Groupama // 2021 Universal Registration Document

5 GROUP RISK FACTORS The Group’s main risks

Pandemic 5.1.2.6 In the context of Covid-19, pandemics are a proven risk. As an insurer and economic player, the Group has suffered from this unprecedented global phenomenon, particularly in 2020 and 2021. As an insurer, it has faced claims for work stoppages, business interruption, assistance, and credit and surety. As an economic player, Groupama has also committed to several initiatives such as premium reductions, contributions to solidarity funds for micro-businesses and independent professionals, and contribution to government healthcare spending via an exceptional tax paid in 2020 and 2021. The pandemic risk is now considered “moderate”. 5.1.3.1 The steady increase in the number of security incidents (attempts to hack information systems) demonstrates the potential magnitude of this emerging risk. While these attempts have not yet succeeded in compromising the systems used by the Group, cyber-risk is a pervasive risk that can result in data theft or a denial of service (saturation of systems) leading to a significant interruption of operations. In the course of its business activities, the Group has access to its customers’ personal data (bank data, health data, etc.), which are protected in its systems, and the growing digitisation of its operations increases the Group’s sensitivity to an attack on its information systems, which could have a significant OPERATIONAL RISKS 5.1.3 Cyber-Operational risk Regulatory development risk 5.1.3.2 New laws or regulations, or changes to them, can have a significant impact on companies, business activities, or markets. The Group’s activity is subject to detailed regulation and rigorous supervision in the countries where it operates. Such regulation and supervision are subject to new regulatory or legal provisions in terms of obligations related to Solvency II, IFRS 17 on the recognition and measurement of insurance contracts, Sapin II, including corruption risks, the Insurance Distribution Directive (IDD) or the new CSR obligations. These various regulations and laws generate implementation costs and a non-compliance risk. impact on the Group’s business activity and reputation. The Cyber-Operational risk is considered “significant”.

The Group is exposed to the risk that changes in laws or regulations, or their judicial interpretation, or new provisions may result in losses due to their negative impact on the income or performance of the Group’s entities, such as the postponement of the retirement age in France. For example, the Group suffered an exceptional tax on health sales in France of approximately €91 million, related to the Covid-19 pandemic. The regulatory development risk is considered “significant”. Reputational risk 5.1.3.3 The Group is a major economic player in France (media visibility). It insures 12 million customers, employs 31,000 people, and is linked to all sectors of economic activity in France, whether as an insurer or an investor. Its reputation may be harmed by unfavourable media coverage (articles in the press or on the Internet) or by litigation in connection with a claim. It may be threatened by defamatory information about its financial position, its management, its handling of a health crisis or natural disaster, its duty to advise, a publicised dispute, or a brand partnership. For example, the increase in consumer programmes with a large TV/radio audience and the use of social media, where all customers can express themselves, has led to an increase in the number of publicised disputes likely to harm the confidence essential to the Group’s business. For the Group, the reputational risk is considered “moderate”. The war in Ukraine that took place on 24 February 2022 as a result of the invasion of Russian troops on Ukrainian territory is generating a context of great international instability, the outcome of which no one knows today. The risks associated with this war are the subject of special monitoring within the specialized risk committees and at the level of the governance bodies. In the present situation, the initial forecasts and estimates made in terms of investment portfolios and activities are not significant. Indeed, the Group is not present in Ukraine or Russia. However, the Group remains vigilant. Indeed, an overflow of the conflict beyond Ukraine’s borders or a protracted war could have more serious consequences for the economic environment and the resulting damage assessment and impact on the Group could vary. To date, it is very difficult to predict precisely all the impacts of this war whose timing and outcome are totally unknown. WAR IN UKRAINE 5.1.4

113 Universal Registration Document 2021 - GROUPAMA ASSURANCES MUTUELLES