NATIXIS - Universal registration document and financial report 2019

3 RISK FACTORS, RISK MANAGEMENT AND PILLAR III Risk management

Stress test results for the Natixis scope (Data certified by the Statutory Auditors in accordance with IFRS 7)

Overall stress test levels reached an average level of €16 million at December 31, 2019, versus -€13 million at December 31, 2018. The historical stress test replicating the sovereign debt crisis in 2011 gave the maximum loss (-€40 million at December 31, 2019).

Overall stress tests at December 31, 2019

(in €M)

116

100 120

20 40 60 80

Hypothétic Stress-Tests

Historic Stress-Tests

61

55

40

38

32

21

21

14

12 15 11

3

-40 -20 0

-4

-12

-13

-36 -33

-40

Liquidity

2009 Rally

1998 LTCM

Commodities

2008 Lehman

1990 Gulf War

2008 Corporates

Default by a bank

1997 Asiatic Crisis

2002 Credit crash

2007 FED Equities

2011 Sovereign crisis

September 11th 2001

Emerging market crisis

Increase in Interest rate

1994 Bond Market Crash

1987 Stock market crash

Influential Issuer default

Fall in stock market indices

Operational risks 3.2.6 Targets and policy 3.2.6.1

Organization 3.2.6.2 The function in charge of monitoring operational risk ensures the monitoring and management of risks arising from failures attributable to operating procedures, employees and internal systems or arising from outside events. Its duties as described in the operational risk policies and procedures validated by the Natixis Operational Risk Committee include: recording incidents via a network of Operational Risk Officers V across all business lines and support functions; analyzing serious incidents using an escalation process; V mapping potential risks, both qualitatively and quantitatively, based V on a risk self-assessment and audits carried out by the business lines; links with other control functions; V establishing key risk indicators and environmental variables of a V predictive nature.

As part of the definition of its risk appetite, and in accordance with the French Ministerial Order of November 3, 2014, Natixis defined its operational risk tolerance policy with a view to limiting losses related to operational risks and regularly reviewing actions to reduce risks. The policy sets out the governance established, the quantitative and qualitative management framework, and the monitoring performed thus far. It defines the operational risk management criteria, including: quantitative indicators: one historical indicator measuring the cost V of risk, one forward indicator measuring the risk exposure, one individual indicator identifying the occurrence of major incidents to be reported to the regulator (Article 98), a specific individual indicator raising the alert on internal fraud events, and an operational risk management indicator measuring the progress of corrective actions; a qualitative indicator measuring the compliance with the V governance of the framework; specific indicators monitoring Information and Communication V Technology (ICT) risk, including cyber risk. The operational risk management system identifies, measures, monitors and controls the level of operational risks for all the Company’s business lines and support functions in France and abroad.

134

NATIXIS UNIVERSAL REGISTRATION DOCUMENT 2019