Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 571

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 571
---
ational damage. This statement has associated loss and control environment metrics.

• Statements regarding technology risk, cyber risk, the cloud, fraud, financial crime compliance, product sales, regulatory compliance, model risk, data management, and supplier risk management, and their own forward-looking monitoring metrics.

Economic capital model

Our economic capital model for operational risk takes a loss distribution approach (LDA) that captures our operational risk profile and calculates economic capital based on information collected from the internal and external event databases and scenario analyses. We use it to determine operational risk economic capital and estimate expected and stressed losses to set operational risk appetite.

Moreover, we use other instruments to analyse and manage operational risk, such as the assessment of new products and services and transformation initiatives; business continuity plans (BCP); review of the management perimeter and corporate insurance policy coverage; recommendations from internal and external auditors and supervisors; and the quality assurance process.

Our management, assessment and reporting system for operational risk, Heracles, supports the operational risk programme and tools through a governance, risk and compliance (GRC) approach and provides information on our subsidiaries and the Group. Heracles also facilitates better operational risk management decisions by using a common set of taxonomies and methodological standards to allow for information consolidation, duplication prevention, and reporting simplification. Through Heracles, we aim for employees to have a timely, complete, and precise view of their operational risks.

Annual report 2024 538

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

Operational resilience and the business continuity plan

The digital transformation, which is ramping up due to the entry of new players with more digital business models, is revolutionizing how banks operate and presenting new business opportunities. At the same time, this structural change has increased exposure to emerging risks such as technology risk, cyber risk, and further dependency on third party suppliers, which heighten the potential exposure to events that could affect the services that we offer to customers.

Thus, regulation continues to focus on the importance of operational resilience through:

• the DORA Act, along with its implementing rules, which complements the perspective of risk related to Information and Communication Technologies (ICT). It encompasses any reasonably identifiable circumstance related to the use of networks and information systems that, if it occur, may compromise the security of networks, systems, tools, processes, operations, or the provision of services;

• the Basel Principles for Operational Resilience