ACTIVE RISK MANAGEMENT

CaixaBank manages its risks to optimise the balance between risk and profitability, and to maintain its position as one of the most robust entities in the Spanish system. To achieve this objective, risks are managed in accordance with the Group‘s risk appetite and are considered in all of its business decisions, enhancing the quality of our service for our customers.

The Governance and Organisation structure − and the specialisation of our professionals − ensures CaixaBank‘s governance bodies and management committees exercise adequate risk control.

CaixaBank‘s Risk Culture is based, inter alia, on general risk management principles and employee training.

MAIN RISK MANAGEMENT COMMITTEES

MANAGEMENT TOOLS AND SYSTEMS

Risk appetite framework

a comprehensive, forward-looking tool used by the Board to determine the types and thresholds of risk it is willing to assume in achieving strategic objectives.

The Board of Directors has approved the following priority dimensions, expressing the Group’s goals in relation to its most significant risks:

• Loss buffer: maintain a medium-low risk profile and comfortable capital adequacy.
• Liquidity and financing: to always be able to meet obligations and funding needs in a timely manner, even under adverse market conditions, with a stable and diversified funding base to protect and safeguard depositors‘ interests.
• Business composition: to maintain leadership in the retail banking market and to generate income and capital in a balanced and diversified manner.
• Franchise: committed to the highest ethical and governance standards in business conduct, encouraging sustainability and social responsibility, and ensuring operating excellence.

Internal control model

Provides a reasonable degree of assurance that the Group will achieve its objectives.

This model evolves in accordance with the guidelines issued by regulatory bodies and best practices in the sector, moving towards the Three Lines of Defence model:

The first line consists of the Group‘s business and support units. Responsible for identifying, measuring, controlling and reporting the Group's risks as it carries out its business.

The second line of defence comprises mainly the Risk Management, Compliance and Internal Control functions, which act independently from the business units. Its purpose is to identify, measure, monitor and report the Group's risks while developing its risk management and control systems.

The third line is Internal Audit, which independently and objectively assesses the efficiency and effectiveness of risk management and control.

Corporate Risk Map

Provides a comprehensive overview of the risks of corporate activities and the control environment. Includes the Corporate Risk Catalogue.

---