Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 136

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 136
---
 on available tools such as indicators and escalation processes. • Risk response decisions including risk mitigation and risk transfer measures: once the operational risk assessment has been carried out, it is important to identify risk mitigation measures to prevent risks from occurring and, if necessary, to take corrective measures to minimise the economic impact of the risks that have occurred. The identification and implementation of such risk mitigating measures is an ongoing process and particularly important for adequate risk management. • Information: information includes obtaining, disseminating and making available the information necessary for decision-making to the relevant persons. The information processes are carried out in accordance with the standards and criteria established in each case. See the OVA and OVB tables for more information about this process. The group has defined an organisational model with three lines of defence for the structure and organisation of operational risk management in order to meet regulatory requirements and in to be in line with best practises in the banking sector: • The first line of defence includes all business units and support functions. The first line of defence is responsible for managing the operational risk generated in its area. Its main function within the operational risk management and control model is to identify, assess, monitor, mitigate and communicate the risks.

• The second line of defence comprises the operational risk control function within the Risk division. Its functions include: designing, maintaining and developing the operational management and control model, while promoting the development of a risk culture throughout the Group; encouraging business units and support functions to monitor and effectively manage identified risks in accordance with established limits; and ensuring that the management bodies receive adequate information on all relevant risks for decision-making. • At Santander, the Internal Audit is the independent body that performs the functions of the third line of defence. Its functions include: verifying that the risks associated with the group's activities are adequately covered; monitoring the compliance, effectiveness and efficiency of the internal control systems of operational risk; assessing the state of implementation of the operational risk management and control model in the group; and making recommendations for continuous improvement to all functions involved in OR management. For more information on risk measurement and control tools and reporting of operational risk, please refer to the EU OVA table of this document, and the 'Risk compliance & conduct management' of the 2024 Annual report.

| Access 2024 Annual Report available on the Santander Group website |

206 2024 Pillar 3 Disclosures Report

| Index |     | Introduction |     | Capital |     | Risks |     | Risk taker's remunerations |     | Append