Euronext - 2020 Universal Registration Document

Risk Management & Control Structure

Mitigation Measures

CYBERSECURITY RISK The Group makes significant efforts to mitigate cybersecurity risks, whether from threat actors or vulnerabilities, frommaterializing by making targeted investments in people, processes and technology. The Group has a specific cybersecurity strategy, roadmap, and a Group-wide established governance model supported by dedicated resources. The roadmap and strategy are challenged by internal audits, external auditors and regulators from all countries where Euronext operates regulated markets. Euronext implements a security strategy and best practices aligned and certified in recognized global standards ( e.g. ISO9001, ISO 27001, NIST) and seek to ensure a high level of cybersecurity maturity. Despite the Group’s efforts, cybersecurity threats continue to grow in sophistication and thus the risk cannot be eliminated. TECHNOLOGY RISK The performance and availability of the Group’s systems are reviewed continuously and monitored to prevent problems when possible and responding, in a timely and efficient manner, when problems do occur. Euronext continuously invests in the development of its technology in order to maintain and ensure best in class service and capacity. The Group seeks to identify and manage risks associated with third party risk by partnering with reputable technology and services providers, via audits of the technology, backups and business continuity arrangements with its partners as well as information on remediation plans should any of its providers experience service issues. CHANGE MANAGEMENT AND INTEGRATION MANAGEMENT RISK Euronext seeks tomanage the risks related to change and integration management by implementing an effective project management team that works with all relevant stakeholders to monitor and implement projects. Governance is an important control and is determined by scale, complexity and level of impact of the change. The risk management team actively follows projects to monitor and escalate risk when necessary. CLEARING AND SETTLEMENT RISK Euronext has contracts with each of its post-trade providers that establish clear governance and service quality. Specifically, with LCH SA a long-term contract has been signed between two entities, in addition to which Euronext holds 11.1% stake in LCH SA as well as a seat on the Board of Directors all of which help ensure a stable durable relationship and involvement in decision-making. Euronext holds approximately 5% of Euroclear S.A./N.V. as well as membership on the Board of Directors ensuring that Euronext’s is involved decision-making.

environment and monitoring, improved high risk alerts to identify critical users, daily monitoring of threat intelligence. Employee awareness raising around increased attempts at phishing attacks during this particular period. Employee workshops on sanitary measures and generalized usage of collaborative applications occurred in order to help avoid slippage with respect to projects as much as possible. Euronext will continue to closely monitor the risks posed by COVID-19 going forward, with particular attention to maintaining the health and safety of its employees by applying the recommendations of local authorities and working to reinforce IT resilience. STRATEGIC TRANSFORMATION RISK Euronext closely monitors its transformation programs, which include formal frameworks that establish governance bodies to organize, implement and follow the integration of recently acquired entities. Group knowledge and expertise is increasing as the Group gains capacity, competence and experience in integrating new companies into the Group and delivering synergies. REGULATORY EVOLUTION AND ENHANCED REGULATORY SCRUTINY RISK Euronext actively monitors all relevant European and national legislative and regulatory policy developments and engages in regular discussions with issuers and trading members, European and national policy-makers, and regulators to provide input and respond to developments and consultations attempting to ensure an acceptable impact on our markets. However, Euronext remains subject to all applicable regulations and directives signed into law whether they be detrimental to Euronext’s business or not and may translate into an additional regulatory burden for the Group or its entities. GLOBAL AND REGIONAL ECONOMY Euronext considers international institutions’ economic outlooks and analyst forecasts to assess the level of this risk. The Covid-19 crisis Euronext has demonstrated the resilience of its business model (diverse asset classes, geographic regions and other sources of income). COMPETITION ON CAPITAL MARKETS RISK Innovation in the equity sector and movements in the competitive landscape are closely monitored and actions are taken to protect market share and develop new offerings to attract trading. Euronext is focused on delivering the highest quality liquidity management with the aim of providing a deep pool of liquidity and best bid and offer. Euronext is subject to competition from peers in our local markets however; it equally competes with peers on their home markets. Euronext identifies unlisted companies and maintains targeted pre- IPO educational programmes regarding the mechanics of capital markets.

2

55

2020 UNIVERSAL REGISTRATION DOCUMENT