BPCE - Risk Report - Pillar III 2020

3

RISK MANAGEMENT SYSTEM

RECOVERY PLAN

The entire system was approved by the Management Board on December 7, 2009, and presented to the Audit Committee on December 16, 2009 and to the BPCE Supervision Board. The Risk Charter was reviewed in 2017 and the body of standards consists of three Group charters covering all activities:

the Group Internal Control Charter: • an umbrella charter drawing on the following two individual – charters: the Internal Audit Charter, and – the Risk, Compliance and Permanent Control Charter. –

Internal Control Coordination Committee

The Chairman of the BPCE Management Board is responsible for ensuring the consistency and effectiveness of the internal control system. A Group Internal Control Coordination Committee, chaired by the Chairman of the Management Board, meets periodically. This committee is responsible for dealing with all issues relating to the consistency and effectiveness of the Group internal control system, as well as the results of risk management and internal control work and follow-up work. The committee’s main responsibilities include: validating the Group Internal Control Charter, the Group Risk, • Compliance and Permanent Control Charter and the Group Internal Audit Charter; reviewing dashboards and reports on Group control results, • and presenting permanent control coordination initiatives and results; validating action plans to be implemented in order to achieve a • consistent and efficient Group permanent control system, and assessing progress made on corrective measures adopted subsequent to recommendations issued by the Group Inspection Générale division, the national or European supervisory authorities, and the Permanent Control functions;

reviewing the Group’s internal control system, identifying any • shortcomings, and suggesting appropriate solutions to further secure the institutions and the Group; reviewing the allocation of resources with respect to risks • incurred; presenting the results of institution controls or benchmarks; • deciding on any cross-business initiatives or measures aimed • at strengthening the Group’s internal control system; ensuring consistency between measures taken to strengthen • permanent control and risk areas identified during the consolidated macro-level risk mapping exercise. The members of the Executive Management Committee in charge of Risk Management (Risk division) and Compliance and Permanent Controls (Corporate Secretary’s Office), and the Head of the Group Inspection Générale division, are members of this committee. Where applicable, the Internal Control Coordination Committee may hear reports from operational managers about measures they have taken to apply recommendations made by internal and external control bodies.

Recovery Plan 3.5

BPCE’s Supervisory Board approved the Group’s Recovery Plan (RP) for 2020. The plan is in line with European regulatory measures on the recovery and resolution of banks and investment firms, and with the provisions of the French Monetary and Financial Code. The objective of the Recovery Plan is to identify measures to restore the Group’s financial solidity in the event it deteriorates significantly. The plan presents the options available to the Group to launch a crisis management system. It assesses the relevance of the different options in various crisis scenarios and the methods and resources available for their implementation. The Recovery Plan is mainly based on the: Group’s organizational structure and the specific implications • of its cooperative status; identification of the Group’s critical responsibilities; •

capital and liquidity management systems; • analysis of financial crisis scenarios; •

identification of options impacting the restoration of the • Group’s financial position and their impacts on the Group’s business model; preventative oversight of leading indicators on financial and • economic conditions; establishment of the organizational structures needed to • implement the recovery. This system is monitored and coordinated by a permanent office at BPCE. The Recovery Plan is kept up to date and approved by the Supervisory Board, aided by its Risk Management Committee for these purposes. The Recovery Plan is updated annually; this year, the analysis of financial crises focused on the current Covid crisis.

40

RISK REPORT PILLAR III 2020 | GROUPE BPCE

www.groupebpce.com