UNIVERSAL REGISTRATION DOCUMENT 2023

5 GROUP RISK FACTORS The Group’s main risks

Although the pressure from Covid ‑ 19 began to subside in 2022, neither France nor other countries are immune to a new wave or epidemic. The pandemic risk is now considered “moderate”.

5.1.3.3 Reputational risk The Group is a major economic player in France (media visibility). It insures 12 million customers, employs 31,000 people, and is linked to all sectors of economic activity in France, whether as an insurer or an investor. Its reputation may be harmed by unfavourable media coverage (articles in the press or on the Internet) or by litigation in connection with a claim. It may be threatened by defamatory information about its financial position, its management, its handling of a health crisis or natural disaster, its duty to advise, a publicised dispute, or a brand partnership. For example, the increase in consumer programmes with a large TV/radio audience and the use of social media, where all customers can express themselves, has led to an increase in the number of publicised disputes likely to harm the confidence essential to the Group’s business. For the Group, the reputational risk is considered “moderate”. For the sector as a whole, 2022 and 2023 were marked by rising inflation (and therefore repair costs) and the exceptional weather ‑ related loss experience. With regard to the pension reform, the Government’s decision to maintain the retirement age of persons with disabilities at 62 will limit the impact of the reform for the Group, despite a slight increase in the loss experience expected in health and protection insurance because of the continued employment of individuals aged 62 to 64. The regulatory development risk is now considered “moderate”. These risks, which often cut across the Group, can potentially impact its risk profile as the Group faces a number of changes in its environment: heightened physical risks of climate ‑ related litigation (impacts that include sustainability factors such as the preservation of biodiversity, water, etc.); ❯ heightened liability and image risk in the event of claims of environmental or social “greenwashing”; and ❯ heightened transition risk if the CSR and sustainability strategy or climate impact of a product or service is not aligned with the action plans and commitments of the Group and its stakeholders. ❯ The classification of sustainability risks and the Group’s actions in this area are presented in chapter 4 – “Corporate Social Responsibility (CSR)” of this document. 5.1.4 SUSTAINABILITY & CSR RISKS

5.1.3

OPERATIONAL RISKS

5.1.3.1 Cyber ‑ Operational risk The steady increase in the number of security incidents (attempts to hack information systems) demonstrates the potential magnitude of this emerging risk. While these attempts have not yet succeeded in compromising the systems used by the Group, cyber ‑ risk is a pervasive risk that can result in data theft or a denial of service (saturation of systems) leading to a significant interruption of operations. In the course of its business activities, the Group has access to its customers’ personal data (bank data, health data, etc.), which are protected in its systems, and the growing digitisation of its operations increases the Group’s sensitivity to an attack on its information systems, which could have a significant impact on the Group’s business activity and reputation. The Cyber ‑ Operational risk is considered “significant”. Regulatory development risk New laws or regulations, or changes to them, can have a significant impact on companies, business activities, or markets. The Group’s activity is subject to detailed regulation and rigorous supervision in the countries where it operates. Such regulation and supervision are subject to new regulatory or legal provisions in terms of obligations related to Solvency II, IFRS 17 on the recognition and measurement of insurance contracts, Sapin 2, including corruption risks, the Insurance Distribution Directive (IDD) or the new CSR and sustainability obligations. These various regulations and laws generate implementation costs and a non ‑ compliance risk. The Group is exposed to the risk that changes in laws or regulations, or their judicial interpretation, or new provisions may result in losses due to their negative impact on the income or performance of the Group’s entities, such as the extension of the retirement age in France. For example, the Group had been subject to an exceptional tax on health insurance premium income in France of around €91 million associated with the Covid ‑ 19 pandemic. 5.1.3.2

171

Document d’Enregistrement Universel 2023 GROUPAMA ASSURANCES MUTUELLES