Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 500

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 500
---
 an organization. In particular, we have defined measures in this area aimed at reinforcing the risk culture, reducing the attack surface and combating phishing scams, among others.

• Automated and assisted cyber defence. Taking advantage of the capabilities provided by advanced technologies to reduce response times, such as the use of AI to speed up analysis by cybersecurity teams, providing more dynamic and efficient defence capabilities.

• Resilience. Strengthening resilience globally is essential to sustainably defend the bank against evolving threats.

The Santander Fusion Center, which integrates the cybersecurity and IT monitoring teams, carries out the functions of detection, monitoring and response to operational failures and cybersecurity events for the Group's entities, 24 hours a day, seven days a week.

Information systems are regularly reviewed through internal and external audits. Santander identifies IT assets, systems and information (including those of third parties) and periodically reviews the risks and level of protection to proactively detect and remedy potential weaknesses. The activities performed comprise periodic security tests including vulnerability scans, penetration tests and red team exercises that simulate real cyber-attack scenarios.

In addition to periodic testing and review, independent certification authorities review and certify our critical cybersecurity processes. Certifications, including International Organization for Standardization (ISO) 27001:2022 and 27017, Statement on Standards for Attestation Engagements (SSAE) 18 and Payment Card Industry Data Security Standard - PCI DSS4.0, are regularly reviewed and updated, including new processes and controls on an annual basis.

For more details on the cybersecurity initiatives we ran in 2024, see section 3.3.1 'Conduct with customers' in the 'Sustainability statement' chapter. For details on the measurement, monitoring and control of cybersecurity-related risks, and their respective mitigation plans, see section 5.2 'Operational risk management' in the 'Risk management and compliance' chapter.

Annual report 2024 479

| Contents |     | Business model and strategy |     | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagement and compliance |

Fintech ecosystem

Santander actively participates in the fintech ecosystem in all the regions in which we operate. We work with fintech companies as partners as part of our efforts to foster and channel innovation while improving customer experience and efficiency. Through our Fintech Station programme, we work with startups and scale-ups in pilot programmes and implement or co-create new products and services with them. In 2024, Santander Fint