Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 134

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 134
---
 risk management model in 2024 in the risk assessment and control tools, operational risk appetite, operational resilience, as well as the integration and reporting of new risks (such as transformation risk, data risk or climate risk) into the non-financial risk monitoring and control model. In terms of key risks, the business opportunities arising from digital transformation include new risks, such as technology risks, cyber risks and increasing dependence on suppliers, which increases potential exposure to events that could affect the delivery of services to our customers. The group has taken numerous initiatives to mitigate these risks and adapt to changes in the regulatory framework, the focus being on strengthening its ability to recover from disruptive events affecting its core operations. For more information, see the 'Risk, compliance & conduct management' chapter of the 2024 Annual report.

| Access 2024 Annual Report available on the Santander Group website |

Operational risk reporting should cover the following objectives: • Provide the heads of business units and support functions with the data they need to manage their risks and meet their objectives and strategies. • Provide senior management with the information it needs to establish, review and where appropriate, modify business strategies and risk profiles. • Provide the operational risk function with the information necessary to efficiently discharge its duties. • Comply with the information requests of supervisory and regulatory bodies. The business and support functions of all group entities are responsible for identifying, assessing and communicating their operational risks. The Operational Risk function in each Group unit collects information from all business and support functions and reports on it in established local forums.

Subsequently, the corporate Operational Risk function consolidates the information available from each unit in order to provide a comprehensive and complete overview of the group's operational risk profile. At the group level, the process of consolidating and reporting operational risk information is divided into the following phases: • Reception of information: the local operational risk functions submit various types of information to the corporate operational risk function with the frequency that is specified in the related procedures and guidelines. Although information can be sent via various channels, the Heracles corporate tool is the primary tool for collecting and recording information. • Consolidation and processing of the information: once all the information has been received, the corporate operational risk function conducts a qualitative analysis, checking the suitability and consistency of the data and the main deviations. • Use of information: the consolidated information is used for reporting to external parties as well as to the group's senior management. The reports' content is updated and developed in response to the needs of the governing bodies. Heracles is the