Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 56

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 56
---
aker's remunerations |     | Appendices |

3.2.2. Risk governance structure The board of directors is ultimately responsible for risk and compliance management and control. It revises and approves the bank's risk frameworks and appetite while promoting a strong risk culture across the Group. The board relies on its risk supervision, regulation and compliance committee for risk control and on the Group’s executive committee for risk approval. For more details on board committees, see the 'Corporate governance' chapter and 'Risk and compliance management' chapter of the 2024 Annual report.

| Access 2024 Annual Report available on the Santander Group website |

3.3. Lines of defence In this section, the provisions of letters (b), (c) and (d) of the CRE - Qualitative disclosure requirements related to IRB approach requirement -Institution risk management approach, are complied with. Our model of three lines of defence effectively manages and controls risks: • First line: formed by the business units and support functions that take or originate exposure to risk, it detects, measures, controls, monitors and reports on risks it originates according to internal risk management regulation. Risk management has to be consistent with the approved risk appetite and related limits. The first line of defence executes the mitigation plans for the risks where we have identified shortcomings in their control environment. • Second line: formed by the risk and compliance functions. It independently oversees and challenges the first line’s risk management. • Third line: the internal audit function, which is independent to ensure the board of directors and senior managers with high quality and efficient internal controls, governance and risk management systems, helping to safeguard our value, solvency and reputation. The Risk, Compliance and Internal Audit functions are separate and independent. Each has direct access to the board of directors and its committees. 3.3.1. Second line of defence Its duties include ensuring that risks are managed according to the risk appetite defined by senior management and strengthening our risk culture throughout Grupo Santander. The second line of defence has to supervise and challenge the control environment implemented by the first line. 3.3.2. Third line of defence The Internal Audit applies the definition of the Institute of Internal Auditors. It is a permanent function and is independent of all other functions and units. Its mission is to provide the board of directors and senior management with independent assurance with regard to the quality and efficacy of the systems and internal control, risk (current and emerging) management and governance processes, helping to safeguard the organisation's value, capital