Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 53

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 53
---
 the risk to which we are exposed to and are inherent to our activities (emerging risks and risk control self-assessment — RCSA— among others). • Common standards embedded in the day-to-day risk management. The Group shares the same risk appetite model, which sets common requirements for processes, metrics, governance bodies, controls and standards. It also facilitates an effective and traceable embedding of our appetite into more granular management policies and limits across our subsidiaries.

2024 Pillar 3 Disclosures Report 65

| Index |     | Introduction |     | Capital |     | Risks |     | Risk taker's remunerations |     | Appendices |

• Continuous adaptation to market best practices, regulatory requirements and supervisors’ expectations. • Aligning with business plans and strategy. The risk appetite is a key point of reference for strategic and business planning. We verify that the three-year strategic plans, the annual budget, and capital and liquidity planning are within the limits set in the RAS before we approve them. The strategic and business plans are aligned with our risk appetite by: • considering the risk appetite, long-term strategic view and the risk culture when drafting strategic and business plans. • challenging business and strategic plans against the risk appetite. Misalignments trigger a review of either the three-year strategic plan (to make sure we stay within RAS limits) or risk appetite limits, with independent governance. • control through the three lines of defence model that the risk appetite limits are subject to periodic oversight and that the specialized control functions report on risk profile and compliance with limits to the board and its committees every month.

B. Risk profile assessment (RPA) Risk identification and assessment activities, and risk profile calculation extend to all types of risks arising from the entity's activities. The risk framework, reviewed annually, defines the key risk types resulting from the Group's main risk identification and assessment exercises. Risk identification encompasses all processes aimed at detecting risks and vulnerabilities, both internal and external, to which the Group is exposed. These processes enable the responsible functions to become aware of these risks and form the starting point for effective management and control. Risk assessment includes processes through which the relevance of identified risks is determined, quantitatively and/or qualitatively, considering both inherent risk (before considering the effects of associated mitigant and controls) and residual risk levels. The responsible function systematically evaluates the Group's risk profile and its subsidiaries using a unique RPA methodology, based on the fundamental principles of the risk identification and assessment model: responsibility of all functions, efficiency