NATIXIS // 2021 Universal Registration Document

3 RISK FACTORS, RISK MANAGEMENT AND PILLAR III Risk management

Natixis is exposed to these risks because of the transactions it executes with its customers (for example, loan activities, over-the-counter derivatives (swaps, options, etc.), and repurchase agreements, etc.). Securitization risk Securitizationsare transactionswhereby credit risk inherent to a set of exposures is housed in special-purpose entities (generally a special-purpose entity (SPE) or “conduit”), which is then divided into tranches, usually for the purpose of selling them to investors. The SPE issues units that may in some cases be subscribed for directly by investors, or by a multi-seller conduit which refinances the purchases of its shares by issuing short-maturity notes (treasury notes or commercial paper). Rating agencies assess the creditworthiness of available-for-sale units for investors. In general, securitizations have the following characteristics: they result in a material transfer of risk where the transaction is V originated by Natixis; payments made in the course of the transaction depend on the V performance of the underlying exposures; the subordination of tranches, defined by the transaction, V determines the distribution of losses over the term of the risk transfer. Market risk Market risk is the risk of loss in value caused by any adverse fluctuations in market parameters. These parameters notably include the prices of securities (bonds, equities) and raw materials, interest rates, prices derivative financial instruments and foreign exchange rates. Asset liquidity is an important componentof market risk. In the event of insufficient or non-existent liquidity (for example, because of a reduced number of transactions, or a major imbalance in the supply and demand of certain assets), a financial instrument or any other tradable asset may not be able to be traded at its estimated value. The absence of liquidity may lead to reduced access to Capital Markets, unforeseen cash or capital requirements, or legal restrictions. Operational risk Operational risk is the risk of loss due to inadequateor failed internal processes, whether this is attributable to employees or information systems, or relate to external events with financial, regulatory, legal or reputational impacts. The Groupe BPCE Insurance Department is tasked with analyzing insurable operational risks and taking out appropriate insurance coverage. Natixis and its subsidiariesbenefit from insurance policies pooled with Groupe BPCE against potentially significant consequences resulting from fraud, embezzlement and theft, operating losses or the incurring of Natixis’ civil liability or that of its subsidiaries or the employees for which it is responsible. Non-compliance risk Non-compliance risk is defined in French regulation as the risk of a legal, administrative or disciplinary penalty, accompanied by significant financial losses or reputational damage, that arises from a failure to comply with the provisions specific to banking and financial activities, whether these are stipulated by national or directly applicable European laws or regulations, or by instructions

from executive officers, issued in accordancewith the policies of the supervisory body. This risk is a sub-category of operational risk, by definition. Cyber risk Cyber risk is caused by a malicious and/or fraudulent act, perpetrated digitally in an effort to manipulate data (personal, banking/insurance,technical or strategic data), processesand users, in order to cause material losses to companies, their employees, partners and clients. The transformation of banking information systems, the new technologies it heralds and the increased outsourcing of related services offer cybercriminals new opportunities to carry out increasingly sophisticated and automated attacks. Natixis’ ability to conduct its business is determined by the availability of its information system, the guaranteed integrity and confidentiality of data and the traceability of everytransaction. Reputational risk Reputational risk is the risk of damage to the confidence shown in the Company by its customers, counterparties,suppliers, employees, shareholders, supervisors, or any other third parties whose trust, in whatever respect, is a prerequisite for the normal conduct of business. Reputational risk is essentially a risk contingent on the other risks incurred by the bank. Legal risk Legal risk is defined under French regulationsas the risk of any legal dispute with a third party, arising from an inaccuracy, omission or deficiency that may be attributable to the Company’s operations. Model risk This is the risk of direct economic loss or economic loss as a consequence of an image problem or legal dispute or reputational harm, due to errors made when defining, implementing or using valuation models, regulatory capital models or other models. Overall interest rate risk The overall interest rate risk is defined as the risk of losses on the banking portfolio as a result of adverse changes in interest rates due to inconsistencies between the rates in use and those of the assets. As is the case for most corporate and investment banks, Natixis has very few financial assets and liabilities generating structural interest rate positions. Natixis’ overall interest rate risk concerns contractual transactions. The most significant positions concern exposures on the short end of the yield curves and are related in particular to the shift in the IBOR rate refixing date. It is thereforea second-raterisk at the bank level. Liquidity risk Liquidity risk is the risk that Natixis will be unable to honor its commitments to its creditors due to the positive difference of maturities between assets and liabilities. This risk could arise, for example, in the event of massive withdrawals of customer deposits, a crisis of confidence, or an overall market liquidity crisis. As a corporate and investment bank, this risk results primarily from mismatched positions between transactions with contractual maturities, as Natixis has fewer stable and permanent customer resources than retail banks, and partly funds its operations on the markets.

120

NATIXIS UNIVERSAL REGISTRATION DOCUMENT 2021