Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1090

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1090
---
 risks and monitoring of cybersecurity threats. For more information regarding these board committees see sections 4.5 'Audit committee activities in 2024', 4.8 'Risk supervision, regulation and compliance committee activities in 2024' and 4.10 'Innovation and technology committee activities in 2024' in the ‘Corporate governance’ chapter of this annual report on Form 20-F. For information regarding the experience of the members of these board committees, see section 4.1 'Our directors' in the ‘Corporate governance’ chapter of this annual report on Form 20-F.

Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures and maintaining cybersecurity programs. The Group Chief Operating & Technology Officer and dedicated personnel are certified and experienced information systems security professionals and information security managers. The Group Chief Operating & Technology Officerjoined the Group in 2018 and has held senior management and IT-related positions within the Group and other companies such as AXA Group. Management, including the Group Chief Operating & Technology Officer and our Global Chief Information Security Officer (who reports to the Group Chief Operating & Technology Officer), regularly, as well as on an as-needed basis, update the board of directors, the innovation and technology, risk supervision, regulation and compliance and audit committees on the Group’s cybersecurity programs, material cybersecurity risks and mitigation and remediation strategies and provide cybersecurity reports that cover, among other topics, cybersecurity threats and incidents and updates of the Group’s cybersecurity programs and mitigation strategies.

In 2024, an increase in cybersecurity events has been observed, primarily related to DDoS attacks and events involving third-party

| 972 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

service providers. For example, on 14 May 2024, we announced that we had become aware of the 2024 Unauthorized Access. We do not currently consider any of these events to have materially affected our operations and customer data.Our team remains vigilant and committed to maintaining and enhancing as needed our cybersecurity measures designed to protect against evolving cybersecurity threats.

Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cyberattack, data breach, data loss or other security incident. For more information about these risks, please see 4. 'Risk