Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 820

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 820
---
 In particular, we are in the process of analysing and implementing the recent EBA guidelines on ESG Risk Management published in January 2025 and Scenario Analysis which are in the consultation process. Both guidelines will apply from January 2026.

2. Risk and compliance governance Grupo Santander robust risk and compliance governance structure allows us to conduct effective oversight in line with our risk appetite. It stands on three lines of defence, a structure of committees and strong Group-subsidiary relations, guided by our risk culture, Risk Pro. 2.1 Lines of defence Grupo Santander model of threelines of defence effectively manages and controls risks: – First line : formed by business and support areas that take or originate risks are primarily responsible for managing them. The first line of defence detects, measures, controls, monitors and reports on the risks it originates according to internal risk management policies, models and procedures. Risk management must be consistent with the approved risk appetite and related limits. The first line executes the mitigation plans for the risks where we have identified shortcomings in their control environment. – Second line: formed by risk and compliance functions, independently oversees and challenges risk management at the first line of defence. Its duties include ensuring that risks will be managed according to the risk appetite approved by senior management and strengthening our risk culture across the Group. The second line must supervise and challenge the control environment implemented by the first line. – Third line: internal audit function, is fully independent to give the board and senior managers assurance of high-quality and efficient risk governance and management to preserve our value, solvency and reputation. Risk, Compliance and Internal Audit are sufficiently separate and autonomous functions, with direct access to the board and its committees. The risk and compliance functions report to the risk supervision, regulation and compliance committee and the internal audit function reports to the audit committee. 2.2 Risk committee structure The board of directors has final oversight of risk and compliance management and control to promote a sound risk culture and review and approve risk appetite and frameworks, with support from its risk, regulation and compliance committee (RSRCC) and its executive committee. The Group's risk governance keeps risk control and risk-taking areas separate. Our governance structure includes key positions and executive level committees that enable us to perform effective risk control and oversight.

The Group chief risk officer (CRO) , who leads the application and execution of risk strategy and promotes proper risk culture, is in charge of overseeing all risks and challenging and advising business lines on risk management. The Group chief compliance officer (CCO