Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 531

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 531
---
 we’ve assessed the effectiveness of the control that mitigates such exposure.

• Oversight: ongoing review of the ICS’s effectiveness as well as the management of material deteriorations and oversight of the mitigation plans drawn up to resolves any issues correctly. Monitoring the implementation of the ICS helps to reinforce its robustness and effectiveness.

• Governance & reporting: to make sure that we adopt accurate and clear information, and disclosure procedures for decision-making, as well as form strict governance to assess the status and performance of the ICS continuously.

To establish a robust control environment, the first line of defence:

• identifies and documents risk and control based on its knowledge and understanding of its businesses and processes. This covers the risks that we face in performing our activities and achieving the targets we set; and the controls we need to mitigate risks.

• keeps our ICS dynamic to reflect the Group’s reality, the risks that affect us, and the controls to mitigate them; and

• assesses the effectiveness of internal controls and exposure to risks, and sets and monitors the mitigation of control shortcomings and undesired exposure.

We run all of this on our Heracles system to provide a comprehensive view of Santander's ICS.

As the second line of defence, the Internal Control function:

• sets the standards and methodology for, and oversees the implementation of, the Group’s ICS. This will help safeguard the suitability and integrity of the internal risks and controls that each function sets to provide reasonable guarantee regarding the achievement of targets.

• oversees and challenges the ICS’s effectiveness by monitoring its main shortcomings, unwanted risk exposure and the correct execution of mitigation plans.

• reports a comprehensive overview of the internal control environment regularly to senior management and governance bodies to enhance our risk management.

We compile the key conclusions and main shortcomings of the RCSA in a report to submit to the CRO, CAO and governance bodies. The report outlines whether we have overcome those shortcomings correctly or have remediation plans in place to do so. It helps the CEO, CFO and CAO decide on the ICS’s effectiveness according to the Sarbanes-Oxley Act (SOx).

Annual report 2024 511

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

#### 2. CREDIT RISK
2.1 Introduction

Credit risk is the risk of financial loss when a customer or counterparty whom Santander has financed or has a contractual obligation with defaults