BPCE - 2018 Registration document

RISK REPORT Non-compliance, security and operational risks

BREAKDOWN OF LOSSES BY BASEL LOSS EVENT ➡ CATEGORY

INCIDENT ALERT PROCEDURE The alert procedure for serious incidents has been extended to the entire scope of Groupe BPCE. The aim of this system is to enhance and reinforce the system for collecting loss data across the Group. An operational risk incident is deemed to be serious when the potential financial impact at the time of detection is over € 300,000, or over € 1 million for Natixis. Operational risk incidents with a material impact on the image and reputation of the Group or its subsidiaries are also deemed to be serious. There is also a procedure in place covering material operational risks, within the meaning of Article 98 of the Ministerial Order of November 3, 2014, for which the minimum threshold is set at 0.5% of Common Equity Tier 1. OPERATIONAL RISK MEASUREMENT Groupe BPCE applies the standardized approach to calculate its capital requirements. Moreover, elements of internal control are considered in the assessment of the Group’s net risk exposures. Breakdown of losses BREAKDOWN OF LOSSES BY BASEL BUSINESS LINE ➡

Internal Fraud 6%

Execution, Delivery and Process Management 51%

External Fraud 23%

Clients, Products and Business Practices 19%

Business Disruption and System Failures 0%

Damage to Physical Assets 1%

51% of gross losses (including losses associated with model risk) were recorded under “Execution, delivery and process management”.

OPERATIONAL RISK MITIGATION TECHNIQUES

In terms of Insurance, the networks and subsidiaries benefit from coverage of their insurable operational risks under group Insurance policies contracted from leading Insurance companies. In addition, the Group has set up its own captive Insurance company. Coverage of insurable risks At January 1, 2018, BPCE SA group had taken out (for itself): and for its subsidiaries, with the exception of Natixis concerning ● the Insurance coverage described in point A.a) below, with Natixis also holding its own similar coverage with a maximum payout of € 15 million per year; and for the Banque Populaire and Caisse d’Epargne networks, ● except for Caisse d’Epargne Rhône-Alpes, covering: the “Fraud” component of the Insurance coverage described in - point A.a) below, the “Global Banking” Insurance coverage described in point A.b) - below, the “Global Banking” component of the Insurance coverage - described in point A.d) below, and the Insurance coverage for “Property Damage” to “Registered - Offices & Similar” and to their contents (including IT equipment) and the consecutive losses in banking activities described in point E below; the following main Insurance policies to cover its insurable operational risks and protect its balance sheet and income statement: A. A combined “Global Banking (Damage to Valuables and Fraud)” &“Professional Civil Liability” policy with a total maximum payout of € 178 million per year of Insurance, of which: € 30 million per year, combined “Fraud/Professional Civil Liability” a) Insurance available, subordinate to the amounts guaranteed set out in b) and/or c) and/or d) below (with Natixis also holding its own similar coverage with a maximum payout of € 15 million per year);

Corporate Items 2%

Corporate Finance 1%

Asset Management 8%

Payment & Settlement 23%

Trading & Sales 60%

Commercial Banking 2% Retail Banking 4%

6

Retail Brokerage 0%

60% of the biggest losses (including losses associated with model risk) were recorded under “Trading and Sales”.

691

Registration document 2018