BPCE - 2020 Universal Registration Document

NON-FINANCIAL PERFORMANCE STATEMENT

BEING A RESPONSIBLE GROUP IN ITS INTERNAL AND EXTERNAL PRACTICES

In addition to the six establishmentsbenefiting from a complete mapping in 2019 (mainlandFrance and overseas territories), four establishmentswere added in 2020. Two other establishments also have partial mapping to date. Between the work carried out at Group level and that carried out directly by the institutions, 90% of the institutions have at least a partial identification of the risks to which they are exposed. BUSINESS CONTINUITY KPI The Business Continuity KPI is structured around five themes: the governance of the business continuity system, which • includes preparing employees for crisis situations through awareness-raising actions, and participating in exercises for some of them; risk analysis, whether inherent or exogenous to the • institution’s activities; the implementation of the system which ensures that the • resources to be mobilized are in line with the defined continuity objectives; its control of the system; • a specific topic dedicated to supplier monitoring. • Once a year, the institutions fill in the 42 control points making up the business continuity control questionnaire in the Group’s permanent control management tool (PRISCOP). The KPI reports the results of these responses. It stands at 92% for 2020 compared to 85% the previous year, when the business continuity policy was updated and the KPI structure adjusted. The KPI reflects more broadly the new requirements of the risk management policy. FIRST LESSONS FROM THE COVID-19 CRISIS Covid-19 is the first crisis requiring massive, widespread and persistent use of business continuity provisions. It is already possible to draw some lessons that can be transposed to other major climate, health or technological risks. The handling of the crisis is largely governed by the decisions of the public authorities, of almost immediate application and which partly replace the methods defined in the plans at the level of the economic agents. They must then operate with great agility in order to comply with the directives of the public authorities, as was the case with the generalized lockdown for which the Group has anticipated and strengthened its remote access system for its employees and taken the opportunity to expand its catalog of end-to-end digital customer service offers. In addition, whatever the level of preparation, which must be maintained at the highest level of requirement, government decisions, such as the possible requisition of certain categories of masks, may limit the effectiveness of the actions initially planned. However, the Group did not wait for this requisition to bring its stock to healthcare workers. In the initial phase of the crisis, Groupe BPCE had to deal with the impacts of Covid-19 on its Asian operations, learning from the measures enacted by local government authorities.

Drawing on this experience and the pandemic plan put together after previous avian and swine flu outbreaks, the Group launched a rapid, appropriate and proportionate response in the rest of the world, and particularly in mainland France. Four areas of concern guided the Group’s decision-making: protection of people (employees and customers); • guaranteeing customers access to banking services and • adapting the relationship to the crisis situation; securing the Group’s refinancing; • participation in the resilience of the financial market. • The Group’s crisis management system, initially mobilized for observation purposes, transitioned to operational mode and was ultimately incorporated in the crisis decision-makingbody (Group executives) as the crisis grew worse, in accordance with the Group crisis plan. Telework infrastructures, already operational, were expanded to address the Group’s needs during the projected lockdown period. Information system security, including GDPR aspects, compliance considerations and anti-fraud controls, was adapted for telework conditions across all relevant operational processing chains. Group HR and communication resources were heavily mobilized to adapt nominal working conditions for staff and enhance social cohesion during lockdown. At the same time, Group institutions rolled out their crisis management system, staying connected at all times and in line with the Group crisis management system. Centered on the Group Coordination Unit, special business line crisis units were added in order to meet the specific challenges of each business line (Retail Banking and Insurance, Finance, etc.). Structural measures were initiated to ensure the continuous management of the Group’s liquidity position and make the switch to a massive, secure telework environment. The Group’s suppliers and service providers were informed and called on to guarantee their own system, incorporating our measures for employees required to work on our premises. A legal and social watch was conducted throughout this event to ensure that the Group met the expectations of government authorities. During lockdown, and now that the lockdown is gradually being lifted, Group institutions are making every effort to ensure the safety of employees and external agents by implementing collective and individual measures, while also constantly emphasizing the proper social distancing practices to be employed. The Group has also made protecting its customers a top priority, starting with their physical protection by promoting technological solutions such as “contactlesspayment” in stores and contactless identification for welfare benefits, but also by immediately deploying government economic measures (in particular state-guaranteed loans (SGL), postponement of loan maturities, customer subscription to online banking solutions including remote signature and contracting, mailing check books, etc.). However, the branches remained open to customers with no other access to banking services.

112

UNIVERSAL REGISTRATION DOCUMENT 2020 | GROUPE BPCE

www.groupebpce.com