The directors present the strategic report for the year ended 31 December 2025.

Origo Secure Internet Services Limited (“OSIS” or “the Company”) delivered a pleasing performance during 2025, assisting its customers to operate efficiently and securely in a competitive, digital market. Revenue increased to £17.4m (2024: £15.5m), up 12.5% from the prior year, and the Company generated an operating profit of £0.5m (2024: £0.5m). The Company continues to be cash generative.

The Company’s activities remain focused on providing technology solutions to the financial services marketplace. Management continues to prioritise service reliability, security and customer service, underpinned by targeted investment, in order to sustain profitability while supporting the needs of customers and other stakeholders.

OSIS management and its Board of Directors continually assess and manage the Company’s risks, with particular focus on material risks that could affect the Company and/or its customers. The Company’s key risks relate to strategy execution and cyber risk.

Strategy Execution

The Company is developing new products and revenue streams whilst also expanding core areas of operation. The risk that the Company invests in new products that are unsuccessful is management by a customer-focused product development strategy, and close customer engagement throughout the product development lifecycle.

Whilst the Company continues to be a market leader, there remains the risk that competition hinders its ability to maintain technological advantage and to execute its strategy. This risk is managed by continued technological innovation and investment, working in partnership with our clients to provide end-to-end, customer-focused solutions.

Cyber Risk

Cyber risk remains a key area of focus for both the Company and its customers. A dedicated Information Security Team supports the Origo Group (including Origo Services Limited, Origo Secure Internet Services and Project Source Bidco Limited), with sustained investment in people, training, capability and tools. Using both internal and external expertise, the Company regularly tests its resilience against cyber threats via extensive penetration tests. The Origo Group (via its subsidiary Origo Services Limited) maintains ISO/IEC 27001 registration and works actively with its customers to manage cyber risk.

Development and future performance

The Company continues to focus on developing new revenue streams whilst expanding its core business. There is continued investment in the people, infrastructure and business systems required to support the Company’s current and anticipated growth.

The Company places great emphasis on collaboration and an open dialogue with all its stakeholders. In particular, the Directors would like to thank the Company’s staff, its customers and investors for their continued support.

On behalf of the board

The directors present their annual report and financial statements for the year ended 31 December 2025.

The principal activity of OSIS is to connect the financial services marketplace for the benefit of everyone.

Profit before tax for the year was £512K (2024: £517K).

No ordinary dividends were paid. The directors do not recommend payment of a final dividend.

The directors who held office during the year and up to the date of signature of the financial statements were as follows:

The auditor, Johnston Carmichael LLP, is deemed to be reappointed under section 487(2) of the Companies Act 2006. A resolution proposing that Johnston Carmichael LLP be reappointed as auditor of the company will be put at a General Meeting.

So far as each person who was a director at the date of approving this report is aware, there is no relevant audit information of which the company’s auditor is unaware. Additionally, the directors individually have taken all the necessary steps that they ought to have taken as directors in order to make themselves aware of all relevant audit information and to establish that the company’s auditor is aware of that information.

The directors are responsible for preparing the annual report and the financial statements in accordance with applicable law and regulations.

Company law requires the directors to prepare financial statements for each financial year. Under that law the directors have elected to prepare the financial statements in accordance with United Kingdom Generally Accepted Accounting Practice (United Kingdom Accounting Standards and applicable law). Under company law, the directors must not approve the financial statements unless they are satisfied that they give a true and fair view of the state of affairs of the company and of the profit or loss of the company for that period.

In preparing these financial statements, the directors are required to:

• select suitable accounting policies and then apply them consistently;

• make judgements and accounting estimates that are reasonable and prudent; and

• prepare the financial statements on the going concern basis unless it is inappropriate to presume that the company will continue in business.

The directors are responsible for keeping adequate accounting records that are sufficient to show and explain the company’s transactions and disclose with reasonable accuracy at any time the financial position of the company and enable them to ensure that the financial statements comply with the Companies Act 2006. They are also responsible for safeguarding the assets of the company and hence for taking reasonable steps for the prevention and detection of fraud and other irregularities.

We have audited the financial statements of Origo Secure Internet Services Limited (the 'company') for the year ended 31 December 2025 which comprise the statement of comprehensive income, the balance sheet, the statement of changes in equity and notes to the financial statements, including significant accounting policies. The financial reporting framework that has been applied in their preparation is applicable law and United Kingdom Accounting Standards, including Financial Reporting Standard 102 The Financial Reporting Standard applicable in the UK and Republic of Ireland (United Kingdom Generally Accepted Accounting Practice).

In our opinion the financial statements:

• give a true and fair view of the state of the company's affairs as at 31 December 2025 and of its profit for the year then ended;

• have been properly prepared in accordance with United Kingdom Generally Accepted Accounting Practice; and

• have been prepared in accordance with the requirements of the Companies Act 2006.

Basis for opinion

We conducted our audit in accordance with International Standards on Auditing (UK) (ISAs (UK)) and applicable law. Our responsibilities under those standards are further described in the Auditor responsibilities for the audit of the financial statements section of our report. We are independent of the company in accordance with the ethical requirements that are relevant to our audit of the financial statements in the UK, including the FRC’s Ethical Standard, and we have fulfilled our other ethical responsibilities in accordance with these requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Conclusions relating to going concern

In auditing the financial statements, we have concluded that the directors' use of the going concern basis of accounting in the preparation of the financial statements is appropriate.

Based on the work we have performed, we have not identified any material uncertainties relating to events or conditions that, individually or collectively, may cast significant doubt on the company's ability to continue as a going concern for a period of at least twelve months from when the financial statements are authorised for issue.

Our responsibilities and the responsibilities of the directors with respect to going concern are described in the relevant sections of this report.

Other information

The other information comprises the information included in the annual report and financial statements other than the financial statements and our auditor's report thereon. The directors are responsible for the other information contained within the annual report and financial statements. Our opinion on the financial statements does not cover the other information and, except to the extent otherwise explicitly stated in our report, we do not express any form of assurance conclusion thereon. Our responsibility is to read the other information and, in doing so, consider whether the other information is materially inconsistent with the financial statements or our knowledge obtained in the course of the audit, or otherwise appears to be materially misstated. If we identify such material inconsistencies or apparent material misstatements, we are required to determine whether this gives rise to a material misstatement in the financial statements themselves. If, based on the work we have performed, we conclude that there is a material misstatement of this other information, we are required to report that fact.

We have nothing to report in this regard.

Opinions on other matters prescribed by the Companies Act 2006

In our opinion, based on the work undertaken in the course of the audit:

• the information given in the strategic report and the directors' report for the financial year for which the financial statements are prepared is consistent with the financial statements; and

• the strategic report and the directors' report have been prepared in accordance with applicable legal requirements.

In the light of the knowledge and understanding of the company and its environment obtained in the course of the audit, we have not identified material misstatements in the strategic report and the directors' report.

We have nothing to report in respect of the following matters in relation to which the Companies Act 2006 requires us to report to you if, in our opinion:

• adequate accounting records have not been kept, or returns adequate for our audit have not been received from branches not visited by us; or

• the financial statements are not in agreement with the accounting records and returns; or

• certain disclosures of directors' remuneration specified by law are not made; or

• we have not received all the information and explanations we require for our audit.

As explained more fully in the directors' responsibilities statement set out on page 3, the directors are responsible for the preparation of the financial statements and for being satisfied that they give a true and fair view, and for such internal control as the directors determine is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error. In preparing the financial statements, the directors are responsible for assessing the company's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless the directors either intend to liquidate the company or to cease operations, or have no realistic alternative but to do so.

Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor's report that includes our opinion. Reasonable assurance is a high level of assurance but is not a guarantee that an audit conducted in accordance with ISAs (UK) will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these financial statements.

A further description of our responsibilities for the audit of the financial statements is located on the Financial Reporting Council’s website at: http://www.frc.org.uk/auditorsresponsibilities. This description forms part of our auditor’s report.

Extent to which the audit was considered capable of detecting irregularities, including fraud

Irregularities, including fraud, are instances of non-compliance with laws and regulations. We design procedures in line with our responsibilities, outlined above, to detect material misstatements in respect of irregularities, including fraud. The extent to which our procedures are capable of detecting irregularities, including fraud is detailed below.

We assessed whether the engagement team collectively had the appropriate competence and capabilities to identify or recognise non-compliance with laws and regulations by considering their experience, past performance and support available.

All engagement team members were briefed on relevant identified laws and regulations and potential fraud risks at the planning stage of the audit. Engagement team members were reminded to remain alert to any indications of fraud or non-compliance with laws and regulations throughout the audit.

We obtained an understanding of the legal and regulatory frameworks that are applicable to the company and the sector in which it operates, focusing on those provisions that had a direct effect on the determination of material amounts and disclosures in the financial statements. The most relevant frameworks we identified include:

• Companies Act 2006;

• Corporation Tax legislation;

• VAT legislation; and

• UK Generally Accepted Accounting Practice.

We gained an understanding of how the company is complying with these laws and regulations by making enquiries of management and those charged with governance. We corroborated these enquiries through our review of relevant correspondence with regulatory bodies and board meeting minutes.

We assessed the susceptibility of the financial statements to material misstatement, including how fraud might occur, by meeting with management and those charged with governance to understand where it was considered there was susceptibility to fraud. This evaluation also considered how management and those charged with governance were remunerated and whether this provided an incentive for fraudulent activity. We considered the overall control environment and how management and those charged with governance oversee the implementation and operation of controls. In areas of the financial statements where the risks were considered to be higher, we performed procedures to address each identified risk. We identified a heightened fraud risk in relation to:

• Management override of controls

• Revenue recognition

In addition to the above, the following procedures were performed to provide reasonable assurance that the financial statements were free of material fraud or error:

• Reviewing minutes of meetings of those charged with governance for reference to: breaches of laws and regulation or for any indication of any potential litigation and claims; and events or conditions that could indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud;

• Reviewing the level of and reasoning behind the company’s procurement of legal and professional services;

• Performing audit work procedures over the risk of management override of controls, including testing of journal entries and other adjustments for appropriateness, evaluating the business rationale of significant transactions outside the normal course of business and reviewing judgements made by management in their calculation of accounting estimates for potential management bias;

• Tested a sample of revenue items to supporting documentation to ensure that these had been appropriately recorded;

• Completion of appropriate checklists and use of our experience to assess the company's compliance with the Companies Act 2006; and

• Agreement of the financial statement disclosures to supporting documentation.

Our audit procedures were designed to respond to the risk of material misstatements in the financial statements, recognising that the risk of not detecting a material misstatement due to fraud is higher than the risk of not detecting one resulting from error, as fraud may involve intentional concealment, forgery, collusion, omission or misrepresentation. There are inherent limitations in the audit procedures performed and the further removed non-compliance with laws and regulations is from the events and transactions reflected in the financial statements, the less likely we would become aware of it.

Use of our report

This report is made solely to the company's members, as a body, in accordance with Chapter 3 of Part 16 of the Companies Act 2006. Our audit work has been undertaken so that we might state to the company's members those matters we are required to state to them in an auditor's report and for no other purpose. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the company and the company's members as a body, for our audit work, for this report, or for the opinions we have formed.

The statement of comprehensive income has been prepared on the basis that all operations are continuing operations.

These financial statements have been prepared in accordance with the provisions relating to medium-sized companies.

Origo Secure Internet Services Limited is a private company limited by shares incorporated and domiciled in Scotland. The registered office is 7 Lochside View, Edinburgh Park, Edinburgh, EH12 9DH.

These financial statements have been prepared in accordance with FRS 102 “The Financial Reporting Standard applicable in the UK and Republic of Ireland” (“FRS 102”) and the requirements of the Companies Act 2006.

The financial statements are prepared in sterling, which is the functional currency of the company. Monetary amounts in these financial statements are rounded to the nearest £'000.

The financial statements have been prepared under the historical cost convention. The material accounting policies adopted are set out below.

This company is a qualifying entity for the purposes of FRS 102, being a member of a group where the parent of that group prepares publicly available consolidated financial statements, including this company, which are intended to give a true and fair view of the assets, liabilities, financial position and profit or loss of the group. The company has therefore taken advantage of exemptions from the following disclosure requirements:

• Section 7 ‘Statement of Cash Flows’ – Presentation of a statement of cash flow and related notes and disclosures;

• Section 33 ‘Related Party Disclosures’ – Compensation for key management personnel.

The financial statements of the company are consolidated in the financial statements of Project Source Bidco Limited. These consolidated financial statements are available from Companies House, Crown Way, Cardiff, CF14 3UZ.

At the time of approving the financial statements, the directors have a reasonable expectation that the company has adequate resources to continue in operational existence for at least 12 months from the signing of these financial statements. Thus the directors continue to adopt the going concern basis of accounting in preparing the financial statements. true

Revenue is recognised at the fair value of the consideration received or receivable for services provided in the normal course of business, and is shown net of VAT and other sales related taxes. Revenue is derived from the following primary types of services:

Revenue from annual licenses, including set up and connection fees, is recognised evenly over the period of a contract as a right to access.

Revenue from variable consideration on excess usage is recognised when excess transfers are performed.

The company acts as an agent in relation to mortality screening services and recognises revenue on a net basis.

Contract assets relate to multi-year agreements. Accrued income is recognised on the right to consideration conditional on the passage of time. Contract liabilities relate to the set up and connection fees received and recognised over the period of a contract. Payments are typically due within 30 days of invoice.

Cash and cash equivalents are basic financial assets and include cash in hand, deposits held at call with banks.

Financial instruments are recognised in the company's balance sheet when the company becomes party to the contractual provisions of the instrument.

Basic financial assets, which include debtors and cash and bank balances, are initially measured at transaction price including transaction costs and are subsequently carried at amortised cost using the effective interest method. Financial assets classified as receivable within one year are not amortised.

Financial assets, other than those held at fair value through profit and loss, are assessed for indicators of impairment at each reporting end date.

Financial assets are impaired where there is objective evidence that, as a result of one or more events that occurred after the initial recognition of the financial asset, the estimated future cash flows have been affected. If an asset is impaired, the impairment loss is the difference between the carrying amount and the present value of the estimated cash flows discounted at the asset’s original effective interest rate. The impairment loss is recognised in profit or loss.

Financial liabilities and equity instruments are classified according to the substance of the contractual arrangements entered into. An equity instrument is any contract that evidences a residual interest in the assets of the company after deducting all of its liabilities.

Basic financial liabilities, including creditors, are initially recognised at transaction price. Financial liabilities classified as payable within one year are not amortised. Basic financial liabilities are subsequently carried at amortised cost, using the effective interest rate method.

Equity instruments issued by the company are recorded at the proceeds received, net of transaction costs. Dividends payable on equity instruments are recognised as liabilities once they are no longer at the discretion of the company.

The tax expense represents the sum of the tax currently payable and deferred tax.

The tax currently payable is based on taxable profit for the year. Taxable profit differs from net profit as reported in the profit and loss account because it excludes items of income or expense that are taxable or deductible in other years and it further excludes items that are never taxable or deductible. The company’s liability for current tax is calculated using tax rates that have been enacted or substantively enacted by the reporting end date.

Deferred tax liabilities are generally recognised for all timing differences and deferred tax assets are recognised to the extent that it is probable that they will be recovered against the reversal of deferred tax liabilities or other future taxable profits. Such assets and liabilities are not recognised if the timing difference arises from goodwill or from the initial recognition of other assets and liabilities in a transaction that affects neither the tax profit nor the accounting profit.

The carrying amount of deferred tax assets is reviewed at each reporting end date and reduced to the extent that it is no longer probable that sufficient taxable profits will be available to allow all or part of the asset to be recovered. Deferred tax is calculated at the tax rates that are expected to apply in the period when the liability is settled or the asset is realised. Deferred tax is charged or credited in the profit and loss account, except when it relates to items charged or credited directly to equity, in which case the deferred tax is also dealt with in equity. Deferred tax assets and liabilities are offset when the company has a legally enforceable right to offset current tax assets and liabilities and the deferred tax assets and liabilities relate to taxes levied by the same tax authority.

The company has early adopted the FRS 102 Periodic Review amendments ("Periodic Review 2024") from 1 January 2025 as follows:

The company has applied the Periodic Review 2024 amendments to Section 23 Revenue for the first time using the fully retrospective approach and has therefore restated the comparative financial information with effect from the beginning of the preceding accounting period, 1 January 2024.

The company’s revised accounting policies for revenue are set out in note 1, including the following main changes on application of Periodic Review 2024:

• Revenue in relation to excess services performed was previously recognised at the end of contract. In line with the new usage-based royalties revenue recognition rules, the company is able to estimate variable consideration and recognise highly probable amount of revenue from the point of the customer exceeds their annual volume limit. Revenue recognised is subject to cumulative revenue not exceeding the sum of minimum pricing plus excess transfer fees earned to date.

• Multi-year agreements were previously treated as individual annual renewals. Under the new revenue recognition model, each multi-year contract is considered as a single performance obligation with a total contract price spread evenly over the total period of the contract.

• Set up and connection fees revenue was recognised at the point of contract signing. Under new revenue recognition model, such fees are combined with a relevant performance obligation of license provision and are spread over the period of a contract.

• Mortality screening fees were previously recognised as cost of sales and under the new revenue recognition model are netted off against revenue recognised.

The company has taken advantage of the following practical expedients permitted:

• for completed contracts - not restate contracts that begin and end within the same annual reporting period;

• for completed contracts - use the transaction price at the date the contract was completed rather than estimating variable consideration amounts in the comparative reporting periods;

• for prior periods presented - not to disclose quantitative or qualitative explanation of the significance of unsatisfied performance obligations and when they are expected to be satisfied.

In the application of the company’s accounting policies, the directors are required to make judgements, estimates and assumptions about the carrying amount of assets and liabilities that are not readily apparent from other sources. The estimates and associated assumptions are based on historical experience and other factors that are considered to be relevant. Actual results may differ from these estimates.

The estimates and underlying assumptions are reviewed on an ongoing basis. Revisions to accounting estimates are recognised in the period in which the estimate is revised where the revision affects only that period, or in the period of the revision and future periods where the revision affects both current and future periods.

The directors are of the opinion that there are no critical judgements or key sources of estimation uncertainty in the compilation on the financial statements.

All turnover relates to revenue recognised from contracts with customers.

The average monthly number of persons (including directors) employed by the company during the year was:

Their aggregate remuneration comprised:

The number of directors for whom retirement benefits are accruing under defined contribution schemes amounted to 1 (2024 - 1).

The actual charge for the year can be reconciled to the expected charge for the year based on the profit or loss and the standard rate of tax as follows:

Deferred tax has been calculated using the rate effective in the period it is expected to reverse.

At the year end, the company had £11,184k related to the transaction price allocated to unsatisfied performance obligations. Management expects that approximately 98% will be recognised as revenue during the next year, 1% will be recognised in 2027 with the remaining amounts recognised by 2030.

Amounts owed by group undertakings are unsecured, interest free, and payable on demand.

Trade debtors include a bad debt provisions totalling £36k (2024: £32k).

The following are the major deferred tax liabilities and assets recognised by the company and movements thereon:

The company operates a defined contribution pension scheme for all qualifying employees. The assets of the scheme are held separately from those of the company in an independently administered fund.

The company's Ordinary shares have full rights in the company with respect to voting and right to dividends.

On 1 July 2024, 4,000,000 Ordinary Shares were cancelled.

Profit and loss reserves represents cumulative profits and losses, net of dividends.

The company has applied the exemption granted by section 33 of FRS 102 to not disclose transactions with wholly owned group companies.

The company's assets are pledged as security in favour of Santander UK plc in respect of a debt facility of the company's ultimate parent company, Project Source Bidco Limited.

The company is a wholly owned subsidiary undertaking of Origo Services Limited, registered office 7 Lochside View, Edinburgh, Scotland, EH12 9DH.

The company's ultimate parent company is Project Source Bidco Limited, registered office 316a Beulah Hill, London, United Kingdom, SE19 3HF.

The smallest and largest group in which the results of the company are consolidated is Project Source Bidco Limited. Copies of the financial statements are available from its registered office.

In the opinion of the directors, the company has no ultimate controlling party.