Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 569

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 569
---
 to manage and control this risk properly throughout the cycle according to advanced regulatory standards and best practices. Execution of the model supports the correct setting and update of management priorities as well as the definition and implementation of internal controls to mitigate risk throughout the organization.

In this section we first detail the risk management cycle, as well as the instruments we use to manage and control operational risk. We then focus on operational resilience and the core operational risks and their mitigation plans. Last, we describe how we use insurance as a risk transfer mechanism and operational risk management in the wholesale banking business.

The operational risk cycle comprises:

• strategic planning: this covers the activities necessary to define the Group's objective operational risk profile, including setting the risk appetite, estimating annual losses and reviewing the management perimeter;

• identification and assessment of risks and internal controls: this process aims to identify the risks and factors that may cause operational risk in the organization and assess their potential impact quantitatively or qualitatively;

• ongoing monitoring of the operational risk profile , to analyse available information regularly on the nature and extent of the risks incurred in the undertaking of the Group's activities through an adequate alerts system, based on tools, such as indicators and escalation procedures.

• risk response decisions including risk mitigation and risk transfer measures: operational risk can emerge in any Group procedure, so its management requires mitigation measures for risks considered unacceptable following identification and assessment.

The analysis of operational risk exposure can conclude with the acceptance of that level of risk, the implementation of action plans to manage it, the transfer of risk through insurance or other outsourcing mechanisms or, alternatively, the discontinuation of the related activity.

Against this backdrop, contingency and business continuity plans are key as they enable us to continue activity and limit losses in the event of severe business interruptions, which are particularly sensitive in financial markets. According to the EU Digital Operational Resilience Act (DORA), it is necessary to increase digital operational resilience such as the capacity to build, support and review operational integrity and reliability, contribute to keep networks and information systems secure, and continuously provide quality financial services even in the face of disruption.

• disclosure and reporting of information necessary for decision-making.

9 Legal proceedings stemming from operational risk.

Annual report 2024 537

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

Additionally, at Grupo Santander, we have various tools that allow us to effectively manage and control risk throughout the management cycle, such as:

Internal