Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 576

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 576
---
 the proper application of policies and procedures to manage risk that is insurable in our subsidiaries. This collaboration is governed by: • NFR's participation as a permanent member in the quarterly corporate insurance forum; • NFR's attendance at the quarterly claims forum, which monitors and enhances processes for loss recovery via insurance; • procedures outlining the interaction model between NFR and Corporate Insurance, as well as other functions that correspond to the various insurance typologies (e.g., facilities, cybersecurity and, legal, among others). These procedures pursue the proper management of insurance throughout the entire process of identification, assessment, transfer, and retention of risk; • twice-yearly coordination of the mapping of risks to insurance across the Group, with the objective of monitoring the effectiveness of insurance coverage, and identifying and correcting any potential gaps in coverage.

We continue to adapt how we use insurance to align our management with changes in the risk environment. Against this backdrop, we extended our analysis and added coverage related to climate change, cyber risk, the digital landscape and other elements to make sure that the policies and governance of the non-financial risk and corporate insurance functions respond to these and other emerging cross-cutting risks. Analysis and oversight of controls in Corporate & Investment Banking (CIB) Given the nature, specificity and complexity of financial markets, CIB must enhance operational risk management and control continuously. We implemented these enhancements in 2024: • Enrichment of processes to drive automation and operational excellence in the services provided to our customers, based on a culture of quality that promotes the best CIB standards in every market; • Reinforcement of the control framework for market activity by enhancing the design of controls, the quality of their execution, and other aspects. We continue to focus on the risk of unauthorized trading as a CIB risk management priority, for which we have clearly defined controls; • Strengthening of the vendor risk management function through monitoring focused on critical and high risk services and targeted reviews of critical third-party processes to boost the risk profile and promote compliance with internal and regulatory requirements. We placed special emphasis in 2024 on meeting all the requirements set out under the DORA's Act; • Strengthening cybersecurity control measures to protect against information leaks and cyber attacks in interactions with third parties (including SaaS 10 providers); controls over user access to systems (privileged user access); and technological contingency tests. In addition, we enhanced monitoring and challenge exercises to execute controls correctly.

10 SaaS - Software as a Service

Annual report 2024 541

| Contents |