NATIXIS // 2021 Universal Registration Document

3 RISK FACTORS, RISK MANAGEMENT AND PILLAR III Risk management

Internal counterparty risk models and rating models are validated by the validation team of the Groupe BPCE Risk division or, acting with the authorization of the Groupe BPCE MRM Committee, by the Natixis Risk division’s Risk Model Validation team. The Natixis Risk Model Validation team uses a six-fold validation process: data and parametersapplied by the model: analysis of data quality V and representativeness, integrity of controls, error reports, comprehensiveness of data, etc.; methodology: analysis of the model’s underlying theory, analysis of V estimates, sizing methods, risk indicators, aggregation rules, model benchmarking, analysis of precision and convergence; usage and robustness test: the validation team ensures that the V internal models are used by qualified staff, that usage procedures are documentedand up to date, and conducts independentex post controls and stress tests; IT development: counter-implementation, code analysis, tests; V compliance with regulations: gap analysis; V documentation: analysis of the quality and comprehensiveness V of the methodological documentation received. The design, modificationand ongoingmanagementof the model are performed by the model designers on behalf of the model owner. Model Risk Management,an independententity, is called upon for all new models as well as for all modifications or improvements to existingmodels. On an annual basis, this team in charge of designing the rating models and, more generally, calculating credit or counterparty risk, regularly reviews the models which cover the analysis of backtesting and usage tests. The third line of defense is the General InspectionDepartment,which annually reviews internal models and compliancewith the risk model management framework and the correct application by Model Risk Management of its own policies and procedures. Where authorizationis granted, the findings and results of the model validation process performed at Natixis are presented to the Risk Model Oversight Committee for confirmation, then submitted to the Model Risk Management Committee for approval before being sent to the Standards and Methods Committee of the Groupe BPCE Risk, Compliance and Permanent Control division for final validation and possible submission to the regulator. This Model Risk Management Committee is tasked with supervising the risk model for all of Natixis’ activities by, on one hand, approving validation reports and the related remediationplans and, on the other hand, monitoringconsolidatedrisk model indicators. The Risk Model Oversight Committee is chaired by the Head of the Model Risk & Risk Governance Department.The Model Risk ManagementCommittee is chaired by the Chief Executive Officer of Natixis, directly or indirectly through a specific delegation of authority. Rating tool performance monitoring (backtesting and benchmarking) Backtesting and benchmarking are an integral part of the model validation process. Backtesting and performance monitoring programs are used at least once a year to ensure the quality and reliability of rating models, probability of default scales and LGD and EAD estimate models. They include a detailed analysis based on a range of indicators, e.g. differences in terms of severity and migration compared with agency ratings, changes in ratings before default, observed defaults and losses and changes in ratings prior to

default, and the performance measurements of LGD models, based on the quantitative analysis of historical data and supplemented by qualitative analysis. Rating method performance monitoring and backtesting of PD The rating methods are periodically checked and undergo external benchmarking to ensure the consistency of ratings produced using expert appraisal methods, as well as their robustness over time according to regulatory requirements. The monitoring methods are defined through a backtesting procedure tailored to each type of model. For Natixis, the corporate (including structured finance), interbank and sovereign portfolios, which are handled using dedicated rating tools, have the lowest default rates (Low Default Portfolios). These portfolios are backtested in accordance with their specific nature, namely the low number of defaults and the difficulty in creating and maintaining a PD scale based on internal data. The backtesting procedure, which draws on these data (and sometimes external data in the case of backtesting of the banking model or the major corporates rating grids particularly), consists of two stages: an analysis of the absolute performance, which is based on the default rate and internal migrations, and an analysis of relative performance, which is based on a comparison with external ratings. Alerts are triggered by performance rules and indicators as necessary. The severities observed between internal ratings and agency ratings are studied. Natixis analyzes all internal ratings of counterparties, which are also rated by rating agencies (Standard and Poor’s, Moody’s and Fitch). The extent to which the risk assessments are aligned can be determined through these analyses. The change in the portfolio’s credit quality over one year is also analyzed by looking at internal rating migrations. Additional indicators are also calculated to verify the internal risk ranking (Gini Index, average rating, previous year’s ratings, ratings of counterparties that have defaulted) and provide statistics as a supplement to the qualitative analyses. Monitoring and backtesting of internal LGDs, EADs (via CCFs) and ELBEs using advanced methods The LGD, ELBE and EAD (CCF) (see glossary) levels for the different lending scopes are backtestedat least once a year (based on internal data), as are the rating models and the associated PD, to verify the reliability of the estimates over time. Backtesting of LGDs, EADs (CCFs) and ELBEs is carried out by the Enterprise Risk Management teams and makes it possible to:

verify that the model is correctly calibrated; V review the model’s discrimination power; V assess the model’s stability over time. V

The inputs of the models for the scope of specialized financing and collateral (financial or other) are regularly updated, so that they reflect actual conditions as accurately as possible. Both the market inputs and collection inputs are updated. The losses and estimates produced by the models are compared based on historical data covering as long a period as possible.

126

NATIXIS UNIVERSAL REGISTRATION DOCUMENT 2021