BPCE_PILLAR III 2025

Structure of the Pillar III report

The Pillar III report is divided into 20 sections dedicated to risk management:

• Section 1 presents the key figures, the type of risks and the regulatory context;
• Section 2 is dedicated to risk factors;
• Section 3 explains the overall organization of Groupe BPCE’s risk management framework;
• Section 4 is dedicated to capital management and capital adequacy;
• Section 5 summarizes the main elements relating to credit risk management;
• Section 6 presents counterparty risk;
• securitization transactions are detailed in Section 7;
• market risks are presented in Section 8;
• liquidity, interest rate and foreign exchange risk is detailed in Section 9;
• the following Sections 10 to 15 provide detailed information on the other main risks;
• environmental, social and governance risks are presented in Section 16;
• reputation risk is presented in section 17.

Each section describes the principles of organization and risk management, presents an overview of the essential information and sets out detailed quantitative information in a dedicated section.

The internal control policy and the statement on the publication of information required under Pillar III are presented in Section 19.

Section 20 is dedicated to the appendices which contain the index of tables, the Pillar III cross-reference table and the glossary.

• 1 According to CRR/CRD IV regulations.

Progress of the banking union

The new banking package (CRR3 regulation and CRD6 directive) was published on June 19, 2024, in the Official Journal of the European Union.

This banking package implements the final component of the Basel III regulatory reform. Most provisions of the CRR3 regulation are applicable from January 1, 2025. However, the rules concerning market risks have been postponed by one year to January 1, 2027, in order to maintain a consistent global regulatory framework.

The governance of financial institutions is at the heart of the provisions of the CRD6 directive, the transposition of which is still ongoing despite the deadline of January 10, 2026.

CRR3 introduces significant technical modifications that directly influence risk management in banks. These adjustments primarily concern the methods for calculating credit risks, market risks, and credit valuation adjustments (CVA). Furthermore, CRR3 imposes more rigorous reporting and data collection standards to enhance the transparency and comparability of financial information.

Among the key issues, the introduction of the output floor (which establishes that capital requirements calculated using internal models cannot fall below 72.5% of the requirements set out by the standardized approach) is of major importance.

The European authorities are considering simplifying the prudential regulations. The Commission intends to address this issue through the report to be published in 2026, which will focus in particular on the functioning of the Banking Union, the contribution of the latest reforms for financial stability and the implementation of the output floor.

With regard to the resolution framework, the Commission, Parliament and Council managed to reach a trilateral political agreement on June 25, 2025 on the revision of the crisis management and deposit insurance framework (CMDI). In France, Article 2-I of the DDADUE 2025 law transposes various provisions of the 2024/1174 directive “Daisy Chains II”.

A sustained regulatory agenda

The regulatory agenda remains robust for banks, and Groupe BPCE is closely monitoring the issues, whether they pertain to the banking sector or the broader economic environment and its cooperative banking model.

The Digital Operational Resilience Act (DORA) came into effect on January 17, 2025. The requirements of this regulation relate to the management of risks associated with information technology and aim to mitigate cyberattacks and other risks linked to information systems. It includes provisions on the governance of financial entities, risk management, and the reporting of ICT (Information and Communication Technologies) related incidents, and introduces resilience testing every three years. On January 17, 2025, the European Supervisory Authorities published a report studying the feasibility of strengthening the centralization of major ICT-related incident reporting, and, in July 2025, they presented a guide for the monitoring of critical third-party providers. On July 16, 2025, the ECB published a guide on the outsourcing of cloud services, which complements the DORA regulation.

Directive (EU) 2023/2225 on consumer credit contracts was published in the Official Journal of the European Union on October 30, 2023. The transposition order was published on September 3, 2025, and the new regime will be fully applicable from November 20, 2026. The main developments concern the scope (a new definition of the credit contract concluded between a lender and a consumer, which effectively excludes the GAFAM), the establishment of a mandatory creditworthiness assessment, the enhancement of pre-contractual information, as well as the modalities for conducting activities for providers not falling under sectoral regulation.

The 2002/65 directive concerning the distance marketing of financial services to consumers, known as the Distance Marketing in Financial Services Directive (DMFSD), has finally been repealed and replaced by the 2023/2673 directive, set to apply from June 19, 2026. The changes concern, in particular, pre-contractual information and the facilitation of the right of withdrawal, through the introduction of a “withdrawal function” accessible via the service provider’s interface. The transposition texts for this directive were published on January 6, 2026.

The European Commission published a set of measures on May 24, 2023, known as the “Retail Investment Package,” aimed at enhancing the protection of retail clients in terms of investment in financial products. While the formal prohibition of inducements is now excluded, the Council’s position of June 12, 2024, introducing an “inducement test,” which could effectively become a de facto prohibition, calls for heightened vigilance regarding the ongoing discussions. The completion of simplification work on these texts is expected for the first quarter 2026.

The proposal to revise the Payment Services Directive (PSD3) presented by the European Commission on June 28, 2023, was amended by the European Parliament during its plenary session on April 23, 2024. This proposal also contributes to the development of open banking (access to banking and financial data). Impact assessments are ongoing. An agreement was reached in trilogue on November 26, 2025. The final text should be published in the first quarter of 2026, for an entry into application in late 2027.

It should also be noted that Articles 2 V and VI of the DDADUE 2025 law participate in the implementation of Regulation 2024/886 concerning instant payments, applicable since January 9, 2025.

On June 28, 2023, the European Commission published its proposal for a regulatory framework for financial data access (Framework for Financial Data Access - FIDA), previously referred to as “open finance.” This initiative is part of the European Commission’s digital finance strategy, which aims to establish a European financial data space. The trilogues began in 2025. The regulation known as the AI act, dated June 13, 2024, establishes the first legal framework for artificial intelligence in Europe. This regulation will come into effect on August 2, 2026, but some measures will be implemented starting February 2, 2025 (prohibiting high-risk AI). However, the publication of the draft “Digital Omnibus” regulation on November 21, 2025 by the European Commission, as well as its subsequent developments, will be closely followed by the banking sector due to the major changes expected concerning, among other matters, the AI Act.

Ordinance 2023-1142 of December 7, 2023, transposing Directive 2022/2464 regarding the publication of sustainability information by companies, known as CSRD, applies to reports published in 2025. It is set to be amended within the framework of Articles 7 to 12 of the DDADUE 2025 law adopted on February 17, 2025. Two proposals for directives known as Omnibus I were published on February 26, 2025, aimed specifically at postponing and modifying the CSRD, the CS3D and the Taxonomy Regulation. A second Omnibus Directive, adopted on December 16, 2025, modified the thresholds for being subject to the CSRD.

The legislative package presented by the European Commission in July 2021 completely overhauls the European framework regarding AML-CTF, particularly by strengthening the harmonization of the rules applicable to customer due diligence and vigilance, redefining the compliance functions, and establishing a new authority, the AMLA, which is based in Frankfurt. The two draft regulations AMLAR and AMLR, as well as the draft directive AMLD, were published in the Official Journal of the European Union on June 19, 2024 and most of their provisions will enter into force on July 10, 2027.

Credit and counterparty risk

Groupe BPCE is exposed to credit and counterparty risks that could have a material adverse effect on the Group’s business, financial position and income.

Groupe BPCE remains significantly exposed to credit and counterparty risk through its financing or market activities. Despite vigilance aimed at limiting concentrations, particularly unit concentrations, defaults may occur within the same sector or the same geographic area due to the interdependencies between counterparties. In the event of default by one or more counterparties, or if the collateral does not fully cover the exposure, the Group could incur losses affecting its cost of risk, results and financial position.

At December 31, 2025, gross exposure to credit risk amounted to €1,552 billion, with the following breakdown: 37% from retail customers, 31% from corporates, 15% from central banks and sovereign exposures, 6% in the public sector and similar. The credit risk-weighted assets amounted to €391 billion (including counterparty risk). For the non-financial corporations portfolio, the main sectors are Real Estate (37% of gross exposures), Wholesale and Retail Trade (11%), Finance/Insurance (10%) and Professional, scientific and technical activities (7%).

Groupe BPCE's activity is mainly concentrated in France, with a gross exposure of €1,186 billion, or 80% of the total. Exposures excluding France are mainly split between the United States (6%) and other countries (14%).

For further information, please see Sections 5 “Credit risk” and 6 “Counterparty risk” in this document.

A substantial increase in impairments or provisions for expected credit losses recognized in Groupe BPCE’s accounts could have a material adverse effect on its results and financial position.

The Group regularly recognizes impairment expenses to reflect actual or potential losses related to its loans and advances, its fixed-income securities (amortized cost or fair value through equity) and its commitments given. These impairments are booked in the income statement under “cost of risk”. The overall level of expenses depends on past losses on loans, volumes and types of loans, loans in payment arrears, economic conditions, other collection factors and applicable standards. Despite the Group's efforts to maintain an adequate level of provisions, a deterioration of non-performing assets or unfavorable market conditions, in particular in certain countries, may lead to an increase in expenses for losses on loans. This substantial increase in expenses, due to a significant revision of the estimated risk of loss inherent in the loan portfolio, or a loss on loans in excess of historical provisions could have a material adverse impact on Groupe BPCE's results and financial position.

For information, the cost of risk amounted to -€2,465 million in 2025 compared to -€2,061 million in 2024, with credit risks accounting for 84% of the Group's risk-weighted assets. On the basis of gross exposures, 37% relate to retail customers and 31% to corporate customers (of which 65% of exposures are located in France).

Thus, the risk associated with a substantial increase in impairment expenses on the loans and advances portfolio remains significant in terms of both impact and probability, and is monitored carefully. In addition, prudential requirements supplement these provisioning mechanisms via the prudential backstop process, which provides for a deduction in equity of non-performing loans beyond a certain threshold in line with the quality of the guarantees and according to a regulatory timetable defined by regulatory texts.

A decline in the financial strength and performance of other financial institutions and market players may have an unfavorable impact on Groupe BPCE.

The interconnection of markets, particularly in trading, clearing, counterparty and financing, can amplify the effects of a liquidity crunch or sector default. A default by a significant sector player (systemic risk), or rumors that accentuate the risk, may lead to liquidity tensions and, in turn, additional losses or defaults for Groupe BPCE.

Groupe BPCE is directly or indirectly exposed to various financial counterparties – investment service providers, banks, clearing houses and central counterparties, mutual funds and hedge funds, as well as other institutional clients – for which any failure could adversely affect its financial position. In addition, the emergence of players with little or no regulation and of new products (in particular crowdfunding or trading platforms) constitutes an additional risk, aggravated if the assets held as collateral cannot be sold or do not cover the exposure in respect of defaulted loans or derivatives, or in the event of fraud, misappropriation of funds or another wrongdoing by financial sector players in general to which Groupe BPCE is exposed or another failure of a major market player, such as a central counterparty.

In addition, the distribution risk in the event of a difficult market or an unfavorable economic environment may also generate losses in a severe scenario.

The exposures to the “financial institutions” asset class represented 4% of Groupe BPCE’s total gross exposures, i.e. €62 billion at December 31, 2025, with 66% of the exposures in France.

Financial risks

Significant changes in interest rates may have a material adverse impact on Groupe BPCE’s net banking income and profitability.

The net interest margin constitutes a major portion of revenues and its evolution strongly influences results for the period. Resource costs and asset yields, particularly for new production, are sensitive to external factors and may cause temporary or lasting fluctuations, even if a rise in interest rates may be globally favorable in the medium/long term.

The recent environment has been marked by a sharp rise in interest rates until 2023, followed by the start of a loosening of monetary policy in 2024 in the Eurozone.

To offset this, the Group has passed on the high resource costs on new fixed-rate loans and has strengthened interest rate hedging notably via swaps (macro-hedging) in order to protect the balance sheet value and the future net interest margin.

Thus, although the high interest rate environment may be favorable in the long term, the changes observed can have significant and lasting repercussions. Groupe BPCE’s interest rate risk indicators reflect this exposure.

The sensitivity of the net present value of Groupe BPCE’s balance sheet to a +/-200 bps variation in interest rates remained lower than the 15% Tier-1 limit. At December 31, 2025, Groupe BPCE’s sensitivity to Tier-1 interest rate increases stood at -11.29% compared to -9.62% at December 31, 2024. This indicator, calculated according to a static approach (contractual or conventional flow of all balance sheet items) and in a stress scenario (immediate and significant interest rate shock), makes it possible to highlight the distortion of the balance sheet over a long horizon.

To better control the Group’s exposure to interest rate risk, this approach must be supplemented by a dynamic approach (including new production forecasts). Following regulatory changes and modifications of its management framework, since 2023 Groupe BPCE has deployed an internal revenue sensitivity indicator on the commercial banking networks and the Supervisory Outlier Test (SOT) Net Interest Margin (NIM) regulatory indicator at Group level, in addition to its internal indicators. The introduction of the SOT NIM supplements the information communicated as part of the interest rate risk management framework by a margin view over a one-year horizon, and must be published in the financial statements, even if it will not directly generate a Pillar I expense. At December 31, 2025, the most penalizing scenario for the Group in terms of the SOT NIM was the downside scenario. The indicator stands at -1.27% and remains below the 5% limit compared to Tier 1.

The dynamic approach in terms of sensitivity of future revenues is reinforced by a multi-scenario vision allowing a broader approach by taking into account the uncertainties related to business forecasts (new activity and changes in customer behavior), possible changes in commercial margin, etc. This is achieved through the sensitivity of the Group’s revenues by measuring the change in the Group’s forecast net interest margin at one year according to four scenarios (rise in rates, decline in rates, steepening of the yield curve, flattening of the yield curve) compared to the core scenario. This revenue sensitivity indicator covers all commercial banking activities and aims to estimate the sensitivity of the institutions’ results to interest rate fluctuations.

Groupe BPCE is dependent on its access to funding and other sources of liquidity, which may be limited for reasons outside its control, thus potentially having a material adverse impact on its results.

Access to short-term and long-term funding is critical for the conduct of Groupe BPCE’s business. Non-collateralized sources of funding for Groupe BPCE include deposits, issues of long-term debt and short/medium-term negotiable debt securities, banks loans and credit lines. Groupe BPCE also uses secured funding, notably through repurchase agreements and the issuance of covered bonds or securitization via dedicated vehicles or conduits. Geopolitical instabilities in the world with variable rate tranches can have an impact on arrears and default rates as well as on final legal maturities. If Groupe BPCE were unable to access the secured and/or unsecured debt market at conditions deemed acceptable, or incurred an unexpected outflow of cash or collateral, including a significant decline in customer deposits, its liquidity may be negatively affected. Furthermore, if Groupe BPCE were unable to maintain a satisfactory level of customer deposits (e.g. in the event its competitors offer higher rates of return on deposits), it may be forced to obtain funding at higher rates, which would reduce its net interest margin and results.

Liquidity could also be impacted by events beyond its control or unforeseeable, such as geopolitical or health crises, a resurgence of financial crises, operational difficulties of third parties, negative perceptions of financial services, rating changes or negative opinions about the state of the Group or the sector. Similarly, access to long-term funding and funding costs depend on credit spreads on the bond and credit derivatives markets, and remain liable to adversely affect its business, its financial position, its results and its ability to meet its obligations to its counterparties. Changes in monetary policy, particularly those of the ECB, may also affect Groupe BPCE's financial position.

To deal with these risks, the Group has significant liquidity reserves made up of cash deposits with central banks and available securities and receivables eligible for central bank refinancing mechanisms.

At December 31, 2025, the liquidity reserve stood at 197% of the short-term funding outstandings and the short-term maturities of the medium- and long-term loans, compared to 177% in 2024. The average 12-month liquidity coverage ratio (LCR) was 145% as of December 31, 2025 (versus 149% in 2024).

Given the importance of these risks for Groupe BPCE in terms of impact and probability, these risks are monitored proactively and closely, with Groupe BPCE also pursuing a very active policy of diversifying its investor base.

Downgraded credit ratings could have an adverse impact on BPCE’s funding cost, profitability and the continuity of some businesses.

At December 31, 2025, the long-term ratings were A+ (Fitch and S&P), A1 (Moody's) and A+ (R&I). A downward revision of these ratings could limit market access, increase borrowing costs, affect the liquidity and competitiveness of the Group, and impact profitability and trigger obligations under certain bilateral contracts for certain trading activities, derivatives and collateralized financing. The cost of unsecured long-term funding is directly related to the credit spread, which in turn is determined by rating and market conditions with sometimes unpredictable and very volatile fluctuations, and a widening spread can increase costs and weigh on profitability if the perception of creditworthiness deteriorates.

Groupe BPCE is exposed to credit spread risk at the level of its assets in a scenario of widening credit spreads, on its portfolio of securities at fair value or at amortized cost. The Group holds a significant bond portfolio eligible for the liquidity reserve, mainly composed of sovereign and corporate bonds, which makes its valuation sensitive to changes in the credit spreads of its securities.

Market fluctuations and volatility could expose Groupe BPCE, and in particular its major corporate & investment banking business lines (Natixis CIB and Natixis IM), to favorable or unfavorable fluctuations in its trading and investment activities, which could adversely affect Groupe BPCE’s results of operations and financial position.

Positions in the bond, currency, commodity, equity, unlisted or unconventional asset markets may be impacted by price fluctuations and liquidity. Adverse market configurations or periods of stress may generate losses on trading and hedging instruments (swaps, futures, options, structured products) and make it difficult to sell assets, which could affect the Group's results and financial position. Similarly, prolonged market declines and/or violent crises may reduce the liquidity of certain asset classes and make it difficult to sell certain assets, therefore generating significant losses.

At end 2025, the market risk-weighted assets totaled €18 billion, i.e. around 4% of Groupe BPCE’s total risk-weighted assets.

For additional details, see Note 10.1.2 to the consolidated financial statements of Groupe BPCE in the Universal Registration Document, which analyzes financial assets and liabilities classified in Level 3 of the fair value hierarchy.

Groupe BPCE’s revenues from brokerage and other activities associated with fee and commission income may decrease in the event of market downturns.

A market downturn may result in lower flows of transactions and financial services, which would lead to a decrease in net banking income from these activities. In addition, the decrease in the value of portfolios or the increase in withdrawals from portfolios managed on behalf of third parties could reduce the management fees and commissions paid by clients and impact revenues from fund distribution and asset management. Even without a fall in the markets, below-market performance could lead to an increase in withdrawals or lower inflows, weighing on the revenues of the activity.

For 2025, total net fees and commissions amounted to €11,258 million, or 44% of Groupe BPCE's net banking income.

For more details on fees and commissions, see Note 4.2 “Fee and commission income and expenses” in Groupe BPCE’s consolidated financial statements in the Universal Registration Document.

Changes in the fair value of Groupe BPCE’s portfolios of securities and derivative products, and its own debt, are liable to have an adverse impact on the net carrying amount of these assets and liabilities, and as a result on Groupe BPCE’s net income and equity.

At each financial reporting date, assets and liabilities measured at fair value are adjusted in the balance sheet, with movements passing either through the income statement or directly through equity. When these adjustments affect profit or loss without being offset by other corresponding changes, they have an impact on net banking income and ultimately on net income and prudential ratios. Fair value adjustments may also adversely affect the net carrying amount of assets and liabilities and thus equity. Recording over a period does not imply a guarantee that a new adjustment will not be necessary at a later date.

At December 31, 2025, financial assets at fair value through profit or loss stood at €240 billion (€227 billion held for trading), and liabilities at €234 billion (€177 billion held for trading).

For more information, see Notes 4.3, 4.4, 5.2, 5.3 and 5.4 to Groupe BPCE’s Universal Registration Document.

Non-financial risks

In the event of non-compliance with applicable laws and regulations, Groupe BPCE could be exposed to significant fines and other administrative and criminal penalties that could have a material adverse effect on its financial position, activities and reputation.

The banking and insurance framework is subject to reinforced supervision, with a growing volume of international and national regulations (MIFID II, PRIIPS, Insurance Distribution Directive, Market Abuse Regulation, GDPR, benchmarks, etc.) that are profoundly changing operational processes.

The European system for combating money laundering and the financing of terrorism is being stepped up. The Anti-Money Laundering Package, adopted in 2024 and mainly applicable from 2027, will be supplemented by subsequent texts. The European AMLA is being strengthened and will ensure from 2027 the direct supervision of a group of entities and the coordination of financial intelligence units at EU level.

Non-compliance with regulations may take the form of risks of inappropriate business practices to promote products, insufficient management of conflicts of interest, disclosure of confidential information, unsatisfied due diligence on entering into relationships, insufficient detection of money laundering or terrorism-related operations, and failure to comply with or circumventing of international sanctions (embargoes, asset freezes) and extraterritorial measures.

The Compliance function coordinates the prevention and control of these risks, but the Group remains exposed to fines and civil or criminal proceedings that could significantly affect its financial position, activities and reputation. Evolving compliance risks can lead to costs and operational disruptions if external systems, processes or services do not meet regulatory requirements. Proactive monitoring remains essential to limit the potential impact on the business and results.

The legal risks to which Groupe BPCE is exposed could have a material adverse effect on its financial position and results.

Judicial, arbitral and administrative proceedings initiated or likely to be initiated against Groupe BPCE in the course of its current activities could give rise to financial penalties (fines, damages, penalties) and impact its profitability, financial strength, operational continuity and reputation. While some proceedings may not have a material impact in the short term, others, such as class actions, may require additional provisions and affect future prospects.

At December 31, 2025, the total provisions for legal and tax risks amounted to €967 million.

For detailed information on the most significant proceedings, please refer to Section 10 “Legal risks” of this document.

Any interruption or failure of the information systems belonging to Groupe BPCE or third parties, particularly external service providers, may generate losses (including commercial losses) and may have a material adverse impact on Groupe BPCE’s results.

As is the case for its competitors, Groupe BPCE is highly dependent on information and communication systems, as a large number of increasingly complex transactions are processed in the course of its activities. Any failure, interruption or malfunction in these systems may cause errors or interruptions in the systems used to manage customer accounts, general ledgers, deposits, transactions and/or to process loans. A temporary failure in Groupe BPCE’s information systems despite back-up systems and contingency plans could generate substantial information recovery and verification costs, or even a decline in its proprietary activities if, for example, such a failure were to occur during the implementation of a hedging transaction. The inability of Groupe BPCE’s systems to adapt to an increasing volume of transactions may also limit its ability to develop its activities and generate losses, particularly losses in sales, and may therefore have a material adverse impact on Groupe BPCE’s results. Cyber risks and the impacts of digital transformation accentuate these vulnerabilities, with an increasing exposure of intangible assets and work tools, and a multiplication of connected channels and devices (cloud, big data, etc.).

Malicious acts aimed at accessing or misappropriating data and systems via digital means, including artificial intelligence, could harm Groupe BPCE, its employees, partners and clients. Numerous processes are gradually going digital. Changing uses by employees and clients also lead to an increased use of the Internet and interconnected technological tools (tablets, smartphones, internet, etc.), increasing the number of channels serving as potential vectors for attacks and disruptions, and the number of devices and applications vulnerable to attacks and disruptions. Consequently, the software and hardware used by Groupe BPCE’s employees and external agents are constantly and increasingly subject to cyberthreats. As a result of any such attacks, Groupe BPCE may face malfunctions or interruptions in its own systems or in third-party systems that may not be adequately resolved. Any interruption or failure of the information systems belonging to Groupe BPCE or third parties may generate losses (including commercial losses) due to the disruption of its operations and the possibility that its customers may turn to other financial institutions during and/or after any such interruptions or failures.

The risk associated with any interruption or failure of the information systems belonging to Groupe BPCE or third parties is significant for Groupe BPCE in terms of impact and probability, and is therefore carefully and proactively monitored.

Groupe BPCE is also exposed to operational risk related to malfunctions or operational failures by one of its clearing agents, foreign exchange markets, custodians or other financial intermediaries or external service providers that it uses to carry out or facilitate its securities transactions.

Lastly, it is necessary to note the risk of outsourcing, particularly in external IT services or more generally in connection with critical and important external services within the meaning of French regulations.

Reputational risks could unfavorably impact Groupe BPCE’s profitability and business outlook.

As a major player in the financial system, Groupe BPCE relies on the notion of a trusted third party for the general public, its clients. Damage to reputation, particularly related to negative media coverage or claims about products, financing, partners or governance, may damage this trust and influence the Group's business relations and attractiveness. Concerns may arise around BPCE’s environmental strategy and social policies or its governance.

External events, such as acts of cybercrime or cyberterrorism, internal or external fraud or misappropriation of funds, may also damage the Group's image and its ability to establish or maintain relationships with counterparties, clients or service providers. Major damage to reputation could limit access to certain financial markets, impact the attractiveness of talent and, ultimately, affect the Group's financial position and business outlook.

For more information, refer to section 17 "Reputation risk management framework" of this document.

Unforeseen events may interrupt Groupe BPCE’s operations and cause losses and additional costs.

Unforeseen events, such as natural disasters, physical climatic risks, pandemics, attacks or other emergency situations, could cause an abrupt interruption in Groupe BPCE's activities and affect its critical business lines (liquidity, payment instruments, securities, loans to individual and corporate clients, fiduciary). These interruptions could generate material losses, particularly if they are not fully covered by insurance, and have a direct impact on net income. They could also disrupt the Group's infrastructure or that of third-party partners, generate additional costs (relocation of personnel, insurance premiums) and increase the overall level of risk if such events preclude insurance coverage.

At December 31, 2025, losses related to operational risk were mainly concentrated on the "Payment and settlement" line (29%) and, within the "Execution, delivery and process management" category (31%).

The failure or inadequacy of Groupe BPCE’s risk management and hedging policies, procedures and strategies may expose it to unidentified or unexpected risks which may trigger unforeseen losses.

Groupe BPCE’s risk management and hedging policies, procedures and strategies may not succeed in effectively limiting its exposure to all types of market environments or all kinds of risks, and may even prove ineffective for some risks that the Group was unable to identify or anticipate. Furthermore, the risk management techniques and strategies employed by Groupe BPCE may not effectively limit its exposure to risk and do not guarantee that overall risk will actually be lowered. These techniques and strategies may prove ineffective against certain types of risk, in particular risks that Groupe BPCE had not already identified or anticipated, given that the tools used by Groupe BPCE to develop risk management procedures are based on assessments, analyses and assumptions that may prove inaccurate or incomplete.

Groupe BPCE’s risk measurement system is based in particular on the use of models. This models portfolio, covering market risks (Corporate & Investment Banking), credit risks and financial areas (ALM, markets), as well as operational risks (including compliance and climate), could fail. As a result, the Group could be exposed to unidentified or unanticipated risks that could result in significant losses.

Some of the indicators and qualitative tools used by Groupe BPCE to manage risk are based on the observation of past market performance. To measure risk exposures, the risk management department analyzes these observations, particularly statistically. These tools and indicators may not be able to predict future risk exposures leading to model risk. For example, these risk exposures may be due to factors that Groupe BPCE may not have anticipated or correctly assessed in its statistical models or due to unexpected or unprecedented shifts in the market. This would limit Groupe BPCE’s risk management capability. As a result, losses incurred by Groupe BPCE may be higher than those anticipated on the basis of past measurements. Moreover, the Group’s quantitative models cannot factor in all risks. While no significant problem has been identified to date in this respect, the risk management systems are subject to the risk of operational failure, which could expose Groupe BPCE to unexpected losses.

Actual results may vary compared to assumptions used to prepare Groupe BPCE’s financial statements, which may expose it to unexpected losses.

In accordance with current IFRS standards and interpretations, Groupe BPCE must use certain estimates when preparing its financial statements, in particular accounting estimates relating to the determination of impairment for credit risk and provisions for employee benefits or provisions for litigation, estimates relating to the determination of the fair value of certain financial assets and liabilities, etc. If the values used for the estimates by Groupe BPCE prove to be materially inaccurate, in particular in the event of major and/or unexpected market trends, or if the methods used to calculate these values are modified due to future changes in IFRS standards or interpretations, Groupe BPCE may be exposed to unexpected losses.

Information on the use of estimates and judgments is provided in Note 2.3 “Use of estimates and judgments” to the consolidated financial statements of Groupe BPCE in the Universal Registration Document.

Strategic, business and ecosystem risks

Environmental, Social and Governance risks (ESG), together with their repercussions for economic players, could adversely affect Groupe BPCE’s activities, results and financial position.

Environmental, Social and Governance (ESG) risks are a set of risk factors arising from the impacts of climate change, environmental issues (biodiversity, pollution, natural resources, water), social issues (respect for human rights, well-being and the interests of people and stakeholders) and governance issues (ethics and corporate culture, business practices, supplier relations). These risks are likely to materialize in the short, medium or long term. They are factors that aggravate other categories of risk to which Groupe BPCE is exposed (credit and counterparty risk, market risk, operational risk, structural balance sheet risk, risk related to insurance activities, strategic risk, legal risk, compliance risk and reputation risk). Groupe BPCE is mainly exposed to ESG risks indirectly through its clients and counterparties and its investments, either on its own behalf or on behalf of third parties. It is also directly exposed to these risks through its own business activities.

Environmental risks include physical risks and transition risks. Physical risks result from damage directly caused to people and property by events related to climate and environmental changes. These risks can be related to acute events, linked to extreme conditions circumscribed in time and space (such as heat waves, landslides, floods, late frosts, fires, storms, situations of water stress or air, water or soil pollution) or to chronic events of a more gradual and diffuse nature (such as changes in rainfall patterns, rise in sea levels and average temperatures, loss of biodiversity, the depletion of natural resources). Physical risks are likely to affect a wide variety of geographic areas and economic sectors and impact the business, assets and financial profile of the counterparties to which Groupe BPCE is exposed, particularly through its financing, investment or insurance activities. Groupe BPCE is also likely to be directly affected by climatic or environmental events that affect its operating sites, employees or suppliers. Transition risks result from adjustments made by economic players and stakeholders during the transition to a low-carbon economy that is more respectful of environmental balances. These adjustments are reflected in regulatory, technological or socio-demographic changes that may affect the business models, operating models and financial profiles of economic players as well as the value of the assets to which Groupe BPCE is exposed, particularly through its financing and investment activities. Groupe BPCE is also directly exposed to transition risks through regulatory changes and changes in stakeholder expectations, particularly with regard to its product and service offering as well as its voluntary commitments.

Social risks arise from issues related to the rights, well-being and interests of people and stakeholders (company and value chain employees, communities concerned, consumers and end-users). Through their potential impact on activities (work organization, supply chains, products, etc.) and the associated reputation issues, these risks are likely to affect the financial profile of the counterparties to which Groupe BPCE is exposed, particularly through its financing and investment activities. They may also lead to increased reputation risk for Groupe BPCE, either directly or through its counterparties.

Governance risks include issues related to ethics and corporate culture (governance structure, business integrity and transparency, etc.), supplier relationship management, influence activities and business conduct practices. Through their potential impact on activities (corporate governance standards, control systems, commercial practices, etc.) and the associated reputation issues, these risks are likely to affect the financial profile of the counterparties to which Groupe BPCE is exposed, in particular through its financing and investment activities. They may also lead to increased reputation risk for Groupe BPCE, either directly or through its counterparties.

Overall, Environmental, Social and Governance risks could adversely affect Groupe BPCE’s business, results and financial position.

Groupe BPCE may be vulnerable to political, macro-economic and financial environments or to specific circumstances in its countries of operation.

Groupe BPCE may be exposed to risks related to the political, macro-economic and financial environments of the countries in which it operates. Some entities are exposed to country risk, which is defined as the risk that economic, financial, political or social conditions in a country affect their financial interests.

In 2025, BPCE concentrated its activities mainly in France (76% of net banking income) and North America (13%), with other regions each accounting for less than 2% of NBI. The breakdown by country and by activity is detailed in Note 12.6 to the consolidated financial statements of Groupe BPCE in the 2025 Universal Registration Document.

A significant change in the political or macro-economic environment in these areas could generate additional expenses or reduce the Group's profits. The economic outlook remains uncertain and marked by geopolitical, economic and trade risks, likely to affect global growth, asset prices and financial stability, with increased market volatility.

The year 2026 began with significant geopolitical tensions and macroeconomic developments, highlighting the complexity of the international context and the potential challenges for the Group's business and results.

Since February 28, 2026, the US-Israeli military operation in Iran has already had significant impacts on the prices of a barrel of Brent crude and gas. The macroeconomic risk is real: a $10 increase in the price of oil causes an increase in inflation of 0.3 points and a decline in GDP of 0.1 points in France in the first year. The form and outcome that the conflict could take leaves a wide universe of possibilities. The latter notably depends on the ability of the oil and gas infrastructures of the countries bordering the Persian Gulf to produce and export oil and gas via the Strait of Hormuz.

Moreover, a major uncertainty remains regarding changes in the international political and economic environment, in particular the trade policy of the United States and global public and private debt, which could weigh on Groupe BPCE's business and financial conditions. The downturn or fragmentation of global trade, geopolitical tensions and the budgetary outlook in Europe (particularly in France and the Eurozone) may influence demand, financing costs and the interest rate risk premium, while supporting or dampening investment and growth. In addition, changes in public deficits, the potential increase in long-term rates and the continued quantitative tightening of central banks could weigh on bond markets and Groupe BPCE's competitiveness. In France, political uncertainty surrounding the presidential election and multi-year budgetary constraints could limit spending and dampen economic momentum, with possible effects on savings, consumption and employment.

For more detailed information, see sections 5.2 "Economic and financial environment" and 5.8 "2026 economic outlook" in the 2025 Universal Registration Document.

Groupe BPCE may not achieve the objectives of its VISION 2030

Groupe BPCE's strategic project, VISION 2030 is based on three pillars: (i) forging our growth for the long term, (ii) giving our clients confidence in their future, and (iii) expressing our cooperative nature in all territories. The first pillar aims to make Groupe BPCE a leading banking group promoting diversified growth, open to partnerships, and capable of achieving high levels of performance. The second pillar aims to make the Group into a facilitator for access to housing for all, and for all types of needs, to be the go-to player for territorial competitiveness, to protect customers at every moment and stage in their lives, and to simplify client relationship models (from 100% physical to 100% digital), notably with the help of AI. The third pillar aims to give full expression to the cooperative values promoted by the Group, which draws its strength from its multifaceted activities and the range of its expertise, from its positive global impact, and from its cooperative shareholders and employees, proud and committed in their day-to-day lives. The new growth model is being implemented in three major geographical circles – France, Europe and the rest of the World – and is based on organic growth, acquisitions, and partnerships.

The success of the 2026 financial trajectory is based on a large number of initiatives currently being implemented within Groupe BPCE's various business lines. Although most of the goals defined in the strategic project are expected to be achieved, others may not be, due to changes in the economic or competitive environment or possible changes in accounting and/or tax regulations. If Groupe BPCE does not achieve these goals, the 2026 financial trajectory could be affected.

Groupe BPCE may encounter difficulties in adapting, implementing and incorporating its policy governing acquisitions or joint ventures

Groupe BPCE may consider acquisition or joint venture opportunities, but it is not always possible to fully assess these targets. Unanticipated liabilities may emerge and the results of the acquired company or joint venture may prove disappointing, or the anticipated synergies may not be fully achieved, with higher-than-expected costs. The integration of a new entity may also prove difficult, and the failure of an external growth operation or its integration may weigh on the Group's profitability and lead to the departure of key employees. To retain talent, the Group may have to offer financial benefits, which may increase certain costs and impact profitability. In the context of joint ventures, the Group is exposed to additional risks related to systems, controls and persons not directly under its control, which may give rise to liability, generate losses or affect its reputation. Conflicts or disagreements with the partners could jeopardize the expected benefits of the joint venture.

Intense competition in France, Groupe BPCE’s main market, or internationally, may cause its net income and profitability to decline

Groupe BPCE’s main business lines operate in a very competitive environment both in France and other parts of the world where it does substantial business.

This competition is heightened by consolidation, either through mergers and acquisitions or cooperation and arrangements. This consolidation has created a certain number of companies which, like Groupe BPCE, can offer a wide range of products and services ranging from insurance, loans and management of deposits to brokerage, investment banking and asset management. Groupe BPCE is in competition with other entities based on a certain number of factors, including the correct execution of products and services offered, innovation, reputation and price. If Groupe BPCE is unable to maintain its competitiveness in France or in its other major markets by offering a range of attractive and profitable products and services, it may lose market share in certain key business lines or incur losses in some or all of its activities.

A slowdown in the global economy or in key markets may intensify competitive pressure through lower prices and lower volumes. The entry of new, more competitive entrants subject to different or more flexible regulatory frameworks, or other prudential ratio requirements, could increase the pressure. In addition, technological advances and the development of e-commerce have facilitated access to financial solutions by non-traditional players, offering online banking and financial services, including securities services. These new entrants could put downward pressure on prices or gain market share if Groupe BPCE does not quickly adapt its strategy and offering.

Groupe BPCE’s ability to attract and retain skilled employees is paramount to the success of its business and failing to do so may affect its performance

Groupe BPCE is highly dependent on its employees, considered to be its main resource. Competition to attract and retain skilled talent is fierce in the financial services industry, and the Group's performance depends on its ability to recruit and retain employees. Technological and economic transformations and the growing demands of clients demand sustained efforts to support and train staff. Failing this, the Group may miss out on certain business opportunities and see its performance deteriorate.

At December 31, 2025, the headcount comprised 105,786 employees.

For more information, please refer to Chapter 2.1, Section 3.1 of the Universal Registration Document.

Insurance risks

A deterioration in market conditions, in particular excessive fluctuations in interest rates (both upwards and downwards) and/or a deterioration in spreads or equity markets, or an increase in reinsurance costs could have a significant adverse impact on the financial position and solvency of Life and Non-Life insurance companies

The main risk to which Groupe BPCE’s insurance subsidiaries are exposed is financial risk. This exposure results mainly from capital guarantees on euro funds and unrealized capital gains or losses on investments held. Interest rate risk is both structural and major, due to the predominance of bonds over liabilities. A rise in interest rates may weaken the competitiveness of euro-denominated offerings and generate flows of redemptions and arbitrages in unfavorable economic conditions, while a decrease could render the return on general funds insufficient to cover capital guarantees.

In addition, the widening of spreads and the weakness of the equity markets may weigh on the results of insurance activities via the valuation at fair value and provisions for impairment. The increase in claims and extreme events (particularly weather events) could also lead to an increase in reinsurance requirements, reducing the overall profitability of insurance activities.

At December 31, 2025, net banking income from Groupe BPCE's insurance activities increased by 12% to €959 million, compared to €858 million in 2024.

A mismatch between the level and cost of claims anticipated by insurers, on the one hand, and premiums and provisions on the other, could have a significant adverse impact on the results and financial position of the non-life, personal protection and surety portion of its insurance activities

Underwriting risk arises from the possible discrepancy between the claims actually incurred and the compensation paid, and the assumptions used to set the rates and determine the technical provisions. Insurers use their experience and industry data to estimate claims and actuarial parameters in order to price products and constitute provisions. However, deviations from these estimates, or unforeseen events such as pandemics or natural disasters, may result in higher-than-expected payments. Changes in climate risks are closely monitored.

If compensation amounts exceed initial assumptions or if underlying assumptions change, companies' liabilities could be higher than expected, adversely impacting the results and financial position of subsidiaries. Conversely, the actions taken in recent years — financial hedging, reinsurance, business diversification and investment management — have strengthened the resilience of the solvency of Groupe BPCE's insurance subsidiaries.

Regulatory risks

Groupe BPCE is subject to many regulations in France and in several other countries around the world where it operates; regulatory measures and changes could have a material adverse impact on Groupe BPCE’s business and results

The uncertainty surrounding future regulatory changes makes it difficult to anticipate their impacts, which could be unfavorable. Faced with new requirements, the Group may have to reduce the range of activities it offers to comply and increase its costs of compliance, which could result in lower revenues and consolidated profits, or even selling or reducing asset portfolios.

The CRR III/CRD VI package, published on June 19, 2024, strengthens prudential frameworks in the EU and is largely applicable from January 1, 2025, except for the rules related to market risks, which will come into force on January 1, 2027. This reform could increase capital and liquidity requirements and impact the Group's financing costs.

In November 2025, the Financial Stability Board, in consultation with the Basel Committee on Banking Supervision and national authorities, published the 2025 list of global systemically important banks (G-SIB). Groupe BPCE is classified as a G-SIB and is also on the list of global systemically important institutions (G-SIIs) for the 2025 fiscal year. This classification reinforces the perception of the systemic importance of the Group and may influence prudential obligations, costs and supervision requirements.

BPCE may have to help entities belonging to the financial solidarity mechanism in the event they experience financial difficulties, including entities in which BPCE holds no economic interest.

As the central institution of Groupe BPCE, BPCE is responsible for ensuring the liquidity and solvency of each regional bank (Banques Populaires and Caisses d’Epargne) and the other members of the group of affiliates. The group of affiliates includes BPCE subsidiaries, such as Natixis, Crédit Foncier de France, Oney and Banque Palatine. In the case of Groupe BPCE, all the financial institutions affiliated with the central institution of Groupe BPCE benefit from a guarantee and solidarity system whose purpose, in accordance with Articles L. 511-31, L. 512-107-5 and L. 512-107-6 of the French Monetary and Financial Code, is to guarantee the liquidity and solvency of all affiliated financial institutions and to organize financial solidarity within the Group.

This financial solidarity is based on legislative provisions establishing a legal principle of solidarity, imposing a performance obligation on the central institution to restore the liquidity or solvency of affiliates in difficulty and/or all affiliates of the Group. By virtue of the unlimited nature of the principle of solidarity, BPCE is entitled at any time to ask any one or several or all of the affiliates to contribute to the financial efforts that may be necessary to restore the situation, and may, if necessary, mobilize all the cash and equity capital of the affiliates in the event of difficulty for one or more of them.

At December 31, 2025, the Banque Populaire and Caisse d’Epargne funds each contained €450 million. The mutual guarantee fund holds €211 million in deposits per network.

The three guarantee funds created to cover Groupe BPCE’s liquidity and insolvency risks are described in Note 1.2 “Guarantee mechanism” to the consolidated financial statements of Groupe BPCE included in the Universal Registration Document. The regional banks are obligated to make additional contributions to the guarantee fund on their future profits.

While the guarantee fund represents a substantial source of resources to fund the solidarity mechanism, there is no guarantee these revenues will be sufficient. If the guarantee funds prove insufficient, BPCE, due to its missions as a central institution, will have to do everything necessary to restore the situation and will have the obligation to make up the deficit by implementing the internal solidarity mechanism that it has put in place, by mobilizing its own resources, and may also make unlimited use of the resources of several or all of its affiliates.

As a result of this obligation, if a member of the Group were to encounter major financial difficulties, the event underlying these financial difficulties could have a negative impact on the financial position of BPCE and that of the other affiliates thus called upon to provide support under the legal principle of financial solidarity.

Investors in BPCE’s securities could suffer losses if BPCE and all of its affiliates were to be subject to liquidation or resolution procedures.

The EU regulation on the Single Resolution Mechanism No. 806/ 214 and the EU Directive for the recovery and resolution of banks No. 2014/59, as amended by EU Directive No. 2019/879 (the “BRRD”), as transposed into French law in Book VI of the French Monetary and Financial Code, give the resolution authorities the power to impair BPCE securities or, in the case of debt securities, to convert them to capital.

Resolution authorities may write down or convert capital instruments, such as BPCE’s Tier-2 subordinated debt securities, if the issuing institution or the group to which it belongs is failing or likely to fail (and there is no reasonable prospect that another measure would avoid such failure within a reasonable time period), becomes non-viable, or requires extraordinary public support (subject to certain exceptions). They must write down or convert additional capital instruments before opening a resolution proceeding, or if doing so is necessary to maintain the viability of an institution. Any write-down of capital instruments must be effected in order of seniority, so that Common Equity Tier-1 instruments are to be written down first, then additional Tier-1 instruments are to be written down, followed by Tier-2 instruments. Additional capital instruments must be converted in order of priority, such that additional Tier-1 instruments are converted first, followed by Tier-2 instruments. If the write-down or conversion of capital instruments is not sufficient to restore the financial health of the institution, the bail-in power held by the resolution authorities may be applied to write down or convert eligible liabilities, such as BPCE’s senior non-preferred and senior preferred securities.

At December 31, 2025, total Tier-1 capital amounted to €76.3 billion and Tier-2 prudential capital to €12.4 billion. Senior non-preferred debt instruments of more than one year and which are therefore eligible for TLAC and MREL amounted to €34 billion at the same date.

As a result of the complete legal solidarity, and in the extreme case of a liquidation or resolution proceeding, one or more affiliates may not find itself subject to court-ordered liquidation, or be affected by resolution measures within the meaning of the “BRRD”, without all affiliates and BPCE also being affected. In accordance with Articles L. 613-29 and L. 613-55-5 of the French Monetary and Financial Code, the judicial liquidation proceedings and resolution measures are therefore brought in a coordinated manner with regard to the central institution and all of its affiliates.

Article L. 613-29 also provides that, in the event of court-ordered liquidation proceedings being brought against all affiliates, the external creditors (of the same rank or enjoying identical rights) of all affiliates would be treated equally according to the ranking of the creditors and regardless of whether they are attached to a particular affiliated entity. As a result, investors in AT1 instruments and other securities of the same rank would be more affected than holders of Tier-2 and other securities of the same rank, which in turn would be more affected than investors in external senior non-preferred debt, which in turn would be more affected than investors in external senior preferred debt. Similarly, in the event of resolution, and in accordance with Article L. 613-55-5 of the French Monetary and Financial Code, identical depreciation and/or conversion rates would be applied to debts and receivables of the same rank, regardless of their attachment to a particular affiliated entity in the order of the hierarchy recalled above.

Due to the systemic nature of Groupe BPCE and the assessment currently made by the resolution authorities, resolution measures would be more likely to be taken than the opening of judicial liquidation proceedings. A resolution procedure may be initiated against BPCE and all affiliated entities if (i) the default of BPCE and all affiliated entities is proven or foreseeable, (ii) there is no reasonable expectation that another measure could prevent this failure within a reasonable timeframe, and (iii) a resolution measure is required to achieve the objectives of the resolution: (a) guarantee the continuity of critical functions, (b) avoid material adverse impacts to financial stability, (c) protect State resources by minimizing the use of exceptional public financial support and (d) protect client funds and assets, particularly those of depositors. Failure of an institution means that it does not respect requirements for continuing authorization, it is unable to pay its debts or other liabilities when they fall due, it requires extraordinary public financial support (subject to limited exceptions), or the value of its liabilities exceeds the value of its assets.

In addition to the bail-in power, resolution authorities are provided with broad powers to implement other resolution measures with respect to failing financial institutions or, under certain circumstances, their groups, which may include (without limitation): the total or partial sale of the institution’s business to a third party or a bridge institution, the separation of assets, the replacement or substitution of the institution as obligor in respect of debt instruments, modifications to the terms of debt instruments (including altering the maturity and/or the amount of interest payable and/or imposing a temporary suspension on payments), discontinuing the listing and admission to trading of financial instruments, the dismissal of managers or the appointment of a temporary administrator (administrateur spécial) and the issuance of new equity or own funds.

The exercise of the powers described above by resolution authorities could result in the partial or total write-down or conversion to equity of the capital instruments and the debt instruments issued by BPCE, or may substantially affect the amount of resources available to BPCE to make payments on such instruments, potentially causing BPCE investors to incur losses.

Tax legislation and its application in France and in countries where Groupe BPCE operates are likely to have an adverse impact on Groupe BPCE’s results.

Tax legislation and its application in countries where Groupe BPCE operates, notably Natixis, could adversely affect the Group's results. As a multinational banking Group, BPCE is subject to numerous tax rules and structures its activity to derive value and synergies while ensuring the compliance of the products sold and their tax treatment. Certain tax positions and interpretations adopted by the Group's entities are based on the opinions of tax advisors and, where applicable, on the interpretations of the competent authorities. It is not impossible that tax authorities may challenge these interpretations, which could lead to adjustments and an adverse impact on results.

• The French Finance Law for 2026 was adopted on February 2, 2026. The main measure for companies concerns the extension of the exceptional contribution on the profits of very large companies. The exceptional contribution introduced by the French Finance Act for 2025 concerns companies with a revenues of €1 billion or more, and has been extended for an additional year. The rate of this exceptional contribution is maintained, namely:

• 20.6% when the revenues of this fiscal year or the previous fiscal year is greater than or equal to €1 billion (increased to €1.5 billion for the second fiscal year, i.e. 2026) and less than €3 billion;

• 41.2% when the revenues of this fiscal year or the previous fiscal year is greater than or equal to €3 billion;

i.e. an effective tax rate for Groupe BPCE of 29.9%.

The Group Risk and Compliance Committee, chaired by the Chairman of the Management Board, met six times in 2025 to review, in particular, the adequacy of the risk management frameworks, and validated the annual review of the risk policies. These systems cover all risks, as described in the order of November 3, 2014 on internal control as amended by the order of February 25, 2021.

The coverage of risks was found to be adequate, consistent with the risk appetite framework validated by the BPCE Management Board and Supervisory Board, and related closely to the Group’s strategy and budget oversight.

All risks are covered by central and local risk management frameworks, in line with the Group’s risk appetite and strategy.

Groupe BPCE’s Supervisory Board approved the Group’s risk appetite framework: quantitative indicators, resilience threshold for each indicator and associated governance. During its annual review, held on November 5 and December 11, 2025, the Supervisory Board examined and approved the Group’s risk appetite.

Risk Appetite Guidelines

As a decentralized and united cooperative Group, Groupe BPCE structures its activity around share capital, held predominantly by the regional institutions, and centralized market funding, optimizing the resources allocated to the entities.

Groupe BPCE:

• through its cooperative nature, is firmly committed to generating recurring and resilient income for its cooperative shareholders and investors by offering the best service to its customers;
• must preserve the solvency, liquidity and reputation of each Group entity – a duty assumed by the central institution through the oversight of consolidated risks, a risk policy and shared tools;
• consists of regional banks, which own the Group and its subsidiaries. In addition to normal management operations, in the event of a crisis, solidarity mechanisms between Group entities ensure the circulation of capital and prevent the entities or the central institution from defaulting;
• focuses on the structural risks of its full-service banking model, with a predominant retail banking component in France, while incorporating other business lines necessary to provide quality service to all of its customers;
• diversifies its exposures by developing certain activities in line with its strategic plan:

• – development of the Corporate & Investment Banking, bancassurance and asset management activities,
• – international expansion (predominantly Corporate & Investment Banking and asset management, with a more targeted approach for retail banking customers).

Groupe BPCE’s risk appetite is defined as the level of risk it is willing to accept with the goal of increasing its profitability while maintaining solvency. This risk appetite must be aligned with the institution’s operating environment, strategy and business model, while making customer interests the top priority. In determining its risk appetite, Groupe BPCE aims to steer clear of any major pockets of concentration and to optimize capital allocation.

In terms of risk profile, Groupe BPCE incurs risks intrinsically associated with its retail banking and Corporate & Investment Banking activities. Changes to its business model are increasing the Group’s exposure to some types of risks, particularly risks related to asset management and international businesses.

The Group does not conduct business unless it has the associated risks sufficiently under control, nor does it exercise proprietary trading activities. Activities with high risk-reward profiles are strictly controlled.

In all activities, entities and regions of operation, the Group undertakes to meet the highest standards of ethics, conduct, best execution and transaction security.

Risk appetite framework and groupwide implementation

The risk appetite framework is based on a master document providing a qualitative and quantitative description of the risks that Groupe BPCE is willing to assume, and describing the governance and operating guidelines in effect.

The implementation of the risk appetite framework is centered on four key components: (i) the definition of groupwide standards, (ii) the existence of a set of limits in line with those defined by regulations, (iii) the distribution of expertise and responsibilities between the entities and the central institution and (iv) the operation of the governance process within the Group and the different entities, enabling the efficient and resilient application of the risk appetite framework.

The Group’s risk appetite framework is regularly updated (at least annually) and is centered on a series of successive limits associated with separate respective authorization levels, i.e.:

• an observation or tolerance threshold, which, if breached, calls for BPCE Management Board members to decide either to require the breach to be corrected or to allow the transaction to go ahead on an exceptional basis;
• a RAF limit (Risk Appetite Framework) or resilience threshold, the breach of which would pose a potential risk to the continuity and/or stability of the business. Any such breach must be reported to the Supervisory Board of BPCE and addressed by a specific action plan validated by the Board;
• an extreme limit in conjunction with the Group’s resolution and recovery plan which, if breached, could jeopardize the Group’s very survival. This extreme limit concerns certain indicators adopted in respect of the Group’s risk appetite.

A quarterly dashboard is prepared by the Group’s Risk division, for the purpose of regularly and extensively monitoring all risk indicators and reporting to the supervisory body or/and any committee thereof.

The risk appetite framework is adapted by the entities for consistent groupwide implementation.

The Group Risk division issues an annual compliance notice to the institutions in their annual review proposal, ensuring a high level of consistency between the risk appetites implemented locally and that of the Group.

Robust financial strength

Groupe BPCE enjoys high liquidity and solvency levels:

• in terms of solvency, the Group is able to absorb, if need be, the occurrence of a risk at entity or Group level;
• in terms of liquidity, the Group has a significant reserve consisting of cash and securities enabling it to meet regulatory requirements, pass stress tests and access central bank unconventional financing mechanisms. It also has a sufficient amount of high-quality liquid assets eligible for market funding mechanisms and those offered by the European Central Bank.

The Group ensures the robustness of this system by implementing global or dedicated stress tests such as those for climate risk management, which are carried out regularly. They are intended to verify the Group’s resilience, particularly in the event of a serious crisis.

Summary of the Group’s risk profile in 2025

The following risks are incurred by the Group because of its business model:

Emerging risks

Groupe BPCE places great importance on anticipating and managing emerging risks in today’s constantly changing environment. To this end, a prospective analysis identifying the risks that could impact the Group is carried out every six months and presented to the Risk and Compliance Committee, followed by the Board’s Risk Committee. This forward-looking analysis is complemented by an expanded study of emerging and increasingly important risks, covering nascent or rapidly evolving risks whose impact could be significant in the medium or long term.

Since the previous study, the macroeconomic context has changed. Although inflation seems to be stabilizing, uncertainties remain, particularly regarding the political situation in France, the impacts of the US administration’s political decisions, and the overall increase in geopolitical risks that could affect economic stability in the short term.

Credit risk, cyber risk, interest rate risk and liquidity risk are still the four main risks weighing on business.

Regarding credit risk, the context remains deteriorated, with the level of corporate defaults continuing. The outlook for businesses, particularly small ones, and for the commercial real estate sector remains unfavorable, while the claims ratio for individuals could be exacerbated by a rise in unemployment.

Cyber risk also remains significant. The continued digitalization of the economy and financial services is accompanied by constant vigilance by banks in the face of cyber risks. The sophistication of cyber-attacks and potential vulnerability of their IS systems are both major risks for Groupe BPCE, in conjunction with the expectations of the regulatory authority.

Climate change is an integral part of the risk management policy, with a risk control mechanism currently being strengthened.

Finally, in the face of a more unstable and conflictual world, banks’ vigilance regarding geopolitical risks is increasing, and this is also accompanied by a strengthening of risk control mechanisms.

Governance of risk management

Risk management is governed by two main bodies at Group level: the Supervisory Board, which is supported by the Board’s Risk Committee, and the Executive Management Committee, of which the Head of Risk Management is a member.

Chaired by the Chairman of the Management Board, the Group Risk and Compliance Committee, an umbrella committee, sets the broad outlines of the risk policy and examines issues related to non-financial risks (specifically those related to banking, insurance and investment service compliance, and to financial security), annually reviews the risk appetite framework, and approves a prospective risk analysis.

Organization of risk management

The Group Risk division and Corporate Secretary’s Office – in charge of compliance and permanent control – measure, monitor and manage risks, pursuant to the order of November 3, 2014 as amended by the order of February 25, 2021, on internal control.

They ensure that the risk management framework is effective, complete and consistent, and that risk-taking is consistent with the guidelines for the business (particularly the targets and resources of the Group and its institutions).

These duties are formalized in Groupe BPCE’s Internal Control Charter, an umbrella charter. This charter is based on the two charters of the control functions, namely the Internal Audit Charter and the Second Line of Defense Charter, reviewed in March 2025.

The various departments of the Group Risk division are involved in all risks (credit, financial, operational, ESG, model and non-banking investments) by acting on:

• the risk policy and the resulting standards;
• permanent monitoring and control;
• coordination.

The departments of the Group’s Risk division operate in three areas (Management, Monitoring and Control):

Specialized committees

Several committees are responsible for defining groupwide methodology standards for measuring, managing, reporting and consolidating all risks throughout the Group.

Organization of the Risk division

The Risk Governance and Control department is responsible for coordinating and animating the risk division, the second level permanent control of the Risk division within Groupe BPCE, and the activities of the Group Risk division. The Second Line of Defense Charter calls for the Group Risk division to participate, at its own initiative, in the annual performance assessment of the Heads of the Permanent Control functions, particularly as regards risk and/or compliance, in consultation with the Chairman of the Management Board or the Chief Executive Officer.

The Risk Governance and Control department deploys the entire system on a daily basis and contributes to the overall supervision of Group risks, primarily through:

• oversight and updates of key risk and Compliance function documents such as charters and standards;
• second-level permanent control of Groupe BPCE’s Risk division, as well as the sensitive activities of the Group’s Risk division, via a dedicated department;
• the performance of operational efficiency work (effective benchmark standards), work related to the risk-based approach (half-yearly risk and compliance reporting, risk appetite framework, macro-mapping of risks, etc.);
• the follow-up of all recommendations issued by supervisors and by the General internal audit in the area of risk management and permanent control;
• an assessment of the Risk Management functions is conducted every year and presented to the Risk Committee of the Groupe BPCE Supervisory Board.

Highlights

• Contribution to the Risk division’s transformation projects.
• Implementation of permanent level 2.2 controls on credit files by the permanent risk control division.
• Control of the proper implementation of the Group’s risk policies (credit risks, operational risks, reputational risks, ALM risks) in the local policies of the institutions.
• Implementation of monthly monitoring of affiliates’ risk appetite indicators.
• Review of the specific headcount benchmark standard for a few institutions.
• Implementation of an induction day for new employees in the Risk division.

Risk and compliance culture

To promote and strengthen the risk and compliance culture at all levels, the Group Risk division and the Group Compliance department strive to develop risk and compliance training and awareness programs at all Group levels, establish regular communication on risk and compliance issues throughout the Group, and disseminate and measure the risk and compliance culture.

Rigorous risk management is one of the principles of Groupe BPCE, which has always prioritized a culture of risk management and control. In order to support the development of its activities, within the framework of its risk appetite, Groupe BPCE strives to promote and strengthen the risk and compliance culture at all levels.

The Risk division training system

First of all, risk training and acculturation are one of the major challenges in the development of the risk culture. All employees and managers are concerned, regardless of their level, including directors. This is why the Group Risk division has developed the Risk Academy, which offers training modules to support the development and refinement of the skills of Risk division employees in their various business lines.

Risk Academy

Training offerings

Regulatory watch:

Coordination and animation for regulatory watch is set up in order to discuss regulatory news and anticipate projects that could be rolled out. Coordination of the risk chapters is also implemented for regulatory reporting (Universal Registration Document, Pillar III, annual report on internal control, ICAAP).

Measurement of the risk culture

The Eval’ CultuRisques study aims to assess the level of risk culture of Groupe BPCE institutions via a questionnaire based on Group standards in accordance with regulatory requirements and best practices in terms of risk culture, particularly as described by the EBA in its “internal governance” document.

Consolidated risk oversight

In addition to the risk supervision conducted both individually and by type of risk, Groupe BPCE’s Risk division also performs consolidated monitoring of the Group’s risks.

The Group Risk division also conducts or coordinates cross-business risk analyses and specific stress tests on the Group’s main portfolios or activities and, if needed, for the entities. It has also developed half-year forward-looking risk analyses aimed at identifying economic risk factors (known and emerging; international, national and regional), circumstantial threats (regulations, etc.) and their potential impact on the Group. These forward-looking analyses are presented at meetings of the Group Supervisory Board’s Risk Committee.

In addition, it carries out risk measurements on a portfolio basis. It reviews and validates risk models developed internally. Lastly, it contributes to efforts to define internal capital requirements as well as internal and external solvency stress tests aimed at measuring the Group’s sensitivity to a series of risk factors and its resilience in the event of a severe shock, by determining impacts in terms of cost of risk and RWA.

Stress testing framework

Groupe BPCE has been developing stress tests since 2011 that can be performed using the risk modules for Group strategic analysis purposes and regulatory purposes.

The Group control system relies on three levels of controls, in accordance with banking regulations and sound management practices (two levels of permanent controls and one level of periodic control), as well as the establishment of consolidated control processes in accordance with provisions approved by BPCE’s Management Board.

Structure of Groupe BPCE’s internal control system

• ⁽¹⁾ SPP: Safety of people and property.

Organization of permanent control functions in the Group’s institutions

The Group’s Risk division and the Corporate Secretary’s Office carry out their missions within the framework of a business line approach dedicated to the management of credit risks, financial risks, operational risks, climate risks and non-compliance risks extended to business continuity functions, financial control and security of information systems, GDPR, business continuity and crisis management. They ensure that the risk policies of the affiliates and subsidiaries comply with those of Groupe BPCE.

The Risk and/or Compliance divisions of subsidiaries not subject to the banking supervision regulatory framework are functionally subordinate to the Group Risk division and the Corporate Secretary’s Office.

The strong functional authority is exercised by the Head of Risk Management and by the Secretary General, both members of Groupe BPCE’s Executive Management Committee. It enables risk controls to be performed objectively, as each Group entity’s operational functions are independent from its risk and Compliance functions. It also promotes a risk management and compliance culture and the application of shared risk management standards, and ensures that managers are given independent, objective and detailed information on the Group’s risk exposures and any possible deterioration in its risk profile.

Group institutions are responsible for defining, monitoring and managing their risk levels, as well as producing reports and data for submission to the central institution’s Risk division and Corporate Secretary’s Office. They ensure the quality, reliability and completeness of the data used to control and monitor risks at the company level and on a consolidated basis, in line with Group risk standards and policies.

Standard risk governance structure at a Group institution

Permanent control system

The organization of permanent control in the Group is specified in the Internal Control Charter (updated in 2025) and in the Second Line of Defense Charter (updated on March 27, 2025) in paragraphs 2 and 5 in accordance with the order of November 3, 2014 (revised on February 25, 2021).

In terms of governance, the assessment of the permanent control system is the responsibility of the Group Internal Control Coordination Committee (or 3CI or CCFC in its local implementation).

Internal Control Coordination Committee

The Chairman of the BPCE Management Board is responsible for ensuring the consistency and effectiveness of the internal control system. A Group Internal Control Coordination Committee, chaired by the Chairman of the Management Board, meets periodically.

This committee is responsible for dealing with all issues relating to the consistency and effectiveness of the Group internal control system, as well as the results of risk management and internal control work and follow-up work.

Periodic control (level 3)

Organization and role of the Group Internal Audit

As part of the responsibilities defined in Article 17 of order A-2014-11-03 amended on February 25, 2021 on internal control, the Group Internal Audit or the Internal Audit function carries out periodic controls of all activities, ensuring the quality, effectiveness, consistency and efficiency of the permanent control system and risk management. Its scope of intervention covers all the risks and all the activities of the institution, including those that are outsourced. Internal audit also extends to its subsidiaries and prudentially consolidated entities.

In fulfilling this responsibility, it relies on the findings of its department’s investigations and the work of other supervisory bodies, such as the Autorité de contrôle prudentiel et de résolution (ACPR), the French prudential supervisory authority for the banking and insurance sector.

In accordance with the duties incumbent on the central institution, and pursuant to the rules of collective solidarity, the General internal audit is responsible for periodically verifying the operation of all Group institutions and providing their executive managers with reasonable assurance of their financial strength.

The Supervisory Board of BPCE approved the Group’s Recovery Plan for 2025.

The plan is in line with European regulatory measures on the recovery and resolution of banks and investment firms, and with the provisions of the French Monetary and Financial Code.

The objective of the Recovery Plan is to identify options to restore the Group’s financial stability in the event it deteriorates significantly.

The plan presents a dedicated crisis management system and analyzes the relevance and feasibility of the options for restoring capital and liquidity under different crisis scenarios in order to estimate its overall recovery capacity.

The Recovery Plan notably includes:

• a description of the Group’s organizational structure and the specific implications of its cooperative status;
• the identification of the Group’s critical functions and the main activities (Core Business Lines) exercised by the Group;
• capital and liquidity management systems;
• the quantification and analysis of financial crisis scenarios;
• the identification of options impacting the restoration of the Group’s financial position and their impacts on the Group’s business model;
• preventative oversight of leading indicators on financial and economic conditions;
• establishment of the organizational structures needed to implement the recovery.

This system is monitored and coordinated by a permanent office at BPCE.

The Recovery Plan is updated at least once a year, and approved by the Supervisory Board, aided by its Risk Committee for these purposes.

Credit institutions’ capital is regularly monitored in accordance with regulations defined by the Basel Committee.

These regulations were reinforced following the introduction of Basel III, with an increase in the level of regulatory capital requirements and the introduction of new risk categories.

In 2025, Groupe BPCE is required to observe a minimum Common Equity Tier-1 ratio of 4.5% under Pillar I, a minimum Tier-1 capital ratio of 6% and, lastly, a minimum total capital ratio of 8%.

Alongside Pillar I minimum capital requirements, Groupe BPCE is subject to additional Tier-1 capital requirements:

• as of January 1, 2019, the Tier-1 capital conservation buffer is 2.5% of the total amount of risk exposures;
• Groupe BPCE’s countercyclical buffer equals the EAD-weighted average of the buffers defined for each of the Group’s countries of operation. Groupe BPCE’s maximum countercyclical buffer as from January 1, 2019 is 2.5%;
• the G-SII buffer has been set at 1% for the Group;
• the systemic risk buffer is applied to all exposures located in the Member State setting this buffer and/or to sectoral exposures located in the same Member State. These buffers only apply above a certain exposure threshold. As Groupe BPCE is below these thresholds, it is not subject to them.

Credit institutions must comply with the prudential requirements, which are based on three pillars that form an indivisible whole:

Pillar I

Pillar I sets minimum requirements for capital. It aims to ensure that banking institutions hold sufficient capital to provide a minimum level of coverage for their credit risk, market risk and operational risk. The bank can use standardized or advanced methods to calculate its capital requirement.

Review of minimum capital requirements under Pillar 1

• (1) G-SII buffer: global systemic buffer.
• (2) The countercyclical buffer requirement is calculated quarterly.

Pillar II

Pillar II establishes a process of prudential supervision that complements and strengthens Pillar I.

It consists of:

• an analysis by the bank of all of its risks, including those already covered by Pillar I;
• an estimate by the bank of the capital requirement for these risks;
• a comparison by the banking supervisor of its own analysis of the bank’s risk profile with the analysis conducted by the bank, in order to adapt its choice of prudential measures where applicable, which may take the form of capital requirements exceeding the minimum requirements or any other appropriate technique.

For 2025, the total capital ratio in force for Groupe BPCE under Pillar II (P2R) is 10.25%, plus a 2.50% capital conservation buffer, a 1% global systemic buffer and a 0.90% countercyclical buffer.

Pillar III

The purpose of Pillar III is to establish market discipline through a series of reporting requirements. These requirements – both qualitative and quantitative – are intended to improve financial transparency in the assessment of exposure to risks, risk assessment procedures and capital adequacy.

Regulatory scope

Groupe BPCE is required to submit consolidated regulatory reports to the European Central Bank (ECB), the supervisory authority for Eurozone banks. Pillar III is therefore prepared on a consolidated basis.

The regulatory scope of consolidation is established based on the statutory scope of consolidation. The main difference between these two scopes lies in the consolidation method for insurance companies, which are accounted for by the equity method within the regulatory scope, regardless of the statutory consolidation method.

The following insurance companies are accounted for by the equity method within the prudential scope of consolidation:

• Surassur;
• BPCE Assurances (formerly Natixis Assurances);
• Compagnie Européenne de Garanties et de Cautions;
• Prépar-Vie;
• Prépar-IARD;
• Oney Insurance;
• Oney Life.

The following insurance companies are accounted for by the equity method within both the statutory and regulatory scopes of consolidation:

• Parnasse Garanties.

In addition, since the second quarter of 2020, the Versailles entity is consolidated using the equity method. This change, which concerns only the regulatory scope, since the entity is still considered to be under control within the meaning of IFRS, follows a detailed analysis of the regulatory texts. The latter stipulate that non-financial entities that do not constitute ancillary services within the meaning of the standard are accounted for using the equity method for the purposes of reporting ratios. This decision, approved by the Group’s bodies, allows for an alignment of the scopes used to calculate liquidity and solvency.

EU CC2 – Transition from accounting balance sheet to prudential balance sheet

The table below shows the transition from an accounting balance sheet to a prudential balance sheet for Groupe BPCE at December 31, 2025.

The differences between the statutory and regulatory scopes can be attributed to restatements for subsidiaries excluded from the regulatory scope (see the description of the regulatory scope below) and the reincorporation of intra-group transactions related to these subsidiaries.

• (1) References refer to those in table EU CC1 in column b.

• (1) References refer to those in table EU CC1 in column b.

Regulatory capital

The regulatory capital is determined in accordance with Regulation (EU) 575/2013 of the European Parliament of June 26, 2013 on capital amended by Regulation (EU) 2024/1623 (CRR3).

It is divided into three categories: Common Equity Tier-1 capital, Additional Tier-1 capital and Tier-2 capital. Deductions are made from these categories.

These categories are broken down according to decreasing degrees of solidity and stability, duration and degree of subordination.

BPCE01 – Regulatory capital

• (1) Including non-current assets and entities classified as held for sale.
• (2) The Common Equity Tier-1 included €29,693 million in cooperative shares (after taking allowances into account) at December 31, 2025, and €29,581 million at December 31, 2024.

Details of debt instruments recognized as additional Tier-1 and Tier-2 capital, other instruments eligible for TLAC, as well as their characteristics, as required by Implementing Regulation 1423/2013 are published at https://groupebpce.com/en/investors/results-and-publications/pillar-iii.

Common Equity Tier-1 (CET1) capital

Core capital and deductions

Common Equity Tier-1 consists of:

• share capital;
• additional paid-in capital or merger premiums;
• reserves, including revaluation differences and gains or losses recognized directly in other comprehensive income;
• retained earnings;
• net income attributable to equity holders of the parent;
• non-controlling interests in banking or related subsidiaries for the share after CET1 eligibility caps.

The following deductions are made:

• treasury shares held and measured at their carrying amount;
• intangible assets (excluding the amount of prudently valued software, exempt from deduction) including start-up costs and goodwill;
• deferred tax assets and liabilities that rely on future profitability;
• prudential filters resulting from CRR Articles 32, 33, 34 and 35: gains or losses on cash flow hedges, gains on transactions in securitized assets, own credit risk;
• negative amounts arising from the comparison between provisions and expected losses (in this calculation, performing loans are clearly separated from loans in default);
• equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holding companies and the phase-in period;
• value adjustments arising from the prudent valuation of assets and liabilities measured at fair value according to a prudential method, deducting any value adjustments;
• defined benefit pension fund assets net of related deferred tax liabilities;
• insufficient hedging of non-performing exposures under Pillar I and Pillar II.

These deductions are supplemented by capital items that are not covered by CRR3.

BPCE02 – Changes in CET1 capital

BPCE03 – Breakdown of non-controlling interests (minority interests)

Additional Tier-1 (AT1) capital

Additional Tier-1 capital includes:

• subordinated instruments issued in compliance with the restrictive eligibility criteria set forth by CRR Article 52;
• additional paid-in capital related to these instruments.

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holding companies.

As of December 31, 2025, the Group had no additional Tier-1 capital.

BPCE04 – Change in AT1 capital

Tier-2 capital

Tier-2 capital consists of:

• subordinated instruments issued in compliance with the restrictive eligibility criteria set forth by CRR Article 63;
• additional paid-in capital related to Tier-2 items;
• the amount arising from provisions in excess of expected losses (in this calculation, performing loans are clearly separated from loans in default).

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holding companies.

BPCE05 – Changes in Tier-2 capital

• (1) As of June 30, 2025, to meet an ECB requirement notified to banks, subordinated loans included in regulatory capital are now measured at their carrying amount, including any hedging effects, rather than at their nominal value. This application had an impact of -€435 million on the value of the Tier-2 assets at December 31, 2025.

In accordance with Regulation (EU) 2024/1623 (CRR3) of the European Parliament, as amended by Regulation (EU) 2019/876 (CRR2), credit risk exposures can be measured using two approaches:

• the “standardized” approach, based on external credit ratings and specific risk weightings according to Basel exposure classes;
• the “internal ratings based” (IRB) approach, based on the financial institution’s internal ratings system, broken down into two categories:

• – the Foundation IRB approach – banks use only their probability of default estimates for this approach,
• – the Advanced IRB approach – banks use all their internal component estimates for this approach, i.e. probability of default, loss given default, exposure at default and maturity.

The methodology applied for IRB approaches is described in greater detail in Section 5 “Credit risk.”

In addition to the requirements related to counterparty risk in market transactions, the Regulation of June 26, 2013 provides for the calculation of an additional charge to hedge against the risk of loss associated with counterparty credit risk (CCR). Capital requirements for the Credit Valuation Adjustment (CVA) are determined using the Standardized Approach.

EU OV1 – Overview of total risk exposure amounts

The table below complies with the CRR format, presenting capital requirements for credit and counterparty risks, before the CVA and after the application of risk mitigation techniques.

BPCE06 – Risk-weighted assets by type of risk and business line

• (1) Including settlement-delivery risk and other risk exposure amounts.

EU INS1 – Insurance participations

EU CMS1 – Comparison of modelled and standardised risk-weighted exposure amounts at risk level

EU CMS2 – Comparison of modelled and standardised risk weighted exposure amounts for credit risk at asset class level

The methods used by Groupe BPCE to calculate risk-weighted assets are described in Section 4.4 “Regulatory capital requirements and risk-weighted assets”.

Regulatory capital and capital ratios

BPCE07 – Regulatory capital and Basel III phased-in capital ratios

Changes in Groupe BPCE’s capital adequacy in 2025

The Common Equity Tier-1 ratio was 16.5% on December 31, 2025 compared to 16.2% on December 31, 2024.

The 31 basis point change in the Common Equity Tier-1 ratio in 2025 was mainly due to the growth in Common Equity Tier 1, driven by retained earnings (+73 basis points), which offset the impact of the year's acquisitions: Société Générale Equipment Solutions and Nagelmakers (-41 basis points).

At December 31, 2025, the Tier-1 ratio stood at 16.5% and the total capital ratio at 19.2% compared to 16.2% and 18.8%, respectively, at December 31, 2024. These ratio levels remain well above the regulatory requirements defined by the European Central Bank (ECB) during the Supervisory Review and Evaluation Process (SREP) in 2025.

Groupe BPCE capital adequacy management policy

Capital and total loss absorbing capacity (TLAC) targets are determined according to Groupe BPCE’s target ratings, in line with prudential constraints.

Capital adequacy management is therefore subject to a high management buffer which not only greatly exceeds prudential constraints on capital adequacy ratios, but is also well above the trigger for the Maximum Distributable Amount.

Thus, the management of own capital and loss absorbing capacity goes beyond the integration of prudential developments (e.g. qualification as a G-SIB) and leads the Group to build its total loss absorbing capacity mainly from CET1 and additionally from subordinated MREL-eligible and TLAC-eligible debt (mainly Tier-2 capital and eligible senior non-preferred debt). The issues of these eligible debts are carried out by BPCE.

Lastly, in addition to this capacity to absorb losses, Groupe BPCE has an MREL. The MREL capacity consists of instruments eligible for loss absorption, as well as senior preferred debt with residual maturity of more than one year.

The Group’s current MREL requirement was received in March 2024 by the Autorité de contrôle prudentiel et de résolution (ACPR), the French prudential supervisory authority for the banking and insurance sector. It amounts to 27.30% of the Group’s risk-weighted assets (RWA) and is respected with a margin. It does not require the Group to modify or increase its issuance program.

Groupe BPCE complies with Articles 92a (1)(a) and 494 of Regulation (EU) 575/2013 (CRR) providing since 2022 for a requirement of 18% of RWA plus solvency buffers, i.e. 22.4% of RWA. The subordination requirement in the leverage base has been set at 6.75% since 2022 pursuant to Article 92a (1)(b) of the CRR. This is also respected with a margin.

Capital allocation equity and solvency management

The Group implemented action plans from 2024 aimed specifically at ensuring the capital adequacy of its networks and its subsidiaries. BPCE SA thus subscribed for €475 million to a Tier 1 issue by Natixis, replacing a Tier 1 issue of $500 million repaid by the subsidiary. BPCE SA also set up a repayable Tier 2 subordinated loan of €60 million for the benefit of its subsidiary Banque Palatine and a second loan of €100 million granted to Natixis.

Leverage ratio

The entry into force of the Capital Requirements Regulation, known as CRR3, makes the leverage ratio a binding requirement as from June 28, 2021. The minimum requirement for this ratio is 3%, plus a buffer for global systemic banks of 0.5% in 2025.

The leverage ratio is not sensitive to risk factors and as such, it is considered as a measure that complements the solvency and liquidity management system, which already limits the size of the balance sheet. The leverage ratio is projected and managed at the same time as Groupe BPCE’s solvency trajectory. The risk of excessive leverage is also measured in the internal stress test via the projection of the regulatory leverage ratio.

Groupe BPCE’s leverage ratio, calculated according to the capital requirements regulation, known as CRR3, was 5.1% at December 31, 2025, based on phased-in Tier-1 capital.

EU LR1 - LRSum: Summary reconciliation of accounting assets and leverage ratio exposures

Financial conglomerate ratio

As an institution exercising banking and insurance activities, Groupe BPCE is also required to comply with a financial conglomerate ratio. This ratio is determined by comparing the financial conglomerate’s total capital against all the regulatory capital requirements for its banking and insurance activities.

The financial conglomerate ratio demonstrates that the institution’s prudential capital sufficiently covers the total regulatory capital requirements for its banking activities (in accordance with CRR3) and insurance sector activities, in accordance with the Solvency 2 regulation.

The calculation of surplus capital is based on the statutory scope. Insurance company capital requirements, determined for the banking capital adequacy ratio by weighting the equity-method value, are replaced with capital requirements based on the solvency margin. The capital requirements within the banking scope are determined by multiplying the risk-weighted assets by the applicable rate under Pillar II, i.e. 15.90% at December 31, 2025 compared to 15.75% at December 31, 2024.

At December 31, 2025, Groupe BPCE’s surplus capital amounted to €16.2 billion.

Supervisory Review and Evaluation Process

SREP – ICAAP process

As the supervisory authority under Pillar II, the ECB conducts an annual assessment of banking institutions. This assessment, referred to as the Supervisory Review and Evaluation Process (SREP), is primarily based on:

• an evaluation based on information taken from prudential reports;
• documentation established by each banking institution, including in particular the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP);
• an assessment of governance & risks, the business model, share capital and liquidity.

Based on the conclusions of the SREP carried out by the ECB in 2024, Groupe BPCE shall maintain a consolidated Common Equity Tier-1 ratio of 10.59% on January 2, 2025, including:

• 1.69% in respect of Pillar II requirements (excluding Pillar II guidance);
• 2.50% in respect of the capital conservation buffer;
• 1.00% in respect of the buffer for global systemically important banks (G-SIB buffer);
• 0.90% in respect of the countercyclical buffer.

The corresponding total capital requirement is 14.65% (excluding Pillar II guidance).

With a Common Equity Tier-1 ratio of 16.5% at the end of December 2025, Groupe BPCE has exceeded the specific capital requirements set by the ECB.

As regards the internal capital adequacy assessment under Pillar II, the principles defined in the ICAAP/ILAAP guidelines published by the ECB in February 2018 and supplemented by the ECB publication in February 2025, were applied in Groupe BPCE’s ICAAP. The assessment is thus carried out using two different approaches:

• a “normative” approach aimed at measuring the impact of internal stress tests within three years of the initial Pillar I regulatory position;
• an “economic” approach aimed at identifying, quantifying and hedging risks using internal capital over the short term (one year) and using internal methodologies. The methodologies developed by Groupe BPCE provide a better assessment of risks that are already covered under Pillar I, and also an additional assessment of risks that are not covered by Pillar I.

The results obtained using these two approaches confirmed the Group’s financial soundness and no capital buffer is necessary in addition to the existing regulatory buffers.

Outlook

The objectives of the “VISION 2030” strategic plan are, with regard to the Common Equity Tier-1 ratio, to exceed 15.5%, and with regard to the subordinated MREL ratio (i.e. TLAC) to exceed 25.5%.

The Group remained on the list of G-SIBs (Global Systemically Important Banks) in November 2023, with a systemic buffer to be respected on the MREL and TLAC ratios of 1%.

MREL – TLAC

In addition to capital adequacy ratios, ratios aiming at verifying the Group’s capacity to carry out a bail-in in the event of default are implemented via the Minimum Requirement for own funds and Eligible Liabilities (MREL) and Total Loss Absorbing Capacity. This second ratio is known as TLAC, according to the terminology of the Financial Stability Board, and in Europe it is defined in the BRRD directive and the CRR regulation as subordinated MREL. Groupe BPCE has established internal monitoring of these indicators.

The TLAC ratio serves the same purpose as subordinated MREL and only applies to G-SIBs.

Groupe BPCE has established internal monitoring of these indicators.

The senior unsecured debt at more than one year and the Group’s regulatory capital make up the numerator of the total MREL (minimum requirement for own funds and eligible liabilities) ratio. The Group’s current MREL requirement was notified in May 2025 by the ACPR.

The updated total MREL requirement was set at 27.5% of the Group’s risk-weighted assets.

The total MREL ratio reached 32.8% at December 31, 2025, compared with 34.6% at December 31, 2024.

For subordinated MREL, the numerator - in addition to the Group’s regulatory capital - only includes the junior liabilities up to the senior non-preferred debt because BPCE has renounced for the time being to use a senior preferred debt allowance, its updated requirement was set at 24.7% of the Group’s risk-weighted assets. The subordinated MREL ratio was 26.7% at December 31, 2025, stable compared to December 31, 2024.

The total loss absorbing capacity (TLAC), a ratio pursuing the same objective as subordinated MREL, is only applicable to G-SIBs. Its requirement remains set at 22.4% of the Group’s risk-weighted assets (RWA), i.e. 18% plus the 4.4% solvency buffers.

The TLAC rose to €123.7 billion at the end of December 2025, compared with €122.07 billion at the end of December 2024.

The detailed quantitative information relating to capital management and capital requirements in the following tables enhances the information in the previous section under Pillar III.

EU LI3 – Explanation of differences between the statutory and prudential scope of consolidation

All companies consolidated by the equity method are associates.