NATIXIS - Universal registration document and financial report 2019

3 RISK FACTORS, RISK MANAGEMENT AND PILLAR III Risk management

Cyber risk Cyber risk is caused by a malicious and/or fraudulent act, perpetrated digitally in an effort to manipulate data (personal, banking/insurance, technical or strategic data), processes and users, in order to cause material losses to companies, their employees, partners and clients. The transformation of banking information systems, the new technologies it heralds and the increased outsourcing of related services offer cybercriminals new opportunities to carry out increasingly sophisticated and automated attacks. Natixis’ ability to conduct its business is determined by the availability of its information system, the guaranteed integrity and confidentiality of data and the traceability of every transaction. Reputational risk Reputational risk is the risk of damage to the confidence shown in the company by its customers, counterparties, suppliers, employees, shareholders, supervisors, or any other third parties whose trust, in whatever respect, is a prerequisite for the normal conduct of business. Reputational risk is essentially a risk contingent on the other risks incurred by the bank. Legal risk Legal risk is defined under French regulations as the risk of any legal dispute with a third party, arising from an inaccuracy, omission or deficiency that may be attributable to the company’s operations. Model risk This is the risk of direct economic loss or economic loss as a consequence of an image problem or legal dispute or reputational harm, due to errors made when defining, implementing or using valuation models, regulatory capital models or other models. Overall interest rate risk Natixis’ overall interest rate risk is defined as the risk of loss on the banking portfolio due to mismatches between interest rates on assets and on liabilities. As is the case for most corporate and investment banks, Natixis has very few assets and liabilities generating structural interest rate positions. Natixis’ overall interest rate risk concerns contractual transactions. The most significant positions concern exposures to the short end of yield curves and are predominantly linked to the lag between IBOR fixing dates. This is therefore classed as a secondary risk at the bank level. Liquidity risk Liquidity risk is the risk that Natixis will be unable to honor its commitments to its creditors due to the positive difference of maturities between assets and liabilities. This risk could arise, for example, in the event of massive withdrawals of customer deposits, a crisis of confidence, or an overall market liquidity crisis. As a corporate and investment bank, this risk results primarily from mismatched positions between transactions with contractual maturities, as Natixis has fewer stable and permanent customer resources than retail banks, and partly funds its operations on the markets. Spread risk is the risk of an increase in the cost of funding in the event of a liquidity crisis, given fixed-margin long-term assets, or when forced to reinvest long-term funds at higher rates relative to available assets.

Structural foreign exchange risk Structural foreign exchange risk is defined as the risk of transferable equity loss generated by an unfavorable fluctuation in exchange rates against the currency used in the consolidated accounts due to a mismatch between the currency of net investments (refinanced by purchases of the same currency) and the currency of equity. Natixis’ structural foreign exchange risk for the most part concerns structural positions in the US dollar due to the consolidation of foreign branches and subsidiaries funded in this currency. Other risks Insurance business-related risk : Insurance risk is the risk to profits of any difference between expected and incurred claims. Depending on the Insurance product in question, the risk varies according to macroeconomic changes, changes in customer behavior, changes in public healthcare policy, pandemics, accidents and natural disasters (such as earthquakes, industrial accidents or acts of terrorism or war). Strategic risk is the risk inherent to the strategy chosen or resulting from Natixis’ inability to implement its strategy. Climate risk is the increased vulnerability of businesses to variations in climate indices (temperature, rainfall, wind, snow, etc.). It may be physical in nature (increase in extreme weather events) or related to environmental transition (new carbon regulations). Environmental and social risks arise from the operations of the clients and companies in which Natixis invests. Stress tests 3.2.2.6 Natixis has developed a comprehensive stress test mechanism to dynamically monitor and manage risks. The set is an integral part of the risk and financial management system and contributes to Natixis’ capital and regulatory requirements planning process. Natixis’ stress test mechanism is structured as follows: comprehensive internal and external exercises; V Comprehensive internal stress tests The purpose of comprehensive internal stress tests is to assess the impact of a baseline economic scenario and of stressed economic scenarios on a bank's income statement, risk-weighted assets and equity. The scenarios proposed by the Economic Research team are discussed and approved at a Groupe BPCE Executive Management Committee meeting and presented at a Natixis Senior Management Committee meeting. They are converted into levels or shocks to economic and financial variables, such as GDP, inflation, employment and unemployment, interest and exchange rates, and stock and commodity prices, over a three-year period. These variables are factored into projection models used by Natixis to apply stress to the various aggregates on the income statement, risk-weighted assets and equity. periodic regulatory exercises; V specific exercises by scope. V

114

NATIXIS UNIVERSAL REGISTRATION DOCUMENT 2019