30. Contingencies and guarantees
Security incidents
In 2016, the Group was notified of (a) a security incident at a number of Kimpton hotels that resulted in unauthorised access to guest payment card data (the Kimpton Security Incident), and (b) a security incident that involved malware being installed on servers that processed payment cards used at restaurants and bars of 12 IHG managed properties (the Americas Security Incident), together the Security Incidents. A provision of $5m was made at 31 December 2016, and remains in place at 31 December 2017 (see note 19), to cover the estimated cost of reimbursing the impacted card networks for counterfeit fraud losses and related expenses. At 31 December 2017, this estimate relates to both the Kimpton and Americas Security Incidents whereas at 31 December 2016 it was Kimpton related only. The estimates continue to involve significant judgement based on currently available information and remain subject to change as actual claims are made and new information comes to light.
The Group may be exposed to investigations regarding compliance with applicable State and Federal data security standards, and legal action from individuals and organisations impacted by the Security Incidents. Due to the general nature of the regulatory enquiries received and class action filings to date, it is not practicable to make a reliable estimate of the possible financial effects of any such claims on the Group at this time. To date, four lawsuits have been filed against IHG entities relating to the Security Incidents, all of which are in the early stages of litigation.
In respect of the $5m provision, it is expected that a proportion will be recoverable under the Group’s insurance programmes although this, together with any potential recoveries in respect of the contingent liabilities detailed above, will be subject to specific agreement with the relevant insurance providers.
Tax
In November 2017, the European Commission (EC) gave formal notice of a preliminary view it had reached that the Group Financing Exemption, included in the UK’s Controlled Foreign Company rules, is in breach of the EU’s State Aid rules. The EC will conduct its detailed investigation during 2018, with a final decision expected later in the year, or even in 2019. Should the EC conclude that the State Aid rules are breached, the UK can appeal before the General Court (and possibly the Court of Justice thereafter). The Group and its advisors consider that it is unlikely that a finding of State Aid will ultimately be upheld.
Other
In limited cases, the Group may provide performance guarantees to third-party hotel owners to secure management contracts. At 31 December 2017, the amount provided in the Financial Statements was $6m (2016: $5m) and the maximum unprovided exposure under such guarantees was $31m (2016: $14m).
At 31 December 2017, the Group had outstanding letters of credit of $35m (2016: $37m) mainly relating to self insurance programmes.
The Group may guarantee bank loans made to facilitate third-party ownership of hotels under IHG management or franchise contracts. At 31 December 2017, there were guarantees of $54m in place (2016: $33m).
From time to time, the Group is subject to legal proceedings the ultimate outcome of each being always subject to many uncertainties inherent in litigation. In particular, the Group is currently subject to the claims listed under ‘Legal proceedings’ on page 172. The Group has also given warranties in respect of the disposal of certain of its former subsidiaries. It is the view of the Directors that, other than to the extent that liabilities have been provided for in these Financial Statements, it is not possible to quantify any loss to which these proceedings or claims under these warranties may give rise, however, as at the date of reporting, the Group does not believe that the outcome of these matters will have a material effect on the Group’s financial position.
At 31 December 2017, the Group had no other contingent liabilities (2016: $nil).