BPCE - 2018 Risk report / Pillar III

NON-COMPLIANCE, SECURITY AND OPERATIONAL RISKS Operational risks

Operational risk mitigation techniques In terms of Insurance, the networks and subsidiaries benefit from coverage of their insurable operational risks under group Insurance policies contracted from leading Insurancecompanies. Inaddition, the Group has set upits own captive Insurance company. COVERAGE OF INSURABLE RISKS At January1, 2018, BPCE SA group had taken out (for itself): and for its subsidiaries, with the exception of Natixis concerning ● the Insurance coverage described in point A.a) below, with Natixis also holding its own similar coverage with a maximum payout of € 15 million per year; and for the Banque Populaire and Caisse d’Epargne networks, ● except for Caisse d’Epargne Rhône-Alpes, covering: the “Fraud” component of the Insurance coverage described in - point A.a) below, the “Global Banking” Insurance coverage described in point A.b) - below, the “Global Banking” component of the Insurance coverage - described inpoint A.d) below, and the Insurancecoveragefor “PropertyDamage”to “Registered - Offices & Similar” and to their contents (includingIT equipment) and the consecutivelosses in bankingactivitiesdescribedin point E below; the following main Insurance policies to cover its insurable operational risks and protect its balance sheet and income statement: A. A combined “Global Banking (Damage to Valuables and Fraud)” &“ProfessionalCivil Liability” policy with a total maximum payout of € 178 million per year of Insurance, of which: € 30 million per year, combined“Fraud/ProfessionalCivil Liability” a) Insurance available, subordinate to the amounts guaranteed set out in b) and/or c) and/or d) below (with Natixis also holding its own similar coveragewith a maximumpayout of € 15 million per year); € 38 million per claim and per year, solely reserved for “Global b) Banking” risk;

€ 25 million per claim and per year, solely reserved for c) “Professional CivilLiability”risk; € 70 million per claim and per year, combined “Global d) Banking/Professional Civil Liability” Insurance available in addition to or after use of the amounts guaranteedset out in b) and/or c) above. The maximumamountthat can be paid out for any one claimunder this arrangement is € 109.75 million under “Professional Civil Liability” coverage and € 109.75 million under “Fraud” coverage in excess of the applicable deductibles. B. “Regulated Intermediation Liability” (in three areas: Financial Intermediation, Insurance Intermediation, Real Estate Transactions/Management) with a total maximum payout of € 10 million per claim and per year. C. “Operating Civil Liability” covering € 100 million per claim, as well as a “SubsidiaryOwner Civil Liability”/“PostDelivery-Reception Civil Liability” coverage extension for up to € 35 million per claim and per yearof Insurance. D. “Company Directors Civil Liability” for up to € 200 million per claim and per year of Insurance. E. “PropertyDamage”to “RegisteredOffices & Similar” and to their content (including IT equipment) and the consecutive “losses in banking activities”,for up to € 400 million perclaim. F. “Protection of Digital Assets against Cyber-Risks” & the consecutive “losses inbanking activities”,for up to € 140 millionper claim and per year of Insurance. This coverage extends worldwide for initial risk or umbrella risk, subject to certain exceptions, mainly in terms of “Professional Civil Liability” where the policy does not cover permanent institutions based in the United States (where coverage is obtained locally by Natixis’ US operations). All the Insurance policies mentioned above were taken out with reputable, creditworthy Insurance companies and in excess of the deductibles and Groupe BPCE’s risk-retentioncapacity.

11

211

Risk Report Pillar III 2018