Risk Management

During 2023, we continued to evolve the Framework in order to enhance our approach to risk management, placing greater focus on climate-related risks and cyber threats, further embedding ESG factors and improving transparency.

Climate Risk Management

We recognise Climate & Environmental Risk factors as crucial elements in safeguarding our clients’ portfolios and assets from climate-related risks. To achieve this goal, we are integrating climate and environmental factors into our risk management processes and procedures. Climate Risk management encompasses the identification, measurement, and monitoring of these risks as well as the implementation of mitigation measures. We actively engage and support corporate clients in transitioning to a lower carbon business model, fully exploiting green business opportunities. Furthermore, we aim to assist our clients in achieving a just transition, ensuring fairness throughout the process.

Risk Identification

Our annual risk identification process is a comprehensive framework that proactively identifies all potential risks the Group may encounter.

In line with the European Banking Authority’s (EBA) eight and the European Central Bank’s (ECB) nine expectations, our risk identification process covers ESG risk dimensions. These are assessed through the lenses of physical and transition risk drivers, considering that these could positively or negatively affect the risk types already incorporated in our risk management framework.

Transition risks

Transition risks refer to the risks arising from the transition to a lower-carbon economy, which may entail extensive policy, legal, technology, and market changes to address mitigation and adaptation requirements related to climate change. Depending on the nature, pace and focus of these changes, transition risks can pose different levels of financial and reputational risk for organisations.

• Policy and Legal Risks: stemming from continuously evolving policy actions, attempting to either constrain actions that contribute to the adverse effects of climate change or seeking to promote adaptation to climate change, and from litigation or legal risks
• Technology Risk: arising from technological improvements or innovations that support the transition to a lower-carbon, energy-efficient economic system and that can have a significant impact on organisations to the extent that new technology replaces old systems and disrupts some parts of the existing economic system
• Market Risk: relating to the potential shifts in supply and demand for certain commodities, products and services
• Reputational Risks: resulting from changing client or community perceptions of the organisation’s contribution to or detraction from the transition to a lower-carbon economy

Physical risks

Physical risks refer to the risks related to the physical impact of climate change. These types of risk can be event-driven (acute) or long-term shifts (chronic) in climate patterns and, as such, their effects can be felt both in the short- and medium-/longterm horizon.

• Acute physical risks are event-driven, including increased severity of extreme weather events (e.g. droughts, floods, etc.)
• Chronic risks refer to longer-term shifts in climate patterns (e.g. sustained higher temperatures)

1. Group exposure (GCA) equal to €224 bn as at 31 December 2023. Exposure equal to €241bn as at 31 December 2022.

Digital Risk Management

During 2023, we continued to develop a number of initiatives to reinforce the Group’s Digital (ICT & Cyber) defences. These included: