Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 572

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 572
---
 guidelines;

• the Building the UK Financial Sector’s Operational Resilience rules published by the Bank of England (BoE), the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA);

These regulations require us to strengthen our ability to prevent and recover from disruptive events and verify that we can deliver services to our customers in all our businesses and maintain systemic stability.

To comply with the law and keep our services running, we have an operational resilience and business continuity management system (OR BCMS) that seeks to establish the continuity of services and business activities in all our subsidiaries should a disaster or major incident occur. It is a holistic management process that identifies potential threats and their impact to our operations and resources (people, apps, data, properties and others). It also defines the proper protocols and governance to provide an effective response and recovery in the shortest time possible.

Our operational resilience and business continuity application (ARK@) is vital to maintain and manage the information we use in this process.

In 2024, we continued to enhance and revise our BCMS to adapt it to the new Operational Resilience regulatory requirements, with particular emphasis on:

• critical services identification, establishing the impact tolerance for disruption for each of them, according to the bank’s risk appetite, risk capacity and risk profile;

• the Group’s board of directors approved operational resilience approach, considering our risk appetite and the tolerance for disruption to critical services;

• internal continuity strategies to minimize the impact on business activities derived from the potential disruptions to the services provided by critical suppliers;

• mandatory risk assessments and cost-benefit analyses in order to select the necessary continuity strategies for each contingency scenario identified;

• bolstering the tests we run every year to check our strategies and plans for every scenario, especially application outage;

• enhancing the methodology to manage and monitor the maturity level of subsidiary business continuity programmes.

Important mitigating measures

Mitigation measures aim to reduce or eliminate exposure to the main sources of risk that our internal and external tools uncover and to significant emerging or potential risks.

Below are the principal sources of operational risk (such as fraud, cyber risk, technology risk, supplier risk, and others) and their respective mitigation measures:

Fraud

The transformation and digitalization of the business has given rise to new risks and threats, such as more payment scams and fraud in loan applications.

To mitigate these risks, we enhanced control mechanisms and implemented new solutions, including:

• stronger authentication for customers;

• increased anti-fraud alerts in loan applications;

• transaction monitoring using advanced fraud prevention