Ghislain FOTSING

Founded and leads an AI-powered process automation practice operating across regulated financial services and adjacent sectors. Designs and deploys multi-agent AI platforms that transform complex, manual GRC and operational workflows into intelligent, auditable pipelines — reducing cycle times by up to 80% while maintaining full regulatory traceability.

About LCH SA: LCH SA is a leading European clearing house headquartered in Paris, serving as a critical financial market infrastructure. As part of the London Stock Exchange Group, it provides central counterparty (CCP) services across multiple asset classes including derivatives, bonds, and equities. LCH SA acts as an independent risk manager between trading parties, guaranteeing the performance of trades and helping maintain financial stability by effectively managing counterparty risks. The clearing house processes trillions of euros in transactions annually, serving a global client base of banks, brokers, and institutional investors across European and international markets. Key responsibilities: • Deployment of the RCA (Risk & Control Self Assessment) framework; • Remediation planning and oversight (internal audit, regulators, 2nd & 3rd lines of defense); • Governance and risk committee facilitation; • GRC tooling strategy and configuration; • Third-Party Risk Management: cybersecurity posture assessments, Résilience plan from Third Party compromise; • Security testing leadership: coordination of pentests, vulnerability assessments, code review cycles and management ; • IT recovery test coordination aligned with DORA’s Operational Resilience requirements.

About INETUM: INETUM is a global IT services company operating in 26 countries with 28,000 employees, specializing in IT innovation, cybersecurity, industry solutions, and digital transformation. Key Achievements: Established and led a new practice focused on GRC, cybersecurity, and IT risk management Built and managed a team of 40 consultants, handling recruitment, coaching, and performance evaluations Structured the service offering around 5 core pillars: Cybersecurity (framework implementation, security assessments, incident response) IT Operational Risk (RCSA implementation, risk remediation, operational loss management) IT Compliance (regulatory alignment with GDPR, DORA, industry standards) IT Audit (control effectiveness verification, specialized audit expertise) Cross-functional GRC transformation initiatives Led a DORA compliance program for a major banking client Developed strategic technology partnerships with key vendors (IBM, ServiceNow) Oversaw integration of emerging technology risks (AI, Cloud, IoT) into client risk frameworks Guided clients through complex regulatory audits and IT resilience transformations This role showcased my ability to build and lead high-performing teams while delivering integrated solutions across cybersecurity, IT risk management, and regulatory compliance domains.

I joined CAPTEO in Paris - France (based near to the “Louvres Museum”) as a senior-manager 2 (acting as director) in charge of the development of our Technology risks And Controls Practice. The practice is dedicated to support our clients in technology Risk Identification (including Cybersecurity risks and Innovation driven new risks), recording and tracking of these risks using GRC Tools (including GRC Tools implementation and settings), assessment of these risks (including assessment of Tech Operational risks in FS sector as per ACPR requirement) and management of these risks. CAPTEO is a 15 years's strategy and management consulting firm dedicated to the financial sector. The firm have a very good reputation within majors tiers 1 bank in France and in Europe. In this position, I reports directly to the Partner in charge of the Risk and Finance Practice and my main activities are:  Commercial: With the support of the partner, developing a go-to-market strategy for the practice. This includes (but not limited to): a) Building and execute an action plan that describes how we will acquire, retain, and grow customers. B) Conduct the business development activities of the Practice: Pre-Sales, Drafting responses to Tender, interview. C) Develop and promote the expertise of the Practice (writing articles, participating in partner events, helping to create communication media);  Operational: With the support of the partner, run the practice. This includes (but not limited to): a) Lead, follow and deliver projects; Staffing and/or resource management for both freelance and internal resource; Reporting activities to the clients and the senior management;  Management: Involved in the recruitment process in coordination with the partner and the HR department; Accompany the teams in the realization of their missions and the evolution of their skills; Ensure close monitoring of employees; Ensuring collaborative working conditions and enabling innovation.

I am Manager within the Risk Assurance (RA) department in PwC Luxembourg. In that role i am performing the audit of IT systems (Applications, middleware, Operating System and Databases levels) in the context of certification of financial statements. My mains clients are Insurance companies, Asset management institutions (TA, MANCO (Management Committee), Etc...) and Banks (Either Depositary bank, privates banks or more). In addition and in my attribution of GDPR leader for the department (cross multi lines of services) i am happy to help our clients to comply with this new regulation. More by issuing an attestation report on GDPR's agreed criterias, I am helping them to show to their shareholders and to the Luxembourg regulator (CNPD) that they are compliant. I also perform the Internal audit either in outsourcing mode or in a co-sourcing mode. In Outsourcing mode I am performing the IT Internal audit on the behalf of the keys players in Luxembourg market. In the co-sourcing mode I am supporting the Internal Audit department of my clients on a specific audit universe they may be interested with. During my spare time I am doing lot of different and interesting things with the aims of thinking about how assurance of the Future may look like. That includes but not limited to get more insight on the following disruptive technologies which will deeply transform the way companies are dealing with risks and controls: Artificial Intelligence, Robotics Process Automation (RPA), Cloud and blockchains.

Assist the CISO in performing following activities: 1) Creation and implementation of the computer emergency response team/ computer security incident response team across the group (19 countries) in order to be ready in case of malicious attacks. 2)Define the cybersecurity plan at the group level and submit for validation by the company senior management 3) Assess the controls (technical and process) aiming either to prevent or detect or either to protect or respond to a cyberattack such as NotPetya at the group level 4) Assessing controls in place in order to comply with Information regulatory requirement such as PCI DSS, DSP-2 directives, Europeans statuts of Etablissement de Monnaie Électronique (EME) 5) Leading the working group on GDPR implementation at the group level 6) Working on the framework of the Information technology controls for financial and other systems ( worldwide) and the link with the company’s ERM. In addition working on the implementation of a GRC tool with the group risk management team 7) Working on the POC and the selection of the Information security operations center (ISOC)

Fixed Incomes IT - Risk and Controls global leader (Paris/London/Hong Kong/New York) a) Assist the Global heads of Fixed Incomes IT in identifying Risk, Fixing risk and Tracking Risk. b) Coordinate internal audit with Internal auditors. IT Regulatory compliance : a) IT SOX Coordinator for France : SOX testing methodology, definition systems test, Plan of testing phases (IT General Controls), Supervision of offshore team, debriefing of issues with control owners or BU manager, monitoring of actions plans, management of relationship with external IT auditors. b) ISAE 3402 Coordinator for IT Systems in Asset Management : Definition of systems, Coordination of testing evidences , participation in the debriefing phase, monitoring of recommendations and actions plans, management of relationship with auditors and control owners. c) IT Application testing manager: Definition of systems to test, Monitoring or setting up of application controls review (Understanding of control in place, Understanding of key risks, drawing of process flowchart with key risks, managing of the test of one and test of effectiveness of controls), Issuing of Report with test results, debriefing of issues with appropriate managers. d) IT General Control Review Manager : Understanding of IT entities level controls and IT environment controls, Auditing of change management process, review of logical access and security, Review of IT operations (jobs schedules, incidents and problem management, back-Up and tapes review), IT - Internal control monitoring plan : a) Running internal control plan in various asset classes in GBM France b) Testing of Toxic combination c) Involved in various thematic review IT - Operational risk management: a) Monitoring of Dispensation, risk acceptance processes and audit issues b) Involved in IT Problems description and recording of action plan in Operational Risk system

Senior Experimented in Ernst & Young FSO (Financial Services Office) practice which includes Ernst and Young expertise in the Banking (both Retail and Corporate and Investment banking) sector, financial institutions, Asset Management and Insurance companies. Range of skills : IT Audit - Internal Control System - Involved in the implementation of the Internal Control System IT and non IT (SOX 404) - Assistance of Certified Accountants by auditing of the IT Systems - Review of IT Applications controls and IT Infrastructure (Network, Operating Systems and DataBase) - Audit of IT Security - Audit of outsourcing, Service Level Agreement (SLA) and SLA reporting. - Audit of Oracle DataBase (9 and / or 10 g release) and AS400 OS in the context of certification of annual accounts - Audit of the Business Continuity Plan (BCM / BCP) for critical activities. - Assist the Head of Internal Audit for all matters relating to the IT audit. IT Governance - Improving IT governance and the IT organization. - Search for potential improvement of IT processes (increase the effectiveness and efficiency). - Satisfaction surveys of users of IT services. IT Security - Logs Analyzing - Involved in security of Group information systems and data for level 1 application (ISO 27000, CobiT). Training - Enhancing user awareness of IT security - Training for IT Audit (Big4 IT Audit methodology - Ernst and Young) - IT Operationnal Risk training

Financial statements auditors (companies based in East region of France) : Main portfolio : Association (1901 Act, about 30 associations), Trading companies, French steel group, building and civil engineering companies Involved in specific review of the statutory auditors Audit of projects financed by the European Commission and or donors Implementation of audit procedure and the audit approach of risk analysis in the context of the integration of the former Cabinet (Chevry and Associates) in the network Constantins become DELOITTE & ASSOCIATES