Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 570

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 570
---
 event database

The internal events database collects and records internal operational risk events, whose impacts could be financial impact (e.g., losses and provisions, regardless of their amount) or non-financial impact (i.e. relating to regulation, customers and/or services). This information:

◦ enables us to conduct root-cause analysis;

◦ increases the awareness of risks for better operational risk management;

◦ enables the escalation of relevant operational risk events to senior risk executives in the shortest time possible;

◦ facilitates regulatory reporting;

◦ facilitates the development of the economic capital model within the internal capital adequacy assessment process (ICAAP).

External event database

This database contains quantitative and qualitative information about external operational risk events, which facilitates detailed analysis of relevant events in the industry; comparison with Group and subsidiaries’ loss profiles; and preparation for the Risk control self-assessment (RCSA) exercises, insurance and scenario analysis.

It provides an additional source of information to internal events, which boosts operational risk management.

Scenario analysis

This is a tool to analyse highly unlikely events that could result in significant losses and establish appropriate mitigating measures based on the assessment and opinion of experts from business lines and risk managers. Scenario analysis results are also used as input to the economic capital models.

RCSA

The RCSA is an assessment of the operational risks and control environment associated with the Group's activities and operations. Its key aim is to assess inherent and residual operational risk, as well as the design and effectiveness of controls and whether they

need to be strengthened or new mitigating actions need to be put in place.

It includes detailed reviews to identify cyber, technology, fraud, supplier and other risk factors that could generate operational risk or a failure to observe the law. The RCSA also covers regulatory compliance, conduct risk and financial crime.

Key operational risks (KORs)

Top-down assessment that considers senior managers’ concerns and opinions about operational risk so that the rest of the organization can review them appropriately and we can include them in the RCSA.

Key risk indicators (KRIs)

These provide quantitative information about our risk exposure and control environment. The most relevant indicators are those related to the bank’s main risk exposures, and are part of the operational risk appetite.

Risk appetite

It has the following structure:

• A global non-financial risk appetite statement, which asserts our commitment to controlling and limiting non-financial risk events that can result in financial losses; fraud events; operational and technological incidents; legal and regulatory infractions; issues associated with conduct; or reput