PILLAR 3 2023

RISK REPORT

2023 - PILLAR III

The purpose of Pillar III is to establish market discipline through a series of reporting requirements. These requirements – both qualitative and quantitative – are intended to improve financial transparency in the assessment of risk exposure, risk assessment procedures and capital adequacy.

Pillar III therefore enhances minimum capital requirements (Pillar I) and the prudential supervision process (Pillar II).

www.groupebpce.com

Regulation (EU) No. 2019/876 (CRR2) provides for new provisions relating to the calculation of risk-weighted assets and new ratio requirements, applicable from June 28, 2021. The main impacts for Groupe BPCE are as follows:

This report presents information on Groupe BPCE’s risks; the format of the Pillar III tables changed at June 30, 2021 in accordance with the technical standards defined by Implementing Regulation (EU) No. 2021/637.

Groupe BPCE has put an internal control framework in place to verify that the reported information is appropriate and compliant.

Structure of the Pillar III report

The Pillar III report is divided into 17 sections dedicated to risk management:

Each section describes the principles of organization and risk management, presents an overview of the essential information and sets out detailed quantitative information in a dedicated section.

The internal control policy and the statement on the publication of information required under Pillar III are presented in Section 18.

Section 19 is dedicated to the appendices which contain the index of tables, the Pillar III cross-reference table and the glossary.

KEY INDICATORS

ADDITIONAL INDICATORS

EU KM1 – KEY INDICATORS

Renewed European solidarity in the face of the Ukrainian crisis

The outbreak of war on the EU’s doorstep, with its impact on energy access and accelerating inflation, has further refocused European and French regulatory work on consumer protection and economic sovereignty. Europeans seem to be united on various subjects, which encourages the Commission and parliamentarians sustain their regulatory work.

Progress of the banking union

Despite the efforts made in the trialogue, negotiations on the CRR3/CRD6 banking package were not completed in 2022.

The European Commission’s project, which dates from October 2021 and aims to implement the finalized Basel III agreement (also known as Basel IV of December 2017) resulted in a compromise between the Member States after six months of work under the French presidency. National interests were expressed on a number of political issues such as the level of application of prudential capital requirements (individual or consolidated) to satisfy host countries (the “output floor” mechanism), the introduction of a grandfather clause for “strategic” investments in favor of the German IPS “Institution Protection Schemes,” the flat-rate calculation of operational risk without taking into account historical losses for Spanish banks, etc. The compromise remains close to the Commission’s initial project and the technical amendments to the Council draft, with the exception of governance issues specific to the European text: the treatment of branches in third countries and the methods for assessing the suitability of executives. As a result, the Trialogue was unable to conclude its work in the first half of 2023, so that publication of the final version of the texts in the Official Journal of the European Union (OJEU) before the end of the year seems unrealistic.

With regard to the resolution framework, the Eurogroup in June 2022 validated a pragmatic approach and asked the Commission to strengthen the reform project on a limited number of subjects (debt hierarchy, notion of public interest, etc.) in order to reinforce the treatment applicable to medium-sized banks. On April 18, 2023, the European Commission published its proposals for texts revising the crisis management and deposit insurance framework (CMDI). Final adoption is expected in mid-2024 at the earliest.

A sustained regulatory agenda

The regulatory agenda remains intense for banks, and Groupe BPCE keeps a close watch on the issues at stake, whether they concern the banking sector or the economic environment as a whole, in line with its cooperative banking model.

Directive 2008/48 on consumer credit agreements has been under review since 2020, culminating in a compromise revision by the trialogue in December 2022. Publication in the Official Journal of the European Union (OJEU) is expected in the second half of 2023, with implementation estimated for mid-2025. The main changes concern the scope of application (de facto excluding GAFAMs), the introduction of a mandatory solvency study, the reinforcement of pre-contractual information and the terms and conditions for carrying out activities for service providers not covered by sector-specific regulations.

The Digital Operational Resilience Act (DORA) regulation and directive published on December 27, 2022 strengthen the control of IT-related risks and aim to mitigate cyber-attacks and other risks to information systems. It also includes provisions on the governance of financial entities, ICT (Information and Communication Technology) risk management and resilience testing every three years. The publication of the final texts last year was followed by the launch of work by EBA, ESMA and EIOPA to complete the European framework with second-level technical standards (RTS and ITS).

The Distance Marketing in Financial Services Directive (DMFSD) 2002/65 has also been under review since summer 2020. The proposal to amend the directive, published on May 11, 2022, resulted in a political agreement on June 6, 2023. The changes concern, in particular, pre-contractual information and the facilitation of the right of withdrawal, through the introduction of a “withdrawal function” accessible via the service provider’s interface. This function is similar to the electronic termination of contracts, known as “3-click termination”, introduced in France on June 1, 2023 by the law on emergency measures to protect purchasing power and the Orders of March 16, 2023 and May 31, 2023.

On May 24, 2023, the European Commission published a package of measures, known as the “Retail Investment Package”, aimed at strengthening the protection of retail customers when investing in financial products. It will result in a revision of sector-specific legislation, and could introduce a partial ban on retrocessions (“inducement”) between the producer and distributor of financial products.

On June 28, the European Commission opened a more specific consultation on its proposal to revise the Payment Services Directive (PSD3).

On June 28, the European Commission published its proposal for a regulatory framework for financial data access (Framework for Financial Data Access – FIDA), previously known as “open finance”. On the same day, the Commission published a proposal for a regulation on the digital euro.

On sustainable finance, numerous texts have already been adopted and are in the implementation and technical development phase: EU taxonomy, CSRD (corporate sustainability reporting directive) which replaces NFRD and will integrate extra-financial reporting standards (EFRAG, SFDR – sustainable finance disclosure regulation – deforestation). The act of March 9, 2023 on various adaptations to European Union law, known as the “DDADUE”, empowers the government to transpose this directive by ordinance within 9 months. Other texts are still being negotiated at European level: CSDDD (Corporate sustainability due diligence directive) and EU green bond standards.

This onslaught of regulations calls on Groupe BPCE to be vigilant in its analyses of operational impact, the ways in which it is handled and the allocation of its resources in the interests of its customers, the social and environmental responsibility of the Group’s entities and the preservation of its cooperative banking model.

The banking and financial environment in which Groupe BPCE operates is exposed to numerous risks and requires the implementation of an increasingly demanding and strict policy to control and manage these risks.

Some of the risks to which Groupe BPCE is exposed are set out below. However, this is not a comprehensive list of all of the risks incurred by Groupe BPCE in the course of conducting its business or given the environment in which it operates. The risks presented below are those identified to date as significant and specific to Groupe BPCE, and liable to have a material adverse impact on its business, financial position and/or results. For each of the risk sub-classes listed below, the risk factor considered to date by Groupe BPCE as the most significant is listed first.

The risks presented below are those identified to date as liable to have an adverse impact on the businesses of BPCE SA.

The risk factors described below are presented as of the date of this document and the situation described may change, even significantly, at any time.

Credit and counterparty risks

Groupe BPCE is exposed to credit and counterparty risks that could have a material adverse effect on the Group’s business, financial position and income.

Groupe BPCE is significantly exposed to credit and counterparty risk through its financing or market activities. The Group could thus incur losses in the event of default by one or more counterparties, in particular if the Group encounters legal or other difficulties in exercising its collateral or if the value of the collateral does not allow it to fully cover the exposure in the event of a default. Despite the due diligence carried out by the Group aimed at limiting the effects of having a concentrated credit portfolio, both in units and sectors, counterparty defaults may be amplified within a specific economic sector or world region by the effects of interdependence between these counterparties. Default by one or more major counterparties could thus have a material adverse effect on the Group’s cost of risk, income and financial position.

For information, on December 31, 2023, Groupe BPCE’s gross exposure to credit risk amounted to €1,486 billion, with the following breakdown for the main types of counterparty: 38% for retail customers, 29% for corporates, 17% for central banks and other sovereign exposures, and 6% for the public sector and similar entities. The credit risk-weighted assets amounted to €399 billion (including counterparty risk).

The main economic sectors to which the Group was exposed in its non-financial corporations portfolio were Real Estate (38% of gross exposures at December 31, 2023), Wholesale and Retail Trade (11%), Finance/Insurance (10%) and Manufacturing industry (6%).

Groupe BPCE develops its activities mainly in France. The Group’s gross exposure (gross carrying amount) to France was €1,059 billion, representing 84% of the total gross exposure. The remaining exposures were mainly concentrated in the United States, for 5%, with other countries accounting for 11% of the total gross exposures.

For further information, please see Chapters 5 “Credit risks” and 6 “Counterparty risk” in this document.

A substantial increase in impairments or provisions for expected credit losses recognized in respect of Groupe BPCE’s portfolio of loans and advances could have a material adverse effect on its income and financial position.

In the course of its lending activities, Groupe BPCE regularly recognizes charges for asset impairments in order to reflect, if necessary, actual or potential losses on its portfolio of loans and advances. Such impairments are booked in the income statement under “Cost of risk.” Groupe BPCE’s total charges for asset impairments are based on the Group’s measurement of past losses on loans, volumes and types of loans granted, industry standards, loans in arrears, economic conditions and other factors associated with the recoverability of various types of loans. While Groupe BPCE makes every effort to set aside a sufficient level of provisions for asset impairment expenses, its lending activities may cause it in the future to have to increase its expenses for losses on loans, due to a rise in non-performing loans or for other reasons such as the deterioration of market conditions or factors affecting certain countries. Any substantial increase in charges for losses on loans, material change in Groupe BPCE’s estimate of the risk of loss associated with its portfolio of loans, or any loss on loans exceeding past impairment expenses, could have an adverse impact on Groupe BPCE’s results and financial position.

For information, Groupe BPCE’s cost of risk amounted to €1,731 million in 2023 compared to €1,964 million in 2022, with credit risks accounting for 87% of Groupe BPCE’s risk-weighted assets. On the basis of gross exposures, 38% relate to retail customers and 29% to corporate customers (of which 70% of exposures are located in France).

Consequently, the risk associated with a significant increase in impairment expenses on assets booked to Groupe BPCE’s loans and advances portfolio is significant in terms of impact and probability, and is therefore monitored carefully and proactively. In addition, prudential requirements supplement these provisioning mechanisms via the prudential backstop process, which results in a deduction in equity of non-performing loans beyond a certain maturity in line with the quality of the guarantees and according to a regulatory timetable.

A decline in the financial strength and performance of other financial institutions and market players may have an unfavorable impact on Groupe BPCE.

Groupe BPCE’s ability to execute transactions may be affected by a decline in the financial strength of other financial institutions and market players. Institutions are closely interconnected owing to their trading, clearing, counterparty and financing operations. A default by a significant sector player (systemic risk), or even mere rumors or concerns regarding one or more financial institutions or the financial industry in general, may lead to a general contraction in market liquidity and subsequently to losses or further defaults in the future. Groupe BPCE is directly or indirectly exposed to various financial counterparties, such as investment service providers, commercial or investment banks, clearing houses and CCPs, mutual funds, hedge funds, and other institutional clients, with which it regularly conducts transactions. The default or failure of any such counterparties may have an adverse impact on Groupe BPCE’s financial position. Moreover, Groupe BPCE may be exposed to the risk associated with the growing involvement of operators subject to little or no regulation in its business sector and to the emergence of new products subject to little or no regulation (including in particular crowdfunding and trading platforms). This risk would be exacerbated if the assets held as collateral by Groupe BPCE could not be sold or if their selling price would not cover all of Groupe BPCE’s exposure to defaulted loans or derivatives, or in the event of fraud, embezzlement or other misappropriation of funds committed by financial sector participants in general to which Groupe BPCE is exposed, or if a key market operator such as a CCP defaults.

The exposures to “financial institutions” represented 4% of Groupe BPCE’s total gross exposures of €1,486 billion at December 31, 2023. In geographic terms, 69% of gross exposures to “institutions” are located in France.

Financial risks

Significant changes in interest rates may have a material adverse impact on Groupe BPCE’s net banking income and profitability.

Groupe BPCE’s net interest margin over a given period represents a significant portion of its revenues. Changes in the latter, in line with changes in interest rates, can have a significant impact on Groupe BPCE’s net banking income and profitability. Resource costs and asset yield conditions, particularly those related to new loan production, are highly sensitive to the interest rate environment, as well as to factors beyond Groupe BPCE’s control.

In an environment marked by a sharp rise in interest rates and a probable continuation of the European Central Bank’s monetary policy tightening cycle, exposure to interest-rate risk and, more generally, to price risk, was thus reinforced by a combination of unfavorable factors, namely rising inflation with a major impact on regulated rates, the reallocation of part of savings following the rapid exit from the low-rate environment, and the rise in interbank spreads, while conversely the rate of new loans was constrained by the usury rate and the competitive environment.

Even though the global central banks, including the European Central Bank (ECB), seem to have completed their monetary policy tightening cycle at the end of 2023, short-term and long-term interest rates at the end of 2023 were higher than they had been since the 2000s. Indeed, the ECB increased its key rates six times over 2023, from the 2.5%-3% range up to 4%-4.5%. The US Federal Reserve increased its key rates four times from the 4.25%-4.5% range to 5.25-5.5%.

However, since the third quarter of 2023, market rates have seen a significant reversal, with a differential of -90 basis points between the 10-year rate and the three-month rate. At the same time, the Livret A savings account rate has followed a similar trajectory and has been stable at 3% since February 2023 (stable rate announced until the beginning of 2025).

The corollary of this atypical situation, in terms of intensity and economic impact, was a massive reduction in Groupe BPCE’s bank loan production after a peak in activity in the first months of the inflationary period. This situation had the following consequences over the period:

As a result, the average resource cost on the customer balance sheet increased from 93 to 100 basis points in 2023 for the two main regional banking networks (Banques Populaires and Caisses d’Epargne). Groupe BPCE gradually passed on the increase in rates observed at the end of 2022 and in 2023 on the rates of new home loans and other fixed-rate consumer and corporate loans, resulting in a change in customer rates for all loans combined by around 170 basis points in 2023, after an increase of nearly 140 basis points in 2022. For example, the interest rate on fixed-rate home loans with a 20-year maturity increased by 205 basis points in 2023, while interest rate swaps with the same maturity rose by 31 basis points in 2023 after a jump of 170 basis points over the last three quarters of 2022 (reference period linked to the delay effect).

At the same time, customers gradually switched their low-interest accounts to higher-yielding products (regulated passbook accounts and term accounts), accentuating the decrease in the value of any portfolio of fixed-rate loans or assets with lower interest rates. In this context of squeezed margins, given the speed with which the rapid rate increases were being passed on, Groupe BPCE adjusted its interest rate hedging policy by increasing the volume of its interest rate swaps (macro-hedging) by some 35% in 2022, and then by around 30% in 2023, so as to protect the value of its balance sheet and its future interest margin.

Consequently, even if rising rates are generally favorable in the medium to long term, these significant changes can have major repercussions, whether temporary or lasting. Groupe BPCE’s interest rate risk indicators reflect this exposure.

The sensitivity of the net present value of the Group’s balance sheet to a +/-200 bps variation in interest rates remained lower than the 15% Tier-1 limit. At December 31, 2023, Groupe BPCE’s sensitivity to interest rate increases stood at -10.80% compared to Tier-1 versus -13.94% at December 31, 2022. The measurement of the change in Groupe BPCE’s projected net interest margin over one year according to four scenarios (“rising rates”, “falling rates”, “steepening of the curve”, “flattening of the curve”) in relation to the central scenario, indicates that “falling rates” (shock of -25 bps) is the most unfavorable scenario, with a negative impact, on December 31, 2023, of -2.1% over a sliding year (loss of €127 million envisaged), while the low amplitude upward scenario (+25 bps) would have a positive impact of 2.0% (gain of €125 million envisaged).

From a regulatory point of view, the European Banking Authority (EBA) has introduced the SOT NIM, defined as the ratio of the sensitivity of the Net Interest Margin to Tier-1 capital. This new SOT (Supervisory Outlier Test) measures the impact of a rate shock (+/- 200 bps) on the one-year NIM with a constant balance sheet, and expresses it as a percentage of Tier-1 capital. The Commission adopted the EBA’s counter-proposal to raise the regulatory limit on the SOT NIM, initially from 2.5%, to 5% of Tier-1 capital. The regulatory text must now undergo a formal validation process, including validation by the Council and the European Parliament, for entry into force no later than March 31, 2024.

The introduction of the SOT NIM will supplement the information communicated as part of the interest rate risk management system by a margin view over a one-year horizon, and must be published in the financial statements, even if it will not directly generate a Pillar I expense.

Market fluctuations and volatility could expose Groupe BPCE, and in particular its major corporate & investment banking business lines (GFS), to favorable or unfavorable fluctuations in its trading and investment activities, which could adversely affect Groupe BPCE’s results of operations and financial position.

In the course of its third-party trading or investment activities, Groupe BPCE may carry positions in the bond, currency, commodity and equity markets, and in unlisted securities, real estate assets and other asset classes. These positions may be affected by volatility on the markets (especially the financial markets), i.e. the degree of price fluctuations over a given period on a given market, regardless of the levels on the market in question. Certain market configurations and fluctuations may also generate losses on a broad range of trading and hedging products used, including swaps, futures, options and structured products, which could adversely impact Groupe BPCE’s results and financial position. Similarly, extended market declines and/or major crises may reduce the liquidity of certain asset classes, making it difficult to sell certain assets and in turn generating material losses.

The market risk-weighted assets totaled €13.4 billion, i.e. around 3% of Groupe BPCE’s total risk-weighted assets, on December 31, 2023. For information, the weight of Corporate & Investment Banking activities in the Group’s net banking income was 18% for the year 2023. For more detailed information and examples, see Note 10.1.2 “Analysis of financial assets and liabilities classified in Level 3 of the fair value hierarchy” to the consolidated financial statements of Groupe BPCE, included in the 2023 Universal Registration Document.

Groupe BPCE is dependent on its access to funding and other sources of liquidity, which may be limited for reasons outside its control, thus potentially having a material adverse impact on its results.

Access to short-term and long-term funding is critical for the conduct of Groupe BPCE’s business. Non-collateralized sources of funding for Groupe BPCE include deposits, issues of long-term debt and short/medium-term negotiable debt securities, banks loans and credit lines. Groupe BPCE also uses guaranteed financing, in particular through the conclusion of repurchase agreements and the issuance of covered bonds. If Groupe BPCE were unable to access the secured and/or unsecured debt market at conditions deemed acceptable, or incurred an unexpected outflow of cash or collateral, including a significant decline in customer deposits, its liquidity may be negatively affected. Furthermore, if Groupe BPCE were unable to maintain a satisfactory level of customer deposits (e.g. in the event its competitors offer higher rates of return on deposits), it may be forced to obtain funding at higher rates, which would reduce its net interest income and results.

Groupe BPCE’s liquidity, and therefore its results, may also be affected by unforeseen events outside its control, such as general market disruptions, which may in particular be related to geopolitical, health or financial crises, operational hardships affecting third parties, negative opinions on financial services in general or on the short/long-term outlook for Groupe BPCE, changes in Groupe BPCE’s credit rating, or even the perception of the position of the Group or other financial institutions among market operators.

Groupe BPCE’s access to the capital markets, and the cost of long-term unsecured funding, are directly related to changes in its credit spreads on the bond and credit derivatives markets, which it can neither predict nor control. Liquidity constraints may have a material adverse impact on Groupe BPCE’s financial position, results and ability to meet its obligations to its counterparties. Similarly, a change in the monetary policy stance, in particular that of the European Central Bank, may impact Groupe BPCE’s financial position.

However, to deal with these risk factors, Groupe BPCE has liquidity reserves made up of cash deposits with central banks and available securities and receivables eligible for central bank refinancing mechanisms. Groupe BPCE’s liquidity reserve amounted to €302 billion on December 31, 2023, covering 161% short-term funding and short-term maturities of MLT debt. The one-month LCR (Liquidity Coverage Ratio) averaged 145% over 12 months on December 31, 2023 versus 142% on December 31, 2022. Given the importance of these risks for Groupe BPCE in terms of impact and probability, these risks are monitored proactively and closely, with Groupe BPCE also pursuing a very active policy of diversifying its investor base.

Downgraded credit ratings could have an adverse impact on BPCE’s funding cost, profitability and business continuity.

Groupe BPCE’s long-term ratings at December 31, 2023 were A for Standard & Poor’s, A1 for Moody’s, A for Fitch ratings and A+ for R&I. The decision to downgrade these credit ratings may have a negative impact on the funding of BPCE and its affiliates active in the financial markets. A ratings downgrade may affect Groupe BPCE’s liquidity and competitive position, increase funding costs, limit access to financial markets and trigger obligations under some bilateral contracts governing trading, derivative and collateralized funding transactions, thus adversely impacting its profitability and business continuity.

Furthermore, BPCE’s unsecured long-term funding cost is directly linked to its credit spreads (the yield spread over and above the yield on government issues with the same maturity that is paid to bond investors), which in turn are heavily dependent on its ratings. An increase in credit spreads may raise BPCE’s funding cost. Shifts in credit spreads are correlated to the market and sometimes subject to unforeseen and highly volatile changes. Accordingly, a change in perception of an issuer solvency due to a rating downgrade could have an adverse impact on that issuer’s profitability and business continuity.

Groupe BPCE’s revenues from brokerage and other activities associated with fee and commission income may decrease in the event of market downturns.

A market downturn is liable to lower the volume of transactions (particularly financial services and securities transactions) executed by Groupe BPCE entities for their customers and as a market maker, thus reducing the net banking income from these activities. In particular, in the event of a decline in market conditions, Groupe BPCE may record a lower volume of customer transactions and a drop in the corresponding fees, thus reducing revenues earned from this activity. Furthermore, as management fees invoiced by Groupe BPCE entities to their customers are generally based on the value or performance of portfolios, any decline in the markets causing the value of these portfolios to decrease or generating an increase in the amount of redemptions would reduce the revenues earned by these entities through the distribution of mutual funds or other products (for the Caisses d’Epargne and the Banques Populaires) or through asset management activities. In addition, any deterioration in the economic environment could have an unfavorable impact on the seed money contributed to asset management structures with a risk of partial or total loss.

Even where there is no market decline, if funds managed for third parties throughout Groupe BPCE and other Groupe BPCE products underperform the market, redemptions may increase and/or inflows decrease as a result, with a potential corresponding impact on revenues from the asset management business.

In 2023, the total net amount of fees and commissions received was €10,318 million, representing 46% of Groupe BPCE’s net banking income. The revenues earned from fees and commissions on customer transactions for financial services came to €51 million and the revenues earned from fees and commissions for securities transactions amounted to €25 million. For more detailed information on the amounts of fees and commissions received by Groupe BPCE, see Note 4.2 (“Fee and commission income and expenses”) to the consolidated financial statements of Groupe BPCE in the 2023 Universal Registration Document.

Changes in the fair value of Groupe BPCE’s portfolios of securities and derivative products, and its own debt, are liable to have an adverse impact on the net carrying amount of these assets and liabilities, and as a result on Groupe BPCE’s net income and equity.

The net carrying amount of Groupe BPCE’s securities, derivative products and other types of assets at fair value, and of its own debt, is adjusted (at balance sheet level) at the date of each new financial statement. These adjustments are predominantly based on changes in the fair value of assets and liabilities during an accounting period, i.e. changes taken to profit or loss or recognized directly in other comprehensive income. Changes recorded in the income statement, but not offset by corresponding changes in the fair value of other assets, have an impact on net banking income and thus on net income. All fair value adjustments have an impact on equity and thus on Groupe BPCE’s capital adequacy ratios. Such adjustments are also liable to have an adverse impact on the net carrying amount of Groupe BPCE’s assets and liabilities, and thus on its net income and equity. The fact that fair value adjustments are recorded over an accounting period does not mean that additional adjustments will not be necessary in subsequent periods.

At December 31, 2023, total financial assets/liabilities at fair value through profit or loss amounted to €215 billion (with €203 billion in financial assets at fair value held for trading) and €204 billion (with €170 billion in financial liabilities at fair value held for trading) respectively. For more detailed information, see also Note 4.3 “Gains (losses) on financial instruments at fair value through profit or loss”, Note 4.4 “Gains (losses) on financial assets measured at fair value through other comprehensive income before tax”, Note 5.2 “Financial assets and liabilities at fair value through profit or loss” and Note 5.4 “Financial assets at fair value through other comprehensive income” to the consolidated financial statements of Groupe BPCE in the 2023 Universal Registration Document.

Non-financial risks

In the event of non-compliance with applicable laws and regulations, Groupe BPCE could be exposed to significant fines and other administrative and criminal penalties that could have a material adverse effect on its financial position, activities and reputation.

The risk of non-compliance is defined as the risk of sanction – judicial, administrative or disciplinary – but also of financial loss or damage to reputation, resulting from non-compliance with laws and regulations, professional standards and practices, and ethical standards specific to banking and insurance activities, whether national or international.

The banking and insurance sectors are subject to increased regulatory oversight, both in France and internationally. Recent years have seen a particularly substantial increase in the volume of new regulations that have introduced significant changes affecting both the financial markets and the relationships between investment service providers and customers or investors (e.g. MIFID II, PRIIPS, the directive on the Insurance Distribution, Market Abuse Regulation, Personal Data Protection Regulation, Benchmark Index Regulation, etc.). These new regulations have major impacts on the company’s operational processes.

In terms of financial security, the fight against money laundering and the financing of terrorism is part of a European trajectory. The Anti-Money Laundering (AML) package, currently in trialogue, will significantly harmonize and raise the level of requirements for regulated professions, particularly the financial sector. This package includes a systemic change in the supervision function due to the establishment, in 2024, of a new European authority, the AML Authority. It will have dual powers: (i) in terms of supervision. As of 2027, it will have around 40 entities under its direct supervision, and will supervise the rest of the financial sector indirectly via national authorities - and (ii) in terms of coordinating the EU’s financial intelligence units (FIUs). The gradual increase in the EBA’s powers in AML-CTF areas also confirms the trend towards bringing these regulations into line with prudential rules, in terms of consolidated supervision requirements for banking groups.

The risk of non-compliance could result, for example, in the use of inappropriate means to promote and market the bank’s products and services, inadequate management of potential conflicts of interest, disclosure of confidential or privileged information, failure to comply with due diligence when dealing with suppliers, failure to comply with legal and regulatory obligations to detect financial transactions likely to derive from criminal offenses (e.g.: corruption, tax fraud, drug trafficking, concealed work, the financing of the proliferation of weapons of mass destruction...) committed by customers and linked to acts of terrorism. The risk of non-compliance may also lead to failures in the implementation of international sanctions (embargoes, asset freezes on individuals targeted by national measures applicable in the jurisdictions in which Groupe BPCE is present, European Union restrictions, or extraterritorial sanctions from certain foreign authorities).

Within BPCE, the Compliance function is responsible for overseeing the system for preventing and managing non-compliance risks. Despite this system, Groupe BPCE remains exposed to the risk of fines or other significant sanctions from the regulatory and supervisory authorities, as well as civil or criminal legal proceedings that could have a significant adverse impact on its financial position, activities and reputation.

Any interruption or failure of the information systems belonging to Groupe BPCE or third parties may generate losses (including commercial losses) and may have a material adverse impact on Groupe BPCE’s results.

As is the case for the majority of its competitors, Groupe BPCE is highly dependent on information and communication systems, as a large number of increasingly complex transactions are processed in the course of its activities. Any failure, interruption or malfunction in these systems may cause errors or interruptions in the systems used to manage customer accounts, general ledgers, deposits, transactions and/or to process loans. For example, if Groupe BPCE’s information systems were to malfunction, even for a short period, the affected entities would be unable to meet their customers’ needs in time and could thus lose transaction opportunities. Similarly, a temporary failure in Groupe BPCE’s information systems despite back-up systems and contingency plans could also generate substantial information recovery and verification costs, or even a decline in its proprietary activities if, for example, such a failure were to occur during the implementation of a hedging transaction. The inability of Groupe BPCE’s systems to adapt to an increasing volume of transactions may also limit its ability to develop its activities and generate losses, particularly losses in sales, and may therefore have a material adverse impact on Groupe BPCE’s results.

Groupe BPCE is also exposed to the risk of malfunction or operational failure by one of its clearing agents, foreign exchange markets, clearing houses, custodians or other financial intermediaries or external service providers that it uses to carry out or facilitate its securities transactions. As interconnectivity with its customers continues to grow, Groupe BPCE may also become increasingly exposed to the risk of the operational malfunction of customer information systems. Groupe BPCE’s communication and information systems, and those of its customers, service providers and counterparties, may also be subject to failures or interruptions resulting from cybercriminal or cyberterrorist acts. For example, as a result of its digital transformation, Groupe BPCE’s information systems are becoming increasingly open to the outside (cloud computing, big data, etc.). Many of its processes are gradually going digital. Use of the Internet and connected devices (tablets, smartphones, apps used on tablets and mobiles, etc.) by employees and customers is on the rise, increasing the number of channels serving as potential vectors for attacks and disruptions, and the number of devices and applications vulnerable to attacks and disruptions. Consequently, the software and hardware used by Groupe BPCE’s employees and external agents are constantly and increasingly subject to cyberthreats. As a result of any such attacks, Groupe BPCE may face malfunctions or interruptions in its own systems or in third-party systems that may not be adequately resolved. Any interruption or failure of the information systems belonging to Groupe BPCE or third parties may generate losses (including commercial losses) due to the disruption of its operations and the possibility that its customers may turn to other financial institutions during and/or after any such interruptions or failures.

The risk associated with any interruption or failure of the information systems belonging to Groupe BPCE or third parties is significant for Groupe BPCE in terms of impact and probability, and is therefore carefully and proactively monitored.

Reputational and legal risks could unfavorably impact Groupe BPCE’s profitability and business outlook.

Groupe BPCE’s reputation is of paramount importance when it comes to attracting and retaining customers. Use of inappropriate means to promote and market Group products and services, inadequate management of potential conflicts of interest, legal and regulatory requirements, ethical issues, money laundering laws, economic sanctions, data policies and sales and trading practices could adversely affect Groupe BPCE’s reputation. Its reputation could also be harmed by inappropriate employee behavior, cybercrime or cyber-terrorist attacks on Groupe BPCE’s information and communication systems, or any fraud, embezzlement or other misappropriation of funds committed by financial sector participants to which Groupe BPCE is exposed, or any legal ruling or regulatory action with a potentially unfavorable outcome. Any such harm to Groupe BPCE’s reputation may have a negative impact on its profitability and business outlook.

Ineffective management of reputational risk could also increase Groupe BPCE’s legal risk, the number of legal disputes in which it is involved and the amount of damages claimed, or may expose the Group to regulatory sanctions. For more information, see Chapter 10 “Legal risks” of this document. The financial consequences of these disputes may have an impact on the financial position of the Group, in which case they may also adversely impact Groupe BPCE’s profitability and business outlook.

At December 31, 2023, the total provisions for legal and tax risks amounted to €934 million.

Unforeseen events may interrupt Groupe BPCE’s operations and cause losses and additional costs.

Unforeseen events, such as a serious natural disaster, events related to climate risk (physical risk directly associated with climate change), pandemics, attacks or any other emergency situation can cause an abrupt interruption in the operations of Groupe BPCE entities, affecting in particular the Group’s core business lines (liquidity, payment instruments, securities services, loans to individual and corporate customers, and fiduciary services) and trigger material losses, if the Group is not covered or not sufficiently covered by an insurance policy. These losses could relate to material assets, financial assets, market positions or key employees, and have a direct and potentially material impact on Groupe BPCE’s net income. Moreover, such events may also disrupt Groupe BPCE’s infrastructure, or that of a third party with which Groupe BPCE does business, and generate additional costs (relating in particular to the cost of re-housing the affected personnel) and increase Groupe BPCE’s costs (such as insurance premiums). Such events may invalidate insurance coverage of certain risks and thus increase Groupe BPCE’s overall level of risk.

At December 31, 2023, the operational risks represented 9% of Groupe BPCE’s risk-weighted assets. At December 31, 2023, Groupe BPCE’s losses in respect of operational risk could be primarily attributed to the “Corporate items” business line (41%). They focused on the Basel category “Clients, Products and Business Practices” for 43%.

The failure or inadequacy of Groupe BPCE’s risk management and hedging policies, procedures and strategies may expose it to unidentified or unexpected risks which may trigger unforeseen losses.

Groupe BPCE’s risk management and hedging policies, procedures and strategies may not succeed in effectively limiting its exposure to all types of market environments or all kinds of risks, and may even prove ineffective for some risks that the Group was unable to identify or anticipate. Furthermore, the risk management techniques and strategies employed by Groupe BPCE may not effectively limit its exposure to risk and do not guarantee that overall risk will actually be lowered. These techniques and strategies may prove ineffective against certain types of risk, in particular risks that Groupe BPCE had not already identified or anticipated, given that the tools used by Groupe BPCE to develop risk management procedures are based on assessments, analyses and assumptions that may prove inaccurate or incomplete. Some of the indicators and qualitative tools used by Groupe BPCE to manage risk are based on the observation of past market performance. To measure risk exposures, the risk management department analyzes these observations, particularly statistically.

These tools and indicators may not be able to predict future risk exposures leading to model risk. For example, these risk exposures may be due to factors that Groupe BPCE may not have anticipated or correctly assessed in its statistical models or due to unexpected or unprecedented shifts in the market. This would limit Groupe BPCE’s risk management capability. As a result, losses incurred by Groupe BPCE may be higher than those anticipated on the basis of past measurements. Moreover, the Group’s quantitative models cannot factor in all risks. While no significant problem has been identified to date, the risk management systems are subject to the risk of operational failure, including fraud. Some risks are subject to a more qualitative analysis, which may prove inadequate and thus expose Groupe BPCE to unexpected losses.

Actual results may vary compared to assumptions used to prepare Groupe BPCE’s financial statements, which may expose it to unexpected losses.

In accordance with current IFRS standards and interpretations, Groupe BPCE must base its financial statements on certain estimates, in particular accounting estimates relating to the determination of provisions for non-performing loans and advances, provisions for potential claims and litigation, and the fair value of certain assets and liabilities. If the values used for the estimates by Groupe BPCE prove to be materially inaccurate, in particular in the event of major and/or unexpected market trends, or if the methods used to calculate these values are modified due to future changes in IFRS standards or interpretations, Groupe BPCE may be exposed to unexpected losses.

Information on the use of estimates and judgments is provided in Note 2.3 “Use of estimates and judgments” in the Group’s consolidated financial statements at December 31, 2023.

Strategic, business and ecosystem risks

The physical and transition components of climate and environmental risk, together with their repercussions for economic players, could adversely affect the activities, income and financial position of Groupe BPCE.

The risks associated with climate change and the environment are factors that exacerbate existing risks, including credit risk, operational risk and market risk. In particular, BPCE is exposed to physical and transition climate risk. They potentially carry an image and/or reputation risk.

Physical risk leads to increased economic costs and financial losses resulting from the severity and increased frequency of extreme weather events related to climate change (such as heat waves, landslides, floods, late frosts, fires and storms), as well as long-term gradual changes in the climate or the environment (such as changes in rainfall patterns, extreme weather variability, rising sea levels and average temperatures or the loss of biodiversity, soil and water pollution, situations of water stress). It could have an extensive impact in terms of scope and magnitude, that may affect a wide variety of geographic areas and economic sectors relevant to Groupe BPCE. For example, the Cévennes episodes that affect the south-east of France every year can cause buildings, factories and offices to flood, slowing down or even making it impossible for our customers to carry out their activities. Moreover, physical climate risk can spread along the value chain of Groupe BPCE’s corporate customers, which can lead to default and thus generate financial losses for Groupe BPCE. These physical climate risks could increase and result in significant losses for Groupe BPCE in both its banking and insurance components.

Transition risk is related to the process of adjusting to a low-carbon economy or one with a lower environmental impact, which may result in regulatory, technological or socio-demographic changes. These processes of reducing emissions are likely to have a significant impact on all sectors of the economy by affecting the value of financial assets and the profitability of companies. The increase in costs related to this transition for economic players, whether corporates or individual customers, could lead to an increase in defaults and thus significantly increase Groupe BPCE’s losses. For example, the French “Énergie-Climat” law of November 8, 2019 partially restricts the sale and rental of real estate with the lowest energy performance from 2023 and more completely in 2028. Some of Groupe BPCE’s customers will therefore have to plan renovation work for a possible future sale or lease of such type of properties. The risk lies in the impossibility for Groupe BPCE’s customers to carry out this costly work and consequently being unable to complete the financial transaction necessary to balance their budget or in the absence of transition that could result in a reputation risk. These customers of Groupe BPCE could therefore become insolvent, which would result in significant financial losses for Groupe BPCE.

Groupe BPCE may be vulnerable to political, macro-economic and financial environments or to specific circumstances in its countries of operation.

Some Groupe BPCE entities are exposed to country risk, which is the risk that economic, financial, political or social conditions in a country (particularly in countries where the Group conducts business) may affect their financial interests. Groupe BPCE predominantly does business in France (78% of net banking income for the fiscal year ended December 31, 2023) and North America (12% of net banking income for the fiscal year ended December 31, 2023), with other European countries and the rest of the world accounting for 3% and 7%, respectively, of net banking income for the fiscal year ended December 31, 2023. Note 12.6 “Locations by country” to the consolidated financial statements of Groupe BPCE, contained in the 2023 Universal Registration Document, lists the entities established in each country and gives a breakdown of net banking income and income before tax by country of establishment.

A significant change in the political or macro-economic environment of such countries or regions may generate additional expenses or reduce profits earned by Groupe BPCE.

The economic outlook remains weakened by the uncertainties and risks that surround them, especially when they are increasing against a backdrop of geopolitical tensions, as has been the case in recent months. Indeed, the extent of the imbalances to be eliminated (public and private debt; inflationary mechanics; heterogeneity of geographical and sectoral situations, combined with many overlapping global risks) can also always tip the developed economies into a downward spiral. In addition, there is the return of the risk of financial instability (such as recent concerns in China related to the level of private debt and the real estate crisis), the possible occurrence of natural disasters or the health risk. These joint threats mainly concern geopolitical and economic uncertainties: the context of the war waged by Russia against Ukraine and the conflict in the Middle East; the availability of nuclear weapons in Iran; Sino-US geostrategic tensions and the development of protectionist trends; the speed of transmission of monetary tightening to the real economy; even the behavior of European and French consumers, whose savings rate remains well above its pre-health crisis level.

In 2024, the uncertainties related to the result of the election of the President of the United States in November could revive a policy of trade war against Europe, harmful to the Eurozone and the rest of the world. It could also reinforce a scenario in which Ukraine is abandoned in its struggle against Russia, which is likely to create the conditions for a climate of concern for Europe.

Several specific risks can be described. The advanced countries escaped the layered risks which could be anticipated late 2022, ranging from the amplification of the energy crisis in the Eurozone to pressure on the global prices of many commodities with the possible intensification of the war in Ukraine and more recently in the Middle East, or the disruption of supply chains in industry. Until now, the impact of the Middle East conflict on energy prices has been reduced, but disruptions in energy supplies could still arise, which would have a significant impact on energy prices, global production and overall price levels. Like the invasion of Iraq in 2003 or the conflict between Israel and Hezbollah in 2006, the recent conflict between Israel and Hamas has had no macroeconomic effect beyond a slight increase in oil and gas prices, due to the lack of sustainable involvement of a major energy producer, unlike the Yom Kippur War (1973) and the Iranian revolution (1978-79) or the Gulf War (1990-91). In addition, OPEC retains a significant unused production capacity (4 million barrels/day) that can replace the official production in Iran (3 million barrels/day). However, there is a latent risk in the event of an extension of the conflict with Iran or the Gulf countries, as 20% of global oil and LNG traffic passes through the Strait of Hormuz. This could materialize in the event that the conflict extends to Iran or the Gulf countries decide to put pressure on Westerners by restricting their hydrocarbon exports. Moreover, because it is geographically close at hand, the development of the war in Ukraine (the Russian-Ukrainian military situation and the evolving sanctions against Russia) – in addition to the risk to the energy supply – maintains not only uncertainty and fear, but also fatigue in the face of the ongoing nature of these rapidly repeating crises, especially since the pandemic.

Specifically for Europe, the loss of competitiveness in the Eurozone (more expensive energy, particularly in Germany, rise in the effective euro exchange rate, public deficits), which the questions raised about the sustainability of public finances may exacerbate for some countries such as Italy and even France, the questions raised about the sustainability of public finances, given the rise in interest rates, has intensified the economic slowdown. The attractiveness of the European and French production site is being called into question by the activism of the United States in terms of re-industrialization. The development of protectionist trends has gained steam in the United States, e.g. the Chips Act – $270 billion – and the Inflation Reduction Act (IRA) – $370 billion – both enacted in August 2022 and both massively subsidizing the microprocessor (semiconductors) and renewable energy (energy transition) industries. Tax credits and other public subsidies could further increase the overall budget cost, estimated ex-ante at $470 billion over 10 years, due to the scale and number of industrial projects concerned. The attractiveness of the Eurozone is further undermined by sharply worsening relative costs in Europe, as a result of an energy shock that has affected it specifically. This situation is likely to send Europe into stagflation, i.e. a combined regime of relatively high inflation, persistently low growth and rising interest rates and unemployment, as occurred in the 1970s. In addition, the need to restore a certain fiscal discipline in the Member States of the Eurozone, after the overrun in public finances which was justified by the pandemic, could lead certain countries, such as Italy and France, to present debt and public deficit reduction plans. This would then gradually lead to a restriction in public spending, likely to cause a drop in demand. The economic development of Europe’s main trading partners, in particular China, could also present risks.

The combined effect of the bond crash (unrealized losses), the rise in interest rates, and restrictions on access to liquidity weakens banks, particularly in the United States, with rather recessive consequences on credit; this is also true in Europe and in France, more specifically in real estate. In particular, the very high leverage of certain types of investment funds, such as those invested in commercial or residential real estate, is likely to constitute a significant risk to financial stability in 2024. These funds could incur high losses on their risky assets if they must be sold to reduce their debt. Similarly, the valuation of equities or EBITDA multiples in private equity transactions could decline significantly in the face of the sharp rise in real long-term interest rates. More generally, in March 2023, the risk of financial instability suddenly reappeared, but without causing a crisis equivalent to that of the 2007-2008 subprime crisis, and without revealing other areas of fragility for the time being, such as liquidity issues, which have become major again. Two of the three biggest bank failures of the last fifty years in the USA spread this banking panic to one of the European banks that are included in the thirty systemic global banks on an international level. These failures (SVB, Signature, and Credit Suisse among others) are linked to management errors and specific circumstances such as a large base of unsecured and volatile deposits, an inadequate hedge against interest rate risk, an overexposure to tech and crypto entities or a loss in standing. More fundamentally, these failures stem from the maturity mismatch between assets and liabilities on the banks’ balance sheets. Basically, they were triggered by the most rapid rise in key rates since Paul Volcker’s in 1980, which pushed up the entire yield curve. This led to a 15 to 20% drop in the value of most bond securities, generating unrealized losses, which were particularly dangerous for banks faced with a process of deposit leakage as they had to mobilize their liquidity reserves for which the value had brutally and sharply fallen. These financial upheavals – which came as a further blow to a global economic situation already subject to a significant downturn – are likely to put a further brake on the distribution of credit to private agents, without necessarily leading to the emergence of a veritable “credit crunch” process. However, the situation in which the banking system finds itself seems better than in 2008, with largely stronger capitalization and liquidity ratios and loan outstandings representing less leverage in relation to deposits, especially in Europe. What is more, the central banks have extended safety nets to ensure liquidity. Eurozone banks are also more closely supervised.

Concerning France more specifically, the transmission of the tightening of monetary policy could weigh on economic activity more heavily and for longer than expected, as it could then prove much more difficult for companies, households and public finances to adjust to the new interest rate environment. In particular, even if consumption were to stimulate activity more in 2024 than in the previous year, while remaining in relatively moderate growth, the savings rate could increase in response to continued uncertainties, including internal risks of recurring social and political unrest. Obviously, it would not return to the pre-Covid level of 15%, but it would fall below 17.5% due to a long-term desire for precautionary savings and the restoration of real wealth, in the face of the previous surge in inflation.

The new housing market suffered more quickly and more severely from the combined effects of an already worsening situation well before the Covid-19 crisis, and the decline in its environment. The gradual weakening of the subsidies that had been administered by the housing policy to housing construction for decades in France, is now penalizing professionals, who are faced with both an increase in costs and a decline in the real estate purchasing power of first-time buyers and investors. The sector is also bogged down by serious structural issues (scarcity and high cost of land, ZNA (zero net artificialization), cost and scarcity of labor, high production costs for developers), with a slow and more difficult exit from the crisis. In accordance with the challenges of the national environmental transition, public authorities are redirecting their efforts towards housing renovation, with less aid for new buildings (end of the Pinel scheme in 2024 which was already more restrictive in 2023, refocusing of the PTZ, etc.) and more for supporting consumers in renovating their homes (increased budget commitments for MaPrimeRénov, Eco-PTZ, etc.). At the same time, real estate operators will have to deal with a sharp decline in activity and look for new, more efficient economic models in line with these environmental challenges, involving the commitment of substantial resources in research and development in a more restrictive economic context. This change, which would take place over a long period of time, would particularly affect builders of individual houses and private developers. In addition, commercial real estate is suffering in large urban centers, in particular due to societal movements linked to the development of remote working requiring fewer m² of offices.

These very ambitious home renovation targets still seem difficult to achieve at the current rate, which ups the probability that the renovation’s contribution to activity in the building sector will not, in the near future, offset the business shortfall caused by the decline in construction.

In 2024, the lending context seems barely more favorable than in 2023, with rates still high and more likely to fall mid-year, and measures to ease the HCSF having little impact at a time of in real estate history where households targeted by these essentially technical measures (rental investors, etc.) are turning away from markets that have become less attractive to them. Despite very motivated consumers (desire for home ownership, preparation for retirement, wealth investment, prospect of transmission, etc.), the slowdown in real estate activity in existing homes should continue in 2024 and be accompanied by a fall in prices that could deepen and spread geographically. A decline in interest rates that is more limited or later than expected, or even the formation of the cross-expectations of falling prices and interest rates would likely accentuate and prolong this fall in prices. The sharp drop in the volumes of real estate transactions accompanying this process would weigh on both the activity of real estate agencies and the resources of local authorities.

With new and existing housing markets contracting and the energy transition timetable weighing down housing stock as a whole, particularly private rental stock (more than one-third of all main residences are occupied by private sector tenants) which is tipping into weaker profitability (compounding factors in private investors’ increasing withdrawal), the overall housing supply could dry up in the face of strong and unmet demand.

Lastly, extreme weather events (heat waves, fires, droughts, floods, late freezing, hail, shrinkage of schist and clay soils...) have hit the entire continent with increasing regularity. This climate change brings with it an increase in physical and energy transition risks, one that threatens very severe consequences for the environment and the people affected in their homes. In addition to devastating social impacts (energy poverty, loss of potential asset value, and social instability), the French economy would also continue suffering the negative effects.

For more detailed information, see sections 4.2 “Economic and financial environment” and 4.8 “Economic Outlook for 2024” in the 2023 Universal Registration Document.

The risk of a pandemic (such as the coronavirus – Covid-19) and its economic consequences may adversely impact the Group’s operations, results and financial position.

The emergence of Covid-19 in late 2019 and rapid spread of the pandemic across the globe led to a deterioration in economic conditions in multiple business sectors, a deterioration in the financial position of economic players, while also disrupting the financial markets. In response, many affected countries were forced to implement preventive health measures (closed borders, lockdown measures, restrictions on certain economic activities, etc.). Government (guaranteed loans, tax and social assistance, etc.) and banking (moratoriums) schemes were put in place. Some counterparties emerged weakened from this unprecedented period.

Massive fiscal and monetary policy measures to support activity were put in place between 2020 and 2022, notably by the French government (State-guaranteed loans for businesses and professional customers on the one hand, for individual customers on the other hand, short-time working measures as well as numerous other fiscal, social and bill-paying measures) and by the European Central Bank (more abundant and cheaper access to very large refinancing packages) with a restrictive monetary policy on rates over the last few quarters. Groupe BPCE has actively participated in the French State-guaranteed loan program in the interest of financially supporting its customers and helping them overcome the effects of this crisis on their activities and income (e.g. automatic six-month deferral on loans to certain professional customers and micro-enterprises/SMEs). There is no way to guarantee, however, that such measures will be enough to offset the negative impacts of the pandemic on the economy or to fully stabilize the financial markets over the long term. In particular, the repayment of State-guaranteed loans may lead to defaults on the part of borrowers and financial losses for Groupe BPCE up to the portion not guaranteed by the State.

Groupe BPCE may not achieve the objectives of its BPCE 2024 strategic plan.

On July 8, 2021, Groupe BPCE announced its BPCE 2024 strategic plan. It is structured around the following three strategic priorities: (i) a winning spirit, with €1.5 billion in additional revenues in five priority areas, (ii) customers, by offering them the highest quality service with an adapted relationship model, and (iii) the climate, through concrete and measurable commitments. The BPCE 2024 strategic plan is based on the following three key principles: (i) be simple: because Groupe BPCE seeks efficiency and customer satisfaction, it aims for greater simplicity; (ii) be innovative: because Groupe BPCE is driven by an entrepreneurial spirit and is aware of the reality of the changes underway, it strengthens its capacity for innovation; and (iii) be safe: because Groupe BPCE is committed to a long-term approach, it prioritizes the security of its development model with regard to its ambitions. These strategic objectives were developed in the context of the Covid-19 crisis, which acted as an indicator and an accelerator of fundamental trends (in particular digitalization, hybrid work, energy transition) and in an economic framework that did not take into account a rise in inflation and an increase in interest rates of the magnitude observed.

The success of the BPCE 2024 strategic plan is based on a very large number of initiatives to be implemented within the various business lines of Groupe BPCE. Although most of the objectives of the strategic plan are expected to be achieved, some may not be, due to this major and abrupt change in the economic environment. If Groupe BPCE does not achieve all of the targets defined in its BPCE 2024 strategic plan, its financial position and results could be more or less significantly affected.

Groupe BPCE may encounter difficulties in adapting, implementing and incorporating its policy governing acquisitions or joint ventures.

Although acquisitions are not a major part of Groupe BPCE’s current strategy, the Group may nonetheless consider acquisition or partnership opportunities in the future. Although Groupe BPCE carries out an in-depth analysis of any potential acquisitions or joint ventures, in general it is impossible to carry out an exhaustive appraisal in every respect. As a result, Groupe BPCE may have to manage initially unforeseen liabilities. Similarly, the results of the acquired company or joint venture may prove disappointing and the expected synergies may not be realized in whole or in part, or the transaction may give rise to higher-than-expected costs. Groupe BPCE may also encounter difficulties with the consolidation of new entities. The failure of an announced acquisition or failure to consolidate a new entity or joint venture may place a strain on Groupe BPCE’s profitability. This situation may also lead to the departure of key employees. In the event that Groupe BPCE is obliged to offer financial incentives to its employees in order to retain them, this situation may also lead to an increase in costs and a decline in profitability. Joint ventures also expose Groupe BPCE to additional risks and uncertainties such as dependency on systems, controls and persons that would be outside its control and may, in this respect, see its liability incurred, suffer losses or incur damage to its reputation. Moreover, conflicts or disagreements between Groupe BPCE and its partners may have a negative impact on the targeted benefits of the joint venture.

At December 31, 2023, the total investments accounted for using the equity method amounted to €1.6 billion. For further information, please refer to Note 12.4.1 “Partnerships and associates” to the consolidated financial statements of Groupe BPCE, included in the 2023 Universal Registration Document.

Intense competition in France, Groupe BPCE’s main market, or internationally, may cause its net income and profitability to decline.

Groupe BPCE’s main business lines operate in a very competitive environment both in France and other parts of the world where it does substantial business. This competition is heightened by consolidation, either through mergers and acquisitions or cooperation and arrangements. Consolidation has created a certain number of companies which, like Groupe BPCE, can offer a wide range of products and services ranging from insurance, loans and deposits to brokerage, investment banking and asset management. Groupe BPCE is in competition with other entities based on a number of factors, including the execution of transactions, products and services offered, innovation, reputation and price. If Groupe BPCE is unable to maintain its competitiveness in France or in its other major markets by offering a range of attractive and profitable products and services, it may lose market share in certain key business lines or incur losses in some or all of its activities.

For example, at December 31, 2023, in France, Groupe BPCE was the number one bank for SMEs⁽¹⁾ and number two for individual, professional and self-employed customers⁽²⁾. It had a 26.2% market share in home loans⁽²⁾. For Retail Banking and Insurance, loan outstandings amounted to €719 billion at December 31, 2023, compared to €701 billion at December 31, 2022, with savings deposits⁽³⁾ of €918 billion at December 31, 2023, compared to €888 billion at December 31, 2022 (for more information on the contribution of each business line, and each network, see section 4.4.2. “The Group’s business lines” of the 2023 Universal Registration Document).

In addition, any slowdown in the global economy or in the economies in which Groupe BPCE’s main markets are located is likely to increase competitive pressure, in particular through increased pressure on prices and a contraction in the volume of activity of Groupe BPCE and its competitors. New, more competitive rivals subject to separate or more flexible regulation or other prudential ratio requirements could also enter the market. These new market participants would thus be able to offer more competitive products and services. Advances in technology and the growth of e-commerce have made it possible for institutions other than custodians to offer products and services that were traditionally considered as banking products, and for financial institutions and other companies to provide electronic and internet-based financial solutions, including electronic securities trading. These new entrants may put downward pressure on the price of Groupe BPCE’s products and services or affect Groupe BPCE’s market share. Advances in technology could lead to rapid and unexpected changes on Groupe BPCE’s markets of operation. Groupe BPCE’s competitive position, net income and profitability may be adversely affected should it prove unable to adequately adapt its activities or strategy in response to such changes.

Groupe BPCE’s ability to attract and retain skilled employees is paramount to the success of its business and failing to do so may affect its performance.

The employees of Groupe BPCE entities are the Group’s most valuable resource. Competition to attract qualified employees is fierce in many areas of the financial services sector. Groupe BPCE’s earnings and performance depend on its ability to attract new employees and retain existing employees. The current upheavals (technological, economic and customer requirements), particularly in the banking sector, demand major efforts to support and train employees. Without enough support, this could prevent Groupe BPCE from taking advantage of potential opportunities in terms of sales or efficiency, which could in turn affect its performance.

At December 31, 2023, Groupe BPCE had 100,670 employees. During the year, 8,738 permanent employees were recruited (for more information, see section 2.4 “A social, active and responsible strategy” of the 2023 Universal Registration Document).

Groupe BPCE could be exposed to unidentified or unanticipated risks that may have a negative impact on its results and financial position if its model-based risk measurement system should fail.

Groupe BPCE’s risk measurement system is based specifically on the use of models. Groupe BPCE’s portfolio of models mainly includes the Corporate & Investment Banking market models and the credit models of Groupe BPCE and its entities. The models used for strategic decision-making and risk management monitoring (credit, financial (ALM and market), operational including compliance and climatic) could fail, exposing BPCE to unidentified or unanticipated risks that could result in significant losses.

Insurance risks

At December 31, 2023, net banking income from insurance activities was €1,311 million for the year 2023 compared to €991 million for 2022 (2022 data restated for the impacts of the first-time application of IFRS 9 and IFRS 17 relating to insurance activities).

A deterioration in market conditions, in particular excessive fluctuations in interest rates (both upwards and downwards) and/or a deterioration in spreads or equity markets, could have a significant adverse impact on the financial position and solvency of Life and Non-Life insurance companies.

The main risk to which Groupe BPCE’s insurance subsidiaries are exposed is financial risk. Exposure to this risk is mainly linked to the capital guarantee on the scope of euro funds for savings products, and to unrealized capital gains or losses on portfolio investments.

Among financial risks, interest-rate risk is structurally significant due to the predominantly bond-based composition of assets backing commitments. Significant fluctuations in interest rates may have the following consequences:

As a result of asset allocation, the widening of spreads and the decline in the equity markets could also have a significant unfavorable impact on the results of Groupe BPCE’s insurance activities, in particular through the recording of provisions for impairment due to the decline in the valuation of investments at fair value through profit or loss.

A mismatch between the level and cost of claims anticipated by insurers, on the one hand, and premiums and provisions on the other, could have a significant adverse impact on the results and financial position of the non-life, personal protection and surety potion of its insurance activities.

The main risk to which Groupe BPCE’s insurance business subsidiaries are exposed in connection with these latter activities is underwriting risk. This risk arises from the mismatch between, on the one hand, the claims actually incurred and the sums actually paid out as compensation for them and, on the other hand, the assumptions used by subsidiaries to set their product rates and establish technical provisions for potential compensation.

Companies use both their own experience and industry data to establish loss ratio and actuarial estimates, including the pricing of insurance products and the establishment of related technical provisions. However, reality may differ from these estimates, and unforeseen risks such as pandemics or natural disasters could result in higher-than-expected payments to policyholders. In this respect, changes in climate phenomena (known as “physical” climate risks) are subject to particular vigilance.

In the event of claims exceeding the underlying assumptions initially used to establish provisions, or if events or trends lead to changes in the underlying assumptions, companies could be exposed to greater liabilities than anticipated, which could adversely affect their results and financial position. This could be the case in connection with the climatic hazards described above.

The various actions implemented in recent years, particularly in terms of financial coverage, reinsurance, business diversification and investment management, have contributed to the resilience of the solvency of Groupe BPCE’s insurance subsidiaries.

Regulatory risks

Groupe BPCE is subject to significant regulation in France and in several other countries around the world where it operates; regulatory measures and changes could have a material adverse impact on Groupe BPCE’s business and results.

The business and results of Group BPCE entities may be materially impacted by the policies and actions of various regulatory authorities in France, other governments of the European Union, the United States, foreign governments and international organizations. Such constraints may limit the ability of Groupe BPCE entities to expand their businesses or conduct certain activities. The nature and impact of future changes in such policies and regulatory measures are unpredictable and are beyond Groupe BPCE’s control. Moreover, the general political environment has evolved unfavorably for banks and the financial industry, resulting in additional pressure on the part of legislative and regulatory bodies to adopt more stringent regulatory measures, despite the fact that these measures may have adverse consequences on lending and other financial activities, and on the economy. Because of the continuing uncertainty surrounding the new legislative and regulatory measures, it is not possible to predict what impact they will have on Groupe BPCE; however, this impact may be highly adverse.

Groupe BPCE may have to reduce the size of some of its activities to comply with new requirements. New measures are also liable to increase the cost of compliance with new regulations. This could cause revenues and consolidated profit to decline in the relevant business lines, sales to decline in certain activities and asset portfolios, and asset impairment expenses.

The purpose of the 2019 adoption of the final versions of the Banking Package was to align prudential requirements for banks with Basel III standards. The implementation of these reforms may result in higher capital and liquidity requirements, which could impact Groupe BPCE funding costs.

On November 11, 2020, the Financial Stability Board (“FSB”), in consultation with the Basel Committee on Banking Supervision and national authorities, reported the 2020 list of global systemically important banks (“G-SIBs”). Groupe BPCE is classified as a G-SIB by the FSB. Groupe BPCE also appears on the list of global systematically important institutions (“G-SIIs”).

These regulatory measures, which may apply to various Groupe BPCE entities, and any changes in such measures may have a material adverse impact on Groupe BPCE’s business and results.

Legislation and regulations have recently been enacted or proposed in recent years with a view to introducing a number of changes, some permanent, in the global financial environment. These new measures, aimed at avoiding a new global financial crisis, have significantly altered the operating environment of Groupe BPCE and other financial institutions, and may continue to alter this environment in the future. Groupe BPCE is exposed to the risk associated with changes in legislation and regulations. These include the new prudential backstop rules, which measure the difference between the actual provisioning levels of defaulted loans and guidelines including target rates, depending on the age of the default and the presence of guarantees.

In today’s evolving legislative and regulatory environment, it is impossible to foresee the impact of these new measures on Groupe BPCE. The development of programs aimed at complying with these new legislative and regulatory measures (and updates to existing programs), and changes to the Group’s information systems in response to or in preparation for new measures generates significant costs for the Group, and may continue to do so in the future. Despite its best efforts, Groupe BPCE may also be unable to fully comply with all applicable laws and regulations and may thus be subject to financial or administrative penalties. Furthermore, new legislative and regulatory measures may require the Group to adapt its operations and/or may affect its results and financial position. Lastly, new regulations may require Groupe BPCE to strengthen its capital or increase its total funding costs.

The late publication of regulatory standards could lead to some delays in their implementation in Groupe BPCE’s tools.

The risk associated with regulatory measures and subsequent changes to such measures is significant for Groupe BPCE in terms of impact and probability, and is therefore carefully and proactively monitored.

BPCE may have to help entities belonging to the financial solidarity mechanism in the event they experience financial difficulties, including entities in which BPCE holds no economic interest.

As the central institution of Groupe BPCE, BPCE is responsible for ensuring the liquidity and solvency of each regional bank (Banques Populaires and Caisses d’Epargne) and the other members of the group of affiliates. The group of affiliates includes BPCE subsidiaries, such as Natixis, Crédit Foncier de France, Oney and Banque Palatine. For Groupe BPCE, all entities affiliated with the central institution of Groupe BPCE benefit from a guarantee and solidarity mechanism, the aim of which, in accordance with Articles L. 511-31, L. 512-107-5 and L. 512-107-6 of the French Monetary and Financial Code, is to ensure the liquidity and solvency of all affiliated entities and to organize financial solidarity throughout the Group.

This financial solidarity is based on legislative provisions establishing a legal principle of solidarity, imposing a performance obligation on the central institution to restore the liquidity or solvency of affiliates in difficulty and/or all affiliates of the Group. By virtue of the unlimited nature of the principle of solidarity, BPCE is entitled at any time to ask any one or several or all of the affiliates to contribute to the financial efforts that may be necessary to restore the situation, and may, if necessary, mobilize all the cash and equity capital of the affiliates in the event of difficulty for one or more of them.

The three guarantee funds created to cover Groupe BPCE’s liquidity and insolvency risks are described in Note 1.2 “Guarantee mechanism” to the consolidated financial statements of Groupe BPCE included in this amendment to the 2023 Universal Registration Document. At December 31, 2023, the Banque Populaire and Caisse d’Epargne funds each contained €450 million. The Mutual Guarantee Fund holds €174 million in deposits per network. The regional banks are obligated to make additional contributions to the guarantee fund on their future profits. While the guarantee fund represents a substantial source of resources to fund the solidarity mechanism, there is no guarantee these revenues will be sufficient. If the guarantee funds prove insufficient, BPCE, due to its missions as a central institution, will have to do everything necessary to restore the situation and will have the obligation to make up the deficit by implementing the internal solidarity mechanism that it has put in place, by mobilizing its own resources, and may also make unlimited use of the resources of several or all of its affiliates.

As a result of this obligation, if a member of the Group were to encounter major financial difficulties, the event underlying these financial difficulties could have a negative impact on the financial position of BPCE and that of the other affiliates thus called upon to provide support under the principle of financial solidarity.

Investors in BPCE’s securities could suffer losses if BPCE and all of its affiliates were to be subject to liquidation or resolution procedures.

The EU regulation on the Single Resolution Mechanism No. 806/214 and the EU directive for the recovery and resolution of banks No. 2014/59, as amended by EU Directive No. 2019/879 (the “BRRD”), as transposed into French law in Book VI of the French Monetary and Financial Code, give the resolution authorities the power to impair BPCE securities or, in the case of debt securities, to convert them to capital.

Resolution authorities may write down or convert capital instruments, such as BPCE’s Tier-2 subordinated debt securities, if the issuing institution or the group to which it belongs is failing or likely to fail (and there is no reasonable prospect that another measure would avoid such failure within a reasonable time period), becomes non-viable, or requires extraordinary public support (subject to certain exceptions). They shall write down or convert additional capital instruments before opening a resolution proceeding, or if doing so is necessary to maintain the viability of an institution. Any write-down of capital instruments shall be effected in order of seniority, so that Common Equity Tier-1 instruments are to be written down first, then additional Tier-1 instruments are to be written down, followed by Tier-2 instruments. Additional capital instruments must be converted in order of priority, such that additional Tier-1 instruments are converted first followed by Tier-2 instruments. If the write-down or conversion of capital instruments is not sufficient to restore the financial health of the institution, the bail-in power held by the resolution authorities may be applied to write down or convert eligible liabilities, such as BPCE’s senior non-preferred and senior preferred securities.

At December 31, 2023, total Tier-1 capital amounted to €71.2 billion and Tier-2 prudential capital to €12.2 billion. Senior non-preferred debt instruments amounted to €32.4 billion at that date, of which €28.9 billion had a maturity of more than one year and were therefore eligible for TLAC and MREL.

As a result of the complete legal solidarity, and in the extreme case of a liquidation or resolution proceeding, one or more affiliates may not find itself subject to court-ordered liquidation, or be affected by resolution measures within the meaning of the “BRRD”, without all affiliates and BPCE also being affected. In accordance with Articles L. 613-29 and L. 613-55-5 of the French Monetary and Financial Code, the judicial liquidation proceedings and resolution measures are therefore brought in a coordinated manner with regard to the central institution and all of its affiliates.

Article L. 613-29 also provides that, in the event of court-ordered liquidation proceedings being brought against all affiliates, the external creditors (of the same rank or enjoying identical rights) of all affiliates would be treated equally according to the ranking of the creditors and regardless of whether they are attached to a particular affiliated entity. As a result, investors in AT1 instruments and other securities of the same rank would be more affected than holders of Tier-2 and other securities of the same rank, which in turn would be more affected than investors in external senior non-preferred debt, which in turn would be more affected than investors in external senior preferred debt. Similarly, in the event of resolution, and in accordance with Article L. 613-55-5 of the French Monetary and Financial Code, identical depreciation and/or conversion rates would be applied to debts and receivables of the same rank, regardless of their attachment to a particular affiliated entity in the order of the hierarchy recalled above.

Due to the systemic nature of Groupe BPCE and the assessment currently made by the resolution authorities, resolution measures would be more likely to be taken than the opening of judicial liquidation proceedings. A resolution procedure may be initiated against BPCE and all affiliated entities if (i) the default of BPCE and all affiliated entities is proven or foreseeable, (ii) there is no reasonable expectation that another measure could prevent this failure within a reasonable timeframe and (iii) a resolution measure is required to achieve the objectives of the resolution: (a) guarantee the continuity of critical functions, (b) avoid material adverse impacts to financial stability, (c) protect State resources by minimizing the use of exceptional public financial support and (d) protect client funds and assets, particularly those of depositors. Failure of an institution means that it does not respect requirements for continuing authorization, it is unable to pay its debts or other liabilities when they fall due, it requires extraordinary public financial support (subject to limited exceptions), or the value of its liabilities exceeds the value of its assets.

In addition to the bail-in power, resolution authorities are provided with broad powers to implement other resolution measures with respect to failing institutions or, under certain circumstances, their groups, which may include (without limitation): the total or partial sale of the institution’s business to a third party or a bridge institution, the separation of assets, the replacement or substitution of the institution as obligor in respect of debt instruments, modifications to the terms of debt instruments (including altering the maturity and/or the amount of interest payable and/or imposing a temporary suspension on payments), discontinuing the listing and admission to trading of financial instruments, the dismissal of managers or the appointment of a temporary administrator (administrateur spécial) and the issuance of new equity or own funds.

The exercise of the powers described above by resolution authorities could result in the partial or total write-down or conversion to equity of the capital instruments and the debt instruments issued by BPCE, or may substantially affect the amount of resources available to BPCE to make payments on such instruments, potentially causing BPCE investors to incur losses.

Tax legislation and its application in France and in countries where Groupe BPCE operates are likely to have an adverse impact on Groupe BPCE’s profits.

As a multinational banking Group that carries out large and complex international transactions, Groupe BPCE (particularly Natixis) is subject to tax legislation in a large number of countries throughout the world, and structures its activity in compliance with applicable tax rules. Changes in tax schemes by the competent authorities in these countries could materially impact Groupe BPCE’s profits. Groupe BPCE manages its activities with a view to creating value from the synergies and sales capabilities of its various constituent entities. It also strives to structure the financial products sold to its customers by factoring in their tax consequences. The structure of intra-group transactions and financial products sold by entities of Groupe BPCE are based on its own interpretations of applicable tax regulations and laws, generally based on opinions given by independent tax experts, and, as needed, on decisions or specific interpretations by the competent tax authorities. It is possible that in the future tax authorities may challenge some of these interpretations, as a result of which the tax positions of Groupe BPCE entities may be disputed by the tax authorities, potentially resulting in tax re-assessments, which may in turn have an adverse impact on Groupe BPCE’s results. Details of ongoing tax disputes are presented in the Legal risks section of this document.

The Group Risk and Compliance Committee, chaired by the Chairman of the Management Board, met six times in 2023 to review the adequacy of Groupe BPCE’s risk management systems, and validated the annual review of the Group’s risk policies. These systems cover all risks, as described in the Ministerial Order of November 3, 2014 on internal control as amended by the Order of February 25, 2021.

The coverage of risks was found to be adequate, consistent with the risk appetite framework validated by the BPCE Management Board and Supervisory Board, and related closely to the Group’s strategy and budget oversight.

All risks are covered by central and local risk management systems, in line with the Group’s risk appetite and strategy.

Groupe BPCE’s Supervisory Board unanimously approved the Group’s risk appetite framework: quantitative indicators, resilience threshold for each indicator and associated governance. During its annual review, the Supervisory Board examined and approved the Group’s risk appetite in November 29, 2023.

Risk Appetite Guidelines

As a decentralized and united cooperative Group, Groupe BPCE structures its activity around share capital, held predominantly by the regional institutions, and centralized market funding, optimizing the resources allocated to the entities.

Groupe BPCE:

Groupe BPCE’s risk appetite is defined as the level of risk it is willing to accept with the goal of increasing its profitability while maintaining solvency. This risk appetite must be aligned with the institution’s operating environment, strategy and business model, while making customer interests the top priority. In determining its risk appetite, Groupe BPCE aims to steer clear of any major pockets of concentration and to optimize capital allocation.

In terms of risk profile, Groupe BPCE incurs risks intrinsically associated with its retail banking and Corporate & Investment Banking activities. Changes to its business model are increasing the Group’s exposure to some types of risks, particularly risks related to asset management and international businesses.

The Group does not conduct business unless it has the associated risks sufficiently under control, nor does it exercise proprietary trading activities. Activities with high risk-reward profiles are strictly controlled.

In all activities, entities and regions of operation, the Group undertakes to meet the highest standards of ethics, conduct, best execution and transaction security.

Risk appetite framework and groupwide implementation

The risk appetite framework is based on a master document providing a qualitative and quantitative description of the risks that Groupe BPCE is willing to assume, and describing the governance and operating guidelines in effect.

The implementation of the risk appetite framework is centered on four key components: (i) the definition of groupwide standards, (ii) the existence of a set of limits in line with those defined by regulations, (iii) the distribution of expertise and responsibilities between the entities and the central institution and (iv) the operation of the governance process within the Group and the different entities, enabling the efficient and resilient application of the risk appetite framework.

The Group’s risk appetite framework is regularly updated (at least annually) and is centered on a series of successive limits associated with separate respective authorization levels, i.e.:

A quarterly dashboard is prepared by the Group’s Risk division, for the purpose of regularly and extensively monitoring all risk indicators and reporting to the supervisory body or/and any committee thereof.

The risk appetite framework is adapted by the entities for consistent groupwide implementation.

The Risk division issues an annual compliance notice to the institutions in their annual draft proposal, ensuring a high level of consistency between the risk appetites implemented locally and that of the Group.

Robust financial strength

Groupe BPCE enjoys high liquidity and solvency levels:

The Group ensures the robustness of this system by implementing global or dedicated stress tests such as those for climate risk management, which are carried out regularly. They are intended to verify the Group’s resilience, particularly in the event of a serious crisis.

Summary of the Group’s risk profile in 2023

The following risks are incurred by the Group because of its business model:

Emerging risks

Groupe BPCE places great importance on anticipating and managing emerging risks in today’s constantly changing environment. To this end, a prospective analysis identifying the risks that could impact the Group is carried out every six months and presented to the Risk and Compliance Committee, followed by the Board’s Risk Committee.

Since the previous study conducted in June 2023, the macro-economic context remains deteriorated, with weaker growth prospects than previously anticipated. The economic slowdown and worsening business conditions persist because the changes initiated since 2022 have continued (inflation down but still high, increase in interest rates). In addition, the geopolitical context is tense once again due to the conflict in the Middle East, an additional source of uncertainty.

Credit risk, cyber risk, interest rate risk and liquidity risk are still the four main risks weighing on business.

Macro-economic conditions pose an increased risk of deterioration in credit portfolios, particularly for certain customer segments such as professionals and corporates whose conditions are worsening, as well as for the sectors most sensitive to interest rate increases, including real estate.

As the economy and financial services have grown increasingly digitized, banks have had to remain constantly vigilant against cyber-threats. The sophistication of cyber-attacks and potential vulnerability of their IS systems are both major risks for Groupe BPCE, in conjunction with the expectations of the regulatory authority.

Vigilance remains high on interest rate, investment and liquidity risks. While the changing interest rate environment is currently weighing heavily on the Group’s profitability, its impact should gradually decrease beginning in 2024. As for liquidity risk, refinancing conditions are becoming more difficult for banks in a context of declining customer resources following the reorientation of inflows and the TLTRO exit.

Finally, climate change is an integral part of the risk management policy, with a risk management system that is now being strengthened.

Governance of risk management

Risk management is governed by two main bodies at Group level: the Supervisory Board, which is supported by the Board’s Risk Committee, and the Executive Management Committee, of which the Head of Risk Management is a member.

Chaired by the Chairman of the Management Board, the Group Risk and Compliance Committee, an umbrella committee, sets the broad outlines of the risk policy and examines issues related to non-financial risks (specifically those related to banking, insurance and investment service compliance, and to financial security), annually reviews the risk appetite framework, and approves a prospective risk analysis.

Organization of risk management

Groupe BPCE’s Risk division and General Secretariat – in charge of compliance and permanent control – measure, monitor and manage risks, pursuant to the Ministerial Order of November 3, 2014 as amended by the Order of February 25, 2021, on internal control.

They ensure that the risk management system is effective, complete and consistent, and that risk-taking is consistent with the guidelines for the business (particularly the targets and resources of the Group and its institutions).

These duties are formalized in Groupe BPCE’s Internal Control Charter, an umbrella charter. It is based on the two charters of the control functions, namely the Internal Audit Charter and the Group Risk, Compliance and Permanent Control Charter.

The various departments of the Group Risk division are involved in all risks (credit, financial, operational, climate and non-banking investments) by acting on:

The departments of the Group’s Risk division operate in three areas (Management, Monitoring and Control):

SPECIAL COMMITTEES

Several committees are responsible for defining Groupwide methodology standards for measuring, managing, reporting and consolidating all risks throughout the Group.

Organization of permanent control functions in the Group’s institutions

The Group’s Risk division and General Secretariat oversee the Group’s risk management, compliance and Permanent Control functions, focusing on the management of credit, financial, operational, climate and non-compliance risks, extended to business continuity, financial control and information system security functions. They ensure that the risk policies of the affiliates and subsidiaries comply with those of Groupe BPCE.

The Risk and/or Compliance divisions of subsidiaries not subject to the banking supervision regulatory framework are functionally subordinate to Groupe BPCE’s Risk division and General Secretariat.

The strong functional authority is exercised by the Head of Risk Management and by the Secretary General, both members of Groupe BPCE’s Executive Management Committee. It enables risk controls to be performed objectively, as each Group entity’s operational functions are independent from its risk and Compliance functions. It also promotes a risk management and compliance culture and the application of shared risk management standards, and ensures that managers are given independent, objective and detailed information on the Group’s risk exposures and any possible deterioration in its risk profile.

Group institutions are responsible for defining, monitoring and managing their risk levels, as well as producing reports and data for submission to the central institution’s Risk division and General Secretariat. They ensure the quality, reliability and completeness of the data used to control and monitor risks at the company level and on a consolidated basis, in line with Group risk standards and policies.

In the course of their work, the Group’s institutions rely on the Group Risk, Compliance and Permanent Control Charter. The charter specifies that each institution’s supervisory body and executive management promote the risk management culture at all levels of their organization.

A twofold assessment of a) Risk Management functions and b) Compliance functions is conducted annually by the Risk Committee of the Groupe BPCE Supervisory Board and sent to the management of the Group’s main establishments.

STANDARD RISK GOVERNANCE STRUCTURE AT A GROUP INSTITUTION

Risk function governance

ORGANIZATION

The Risk Governance and Control department is responsible for coordinating and leading the risk function and the second level permanent control of the Risk function within Groupe BPCE. The Risk, Compliance and Permanent Control Charter calls for the Group Risk division to participate, at their own initiative, in the annual performance assessment of the Heads of the Permanent Control functions, particularly risk and/or compliance, in consultation with the Chairman of the Management Board or the Chief Executive Officer.

The Risk Governance and Control department deploys the entire system on a daily basis and contributes to the overall supervision of Group risks, primarily through:

For coordination purposes, the Risk Governance and Control department relies on a half-yearly report drawn up by the institutions, aimed at ensuring that the various components of the local systems are properly implemented and operate under satisfactory conditions, particularly with respect to banking regulations and Group charters. The findings of this report improve operational efficiency and optimize best practices throughout the Group.

Activities specifically focused on the Lagarde report are being monitored in conjunction with the Group’s institutions. There is also a system in place to monitor anomalies observed at Group institutions, aimed at ensuring that business is conducted properly and the rules of ethics are applied.

Risk culture

To promote and strengthen the risk and compliance culture at all levels, the Risk function and culture of the Risk Governance and control department is focused on developing risk training and awareness programs at all Group levels, establishing regular communication on risk issues throughout the Group, and disseminating and measuring the risk culture.

Macro-level risk mapping of institutions

The macro-level risk map plays a central role in an institution’s overall risk management system: by identifying and rating its risks, in particular through the evaluation of its risk management system, each institution in the Group has its own risk profile and priority risks. This risk-based approach serves to update the risk appetite and the permanent/periodic control plans of Group institutions on a yearly basis.

Action plans targeting high-priority risks are defined with the goal of reducing and/or managing risks.

The results of the macro-level risk mapping process contribute to the Group’s Supervisory Review and Evaluation Process (SREP), by identifying the main risks under the risk management and prudential approach, included in the annual report on internal control, the ICAAP report and the Universal Registration Document (risk factors section).

In 2023, as in previous years, a consolidation of the macro-level risk mapping was carried out for each network. Each institution is able to compare the results of its own macro-level risk mapping with those of its network. Action plans set up by the institutions to address their priority risks were also consolidated.

The macro-risk mapping is integrated into the PRISCOP permanent control management tool, which makes it possible to automate the risk-control links in the risk management system.

The macro-level risk mapping was performed at Group level in 2023 as in previous years, by consolidating the macro-level risk maps of the parent company institutions and subsidiaries.

Lastly, the Risk Governance and Control department is responsible for validating the Group’s models outside Natixis and the General Secretariat (human resources and Budget) of the Group Risk division.

Consolidated risk oversight

ORGANIZATION

In addition to the risk supervision conducted both individually and by type of risk, Groupe BPCE’s Risk division also performs consolidated monitoring of the Group’s risks. A Group risk dashboard is produced quarterly. It contains a quarterly Group risk dashboard, which is used to monitor the risk appetite defined by the Group as well as for comprehensive monitoring of risks based on an analysis of the Group’s risk profile in each area (mapping of risk-weighted assets, credit risks and counterparty risks – by customer segment –, market risks, structural ALM risks, non-financial risks and risks related to insurance businesses). In addition to the dashboard, a monthly flash report provides the Group with a more responsive and updated overview of Group risks.

The Group Risk division also conducts or coordinates cross-business risk analyses and specific stress tests on the Group’s main portfolios or activities and, if needed, for the entities. It has also developed half-year forward-looking risk analyzes aimed at identifying economic risk factors (known and emerging; international, national and regional), circumstantial threats (regulations, etc.) and their potential impact on the Group. These forward-looking analyses are presented at meetings of the Group Supervisory Board’s Risk Committee.

In addition, it carries out risk measurements on a portfolio basis. It reviews and validates risk models developed internally. Lastly, it contributes to efforts to define internal capital requirements as well as internal and external solvency stress tests aimed at measuring the Group’s sensitivity to a series of risk factors and its resilience in the event of a severe shock, by determining impacts in terms of cost of risk and RWA.

Stress testing system

Groupe BPCE has been developing stress tests since 2011 that can be performed using the risk modules for Group strategic analysis purposes and regulatory purposes.

The Group control system relies on three levels of controls, in accordance with banking regulations and sound management practices (two levels of permanent controls and one level of periodic control), as well as the establishment of consolidated control processes in accordance with provisions approved by BPCE’s Management Board.

STRUCTURE OF GROUPE BPCE’S INTERNAL CONTROL SYSTEM

Permanent control system

The organization of permanent control in the Group is specified in the Internal Control Charter (updated on July 23, 2020) in paragraph 3 and in the DRCCP Charter (updated on December 9, 2021) in paragraphs 2 and 5 in accordance with the Ministerial Order of November 3, 2014 (revised on February 25, 2021), in particular in Article 12.

In terms of governance, the assessment of the permanent control system is the responsibility of the Group Internal Control Coordination Committee (or 3CI or CCFC in its local implementation).

The permanent control system is based on the taxonomy of controls, which includes definitions of control methods.

The system comprises two types of level 1 controls (first line of defense LOD1) carried out by employees carrying out operational activities. These employees identify the risks associated with their activity and comply with the procedures and limits set:

The system also includes two types of level 2 controls (second line of defense LOD2) performed by agents at the central and local levels:

COORDINATION OF PERMANENT CONTROLS IN INSTITUTIONS

In accordance with the Group’s Risk, Compliance and Permanent Control Charter, it is recommended that a permanent control coordination function be set up in each institution or Group head office covering the entire Risk/Compliance/Security area. In the absence of a dedicated department, these missions are the responsibility of the Head of Risk, Compliance and Permanent Control or the Chief Risk Officer and the Head of Compliance, it being understood that the designated Executive Officer remains responsible for the consistency and effectiveness of the control, within the meaning of the Ministerial Order of November 3, 2014 as amended by the Order of February 25, 2021.

COORDINATION OF PERMANENT CENTRAL CONTROLS

In the General Secretariat, the main role of the Group Coordination of Permanent Controls department is to coordinate the Group’s level 1 and 2 permanent control system. In this context, it:

CREATION OF PERMANENT RISK CONTROL AT THE GROUP RISK DIVISION

At the Group Risk division, a permanent risk control unit was set up at the end of 2022 with a team fully constituted in 2023 in charge of permanent controls of Level 2.2 for the risk function and Level 2 for the GRD’s sensitive activities.

This team brings together all the permanent control activities carried out by the various risk departments and covers all risks: credit, financial, operational, climate, models, etc.

PERMANENT CONTROL CULTURE

The control culture has been strengthened by the implementation of a certification in permanent control of the banking and insurance business lines validated by the external body France Compétences. This certification is intended for the level 1 and level 2 Permanent Control functions but also for the LOD2 functions.

Structure of integrated control functions

The Group Risk division and the Group General Secretariat are responsible for permanent controls at Group level, and the General internal audit for periodic control.

The permanent and periodic control functions of affiliates and subsidiaries, subject to banking supervision, are functionally subordinate, as Consolidated Control departments, to BPCE’s corresponding Central Control divisions and report to their entity’s executive body.

These ties have been formally defined in charters for each function, covering:

The entire system was approved by the Management Board on December 7, 2009, and presented to the Audit Committee on December 16, 2009 and to the BPCE Supervision Board. The Risk, Compliance and Permanent Control Charter was reviewed in December 2021 and the body of standards consists of three Group charters covering all activities.

The Group’s Internal Control Charter is the umbrella charter. It is based on two specific charters:

Internal Control Coordination Committee

The Chairman of the BPCE Management Board is responsible for ensuring the consistency and effectiveness of the internal control system. A Group Internal Control Coordination Committee, chaired by the Chairman of the Management Board, meets periodically.

This committee is responsible for dealing with all issues relating to the consistency and effectiveness of the Group internal control system, as well as the results of risk management and internal control work and follow-up work.

The committee’s main responsibilities include:

The members of the Executive Management Committee in charge of Risk Management (Group Risk division) and of Compliance and Permanent Controls (General Secretariat), as well as the Head of the General internal audit, are members of this committee. Where applicable, the Internal Control Coordination Committee may hear reports from operational managers about measures they have taken to apply recommendations made by internal and external control bodies.

Periodic control (level 3)

ORGANIZATION AND ROLE OF THE GENERAL INTERNAL AUDIT

DUTIES

In accordance with the duties incumbent on the central institution, and pursuant to the rules of collective solidarity, the General internal audit is responsible for periodically verifying the operation of all Group institutions and providing their executive managers with reasonable assurance of their financial strength.

In that role, it ensures the quality, effectiveness, consistency and efficiency of their control system as well as their risk management. The division’s scope of authority covers all risks, all institutions and all activities, including those that are outsourced.

Its top priorities are to assess and to report to the executive and decision-making bodies of the entities and the Group as a whole on:

Reporting to the Chairman of the Management Board, the General internal audit performs its duties independently of the Operational and Permanent Control divisions.

REPRESENTATION ON GROUP GOVERNANCE BODIES AND RISK COMMITTEES

In the interest of exercising its duties and contributing effectively to the promotion of an auditing culture, the Head of the General internal audit takes part, without voting rights, in the central institution’s key Risk Management Committees.

As indicated above, the Head of the General internal audit is a member of the Group Internal Control Coordination Committee and has a standing invitation to participate in the Supervisory Board’s Risk Committee and the Audit Committee of BPCE, the Risk Committee and Audit Committee of Natixis, and the Risk Committee and Audit Committee of the Group’s main subsidiaries (FSE division, Banque Palatine, Oney, Crédit Foncier, BPCE International).

SCOPE OF AUTHORITY

To fulfill its duties, the General internal audit establishes and maintains an inventory of the Group’s auditing scope, which is defined in coordination with the Internal Audit departments of the Group institutions.

It makes sure that all institutions, activities and corresponding risks are covered by comprehensive audits, performed at frequencies defined according to the overall risk level of each institution or activity, which must not exceed five years for banking activities.

In so doing, the General internal audit takes into account not only its own audits, but also those conducted by the supervisory authorities and the Local internal audit.

The annual audit plan is defined with the Chairman of the BPCE Management Board, and presented to the Group Internal Control Coordination Committee and the Supervisory Board’s Risk Committee. It is also transmitted to the national and European supervisors.

REPORTING

Group Internal Audit audits contain recommendations prioritized by order of importance, which are regularly monitored (at least once every six months).

The Group Internal Audit reports the findings of its work to the executive managers of the audited companies and to their supervisory body. It also reports to the Chairman of the Management Board, the Supervisory Board’s Risk Committee and the Supervisory Board of BPCE. It provides them with a report on the implementation of its major recommendations, as well as those of the Autorité de contrôle prudentiel et de résolution (ACPR), the French prudential supervisory authority for the banking and insurance sector, and the Single Supervisory Mechanism (SSM). It sees to the expedient execution of any corrective measures to the internal control system, in accordance with Article 26 of the amended Ministerial Order of November 3, 2014 on internal control, and may call on the Supervisory Board’s Risk Committee to address any measures that have not been executed.

RELATIONS WITH THE PERMANENT CONTROL DIVISIONS OF THE CENTRAL INSTITUTION

In the central institution, the Head of the General internal audit maintains regular relations and shares information with the heads of the units in the scope of inspection, and more specifically with the divisions in charge of level 2 controls.

The heads of these divisions are responsible for notifying the Head of the General internal audit in a timely manner of any disruption or major incident that comes to their attention. The Head of the General internal audit and the Heads of Group Risk Management and Group Compliance and Security notify each other in a timely manner of any inspection or disciplinary procedure initiated by the supervisory authorities and in general of any external audits brought to their attention.

ACTIVITIES IN 2023

The 2023 audit plan was built by integrating strong macro-economic tensions (rise in interest rates and inflation), geopolitical tensions, risks related to structural transformations integrating technological and environmental issues, in a context of increasing regulatory requirements.

The number of planned assignments increased significantly, from 75 in 2022 to 97 in 2023, with the increase in internal audit assignments carried out by Group Internal Audit on behalf of certain business lines (Payments division, FSE division, Crédit Foncier de France). At the end of the Pléiade project, the latter carries out internal audits in entities that do not have one. 25 audits were launched in wave 1, 39 in wave 2 and 25 in wave 3. In 2023, Group Internal Audit continued to catch up on audits abroad or in the French Overseas Departments and Territories, which were postponed due to the health situation.

The organization of the support functions changed on July 1 of the year in order to ensure exhaustive coverage of risks, to strengthen the follow-up of recommendations and to group together data and IT project management expertise. The Audit Management team has been strengthened to take charge of the follow-up of the recommendations previously carried out in part by the Methods department.

AUDIT FUNCTION

STRUCTURE OF THE AUDIT FUNCTION

The Group Internal Audit department carries out its duties within the framework of business line operations. Its operating procedures – for the purposes of consolidated supervision and optimal use of resources – are set out in a charter approved by BPCE’s Management Board on December 7, 2009; the latter was redesigned and approved on December 12, 2022.

The aim of this structure is to cover all of the Group’s operational or functional units over a reasonable number of fiscal years, according to the associated risk, and to achieve efficiency between the various complementary audits conducted by the Internal Audits teams of Group entities.

The Local Internal Audit departments of the direct affiliates and subsidiaries are functionally subordinate to Group Internal Audit and report to the executive branch of their entity.

These ties are strictly replicated at the level of each company in the Group, which is itself a parent company.

This strong functional subordination is also based on operating rules and the Group Internal Audit Standards applicable by the entire function. It is reflected as follows:

The following items are transmitted to the General internal audit:

The rules governing oversight of the inspection function between Natixis and the central institution fall within the framework of the Group’s Internal Audit function.

ACTIVITIES IN 2023

The Methods division updated the documentary corpus and participated in the upgrade of the Group audit function’s SharePoint in connection with the launch of the IGG Hub. In addition to the review and updating of audit guides, it collaborated in the regular updating of the Auditable Units of Group Internal Audit and those intended for the Retail networks. In addition to improving the reporting and use of the Retail Risk Assessment, the division also participated in the development of expert risk assessment for scopes other than Retail and Natixis CIB, as well as in the drafting of an operating procedure for the breakdown of the auditable universe of Group Internal Audit. It supported, in support of the Business Projects team, the implementation of the new tool for monitoring recommendations to the institutions of the network, OMEGA. As part of the internal reorganization of Group Internal Audit, work on monitoring recommendations continued on a temporary basis pending transfer to the Supply Chain Coordination division. Lastly, the standard “Internal audit resources for establishments (excluding Group Internal Audit)” was reviewed and published. It provides Group institutions with references to assess the size and skills of their internal audit staff with regard to their specific needs, in order to carry out their multi-year audit plan based on a risk-based approach.

The data division of Group Internal Audit continued its structuring and tooling work with the aim of strengthening the place of data within the sector. The data team has thus developed a catalog of automated analyses as well as four data science projects using advanced techniques (model training, unsupervised techniques, clustering, etc.). An expert data scientist and a consultant specializing in natural language processing (NLP) joined the team during the year. In addition, the data department now has the first cloud infrastructure bricks (Azure) for the development of complex algorithms. At the end of the year, the division was working on opening up data analysis to auditors for autonomous use via the implementation of an on-site server (on premise) and an interface. Lastly, the end of the year was marked by the first explorations of Generative AI for auditing, with the use of LLMs (Large Language Models).

The activity of the Business Projects team focused on the finalization of the initial OMEGA project (audit activity management tool), in particular on the delivery of lot 3 (“Missions” module). All OMEGA features are now in production.

The audit guides are now integrated into the application, which will make it possible to build the work program of the audit missions in a semi-automated manner. From now on, the tool offers the integration of working papers, test cases and also the automatic generation of the audit report.

The widespread use of OMEGA by the Group’s institutions continued (Habitat en Région, Ensemble Protection Sociale and certain service providers). The security of the tool was strengthened in accordance with the requests of the Group RSSI and a complete review of rights was carried out in H2 2023. In addition, throughout the year, the teams managed maintenance under operational conditions (MCO) as well as support for changes, which made it possible to increase the stability of the tool.

BPCE’s Supervisory Board approved the Group’s Recovery Plan for 2024.

The plan is in line with European regulatory measures on the recovery and resolution of credit institutions and investment firms, and with the provisions of the French Monetary and Financial Code.

The objective of the Recovery Plan is to identify measures to restore the Group’s financial solidity in the event it deteriorates significantly.

The plan presents the options available to the Group to launch a crisis management system. It assesses the relevance of the different options in various crisis scenarios and the methods and resources available for their implementation.

The Recovery Plan is mainly based on the:

This system is monitored and coordinated by a permanent office at BPCE.

The Recovery Plan is kept up to date and approved by the Supervisory Board, aided by its Risk Committee for these purposes.

The Recovery Plan is updated annually on these various components (description of the Group, analysis of scenarios, analysis of the options available).

Credit institutions’ capital is regularly monitored in accordance with regulations defined by the Basel Committee.

These regulations were reinforced following the introduction of Basel III, with an increase in the level of regulatory capital requirements and the introduction of new risk categories.

The Basel III recommendations were incorporated in EU directive 2013/36/EU (Capital Requirements Directive – CRD IV) and Regulation No. 575/2013 (Capital Requirements Regulation – CRR) of the European Parliament and of the Council, as amended by Regulation (EU) No. 2019/876 (the “CRR2”). As of January 1, 2014, all EU credit institutions are subject to compliance with the prudential requirements set out in these texts.

Credit institutions subject to CRD and CRR are thus required to continuously observe:

These buffers include:

The capital ratios are equal in terms of the relationship between capital and the sum of:

In 2023, Groupe BPCE is required to observe a minimum Common Equity Tier-1 ratio of 4.5% under Pillar I, a minimum Tier-1 capital ratio of 6% and, lastly, a minimum total capital ratio of 8%.

Alongside Pillar I minimum capital requirements, Groupe BPCE is subject to additional Tier-1 capital requirements:

Credit institutions must comply with the prudential requirements, which are based on three pillars that form an indivisible whole:

Pillar I

Pillar I sets minimum requirements for capital. It aims to ensure that banking institutions hold sufficient capital to provide a minimum level of coverage for their credit risk, market risk and operational risk. The bank can use standardized or advanced methods to calculate its capital requirement.

REVIEW OF MINIMUM CAPITAL REQUIREMENTS UNDER PILLAR I

Pillar II

Pillar II establishes a process of prudential supervision that complements and strengthens Pillar I.

It consists of:

For 2023, the total capital ratio in force for Groupe BPCE under Pillar II (P2R) is 10.00%, plus a 2.50% capital conservation buffer, a 1% global systemic buffer and a 0.47% countercyclical buffer.

Pillar III

The purpose of Pillar III is to establish market discipline through a series of reporting requirements. These requirements both qualitative and quantitative are intended to improve financial transparency in the assessment of exposure to risks, risk assessment procedures and capital adequacy.

Regulatory scope

Groupe BPCE is required to submit consolidated regulatory reports to the European Central Bank (ECB), the supervisory authority for Euro zone banks. Pillar III is therefore prepared on a consolidated basis.

The regulatory scope of consolidation is established based on the statutory scope of consolidation. The main difference between these two scopes lies in the consolidation method for insurance companies, which are accounted for by the equity method within the regulatory scope, regardless of the statutory consolidation method.

The following insurance companies are accounted for by the equity method within the prudential scope of consolidation:

The following insurance companies are accounted for by the equity method within both the statutory and regulatory scopes of consolidation:

In addition, since the second quarter of 2020, the Versailles entity is consolidated using the equity method. This change, which concerns only the regulatory scope, since the entity is still considered to be under control within the meaning of IFRS, follows a detailed analysis of the regulatory texts. The latter stipulate that non-financial entities that do not constitute ancillary services within the meaning of the standard are accounted for using the equity method for the purposes of reporting ratios. This decision, approved by the Group’s bodies, allows for an alignment of the scopes used to calculate liquidity and solvency.

EU CC2 ‒ TRANSITION FROM ACCOUNTING BALANCE SHEET TO PRUDENTIAL BALANCE SHEET

The table below shows the transition from an accounting balance sheet to a prudential balance sheet for Groupe BPCE at December 31, 2023.

The differences between the statutory and regulatory scopes of consolidation can be attributed to restatements for subsidiaries excluded from the regulatory scope of consolidation (see description of regulatory scope of consolidation below) and the reincorporation of intra-group transactions associated with these subsidiaries.

Regulatory capital

Regulatory capital is determined in accordance with Regulation No. 575/2013 of the European Parliament of June 26, 2013 on capital (“CRR”) amended by Regulation (EU) No. 2019/876 (“CRR2”).

It is divided into three categories: Common Equity Tier-1, Additional Tier-1 capital and Tier-2 capital. Deductions are made from these categories.

These categories are broken down according to decreasing degrees of solidity and stability, duration and degree of subordination.

BPCE01 – REGULATORY CAPITAL

A detailed breakdown of regulatory capital by category, as required by Implementing Regulation No. 1423/2013, is published at the following address: https://groupebpce.com/en/investors/results-and-publications/pillar-iii.

Details of debt instruments recognized as additional Tier-1 and Tier-2 capital, other instruments eligible for TLAC, as well as their characteristics, as required by Implementing Regulation No. 1423/2013 are published at https://groupebpce.com/en/investors/results-and-publications/pillar-iii.

Common Equity Tier-1 (CET1)

CORE CAPITAL AND DEDUCTIONS

Common Equity Tier-1 consists of:

The following deductions are made:

These deductions are supplemented by capital items that are not covered by CRR2.

BPCE02 – CHANGES IN CET1 CAPITAL

BPCE03 ‒ BREAKDOWN OF NON-CONTROLLING INTERESTS (MINORITY INTERESTS)

Additional Tier-1 (AT1) capital

Additional Tier-1 capital includes:

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holding companies.

As of December 31, 2023, the Group had no additional Tier-1 capital.

BPCE04 ‒ CHANGE IN AT1 CAPITAL

Tier-2 capital

Tier-2 capital consists of:

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holding companies.

BPCE05 – CHANGES IN TIER-2 CAPITAL

In accordance with Regulation No. 575/2013 (CRR) of the European Parliament as amended by Regulation (EU) No. 2019/876 (the “CRR2”), credit risk exposures can be measured using two approaches:

The methodology applied for IRB approaches is described in greater detail in Section 5 “Credit risk.”

In addition to the requirements related to counterparty risk in market transactions, the regulation of June 26, 2013 provides for the calculation of an additional charge to hedge against the risk of loss associated with counterparty credit risk (CCR). Capital requirements for the Credit Valuation Adjustment (CVA) are determined using the Standardized Approach.

EU OV1 – OVERVIEW OF RISK-WEIGHTED ASSETS

The table below complies with the CRR format, presenting capital requirements for credit and counterparty risks, before the CVA and after the application of risk mitigation techniques.

BPCE06 ‒ RISK-WEIGHTED ASSETS BY TYPE OF RISK AND BUSINESS LINE

EU INS1 ‒ NON-DEDUCTED PARTICIPATIONS IN INSURANCE UNDERTAKINGS

The methods used by Groupe BPCE to calculate risk-weighted assets are described in Section 4.4 “Regulatory capital requirements and risk-weighted assets”.

Regulatory capital and capital ratios

BPCE07 ‒ REGULATORY CAPITAL AND BASEL III PHASED-IN CAPITAL RATIOS

CHANGES IN GROUPE BPCE’S CAPITAL ADEQUACY IN 2023

The Common Equity Tier-1 ratio was 15.6% at December 31, 2023 versus 15.1% at December 31, 2022.

The change in the Common Equity Tier-1 ratio in 2023 is mainly due to:

At December 31, 2023, the Tier-1 ratio stood at 15.6% and the total capital ratio at 18.2% compared to 15.1% and 17.9%, respectively, at December 31, 2022. These ratio levels remain well above the regulatory requirements defined by the European Central Bank (ECB) during the Supervisory Review and Evaluation Process (SREP) in 2023.

GROUPE BPCE CAPITAL ADEQUACY MANAGEMENT POLICY

Capital and total loss absorbing capacity (TLAC) targets are determined according to Groupe BPCE’s target ratings, in line with prudential constraints.

Capital adequacy management is therefore subject to a high management buffer which not only greatly exceeds prudential constraints on capital adequacy ratios, but is also well above the trigger for the Maximum Distributable Amount.

Capital and TLAC management is thus less sensitive to prudential changes (e.g. not dependent on G-SIB classification). As a result, the Group very predominantly builds its total loss absorbing capacity from CET1 and additionally from subordinated MREL-eligible and TLAC-eligible debt (mainly Tier-2 capital and senior non-preferred debt). The issues of these eligible debts are carried out by BPCE.

Finally, in addition to TLAC, Groupe BPCE carries bail-inable debt, the majority of which is accepted for the calculation of MREL: accordingly, senior preferred debt issued by BPCE is eligible for MREL, with Groupe BPCE leaving the possibility of meeting MREL requirements open, beyond its total loss absorbing capacity, with any bail-inable debt instrument.

The Single Resolution Board set the Group’s MREL requirement in February 2022 (equivalent to 25.05% of the risk-weighted assets), which has now been met with room to spare. As a result, the Group does not need to modify or increase its issuance program.

With regard to the subordination constraint, Groupe BPCE complies with Articles 92a 1(a) and 494 of CRR Regulation No. 575/2013 providing for a requirement of 21.5% of RWA since 2022. The subordination requirement in the leverage base is set at 6.75% since 2022 pursuant to Article 92a 1(b) of the CRR.

CAPITAL ALLOCATION EQUITY AND SOLVENCY MANAGEMENT

The Group implemented action plans over the course of 2023 aimed specifically at ensuring the capital adequacy of its networks and its subsidiaries. BPCE SA thus subscribed €100.2 million (including premium) to a capital increase of €200 million of Oney Bank. BPCE SA also subscribed to four Tier-2 issues: one for €30 million issued by Oney Bank, two others for €75 and €40 million issued by Banque Palatine and a fourth for €300 million issued by GFS, replacing a Tier-2 issue of the same amount.

LEVERAGE RATIO

The entry into force of the Capital Requirements Regulation, known as CRR2, makes the leverage ratio a binding requirement as from June 28, 2021. The minimum requirement for this ratio is 3%, plus a buffer for global systemic banks of 0.5% in 2023.

This regulation authorizes certain exemptions in the calculation of exposures concerning regulated savings transferred to Caisse des Dépôts et Consignations for the totality of the centralized outstanding and Central Bank exposures for a limited period (pursuant to ECB decision 2021/27 of June 18, 2021).

This last exemption, in force until March 31, 2022, made it possible to avoid the impact of the increase in central bank assets that began at the time of the Covid-19 crisis. The reference date for the calculation of this adjusted requirement was set at December 31, 2019. At December 31, 2021, the Group’s adjusted requirement amounted to 3.23%.

The leverage ratio is not sensitive to risk factors and as such, it is considered as a measure that complements the solvency and liquidity management system, which already limits the size of the balance sheet. The leverage ratio is projected and managed at the same time as Groupe BPCE’s solvency trajectory. The risk of excessive leverage is also measured in the internal stress test via the projection of the regulatory leverage ratio.

Groupe BPCE’s leverage ratio, calculated according to the capital requirements regulation, known as CRR2, was 5.04% at December 31, 2023, based on phased-in Tier-1 capital.

EU LR1 ‒ LRSUM ‒ TRANSITION FROM BALANCE SHEET TO LEVERAGE EXPOSURE

FINANCIAL CONGLOMERATE RATIO

As an institution exercising banking and insurance activities, Groupe BPCE is also required to comply with a financial conglomerate ratio. This ratio is determined by comparing the financial conglomerate’s total capital against all the regulatory capital requirements for its banking and insurance activities.

The financial conglomerate ratio demonstrates that the institution’s prudential capital sufficiently covers the total regulatory capital requirements for its banking activities (in accordance with CRR2) and insurance sector activities, in accordance with the Solvency 2 regulation.

The calculation of surplus capital is based on the statutory scope. Insurance company capital requirements, determined for the banking capital adequacy ratio by weighting the equity-method value, are replaced with capital requirements based on the solvency margin. The capital requirements within the banking scope are determined by multiplying the risk-weighted assets by the applicable rate under Pillar II, i.e. 15.22% at December 31, 2023, compared to 14.77% at December 31, 2022.

On December 31, 2023, Groupe BPCE’s surplus capital amounted to €16 billion.

Supervisory Review and Evaluation Process

SREP – ICAAP PROCESS

As the supervisory authority under Pillar II, the ECB conducts an annual assessment of banking institutions. This assessment, referred to as the Supervisory Review and Evaluation Process (SREP), is primarily based on:

Based on the conclusions of the SREP carried out by the ECB in 2023, Groupe BPCE shall maintain a consolidated Common Equity Tier-1 ratio of 10.46% on January 2, 2024, including:

The corresponding total capital requirement is 14.49% (excluding Pillar II guidance).

with a Common Equity Tier-1 ratio of 15.6% at the end of 2023, Groupe BPCE has exceeded the specific capital requirements set by the ECB;

as regards the internal capital adequacy assessment under Pillar II, the principles defined in the ICAAP/ILAAP guidelines published by the ECB in February 2018 were applied in Groupe BPCE’s ICAAP. The assessment is thus carried out using two different approaches:

The results obtained using these two approaches confirmed the Group’s financial soundness and no capital buffer is necessary in addition to the existing regulatory buffers.

Outlook

The objectives of the 2021-2024 strategic plan are, with regard to the Common Equity Tier-1 ratio, to exceed 15.5%, and with regard to the subordinated MREL ratio (i.e. TLAC), to exceed 23.5%.

The Group remained on the list of G-SIBs (Global Systemically Important Banks) in November 2023.

MREL – TLAC

In addition to capital adequacy ratios, ratios aiming at verifying the Group’s capacity to carry out a bail-in in the event of default are implemented via the Minimum Requirement for own funds and Eligible Liabilities (MREL) and Total Loss Absorbing Capacity. This second ratio is known as TLAC, according to the terminology of the Financial Stability Board, and in Europe it is defined in the BRRD directive and the CRR regulation as subordinated MREL. Groupe BPCE has established internal monitoring of these indicators.

Senior unsecured debt at more than one year and the Group’s equity make up the numerator of the MREL ratio. The Group’s current MREL requirement was received in March 2023.

The updated total MREL requirement was set at 25.49% of the Group’s risk-weighted assets. The total MREL ratio reached 33.4% at December 31, 2023, compared with 30.4% at December 31, 2022.

From January 2, 2024, the total MREL requirement will increase by 1.5% of RWAs, reaching 27.0%. This is due to the gradual implementation of the “phase-in” requirement, as well as the increase in the countercyclical buffer following the decision of the High Council for Financial Stability in France to increase the rate applicable to French exposures. This target of 27.0% is itself subject to an update, as soon as the Group’s 2024 MREL letter is received.

For subordinated MREL, the numerator only includes junior liabilities through senior non-preferred debt because BPCE has renounced for the time being to use of a senior preferred debt allowance.

The TLAC ratio serves the same purpose as subordinated MREL and only applies to G-SIBs. CRR2, published at the same time as BRRD2, transcribed TLAC into positive law in the form of a minimum subordinated MREL requirement applicable to G-SIBs. As indicated above, the Group has set its own TLAC target above the regulatory requirement, which at December 31, 2023 is 21.98% of risk-weighted assets, i.e. 18% plus the 3.98% solvency buffers. From January 2, 2024, the subordinated MREL requirement will increase by 0.4% of risk-weighted assets, thus reaching 22.4% of risk-weighted assets.

TLAC (Total Loss Absorbing Capacity) amounted to €116.2 billion at the end of December 2023. The subordinated MREL ratio was 25.4% on December 31, 2023 compared to 23.8% on December 31, 2022.

The detailed quantitative disclosures relating to capital management and capital requirements in the following tables enhance the information in the previous section under Pillar III.

EU LI3 ‒ EXPLANATION OF DIFFERENCES BETWEEN THE STATUTORY AND PRUDENTIAL SCOPE OF CONSOLIDATION

All companies consolidated by the equity method are associates.