Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 376

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 376
---
 automated back-up systems that support critical systems and

require little manual intervention owing to redundant systems and communication lines, high availability systems and data back-up.

Internal control policies and procedures for outsourced activities and valuation services from independent experts

Grupo Santander has a corporate outsourcing and third party agreement framework and third party approval policies and procedures to cover outsourcing risks properly.

The Group must adhere to this framework (and the models and policies that build on it), which meets the EBA's requirements for outsourcing and risk management with third parties and complies with DORA Regulation.

Key processes include:

• tasks to initiate, record, process, settle, report and account for transactions and asset valuations;

• IT support in terms of software development, infrastructure maintenance, incident management, security and processing; and

• other material support services that are not directly related to financial reporting, such as vendor management, property management, HR management and others.

Key control procedures to ensure adequate coverage of risks in these processes are:

• documenting relations between Group companies with comprehensive service agreements;

• documenting and validating by the Group’s service providers of processes and controls for the services that the Group´s vendors perform; and

• external suppliers undergoing an approval process to ensure that the relevant risks associated with the services they provide remain within acceptable levels (according to the Group's risk appetite) and to encourage them to prove the effectiveness of their internal controls through external certifications.

Grupo Santander reviews its estimates internally according to its control model guidelines. It will hire the services of a third party to help with specific matters upon confirming their expertise and independence and approving their methods and rationale of assumptions though relevant procedures.

In particular, we have controls in place to ensure the integrity and quality of information on external suppliers of key services that could affect the financial statements. These controls are comprehensively detailed in the service level agreements that form part of the respective contracts with third parties.

For more details, see 'Supplier risk management' in the section 5.2. 'Operational risk management' in the 'Risk management and compliance' chapter.

Annual report 2024 341

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagement and compliance |

8.4 Information and communication

Group accounting policies

Accounting policies should be understood as a complement to local financial and accounting rules. Their overarching aims are (i) for statements and financial information to be made available to management bodies, supervisors and the market to provide accurate and