BPCE - 2019 Universal Registration Document

RESPONSIBLE INTERNAL AND EXTERNAL PRACTICES NON-FINANCIAL PERFORMANCE REPORT

Governance, methodology and scope of the due diligence plan In view of the issues covered by the due diligence system and the scope of risks covered, a number of divisions were involved in drafting the due diligence plan: CSR & Sustainable Development, Risks, Compliance and Permanent Control, Human Resources, Procurement, and Legal, as well as representatives from Natixis, a BPCE subsidiary also subject to the law on due diligence. Tasked with identifying the main risks liable to arise in the course of its activities, the working group selected the following two risk approaches: an approach tailored to the activities and operations of BPCE • and its subsidiaries, covered in the “Activities” pillar; an approach specific to the procurement function, developed • during the update of procurement processes as a whole, addressed in the “Procurement” pillar. In light of these identified risks, and given the obligation to provide results, reasonable due diligence measures intended to prevent the risks were identified and/or enhanced. The overall rollout of the due diligence plan is coordinated by the divisions listed above and implemented under their responsibility. The plan is designed to adapt over time as new issues and risks are identified. In preparing its due diligence plan, the Group determined the issues covered by the scope of the law, identified the risks involved in relation to the non-financial performance report and reviewed its policies and existing risk assessment and management procedures. The Group based its due diligence plan on the Declaration of Human Rights of 1789, the Environment Charter and international law more broadly. It led to a risk review covering the following: issues involving human rights and fundamental freedoms, in • particular discrimination, inequality, the right to privacy and family life, the right to protest, freedom of association and freedom of opinion; issues involving personal health and safety: health-related risk, • failure to observe legal working conditions, forced labor, child labor, violation of worker safety and unequal access to healthcare; issues relating to the environment: risk of pollution (water, • sea, soil), interfering with the fight against global warming, harming biodiversity, waste management. As a signatory of the Global Compact (for the second year, with “advanced level” obtained in 2019), Groupe BPCE has undertaken to uphold the ten associated principles covering human rights, international labor standards, environmental protection and the prevention of corruption. First, regarding the risks relating to the Group’s activities, the review scope included its employees and the main activities performed in respect of its banking business (“Activities” pillar). Second, the scope of suppliers and sub-contractors was extended with a specific system (“Procurement” pillar). For monitoring purposes, the indicators used under the TEC2020 strategic plan and for the Group’s non-financial performance disclosures enable it to monitor the implementation and effectiveness of action taken by the Group. These indicators are mentioned in the explanation of the due diligence plan.

Groupe BPCE prepares transfer pricing documentation for its intragroup transactions to comply with local transfer pricing documentation requirements in the countries where its entities are located. Transfer pricing tax compliance French legislation requires the completion of several specific tax returns and disclosures on transfer pricing. At the end of 2019, BPCE completed the new Country-by-Country (CbC) report for 2018. This report was created in accordance with Action 13 of the OECD’s Base Erosion and Profit Shifting (BEPS) action plan – a coordinated international approach to combat tax evasion by multinational enterprises. The French General Tax Code requires the arm’s length principle be applied to intragroup transactions. Groupe BPCE entities are subject to regular tax audits during which the authorities review the compliance of its transfer pricing policy. Financial institutions are also subject to specific annual reporting requirements (under the European CRD IV directive), calling for an itemized disclosure of corporate tax paid in all countries of operation. This report is included in Groupe BPCE’s annual registration document. No commercial presence in non-cooperative states or territories Groupe BPCE does not conduct any business in non-cooperative countries and territories, and there are no registered offices of Group companies in these countries. The French tax authorities publish a list of non-cooperative states or territories pursuant to Article 238-0 A of the General Tax Code. The latest list includes the following countries: Botswana, Brunei, Guatemala, Marshall Islands, Nauru, Nioué, and Panama. DUE DILIGENCE OBLIGATIONS As a French company with over 5,000 employees, Groupe BPCE is subject to the act of March 27, 2017 defining the requirements in terms of due diligence of parent companies and client companies. This act requires the Group to prepare a due diligence action plan containing measures capable of identifying and preventing risks of violations to human rights and fundamental freedoms, the environment, and occupational health and safety, which could be associated with the activities conducted by BPCE as well as its subsidiaries, sub-contractors and suppliers. The plan notably includes risk mapping, a risk assessment and mitigation measures, as well as a whistleblowing system. The Group sees this new regulatory obligation as an opportunity to reiterate and continuously improve its existing due diligence plan. It strengthens the environmental and social risk management framework implemented by the Group on a voluntary basis.

86

UNIVERSAL REGISTRATION DOCUMENT 2019 | GROUPE BPCE

www.groupebpce.com