BPCE - 2019 RISK REPORT Pillar III

RISK MANAGEMENT SYSTEM

INTERNAL CONTROL

Internal control 3.4

The Group control system relies on three levels of controls, in accordance with banking regulations and sound management practices (two levels of permanent controls and one level of periodic control), as well as the establishment of consolidated control processes in accordance with provisions approved by BPCE’s Management Board.

3

STRUCTURE OF GROUPE BPCE’S INTERNAL CONTROL SYSTEM

Supervisory Body

Responsible for the quality of the internal Control system

Audit Committee Risk Committee

Executive Body Executive managers

Remuneration Committee

Appointments Committee

Internal Control Coordination Committee (3CI)

Periodic control

Audit-Inspection function

Risk and Compliance Committee or Executive Risk Committee and specific committees for each type of risk

Outsourced activities

Review, ISS, BCP and SPB functions

Risk Management function

Compliance function

Level 2 permanent controls

Non-financial risks (Compliance, Operational Risk BPC, ISS)

Credit risks

Financial risks

Coordination of Permanent Controls

Level 1 permanent controls

Self-checks by the operational departments under managerial or functional supervision

35

RISK REPORT PILLAR III 2019 | GROUPE BPCE