Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 593

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 593
---
's risk appetite and the EU AI Act 17 . Additionally, it is necessary to consider the progressive entry into force of the AI Regulation in the EU (AI Act), which will have a high regulatory impact on the implementation and use of AI systems classified as high-risk. Our generative AI platform makes sure that the developments we undertake in the Group comply with our internal security and ethical control policies. Potential disruption of a critical ICT 18 supplier Digitalization is increasing banks’ reliance on information and communication technology (ICT) and making them particularly vulnerable to potential disruptions and associated threats. This could result in the loss of data and disruption to our business. Some of Grupo Santander's mitigating measures in this regard are comprehensive and strictly governed due diligence prior to ICT supplier onboarding, including supplier certification and regular monitoring and review; and exit strategies and business continuity plans for potential failures or disruptions, which we test regularly.

Central bank digital currencies (CBDC) and disintermediation risk The digital versions of fiduciary currencies issued by central banks (central bank digital currency — CBDC), especially those that target retail customers, could impact on financial system stability if they replace traditional current accounts, which in turn could affect commercial banks’ volume, structure and cost of funding. To mitigate CBDC risk, the Group: • Actively participates in the debate on CBDC with domestic and international authorities to explain the risks to financial stability and propose solutions to mitigate them. • Monitors central banks’ CBDC projects to analyse their impact on the business or the possibility of developing new services for our customers to mitigate impact. • Sets up multidisciplinary working groups with banking associations, think tanks, regulators and others to foresee and escalate, if necessary, potential CBDC impacts. Risk of suffering a severe cyber attack Our goal is to achieve a cyber-resilient organization capable of withstanding large-scale cyberattacks that could disrupt the normal functioning of the bank. In line with new regulatory requirements, the objective is to enhance all necessary capabilities to preserve the security of networks and information systems that underpin the continuous provision of financial services and their quality, even in the face of significant disruptions. To achieve this, we have a governance and control framework that allows us to measure and monitor the cyber risk profile and its control environment, with the aim of maintaining a high level of digital operational resilience and an effective and prudent management of ICT-related risks.

| For more details on the main cybersecurity risks, see 'Cyber risk' in section5.2 ‘Operational risk management’. |

|