NATIXIS_PILLAR_III_2017_EN

OPERATIONAL RISKS Risk profile

Risk profile 10.4

In 2017, a risk analysis was performed on all of Natixis’ business lines and support and control functions. Verifying consistency with the results from internal audits and the results of permanent controls highlighted the most important risks for each scope and helped prioritize corrective measures to be implemented in order to improve the risk management mechanism. The Corporate and Investment Banking business lines represent the majority of risks under review owing to the extensive nature of the division's activities and operations in both France and internationally.

Natixis’ risk profile features two main risk categories in terms of high potential impact: business line risk, concentrated under Corporate & Investment Banking, and overall risk (cyber, regulatory, loss of access to premises or information systems, or of availability of employees) to which the Company as a whole is exposed. Tailored risk management mechanisms have been introduced to cover these risks, including the safeguarding of procedures and controls, raising employee awareness, Business Continuity Plans, IT Systems Security and insurance policies.

Operational risk insurance 10.5

Groupe BPCE’s Risk Insurance Department is tasked with: analyzing insurable operational risks; j taking out appropriate insurance coverage (direct insurance j and/or transfer). Natixis and its subsidiaries benefit from the guarantees a provided in the following main insurance programs: to cover its insurable operational risks; and j which are pooled with Groupe BPCE (with the exception of j the risk described in point a) below). Combined “Banker’s Blanket Bond” (securities and fraud) and a Company Civil Liability policies providing coverage of €148 million per insurance year (of which €133 million have been pooled with Groupe BPCE), including: €15 million per year, combined “Fraud/Professional Civil a)  Liability” insurance available, subordinate to the amounts guaranteed set out in b) and/or c) and/or d) below; €38 million per claim and per year, solely reserved for b)  “Global Banking” risk; €25 million per claim and per year, solely reserved for c)  “Professional Civil Liability” risk; €70 million per claim and per year, combined “Global d)  Banking/Professional Civil Liability” insurance available in addition to or after use of the amounts guaranteed set out in b) and/or c) above. The maximum amount that can be paid out for any one claim under this arrangement is €109.75 million under “Professional

Civil Liability” coverage and €109.75 million under “Fraud” coverage in excess of the applicable deductibles. “Regulated Intermediation Liability” (in three areas: Financial a Intermediation, Insurance Intermediation, Real Estate Transactions/Management) with a total maximum payout of €10 million per claim and per year. “Operating Liability” covering €100 million per claim, as well as a a “Subsidiary Owner Civil Liability”/“Post Delivery-Reception Civil Liability” coverage extension for up to €30 million per claim and per year of insurance. “Company Directors Liability” for up to €200 million per claim a and per year of insurance. “Property Damage to Offices and to their content” (including a IT equipment) and the consecutive “losses in banking activities”, for up to €300 million per claim. “Protection of Digital Assets against Cyber-Risks” & the a consecutive “losses in banking activities”, for up to €100 million per claim and per insured year. This coverage extends worldwide for initial risk or umbrella risk, subject to certain exceptions, mainly in terms of “Professional Civil Liability” where the policy does not cover permanent institutions based in the United States (where coverage is obtained locally by Natixis’ subsidiaries or US branches). All the insurance policies mentioned above were taken out with reputable, creditworthy insurance companies and in excess of the deductibles and Natixis’ risk-retention capacity.

10

127

NATIXIS Risk report Pillar III 2017