Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 573

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 573
---
 models.

Additional examples of controls that we are implementing for online banking fraud include:

→ strong customer authentication and signature to approve transactions;

→ behavioural biometrics and anti-malware protection;

→ identification and secure registration of customer devices.

Moreover, the second line of defence made progress with internal fraud management in 2024 by enhancing a related policy that applies to all Group subsidiaries and coordinating several activities to standardize how we manage these events, based on best practice and identified controls.

Cyber risk

At Santander, cyber risk management is an integral part of our operational risk control and management model. Our cybersecurity management is designed to align with international best practices and provide a framework to measure and monitor the cyber risk profile and control environment, including threats and incidents associated with the use of external service providers.

The increasing reliance on digital systems puts cybersecurity at the heart of managing non-financial risks in the financial industry. Our goal is to make Grupo Santander a cyberresilient organization, capable of preventing, detecting, and quickly responding to cyberattacks, while constantly improving and evolving our defences.

Annual report 2024 539

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagementandcompliance |

Ransomware in all its forms (data encryption and exfiltration) continues to be the prominent external threat. Moreover, distributed denial of service (DDoS) attacks associated with geopolitical tension and international conflicts in Ukraine and the Middle East, also continue to have a high incidence. During 2024, multiple events were responded to, including those involving third-party service providers. For example, on May 14, 2024, Santander announced that it had become aware of unauthorized access to a Santander database hosted by an external provider, which included certain customer and employee information. Numerous measures were immediately implemented to manage the incident, such as blocking access to the database, strengthening fraud prevention, taking preventive actions to avoid a similar incident from occurring again, and maintaining direct contact with regulatory bodies and collaborating in the investigation with law enforcement agencies. In this regard, we continue to improve risk management and develop controls in line with the Group's global cybersecurity framework and international best practices. From the second line of defence perspective, there is a framework to measure and monitor the cyber risk profile and its control environment. The key aspects of our cyber risk oversight programme in 2024 were: • the expansion of the services and scope of a global second line of defence Centre