Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 522

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 522
---

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

Our corporate risk framework defines each key risk type. They are (click on each one type for more details):

|                  |     | Credit risk     |     | Operational risk     |
|                  |     | Market risk     |     | Financial crime risk |
|                  |     | Liquidity risk  |     | Model risk           |
|                  |     | Structural risk |     | Reputational risk    |
|                  |     |                 |     | Strategic risk       |
| ESG risk factors |     |                 |     |                      |

Given the cross-cutting impact that ESG (environmental, social and governance) risk factors can have on the different types of risks that exist in different time horizons, our ESG risk management requires a comprehensive view to be able to manage and control these risks correctly, align with the Group’s sustainability strategy, and meet regulatory requirements and supervisory expectations.

| For more details about ESG factor management, see the section'2.3Embedding ESG in risk management'of the 'Sustainability statement'. |

1.3 Risk and compliance governance Our risk and compliance governance structure emanates from our board of directors and is set up to promote autonomy between management and control functions according to our three lines of defence model. Our units’ adherence to corporate frameworks gives us a common governance model that we replicate across our footprint. Lines of defence Grupo Santander’s risk governance keeps the functions of each line of defence separate to manage and control risks effectively. This model is key to ensuring that the Group remains robust, secure and sustainable.

| 1st |     | The business and support functions that take or originate risks are primarily responsible for managing them. The first line detects, measures, controls, monitors and reports on the risks it originates according to internal risk management policies, models and procedures. Risk management must be consistent with the approved risk appetite and related limits. The first line of defence executes the mitigation plans for the risks where we have identified shortcomings in their control environment. |

| 2nd |     | The second line of defence, comprising the risk and compliance functions, independently oversees and challenges risk management at the first line of defence. Its duties include promoting that risks are managed according to the senior management approved risk appetite, and strengthening our risk culture across the Group. The second line of defence must supervise and challenge the