The Risk Register is a key document set out in the Performance Assurance Schedule. This schedule drives the structure of the risk register as follows: 1. It drives the Risk Register to focus on Retail Risk, which includes both compliance with the Code, but also the delivery of right outcomes, both for customers and market participants. 2. It is clear that the Risk Register covers both Party performance and that of the REC Service Providers. 3. It limits any Performance Assurance interventions to areas identified in the Risk Register. Retail markets are both dynamic and complex, often with specific issues occurring and needing to be resolved quickly, with information from multiple participants needed to identify their root cause. The Risk Register, therefore, is structured with risks structured around the REC objectives. ‘Risk Drivers’ are associated with risks which measure the market and trigger appropriate action. These Risk Drivers can measure either compliance or customer outcomes. This Risk Register is reviewed annually by the Code Manager and approved by PAB. The Code Manager has conducted a review for 2025-26 and proposed changes covering: • Removed Retail Risk VI which was added last year as a result of expected increase in transformation activities resulting from transfer of responsibility for the Central Registration Service (CRS) from DCC to RECCo. Whilst there continues to be transformation of REC Service Provision, the level of risk associated with it is reduced. This is, therefore, no longer viewed as a key risk affecting the effective operation of REC arrangements. • Introduction of new Risk Drivers to monitor: o Usage of Change of Occupier (CoO) flag during switching. These are separated by Domestic and Non-Domestic supply points as trends and behaviours in both segments may vary. Based on insights from R0155, which clarified the REC requirements for CoO, we understand if the CoO flag is misused, it can lead to Erroneous Switches especially if some Suppliers have opted to not object to CoO Switch Request. Introducing this Risk Driver helps us monitor if any Supplier have disproportionality high usage, indicating if outcomes were at risk. Once these Risk Drivers are live, we will review performance for the previous 6 months as the CSS reporting is already available and propose thresholds for PAB approval in the following month. o IF045 for issues with Meter Operator Agent (MOA) Appointments. Suppliers are required to appoint a qualified MOA to every meter point they supply, and it measure would help us measure their compliance and identify any meter points open to safety risk due to lack of MOA appointment. This is dependent on reporting from DIP after migration to MHHS arrangements starts. Once the reporting is available and we have a view for c. 6 months of performance data, we will use that to propose thresholds for this Risk Driver. • General housekeeping changes, including: o Removed reference to activities that formed part of the Performance Assurance Operating Plan (PAOP) for 2024-25. o Added reference to activities within PAOP 2025-26. o Updated reference to active REC Change Issues and Proposals. When making these updates, we also considered other possible updates to the Risk Register. Notably this included considering items that have progressed through the change process and rejected or withdrawn, but evidence suggests there is still a user need or risk. These include: a. R0169 Introduction of End of Gate Closure notifications, a change raised in response to the CSS Major Incident in 2023, which intended to help CSS Users identify when all processing is completed. b. R0009 Introduction of SDEP and EES User Maintenance API, which recent sandbox applications indicate a continued need for machine-to-machine interactivity. Both of these were rejected or withdrawn as a cost beneficial solution could not be identified. Whilst we considered raising a Retail Risk, we think these kinds of identified issues are best managed through the Change Panel and Codes Roadmap, or the future Design Authority. This consultation offers REC Parties and Service Providers an opportunity to feedback on the updates proposed to the Retail Risk Register. The Code Manager has also presented this document to the Performance Assurance Board (PAB) on 30 September 2025 and sought their approval, contingent to any refinements that may be made in response to the feedback received. As the Retail Risk Register is a Category 3 document, an industry wide consultation is not required as part of updating the document. Notwithstanding, we have identified that engaging with industry is a key part of implementing the changes and are therefore seeking feedback through a consultation in order to support our Performance Assurance activity.