Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 185

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 185
---
 the information provided is true and reliable, establishing the necessary controls to guarantee this and correcting any weaknesses.

#### Second line of defence
Risk and Compliance & Conduct functions, as the second line of defence, will provide independent challenge and oversight of the risk management activities performed by the first line of defence. This second line of defence should oversee, within their respective domains of responsibility, that risks are managed in accordance with the risk appetite

defined by senior management and promote a strong risk culture throughout the organization.

The internal control function within the Enterprise Wide Risk Management (EWRM) function will be responsible for establishing the criteria and monitoring the implementation and effectiveness of the Santander Group Internal Control System. This will help the adequacy and integrity of the internal controls established by the different functions to provide reasonable assurance in the achievement of the defined objectives (which include, among others, the reliability of financial and sustainability reporting).

#### Third line of defence
The internal audit function periodically assesses that policies, methods and procedures are adequate and effectively applied for the management and control of accounting, financial and management information. The annual audit plan, which was carried out on the basis of a robust risk assessment process (Top-down & Bottom-up methodology), provides reviews of the main aspects contained in this report.

In this way, issues related to climate risk and disclaimers are regularly verified as well as compliance with the rules and procedures established in the General Code of Conduct (GCC), independently monitoring their adequacy and effectiveness and those of their local developments. the Open Channel is reviewed and specifically evaluates compliance with data protection regulations.

The audit function reports to the Audit Committee, which, among other functions, assists the board in the supervision and evaluation of the process of preparing and presenting financial and non-financial information, as well as internal control systems.

Risk management and internal controls over sustainability information

In order to control the quality and reliability of the information included in the Sustainability Statement, Santander implemented an Internal Control System that complies with the most demanding international standards and complies with the guidelines established by the Committee of Sponsoring Organisations of the Treadway Commission (COSO).

Like the Sustainability information itself, at Santander we are evolving our Internal Control System so that it covers all the material aspects identified for 2026.

First, we identify the most material risks and then establish the necessary controls, complying with the requirements regarding the disclosure of sustainability information.

The most significant aspects taken into account in the process of preparing sustainability information are the following:

• Identification and definition of quantitative and qualitative