BPCE - 2019 RISK REPORT Pillar III

12

OPERATIONAL RISKS

Incident alert procedure

The alert procedure for serious incidents has been extended to the entire scope of Groupe BPCE. The aim of this system is to enhance and reinforce the system for collecting loss data across the Group. An operational risk incident is deemed to be serious when the potential financial impact at the time of detection is over €300,000, or over €1 million for Natixis. Operational risk

incidents with a material impact on the image and reputation of the Group or its subsidiaries are also deemed to be serious. There is also a procedure in place covering material operational risks, within the meaning of Article 98 of the Ministerial Order of November 3, 2014, for which the minimum threshold is set at 0.5% of Common Equity Tier 1.

Operational risk measurement

Groupe BPCE applies the standardized approach to calculate its capital requirements. Moreover, elements of internal control are considered in the assessment of the Group’s net risk exposures.

BREAKDOWN OF LOSSES BREAKDOWN OF LOSSES BY BASEL BUSINESS LINE

BREAKDOWN OF LOSSES BY BASEL LOSS EVENT CATEGORY

Internal Fraud 2 %

Trading and Sales (TS) 3 %

Retail Brokerage (RBR) 1 %

Corporate Finance (CF) 0 %

Commercial Banking (CB) 7 %

Execution, Delivery and Process Management 34 %

External Fraud 36 %

Corporate Items (CI) 18 %

Retail Banking (RB) 24 %

Agency services (AS) 0 % Asset Management (AM) 12 %

Business Disruption and System Failures 1 %

Damage to Physical Assets 3 %

Employment Practices and Workplace Safety 9 %

Clients, Products and Business Practices 15 %

Payment and Settlement (PS) 35 %

Operational risk mitigation techniques

In terms of Insurance, the networks and subsidiaries benefit from coverage of their insurable operational risks under group Insurance policies contracted from leading Insurance companies. In addition, the Group has set up its own captive insurance company. COVERAGE OF INSURABLE RISKS At January 1, 2019, BPCE SA had taken out (for itself): and for its subsidiaries, with the exception of Natixis • concerning the insurance coverage described in point A.a) below, with Natixis also holding its own similar coverage with a maximum payout of €15 million per year;

and for the Banque Populaire and Caisse d’Epargne networks, • except for Caisse d’Epargne Rhône Alpes, covering: the “Fraud” component of the Insurance coverage – described in point A.a) below, the “Global Banking” Insurance coverage described in point – A.b) below, the “Global Banking” component of the Insurance coverage – described in point A.d) below, and the Insurance coverage for “Property Damage” to – “Registered Offices & Similar” and to their contents (including IT equipment) and the consecutive losses in banking activities described in point E below;

216

RISK REPORT PILLAR III 2019 | GROUPE BPCE

www.groupebpce.com