provide guidelines for
sustainable and performant
operations, develop synergies
between the building and its
environmental context.
Third party due diligence is
performed to early identify
assets considered for
acquisition, together with
relevant details regarding
building certification and
permitting.
The Group is developing
climate adaptation plans
for its assets and allocates
CAPEX necessary to mitigate
exposure to climate risk.
» continued
Strategic
Stakeholders Stakeholders
Risk description goal Business impact Key mitigating actions
impacted impacted
impacted
Non-compliance Non-compliance with The Group engages Shareholders
with laws and regulatory requirements experienced and reputable in-
regulations and could lead to fines, penalties, house and external legal and Financing partners
non-adherence to censures, and reputational specialised advisors.
good governance damage. Employees
practices. Management continuously
Investing in international monitors compliance Tenants
markets increases operational, with legal requirements.
regulatory and other related Appropriate operational Suppliers
risks. The Group operates compliance management is
across numerous jurisdictions ensured through continuous Local authorities
and is therefore subject monitoring of permits and
to a complex compliance authorisations required by
environment, as well as law, covering all properties,
diverse governmental and operations and jurisdictions.
regulatory changes.
The Company conducts a
centralised quarterly review
of the operational compliance
status at Group level and
reports results to the Board
who provides oversight.
Appropriate policies and
procedures set the Group’s
Shareholders
ethical tone at the top culture.
Tenants
The Know your Client/Partner
policy mitigates money-
Suppliers
laundering/terrorism financing
and prevents corruption.
Local authorities
A Group Risk Management
and Compliance Officer,
as well as risk partners
are assigned, while risk
management and compliance
status is regularly reported to
the Committee.
Non-compliance Non-compliance with The Group has set up a Tenants
with EU General regulatory requirements structure and has employed
Data Protection could lead to fines, penalties, an experienced Data Privacy Shareholders
Regulation, censures, and reputational Officer (‘DPO’) to coordinate
within complex damage. data privacy compliance. Employees
jurisdictions and
local specificities. Local authorities
NEPI Rockcastle N.V. Annual Report 2022 131
Risk Management & Compliance
» continued

Strategic
Stakeholders
Risk description goal Business impact Key mitigating actions
impacted
impacted

Non-compliance The Group implemented

with EU General Data Privacy policies and
Data Protection procedures, as well as regular
Regulation, training and awareness
within complex campaigns for all staff.
jurisdictions and
local specificities. Responsibilities for data
(continued) privacy were assigned in each
jurisdiction.

Relevant processes have been

scrutinised and as a result the
Group implemented measures
to ensure compliance, as
well as to early identify and
address vulnerabilities.

Contractual arrangements in
relation to outsourcing providers
acting as data processors
comply with legal requirements
and best practices.

Platforms and software are

assessed to be privacy by-
design, pentests are applied to
critical systems/platforms, based
on a predefined risk matrix
considering the type and volume
of personal data processed.

A data governance project

was launched to harmonise
Group practices, meant to also
cover privacy risks.

The Group has not faced any unexpected or unusual material risks and did not undertake any material risk outside its
risk appetite and tolerance levels during 2022.

PHOTO: PROMENADA SIBIU

132 NEPI Rockcastle N.V. Annual Report 2022 133

Remuneration review
1. Key principles of remuneration
The Remuneration Report aims to provide insight into the
Group's remuneration strategy and policy for Directors
and staff.
The report has been approved by the Remuneration
Committee, that ensures that NEPI Rockcastle's
remuneration and incentive policy, practices and
performance indicators align with the Board's vision,
Group's values and business objectives.
The Group's remuneration policy and its implementation
are strategically important to the human capital and
directly affects the Group's strategy, long-term interests
and sustainability. It also aligns business objectives
and targets with the objectives and strategic priorities
of Directors and staff. The remuneration and incentive
policies are designed to motivate Directors and employees
to pursue the Group's growth and success.
The Group's philosophy is that remuneration reflects the
health of the business, is aspirational for the staff and is
the result of both personal and business outcomes.
Hence, remuneration is critical in driving the achievement
of results and attracting, engaging and retaining the
best professionals. The Remuneration Committee
and management are committed to ensuring that the
remuneration strategy:
• supports through full integration the corporate and
people strategy;
• is clear, flexible, transparent and fair and its
implementation is a priority for management; and
• is market competitive providing a balance between
performance and motivation.
The Remuneration Policy is aimed at creating a
performance-driven corporate culture, strong enough
to compete in a rapidly developing market – one that
is characterised by high turnover, low unemployment,
expertise scarcity and increased mobility towards Western
Europe or inter-continental.
Considering all these factors, the remuneration
proposition has been designed to motivate the delivery of
strong results, positive performance and the achievement
of strategic objectives, while also serving as a powerful
tool for the retention of valuable, high-achieving and
skilled professionals.
The key remuneration principles set out by the Group
remain unchanged, as they position the Group's policy
competitively in the market and serve the business
strategy:
Performance-driven pay – remuneration is driven by the
employee's role and performance, as well as the Group's
performance.
134
NEPI Rockcastle has implemented a clear process for
setting short- and long-term measurable goals, based
on Objectives and Key Results ('OKR'), to ensure greater
focus on those important business elements and results
that are directly connected to business performance and
shareholders’ return. The objective setting process is
structured along two important pillars, which are aimed to
ensure that business targets and adherence to values and
professional conduct are drivers of strong performance.
Hence, each employee and Director have pre-set annual
objectives structured as follows:
• Business objectives: key performance indicators
('KPI's) and strategic priorities;
• Key results – a breakdown of what are the essential
results expected to be delivered in order to ensure
achievement of the objective;
• Personal development objectives - professional
behaviour, management skills, adherence to the
Group's values and expected competencies.
Objectives are measured progressively throughout the
year, with an expectation of at least one ‘check-in’ mid-
year to ensure proper monitoring.
Competitive pay – the Group is committed to offering
competitive packages to its employees and Executive
Directors and is constantly observes relevant market
benchmarks. NEPI Rockcastle ensures remuneration
components are market aligned, at least at the median
and approaching the maximum for strong performers.
Total annual pay – remuneration is defined as a total
annual package and consists of three main components:
• fixed pay;
• variable pay: short- and long-term incentives, which
can be delivered in both cash and share awards, as
per the Group's incentive plan, rules of which were
last approved by shareholders in 2022 (‘the New
Incentive Plan Rules’); and
• individual and collective benefits.
Variable pay as a differentiator – the Group's
Remuneration Policy emphasises variable pay structures
as enhancers of differentiated total pay, in line with
performance, seniority and complexity of the role,
predetermined objectives and expected impact on the
business, measured in terms of results delivered and
managerial capabilities to develop, lead and motivate
people.
Fair pay – when setting pay levels and packages, the
Group aims to achieve internal equality (similar pay for
similar roles, levels of complexity and experience) and
external fairness (pay determined considering the market
levels and dynamics).
Annual pay review process – remuneration reviews are
held annually, in connection with performance reviews,
to ensure the remuneration process is benefiting the
business and is based on the performance review process.
NEPI Rockcastle N.V.
PHOTO: MEGA MALL
NEPI Rockcastle's objective is that the annual review
considers business results and individual achievements, as
well as external factors such as market circumstances and
benchmarks.
Connecting annual pay and performance reviews
enhances a business-driven, objective process, well
adapted to internal and external factors.
2. Internal and external factors influencing remuneration
related decisions
Internal and external factors affecting the Group’s
markets, industry and business generally are continually
observed and adapted to, maintaining a valuable and
flexible proposition to its staff members.
Wider external factors
The Group operates in competitive markets which are
influenced by challenging and diverse factors. Elements
related to the Remuneration Policy are workforce
dynamics, skillset availability, working arrangements and
routines and remuneration specificity across multiple
geographies.
An important external factor affecting and influencing
NEPI Rockcastle’s markets, workforce dynamics and
stability, directly and indirectly, is the Ukraine – Russia
military conflict. With five of the Group’s countries of
operation bordering either Russia or Ukraine, the pressure
created by the war was intensively felt especially in the
first half of 2022. New security measures and specific
crisis management schemes are in place at asset, country
and corporate levels to prepare for, and prevent, any
significant business disruptions. Maintaining direct contact
with staff was a priority, as well as using the Company’s
scope and resources to provide comfort and security.
Annual Report 2022
Effective risk management actions were implemented,
including, but not limited to, business continuity plans and
staff mobilisation in cases of serious repercussions.
The Ukraine – Russia military conflict affected the business
environment, by negatively impacting the perception of
stability and safety of the investments in the surrounding
geographical area. The Group experienced a generalised
increase of costs and reduced predictability over its
budgets – driven by the volatility of utilities prices,
especially electricity and interest rates hikes.
Despite the unfortunate and regretful context, the Group’s
strategy and management of the crisis have maintained
a strong business position, ensuring considerable growth,
while maintaining the safety of all the staff members.
The migration of skilled professionals to Western Europe
or other more developed regions continues to be critical
to talent availability and overall retention. The effect of
this migration was even stronger this year driven by the
instability generated by the war at the borders of Hungary,
Lithuania, Poland, Romania and Slovakia, and is expected
to continue throughout 2023.
Moreover, a large-scale introduction of hybrid and remote
work options was experienced during 2022 further
reducing the availability of skilled professionals. Major
international companies continue to leverage Central and
Eastern European talent by either relocating employees or
creating flexible working hubs across Central and Eastern
Europe, especially in Bulgaria, Poland and Romania.
The fiscal environment remained relatively stable across
CEE apart from some important changes in Poland,
which represents the second largest country of operation
for NEPI Rockcastle. This led to direct pressure on
remuneration and hence, to an in-depth review of the
annual reward packages offered to the staff members,
during the 2021 and 2022 performance and reward review
(March 2022 and February 2023).
135