Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 575

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 575
---
, we used a risk-based approach that focused on suppliers that could increase the potential risk level in our operations and customer services in the Group’s subsidiaries. We increased monitoring of those suppliers to check that: • they have an appropriate control environment in accordance with established Group policies and that mitigate the risk level of the service provided; • business continuity plans are in place to enable the delivery of the service even in the event of a disruption; • the proper controls are in place to protect the information processed during the provision of services; • contracts and third-party agreements include the required clauses to protect the interests of our customers and the Group, while providing coverage of the legal obligations in force; • regular monitoring of these suppliers is carried out, with particular attention to service level agreements and the regular testing of their business continuity plans; • exit strategies are defined, including reversion or migration plans, particularly for those services with a high impact on business continuity and difficult to replace.

Annual report 2024 540

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

We continue to embed our environmental, social and governance approach in our strategy and culture to build a more responsible bank. Because our suppliers may have an impact on the environment and broader society, we implemented a new certification procedure to verify that they follow the Group’s ESG sustainability standards and criteria. Other key mitigating actions We are constantly improving our risk mitigation measures related to customer, products, and business practices. Santander has specific frameworks and policies on the marketing and selling of products and services; customer complaint handling and analysis; financial crime prevention; and compliance with new regulations.

| For more details on compliance risk mitigation, see section6.2'Compliancerisk management'. |

Insurance in operational risk management Santander considers insurance a key component of operational risk management. The Corporate Insurance function is responsible for the use of risk transfer formulas to optimize and safeguard the bank's financial results. We have global insurance programmes for property damage, civil liability, fraud, expenses arising from cybersecurity breaches, and third-party claims against directors and officers of the Group (D&O insurance). We supplement these global policies with a wide range of local insurance policies that adapt to the characteristics of each subsidiary and are taken out according to the insurance risk management model that the Corporate Insurance area implements in each market. This area works with the Non-Financial Risk (NFR) function to perform continuous monitoring and oversight of