Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 135

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 135
---
 Golden Source of the operational risk data of the Group. One of its main components is the database of events and losses for this risk, which is used in internal and regulatory reporting and in the calculation of economic capital. In addition, Heracles contains all the necessary tools for operational risk analysis and management: controls, risks, metrics, scenarios and mitigation measures. Its functionality integrates all these programs through the use of common taxonomies applied in the different control communities and common methodologies for assessing risks and the effectiveness of controls. Heracles is also the tool used to perform certifications related to various regulations such as SOX, Volcker and FATCA. Risk mitigation is one of the core elements of the operational risk framework and consists of continuous monitoring of risks exposure to identify risks above established levels, implement control procedures, provide training and reduce the occurrence of events and losses. This information is shared on a regular basis with the governing bodies in order to ensure proper monitoring and control. For Santander, insurance is also a key element in operational risk management. The Corporate Insurance function is responsible for the use of risk transfer formulas to optimize and safeguard the bank´s financial results. The group constantly monitors the appropriate implementation of policies and procedures for managing insurable risks, in collaboration with the relevant group areas that contribute to their correct execution in the various units.

2024 Pillar 3 Disclosures Report 205

| Index |     | Introduction |     | Capital |     | Risks |     | Risk taker's remunerations |     | Appendices |

For further information on the specific management of the principal operational risks, as well as global insurance programs, please refer to the 'Risk, compliance & conduct management' of the 2024 Annual report.

| Access 2024 Annual Report available on the Santander Group website |

The following are the key operational risk management and control processes: • Strategic planning: covers the activities necessary to define the Group's objective operational risk profile, including setting the risk appetite, estimating losses annually and reviewing the management perimeter. • Identification and assessment of operational risk: aims to identify the risks and factors that may cause operational risk in the organisation and assess their potential impact quantitatively or qualitatively. The first lines of defence, which include all organisational units of the group, are responsible for identifying and assessing the operational risks in their activities. • Continuous monitoring of the OR profile: this process aims to regularly analyse available information on the nature and extent of the risks incurred in the development of the group's activities through an adequate alerts system, based