BPCE - 2020 Universal Registration Document

RISK FACTORS & RISK MANAGEMENT

OPERATIONAL RISKS

OPERATIONAL RISK MEASUREMENT Groupe BPCE applies the standardized approach to calculate its capital requirements. Moreover, elements of internal control are considered in the assessment of the Group’s net risk exposures.

HIGHLIGHTS The following special measures were applied to oversight of operational risks:

measurement of impact completeness: joint oversight between CBCP (Contingency and Business Continuity Plan) functions • and operational risks, with exchange of information and recognition of operating losses due to Covid-19 (during monthly videoconferencing sessions of institutions’ operational risk functions); verification of completeness and quality of data input to the information system: weekly check of all operational risk incidents • entered by all Group entities to ensure that Covid-19 related losses are clearly flagged as such (control carried out by Operational Risk Function team); new incidents and monthly increases/decreases are reported for operational risk events related directly or indirectly to the • health crisis (COREP view) as of March 1 (external fraud; execution, delivery and process management; damage to physical assets; employment practices and workplace safety; business disruption and systems failures; clients, products and business practice; internal fraud); establishment of monthly reporting on Covid-19 losses for submission to the ECB, Group executive managers and the • operational risk function (under the responsibility of the consolidated operational risks team).

BREAKDOWN OF LOSSES BREAKDOWN OF LOSSES BY BASEL BUSINESS LINE

OPERATIONAL RISK MITIGATION TECHNIQUES In terms of Insurance, the networks and subsidiaries benefit from coverage of their insurable operational risks under group Insurance policies contracted from leading Insurance companies. In addition, the Group has set up its own captive insurance company. COVERAGE OF INSURABLE RISKS On January 1, 2020, BPCE SA had taken out (for itself): that of its subsidiaries, including Natixis; • and for the Banque Populaire and Caisse d’Epargne networks, • except for Caisse d’Epargne Rhône Alpes, covering: the “Fraud” component of the Insurance coverage – described in point A.a) below; the “Global Banking” Insurance coverage described in point – A.b) below; the “Global Banking” component of the Insurance coverage – described in point A.d) below; and the Insurance coverage for “Property Damage” to – “Registered Offices & Similar” and to their contents (including IS equipment) and the consecutive losses in banking activities described in point E below. The following main Insurance policies to cover its insurable operational risks and protect its balance sheet and income statement: combined “Global Banking (Damages to Valuables and A/ Fraud)” & “Professional Civil Liability” policy with a total maximum payout of €215.5 million per year of insurance, of which: €72.5 million per year, combined “Fraud/Professional Third a) Party Liability” and underlying the guaranteed amounts indicated in b) and/or c) and/or d) below;

Retail Brokerage (RBR) 1 % Commercial Banking (CB) 2 % Retail Banking (RB) 12 %

Trading and Sales (TS) 2 % Corporate Finance (CF) 0 %

Corporate Items (CI) 59 %

Payment and Settlement (PS) 21 % Agency services (AS) 0 %

Asset Management (AM) 3 %

6

BREAKDOWN OF LOSSES BY BASEL LOSS EVENT CATEGORY

Execution, Delivery and Process Management 13 %

Internal Fraud 1 %

External Fraud 22 %

Business Disruption and System Failures 2 %

Employment Practices and Workplace Safety 7 %

Damage to Physical Assets 21 %

Clients, Products and Business Practices 34 %

695

UNIVERSAL REGISTRATION DOCUMENT 2020 | GROUPE BPCE