The Pillar III report presents information relating to the risks of Groupe BPCE and is prepared in accordance with European regulation 2019/876, known as "CRR II", in particular according to articles 431 to 455 of the regulation, which detail the information to be published by institutions under Pillar III. The CRR II-CRD V legislative package was adopted on May 20, 2019 by the European Parliament and entered into force on June 28, 2021. Pillar III disclosures have also been prepared in accordance with the European Commission's Implementing Regulation (EU) 2021/637 of March 15, 2021.

The format and references of the Pillar III tables changed on June 30, 2021 according to the technical standards defined by Implementing Regulation (EU) No. 2021/637.

The data expected under Pillar III ESG is published here for the first time.

Groupe BPCE has put an internal control framework in place to verify that the reported information is appropriate and compliant.

Structure of the Pillar III report

The Pillar III report is divided into 16 sections:

KEY INDICATORS

FULLY-LOADED CAPITAL RATIOS ⁽¹⁾
(as a %)

TOTAL FULLY LOADED CAPITAL ⁽¹⁾
(in billions of euros)

RISK-WEIGHTED ASSETS BY TYPE OF RISK

RISK-WEIGHTED ASSETS BY BUSINESS LINE

MREL RATIO (as a % of RWAs)

MREL RATIO (as a % of RWAs)

ADDITIONAL INDICATORS

EU KM1 – KEY INDICATORS

Renewed European solidarity in the face of the Ukrainian crisis

The outbreak of war on the EU's doorstep, with its impact on energy access and accelerating inflation, has further refocused European and French regulatory work on consumer protection and economic sovereignty Europeans seem to be united on various subjects, which encourages the Commission and parliamentarians sustain their regulatory work.

Progress of the banking union

In a context of difficulties in the “real” economy, the co-legislators were particularly effective in taking charge of the CRR3/CRD6 banking package in 2022.

The Commission’s draft (October 2021) had already included a significant number of agreed measures between Member States. The Council, under the French Presidency, was able to find a compromise in six months of work. National interests were expressed on a number of political issues, such as the level at which prudential capital requirements are applied (individual or consolidated) to satisfy host countries (output floor mechanism), the introduction of a grandfather clause for "strategic" holdings for the benefit of German IPS, the flat-rate calculation of operational risk without taking into account historical losses for Spanish banks... In the European Parliament, the high degree of fragmentation of the parties has encouraged accelerated work due to the absence of a majority on most of the proposed amendments, including the environmentalists' demands to use the banks as a tool for greening the European economy. The compromise therefore remains close to the Commission's initial draft and the technical amendments to the Council's draft, except on governance issues specific to the European text: the treatment of third-country branches and the methods to assess the suitability of managers. Thus, the work of the Trilogue should also be concluded quickly in 2023.

With regard to the resolution framework, the Eurogroup in June 2022 validated a pragmatic approach and asked the Commission to refocus the reform project on a limited number of subjects (debt hierarchy, notion of public interest, etc.) in order to clarify the treatment applicable to medium-sized banks. Parliament regrets that the European guarantee fund project is not part of the scope of the review and asks for strong commitments. A legislative draft is expected in 2023.

A sustained regulatory agenda

The regulatory agenda remains strong for banks and BPCE: the digital euro initiative, revision of the consumer loans directive, revision of the directive on the distance marketing of financial services, as well as acceleration of the sustainable finance agenda, and finalizing the work on open finance.

On the digital euro, the committee is working on a text that will specify the legal basis, and which will be published at the end of May 2023.

The consumer loans directive is still under negotiation at the Trilogue, where discussions continue on the inclusion of GAFAMs (acronym for American technology companies), which make deferred/split payments for their goods and services, in the scope of the directive.

On the directive on the distance marketing of financial services, the provisions of the text must be repealed and incorporated into the Consumer Law Directive.

On sustainable finance, many texts have already been adopted and are in the implementation and technical development phase: EU taxonomy, CSRD (corporate sustainability disclosure regulation) which replaces NFRD and will integrate the standards of extra-financial reporting (EFRAG, SFDR - sustainable finance disclosure regulation - Deforestation), while other texts are being negotiated: CSDDD (Corporate sustainability due diligence directive) - corporate duty of vigilance in terms of sustainability, and EU green bond standards.

On open finance, the Commission’s work is progressing and the publication of the text is expected at the end of June.

The banking and financial environment in which Groupe BPCE operates exposes it to a multitude of risks and requires it to implement an increasingly demanding and rigorous policy to control and manage these risks (see Article 16 of Regulation (EU) No. 2017/1129 known as “Prospectus 3” of June 14, 2017, the provisions of which relating to risk factors entered into force on July 21, 2019).

Some of the risks to which Groupe BPCE is exposed are set out below. However, this is not a comprehensive list of all of the risks incurred by Groupe BPCE in the course of conducting its business or given the environment in which it operates. The risks presented below are those identified to date as significant and specific to Groupe BPCE, and liable to have a material adverse impact on its business, financial position and/or results. For each of the risk sub-classes listed below, the risk factor considered to date by Groupe BPCE as the most significant is listed first.

The risks presented below are those identified to date as liable to have an adverse impact on the businesses of BPCE SA group and BPCE SA.

Groupe BPCE may be vulnerable to political, macro-economic and financial environments or to specific circumstances in its countries of operation.

Some Groupe BPCE entities are exposed to country risk, which is the risk that economic, financial, political or social conditions in a foreign country (particularly in countries where the Group conducts business) may affect their financial interests. Groupe BPCE predominantly does business in France (81% of net banking income for the fiscal year ended December 31, 2022) and North America (11% of net banking income for the fiscal year ended December 31, 2022), with other European countries and the rest of the world accounting for 4% and 4%, respectively, of net banking income for the fiscal year ended December 31, 2022. Note 12.6 “Locations by country” to the consolidated financial statements of Groupe BPCE, contained in the 2022 universal registration document, lists the entities established in each country and gives a breakdown of net banking income and income before tax by country of establishment.

A significant change in the political or macro-economic environment of such countries or regions may generate additional expenses or reduce profits earned by Groupe BPCE.

The extent of the imbalances to be eliminated (mismatch between supply and demand in the goods and labor markets, public and private debt, inflationary mechanics of expectations, heterogeneity of geographical and sectoral situations), combined with numerous overlapping global risks, can always tip developed economies into a downward spiral. To date, these joint threats mainly relate to: geopolitical and health uncertainties (risks on supplies and value chains, evolution of the Russian-Ukrainian military situation and sanctions against Russia, increased tension between Taiwan and China, availability of nuclear weapons in Iran, effective challenge to the zero-Covid policy in China); the development of protectionist trends, particularly in the United States (such as the Chips Act - $270 billion - and the Inflation Reduction Act (IRA) - $370 billion - enacted in August 2022, both of which massively subsidize the microprocessor industry and renewable energies); delays in the negative impacts of successive monetary tightening and reduced budget support; contract renegotiations, particularly for natural gas and electricity in the Euro zone. In addition, the development of the war in Ukraine, by its geographical proximity, maintains both uncertainty and fear and weariness in the face of the continuation of rapid repetitive crises, especially after the pandemic.

In addition to any serious economic disruption, such as current inflation and its impact on the economy, or such as the financial crisis of 2008 or the sovereign debt crisis in Europe in 2011 or a major geopolitical crisis, could have a significant negative impact on all Groupe BPCE activities, in particular if the disruption is characterized by a lack of market liquidity making it difficult for Groupe BPCE to obtain funding. In particular, some risks do not occur in the normal economic cycle because they are externally generated. Examples include the increase in credit risk associated with corporate debt around the world (leveraged loans market) and the threat of the Covid-19 epidemic growing even worse, or the longer-term impacts of climate change. During the financial crisis of 2008 and 2011, the financial markets were subject to strong volatility in response to various events, including but not limited to the decline in oil and commodity prices, the slowdown in emerging economies and turbulence on the equity markets, which directly or indirectly impacted several Groupe BPCE businesses (primarily securities transactions and financial services).

Similarly, the armed conflict triggered by the Russian Federation following its invasion of Ukraine constitutes a significant change that directly or indirectly penalizes the economic activity of the counterparties financed by Groupe BPCE, and entails additional expenses for or reduces the profits of Groupe BPCE, in particular by discontinuing its activities in this geographical area. For information, as of December 31, 2022, Ukrainian counterparties were impaired in the amount of €35 million, corresponding to a gross exposure of €91 million. The Russian counterparties were impaired in the amount of €85 million corresponding to a gross exposure of €1,088 million. These exposures are very limited in view of Groupe BPCE’s €939 billion in gross outstanding loans and advances at amortized cost at December 31, 2022 (customers and banks).

For more detailed information, see Sections 4.2.1 “Economic and financial environment” and 4.7 “Outlook for Groupe BPCE” of the 2022 universal registration document.

The risk of a pandemic (such as the coronavirus - Covid-19) and its economic consequences may adversely impact the Group’s operations, results and financial position.

The emergence of Covid-19 in late 2019 and rapid spread of the pandemic across the globe led to a deterioration in economic conditions in multiple business sectors, a deterioration in the financial position of economic players, while also disrupting the financial markets. In response, many affected countries were forced to implement preventive health measures (closed borders, lockdown measures, restrictions on certain economic activities, etc.). Government (guaranteed loans, tax and social assistance, etc.) and banking (moratoriums) schemes were put in place. Some counterparties may emerge weakened from this unprecedented period.

Massive fiscal and monetary policy measures to support activity were put in place between 2020 and 2022, notably by the French government (State-guaranteed loans for businesses and professional customers, for individual customers, short-time working measures as well as numerous other fiscal, social and bill-paying measures) and by the European Central Bank (more abundant and cheaper access to very large refinancing packages). Groupe BPCE has actively participated in the French State-guaranteed loan program in the interest of financially supporting its customers and helping them overcome the effects of this crisis on their activities and income (e.g. automatic six-month deferral on loans to certain professional customers and micro-enterprises/SMEs). There is no way to guarantee, however, that such measures will be enough to offset the negative impacts of the pandemic on the economy or to fully stabilize the financial markets over the long term. In particular, the repayment of State-guaranteed loans may lead to defaults on the part of borrowers and financial losses for Groupe BPCE up to the portion not guaranteed by the State.

Groupe BPCE may not achieve the objectives of its BPCE 2024 strategic plan.

On July 8, 2021, Groupe BPCE announced its BPCE 2024 strategic plan. It is structured around the following three strategic priorities: (i) a winning spirit, with €1.5 billion in additional revenues in five priority areas, (ii) customers, by offering them the highest quality service with an adapted relationship model, and (iii) the climate, through concrete and measurable commitments that are part of a Net zero trajectory. The BPCE 2024 strategic plan is based on the following three key principles: (i) be simple: because Groupe BPCE seeks efficiency and customer satisfaction, it aims for greater simplicity; (ii) be innovative: because Groupe BPCE is driven by an entrepreneurial spirit and is aware of the reality of the changes underway, it strengthens its capacity for innovation; and (iii) be safe, because Groupe BPCE is committed to a long-term approach, it prioritizes the security of its development model with regard to its ambitions. These strategic objectives were developed in the context of the Covid-19 crisis, which has acted as an indicator and accelerator of fundamental trends (in particular, digitization, hybrid work, energy transition) and reflects Groupe BPCE’s desire to accelerate its development by supporting its customers in their economic recovery and their projects to emerge from the health crisis. The success of the BPCE 2024 strategic plan is based on a very large number of initiatives to be implemented within the various business lines of Groupe BPCE. Although many of these targets can be achieved, it is possible that not all of them will be, nor is it possible to predict which of these goals will not. The BPCE 2024 strategic plan also calls for significant investments, but if the plan’s objectives are not met, the return on these investments may be lower than expected. If Groupe BPCE does not achieve the targets defined in its BPCE 2024 strategic plan, its financial position and results could be more or less significantly affected.

The physical and transition components of climate risk, together with their repercussions for economic players, could adversely affect the activities, income and financial position of Groupe BPCE.

The risks associated with climate change are factors that exacerbate existing risks, including credit risk, operational risk and market risk. In particular, BPCE is exposed to physical and transition climate risk. They potentially carry an image and/or reputation risk.

Physical risk leads to increased economic costs and financial losses resulting from the severity and increased frequency of extreme weather events related to climate change (such as heat waves, landslides, floods, late frosts, fires and storms), as well as long-term gradual changes in climate (such as changes in rainfall patterns, extreme weather variability, and rising sea levels and average temperatures). It could have an extensive impact in terms of scope and magnitude, that may affect a wide variety of geographic areas and economic sectors relevant to Groupe BPCE. For example, the Cévennes episodes that affect the south-east of France every year can cause buildings, factories and offices to flood, slowing down or even making it impossible for some of the Group’s customers to carry out their activities. Moreover, physical climate risk can spread along the value chain of Groupe BPCE’s corporate customers, which can lead to default and thus generate financial losses for Groupe BPCE. These physical climate risks are likely to increase and could lead to significant losses for Groupe BPCE.

The transition risk is connected to the process of adjusting to a low-carbon economy. The process of reducing emissions is likely to have a significant impact on all sectors of the economy by affecting the value of financial assets and the profitability of companies. The increase in costs related to this energy transition for economic players, whether corporates or individual customers, could lead to an increase in defaults and thus significantly increase Groupe BPCE’s losses. For example, the French “Énergie-Climat” law of November 8, 2019 is expected to limit from 2023, and completely limit from 2028, the sale and rental of real estate with very low energy performances. Some of Groupe BPCE’s customers will therefore have to plan renovation work for a possible future sale or lease of such type of properties. The risk lies in the impossibility for Groupe BPCE’s customers to carry out this costly work and consequently being unable to complete the financial transaction necessary to balance their budget. These customers of Groupe BPCE could therefore become insolvent, which would result in significant financial losses for Groupe BPCE.

Groupe BPCE may encounter difficulties in adapting, implementing and incorporating its policy governing acquisitions or joint ventures.

Although acquisitions are not a major part of Groupe BPCE’s current strategy, the Group may nonetheless consider acquisition or partnership opportunities in the future. Although Groupe BPCE carries out an in-depth analysis of any potential acquisitions or joint ventures, in general it is impossible to carry out an exhaustive appraisal in every respect. As a result, Groupe BPCE may have to manage initially unforeseen liabilities. Similarly, the results of the acquired company or joint venture may prove disappointing and the expected synergies may not be realized in whole or in part, or the transaction may give rise to higher-than-expected costs. Groupe BPCE may also encounter difficulties with the consolidation of new entities. The failure of an announced acquisition or failure to consolidate a new entity or joint venture may place a strain on Groupe BPCE’s profitability. This situation may also lead to the departure of key employees. In the event that Groupe BPCE is obliged to offer financial incentives to its employees in order to retain them, this situation may also lead to an increase in costs and a decline in profitability. Joint ventures expose Groupe BPCE to additional risks and uncertainties in that it may depend on systems, controls and persons that are outside its control and may, in this respect, see its liability incurred, suffer losses or incur damage to its reputation. Moreover, conflicts or disagreements between Groupe BPCE and its joint venture partners may have a negative impact on the targeted benefits of the joint venture. At December 31, 2022, the total investments accounted for using the equity method amounted to €1.7 billion. For further information, please refer to Note 12.4 “Partnerships and associates” to the consolidated financial statements of Groupe BPCE, included in the 2022 universal registration document.

Intense competition in France, Groupe BPCE’s main market, or internationally, may cause its net income and profitability to decline.

Groupe BPCE’s main business lines operate in a very competitive environment both in France and other parts of the world where it does substantial business. This competition is heightened by consolidation, either through mergers and acquisitions or cooperation and arrangements. Consolidation has created a certain number of companies which, like Groupe BPCE, can offer a wide range of products and services ranging from insurance, loans and deposits to brokerage, investment banking and asset management. Groupe BPCE is in competition with other entities based on a number of factors, including the execution of transactions, products and services offered, innovation, reputation and price. If Groupe BPCE is unable to maintain its competitiveness in France or in its other major markets by offering a range of attractive and profitable products and services, it may lose market share in certain key business lines or incur losses in some or all of its activities.

For example, at December 31, 2022, in France, Groupe BPCE was the number one bank for SMEs⁽¹⁾, and number two for individual⁽²⁾. It has a 26.2% market share in home loans⁽²⁾. For Retail Banking and Insurance, customer loan outstandings amounted to €701 billion and customer deposits & savings⁽³⁾ to €888 billion (for more information on the contribution of each business line, and each network, see Section 1.4 “The Group’s business lines” of the 2022 universal registration document).

In addition, any slowdown in the global economy or in the economies in which Groupe BPCE’s main markets are located is likely to increase competitive pressure, in particular through increased pressure on prices and a contraction in the volume of activity of Groupe BPCE and its competitors. New, more competitive rivals subject to separate or more flexible regulation or other prudential ratio requirements could also enter the market. These new market participants would thus be able to offer more competitive products and services. Advances in technology and the growth of e-commerce have made it possible for institutions other than custodians to offer products and services that were traditionally considered as banking products, and for financial institutions and other companies to provide electronic and internet-based financial solutions, including electronic securities trading. These new entrants may put downward pressure on the price of Groupe BPCE’s products and services or affect Groupe BPCE’s market share. Advances in technology could lead to rapid and unexpected changes on Groupe BPCE’s markets of operation. Groupe BPCE’s competitive position, net earnings and profitability may be adversely affected should it prove unable to adequately adapt its activities or strategy in response to such changes.

Groupe BPCE’s ability to attract and retain skilled employees is paramount to the success of its business and failing to do so may affect its performance.

The employees of Groupe BPCE entities are the Group’s most valuable resource. Competition to attract qualified employees is fierce in many areas of the financial services sector. Groupe BPCE’s earnings and performance depend on its ability to attract new employees and retain and motivate existing employees. Changes in the economic environment (in particular tax and other measures aimed at limiting the pay of banking sector employees) may compel Groupe BPCE to transfer its employees from one unit to another, or reduce the workforce in certain business lines, which may cause temporary disruptions due to the time required for employees to adapt to their new duties, and may limit Groupe BPCE’s ability to benefit from improvements in the economic environment. This may prevent Groupe BPCE from taking advantage of potential opportunities in terms of sales or efficiency, which could in turn affect its performance.

At December 31, 2022, Groupe BPCE had 99,800 employees. 8,700 permanent employees were recruited during the year (for more information, see Section 2.4 “A committed and socially responsible group” of the 2022 universal registration document).

Significant changes in interest rates may have a material adverse impact on Groupe BPCE’s net banking income and profitability.

The net interest margin collected by Groupe BPCE during a given period represents a significant portion of its net banking income. Consequently, changes in the latter have a significant impact on Groupe BPCE’s profitability. The cost of the resource as well as the conditions of return on the asset and in particular those attached to new production are therefore very sensitive elements, particularly to factors that may be beyond Groupe BPCE’s control. These significant changes can have significant temporary or lasting repercussions, even if the rise in interest rates should be generally favorable in the medium to long term.

After a decade of low or even negative interest rates, a sharp and rapid rise in interest rates and strong inflationary pressures have emerged, reinforced by the consequences of the health crisis and the conflict in Ukraine. The exposure to interest rate risk was increased by the combination of unfavorable elements, namely the increase in inflation (major impact on regulated rates), the rapid exit from the negative interest rate policy (deposit arbitrage), the rise in interbank spreads, while, conversely, new loan production is constrained by the attrition rate and the competitive environment.

The sensitivity of the net present value of Groupe BPCE’s balance sheet to a +/-200 bps variation in interest rates remains below the 15% Tier 1 limit. At December 31, 2022, Groupe BPCE’s sensitivity to interest rate increases stood at -13.94% compared to Tier 1 versus -11.37% at December 31, 2021. As of September 30, 2022, the small upward shock (+25 bps) would have a negative impact of 1.4% on the projected net interest margin (expected loss of €91 million) over a rolling year, whereas the small downward scenario (-25 bps) would have a positive impact of 1.5% (expected gain of €95 million).

Market fluctuations and volatility expose Groupe BPCE to losses in its trading and investment activities, which may adversely impact Groupe BPCE’s results and financial position.

In the course of its third-party trading or investment activities, Groupe BPCE may carry positions in the bond, currency, commodity and equity markets, and in unlisted securities, real estate assets and other asset classes. These positions may be affected by volatility on the markets (especially the financial markets), i.e. the degree of price fluctuations over a given period on a given market, regardless of the levels on the market in question. Certain market configurations and fluctuations may also generate losses on a broad range of trading and hedging products used, including swaps, futures, options and structured products, which could adversely impact Groupe BPCE’s results and financial position. Similarly, extended market declines and/or major crises may reduce the liquidity of certain asset classes, making it difficult to sell certain assets and in turn generating material losses.

The market risk-weighted assets totaled €15.4 billion, i.e. around 3% of Groupe BPCE’s total risk-weighted assets, on December 31, 2022. For information, the weight of Corporate & Investment Banking activities in the Group’s net banking income was 15% for the year 2022. For more detailed information and examples, see Note 10.1.2 “Analysis of financial assets and liabilities classified in level 3 of the fair value hierarchy” to the consolidated financial statements of Groupe BPCE, included in the 2022 universal registration document.

Groupe BPCE is dependent on its access to funding and other sources of liquidity, which may be limited for reasons outside its control, thus potentially having a material adverse impact on its results.

Access to short-term and long-term funding is critical for the conduct of Groupe BPCE’s business. Non-collateralized sources of funding for Groupe BPCE include deposits, issues of long-term debt and short/medium-term negotiable debt securities, banks loans and credit lines. Groupe BPCE also uses guaranteed financing, in particular through the conclusion of repurchase agreements and the issuance of covered bonds. If Groupe BPCE were unable to access the secured and/or unsecured debt market at conditions deemed acceptable, or incurred an unexpected outflow of cash or collateral, including a significant decline in customer deposits, its liquidity may be negatively affected. Furthermore, if Groupe BPCE were unable to maintain a satisfactory level of customer deposits (e.g. in the event its competitors offer higher rates of return on deposits), it may be forced to obtain funding at higher rates, which would reduce its net interest income and results.

Groupe BPCE’s liquidity, and therefore its results, may also be affected by unforeseen events outside its control, such as general market disruptions, which may in particular be related to geopolitical or health crises, operational hardships affecting third parties, negative opinions on financial services in general or on the short/long-term outlook for Groupe BPCE, changes in Groupe BPCE’s credit rating, or even the perception of the position of Groupe BPCE or other financial institutions among market operators.

Groupe BPCE’s access to the capital markets, and the cost of long-term unsecured funding, are directly related to changes in its credit spreads on the bond and credit derivatives markets, which it can neither predict nor control. Liquidity constraints may have a material adverse impact on Groupe BPCE’s financial position, results and ability to meet its obligations to its counterparties. Similarly, a change in the monetary policy stance, in particular that of the European Central Bank, may impact Groupe BPCE’s financial position.

However, to deal with these risk factors, Groupe BPCE has liquidity reserves made up of cash deposits with central banks and available securities and receivables eligible for central bank refinancing. Groupe BPCE’s liquidity reserve amounted to €322 billion on December 31, 2022, covering 150% short-term funding and short-term maturities of MLT debt. The one-month LCR (Liquidity Coverage Ratio) averaged 142% over 12 months on December 31, 2022 versus 161% on December 31, 2021. Given the importance of these risks for Groupe BPCE in terms of impact and probability, these risks are monitored proactively and closely, with Groupe BPCE also pursuing a very active policy of diversification of its investors.

Changes in the fair value of Groupe BPCE’s portfolios of securities and derivative products, and its own debt, are liable to have an adverse impact on the net carrying amount of these assets and liabilities, and as a result on Groupe BPCE’s net income and equity.

The net carrying amount of Groupe BPCE’s securities, derivative products and other types of assets at fair value, and of its own debt, is adjusted (at balance sheet level) at the date of each new financial statement. These adjustments are predominantly based on changes in the fair value of assets and liabilities during an accounting period, i.e. changes taken to profit or loss or recognized directly in other comprehensive income. Changes recorded in the income statement, but not offset by corresponding changes in the fair value of other assets, have an impact on net banking income and thus on net income. All fair value adjustments have an impact on equity and thus on Groupe BPCE’s capital adequacy ratios. Such adjustments are also liable to have an adverse impact on the net carrying amount of Groupe BPCE’s assets and liabilities, and thus on its net income and equity. The fact that fair value adjustments are recorded over an accounting period does not mean that additional adjustments will not be necessary in subsequent periods.

On December 31, 2022, financial assets at fair value totaled €193 billion (with approximately €182 billion in financial assets at fair value held for trading purposes) and financial liabilities at fair value totaled €185 billion (with €156 billion in financial liabilities at fair value held for trading purposes). For more detailed information, see also Note 4.3 “Gains (losses) on financial instruments at fair value through profit or loss”, Note 4.4 “Gains (losses) on financial assets measured at fair value through other comprehensive income before tax”, Note 5.2 “Financial assets and liabilities at fair value through profit or loss” and Note 5.4 “Financial assets at fair value through other comprehensive income” to the consolidated financial statements of Groupe BPCE in the 2022 universal registration document.

Groupe BPCE’s revenues from brokerage and other activities associated with fee and commission income may decrease in the event of market downturns.

A market downturn is liable to lower the volume of transactions (particularly financial services and securities transactions) executed by Groupe BPCE entities for their customers and as a market maker, thus reducing the net banking income from these activities. In particular, in the event of a decline in market conditions, Groupe BPCE may record a lower volume of customer transactions and a drop in the corresponding fees, thus reducing revenues earned from this activity. Furthermore, as management fees invoiced by Groupe BPCE entities to their customers are generally based on the value or performance of portfolios, any decline in the markets causing the value of these portfolios to decrease or generating an increase in the amount of redemptions would reduce the revenues earned by these entities through the distribution of mutual funds or other investment products (for the Caisses d’Epargne and the Banques Populaires) or through asset management activities, by an unfavorable evolution of management or superperformance fees. In addition, any deterioration in the economic environment could have an unfavorable impact on the seed money contributed to asset management structures with a risk of partial or total loss.

Even where there is no market decline, if funds managed for third parties throughout Groupe BPCE and other Groupe BPCE products underperform the market, redemptions may increase and/or inflows decrease as a result, with a potential corresponding impact on revenues from the asset management business.

In 2022, the total net amount of fees and commissions received was €11,929 million, representing 46% of Groupe BPCE’s net banking income. The revenues earned from fees and commissions for financial services came to €513 million and the revenues earned from fees and commissions for securities transactions amounted to €237 million. For more detailed information on the amounts of fees and commissions received by Groupe BPCE, see Note 4.2 (“Fee and commission income and expenses”) to the consolidated financial statements of Groupe BPCE in the 2022 universal registration document.

Downgraded credit ratings could have an adverse impact on BPCE’s funding cost, profitability and business continuity.

Groupe BPCE’s long-term ratings on December 31, 2022 were AA- for Fitch Ratings, A1 for Moody’s, A+ for R&I and A for Standard & Poor’s. The decision to downgrade these credit ratings may have a negative impact on the funding of BPCE and its affiliates active in the financial markets. A ratings downgrade may affect Groupe BPCE’s liquidity and competitive position, increase funding costs, limit access to financial markets and trigger obligations under some bilateral contracts governing trading, derivative and collateralized funding transactions, thus adversely impacting its profitability and business continuity.

Furthermore, BPCE’s unsecured long-term funding cost is directly linked to its credit spreads (the yield spread over and above the yield on government issues with the same maturity that is paid to bond investors), which in turn are heavily dependent on its ratings. An increase in credit spreads may materially raise BPCE’s funding cost. Shifts in credit spreads are correlated to the market and sometimes subject to unforeseen and highly volatile changes. Credit spreads are also influenced by market perception of issuer solvency and are associated with changes in the purchase price of Credit Default Swaps backed by certain BPCE debt securities. Accordingly, a change in perception of an issuer solvency due to a rating downgrade could have an adverse impact on that issuer’s profitability and business continuity.

Groupe BPCE is exposed to credit and counterparty risks that could have a material adverse effect on the Group’s business, financial position and income.

Groupe BPCE is significantly exposed to credit and counterparty risk through its financing or market activities. The Group could thus incur losses in the event of default by one or more counterparties, in particular if the Group encounters legal or other difficulties in exercising its collateral or if the value of the collateral does not allow it to fully cover the exposure in the event of a default. Despite the due diligence carried out by the Group, aimed at limiting the effects of having a concentrated credit portfolio, counterparty defaults may be amplified within a specific economic sector or world region by the effects of interdependence between these counterparties. Default by one or more major counterparties could thus have a material adverse effect on the Group’s cost of risk, income and financial position.

For information, on December 31, 2022, Groupe BPCE’s gross exposure to credit risk amounted to €1,484 billion, with the following breakdown for the main types of counterparty: 38% for retail customers, 28% for corporates, 17% for central banks and other sovereign exposures, and 6% for the public sector and similar entities. The credit risk-weighted assets amounted to €400 billion (including counterparty risk).

The main economic sectors to which the Group was exposed in its non-financial corporations portfolio were Real Estate (37% of gross exposures at December 31, 2022), Wholesale and Retail Trade (11%), Finance/Insurance (10%) and Manufacturing industry (7%).

Groupe BPCE develops its activities mainly in France. The Group’s gross exposure (gross carrying amount) to France was €1,046 billion, representing 84% of the total gross exposure. The remaining exposures were mainly concentrated in the United States, for 5%, with other countries accounting for 11% of the total gross exposures.

For further information, please see Chapters 5 “Credit risks” and 6 “Counterparty risk” in this document.

A substantial increase in impairments or provisions for expected credit losses recognized in respect of Groupe BPCE’s portfolio of loans and advances could have a material adverse effect on its income and financial position.

In the course of its lending activities, Groupe BPCE regularly recognizes charges for asset impairments in order to reflect, if necessary, actual or potential losses on its portfolio of loans and advances. Such impairments are booked in the income statement under “Cost of risk.” Groupe BPCE’s total charges for asset impairments are based on the Group’s measurement of past losses on loans, volumes and types of loans granted, industry standards, loans in arrears, economic conditions and other factors associated with the recoverability of various types of loans. While Groupe BPCE makes every effort to set aside a sufficient level of provisions for asset impairment expenses, its lending activities may cause it in the future to have to increase its expenses for losses on loans, due to a rise in non-performing loans or for other reasons such as the deterioration of market conditions or factors affecting certain countries. Any substantial increase in charges for losses on loans, material change in Groupe BPCE’s estimate of the risk of loss associated with its portfolio of loans, or any loss on loans exceeding past impairment expenses, could have an adverse impact on Groupe BPCE’s results and financial position.

For information, Groupe BPCE’s cost of risk amounted to €2,000 million in 2022 compared to €1,783 million in 2021, with credit risks accounting for 87% of Groupe BPCE’s risk-weighted assets. On the basis of gross exposures, 38% relate to retail customers and 28% to corporate customers (of which 70% of exposures are located in France).

Consequently, the risk associated with a significant increase in impairment expenses on assets booked to Groupe BPCE’s loans and advances portfolio is significant for Groupe BPCE in terms of impact and probability, and is therefore monitored carefully and proactively. In addition, prudential requirements supplement these provisioning mechanisms via the prudential backstop process, which results in a total deduction in equity of non-performing loans beyond a certain maturity in line with the quality of the guarantees and according to a regulatory timetable.

A decline in the financial strength and performance of other financial institutions and market players may have an unfavorable impact on Groupe BPCE.

Groupe BPCE’s ability to execute transactions may be affected by a decline in the financial strength of other financial institutions and market players. Institutions are closely interconnected owing to their trading, clearing, counterparty and financing operations. A default by a significant sector player (systematic risk), or even mere rumors or concerns regarding one or more financial institutions or the financial industry in general, may lead to a general contraction in market liquidity and subsequently to losses or further defaults in the future. Groupe BPCE is directly or indirectly exposed to various financial counterparties, such as investment service providers, commercial or investment banks, clearing houses and CCPs, mutual funds, hedge funds, and other institutional clients, with which it regularly conducts transactions. The default or failure of any such counterparties may have an adverse impact on Groupe BPCE’s financial position. Moreover, Groupe BPCE may be exposed to the risk associated with the growing involvement of operators subject to little or no regulation in its business sector and to the emergence of new products subject to little or no regulation (including in particular crowdfunding and trading platforms). This risk would be exacerbated if the assets held as collateral by Groupe BPCE could not be sold or if their selling price would not cover all of Groupe BPCE’s exposure to defaulted loans or derivatives, or in the event of fraud, embezzlement or other misappropriation of funds committed by financial sector participants in general to which Groupe BPCE is exposed, or if a key market operator such as a CCP defaults.

The exposures to “financial institutions” represented 4% of Groupe BPCE’s total gross exposures (€1,484 billion) on December 31, 2022. In geographic terms, 69% of gross exposures to “institutions” are located in France.

In the event of non-compliance with applicable laws and regulations, Groupe BPCE could be exposed to significant fines and other administrative and criminal penalties that could have a material adverse effect on its financial position, activities and reputation.

The risk of non-compliance is defined as the risk of sanction – judicial, administrative or disciplinary – but also of financial loss or damage to reputation, resulting from non-compliance with laws and regulations, professional standards and practices, and ethical standards specific to banking and insurance activities, whether national or international.

The banking and insurance sectors are subject to increased regulatory oversight, both in France and internationally. Recent years have seen a particularly substantial increase in the volume of new regulations that have introduced significant changes affecting both the financial markets and the relationships between investment service providers and customers or investors (e.g. MIFID II, PRIIPS, the directive on the Insurance Distribution, Market Abuse Regulation, fourth Anti-Money Laundering and Terrorism Financing directive, Personal Data Protection Regulation, Benchmark Index Regulation, etc.). These new regulations have major impacts on the company’s operational processes.

The realization of the risk of non-compliance could result, for example, in the use of inappropriate means to promote and market the bank’s products and services, inadequate management of potential conflicts of interest, the disclosure of confidential information, or privileged, failure to comply with due diligence on entering into relations with suppliers and customers, particularly in terms of financial security (in particular the fight against money laundering and the financing of terrorism, compliance with embargoes, the fight against fraud or corruption).

Within BPCE, the Compliance function is responsible for overseeing the system for preventing and managing non-compliance risks. Despite this system, Groupe BPCE remains exposed to the risk of fines or other significant sanctions from the regulatory and supervisory authorities, as well as civil or criminal legal proceedings that could have a significant adverse impact on its financial position, activities and reputation.

Any interruption or failure of the information systems belonging to Groupe BPCE or third parties may generate losses (including commercial losses) and may have a material adverse impact on Groupe BPCE’s results.

As is the case for the majority of its competitors, Groupe BPCE is highly dependent on information and communication systems, as a large number of increasingly complex transactions are processed in the course of its activities. Any failure, interruption or malfunction in these systems may cause errors or interruptions in the systems used to manage customer accounts, general ledgers, deposits, transactions and/or to process loans. For example, if Groupe BPCE’s information systems were to malfunction, even for a short period, the affected entities would be unable to meet their customers’ needs in time and could thus lose transaction opportunities. Similarly, a temporary failure in Groupe BPCE’s information systems despite back-up systems and contingency plans could also generate substantial information recovery and verification costs, or even a decline in its proprietary activities if, for example, such a failure were to occur during the implementation of a hedging transaction. The inability of Groupe BPCE’s systems to adapt to an increasing volume of transactions may also limit its ability to develop its activities and generate losses, particularly losses in sales, and may therefore have a material adverse impact on Groupe BPCE’s results.

Groupe BPCE is also exposed to the risk of malfunction or operational failure by one of its clearing agents, foreign exchange markets, clearing houses, custodians or other financial intermediaries or external service providers that it uses to carry out or facilitate its securities transactions. As interconnectivity with its customers continues to grow, Groupe BPCE may also become increasingly exposed to the risk of the operational malfunction of customer information systems. Groupe BPCE’s communication and information systems, and those of its customers, service providers and counterparties, may also be subject to failures or interruptions resulting from cybercriminal or cyberterrorist acts. For example, as a result of its digital transformation, Groupe BPCE’s information systems are becoming increasingly open to the outside (cloud computing, big data, etc.). Many of its processes are gradually going digital. Use of the Internet and connected devices (tablets, smartphones, apps used on tablets and mobiles, etc.) by employees and customers is on the rise, increasing the number of channels serving as potential vectors for attacks and disruptions, and the number of devices and applications vulnerable to attacks and disruptions. Consequently, the software and hardware used by Groupe BPCE’s employees and external agents are constantly and increasingly subject to cyberthreats. As a result of any such attacks, Groupe BPCE may face malfunctions or interruptions in its own systems or in third-party systems that may not be adequately resolved. Any interruption or failure of the information systems belonging to Groupe BPCE or third parties may generate losses (including commercial losses) due to the disruption of its operations and the possibility that its customers may turn to other financial institutions during and/or after any such interruptions or failures.

The risk associated with any interruption or failure of the information systems belonging to Groupe BPCE or third parties is significant for Groupe BPCE in terms of impact and probability, and is therefore carefully and proactively monitored.

Reputational and legal risks could unfavorably impact Groupe BPCE’s profitability and business outlook.

Groupe BPCE’s reputation is of paramount importance when it comes to attracting and retaining customers. The use of inappropriate means to promote and market Group products and services, inadequate management of potential conflicts of interest, legal and regulatory requirements, ethical issues, money laundering laws, economic sanctions, data security policies, sales and trading practices, and inadequate customer protection systems could adversely affect Groupe BPCE’s reputation. Its reputation could also be harmed by inappropriate employee behavior, cybercrime or cyber terrorist attacks on Groupe BPCE’s information and communication systems, or any fraud, embezzlement or other misappropriation of funds committed by financial sector participants to which Groupe BPCE is exposed, or any legal ruling or regulatory action with a potentially unfavorable outcome. Any such harm to Groupe BPCE’s reputation may have a negative impact on its profitability and business outlook.

Ineffective management of reputational risk could also increase Groupe BPCE’s legal risk, the number of legal disputes in which it is involved and the amount of damages claimed, or may expose the Group to regulatory sanctions. For more information, see Chapter 10 “Legal risks” of this document. The financial consequences of these disputes may have an impact on the financial position of the Group, in which case they may also adversely impact Groupe BPCE’s profitability and business outlook.

Unforeseen events may interrupt Groupe BPCE’s operations and cause losses and additional costs.

Unforeseen events, such as a serious natural disaster, events related to climate risk (physical risk directly associated with climate change), new pandemics, attacks or any other emergency situation can cause an abrupt interruption in the operations of Groupe BPCE entities, affecting in particular the Group’s core business lines (liquidity, payment instruments, securities services, loans to individual and corporate customers, and fiduciary services) and trigger material losses, if the Group is not covered or not sufficiently covered by an insurance policy. These losses could relate to material assets, financial assets, market positions or key employees, and have a direct and potentially material impact on Groupe BPCE’s net income. Moreover, such events may also disrupt Groupe BPCE’s infrastructure, or that of a third party with which Groupe BPCE does business, and generate additional costs (relating in particular to the cost of re-housing the affected personnel) and increase Groupe BPCE’s costs (such as insurance premiums). Such events may invalidate insurance coverage of certain risks and thus increase Groupe BPCE’s overall level of risk.

At December 31, 2022, the operational risks accounted for 9% of Groupe BPCE’s risk-weighted assets, as on December 31, 2021. At December 31, 2022, Groupe BPCE’s losses in respect of operational risk could be primarily attributed to the “Payment and Settlements” business line (35%). They were concentrated in the Basel category external fraud for 40%.

The failure or inadequacy of Groupe BPCE’s risk management and hedging policies, procedures and strategies may expose it to unidentified or unexpected risks which may trigger unforeseen losses.

Groupe BPCE’s risk management and hedging policies, procedures and strategies may not succeed in effectively limiting its exposure to all types of market environments or all kinds of risks, and may even prove ineffective for some risks that the Group was unable to identify or anticipate. Furthermore, the risk management techniques and strategies employed by Groupe BPCE may not effectively limit its exposure to risk and do not guarantee that overall risk will actually be lowered. These techniques and strategies may prove ineffective against certain types of risk, in particular risks that Groupe BPCE had not already identified or anticipated, given that the tools used by Groupe BPCE to develop risk management procedures are based on assessments, analyses and assumptions that may prove inaccurate. Some of the indicators and qualitative tools used by Groupe BPCE to manage risk are based on the observation of past market performance. To measure risk exposures, the heads of risk management carry out a statistical analysis of these observations.

These tools or indicators may not be capable of predicting future exposure to risk. For example, these risk exposures may be due to factors that Groupe BPCE may not have anticipated or correctly assessed in its statistical models or due to unexpected or unprecedented shifts in the market. This would limit Groupe BPCE’s risk management capability. As a result, losses incurred by Groupe BPCE may be higher than those anticipated on the basis of past measurements. Moreover, the Group’s quantitative models cannot factor in all risks. While no significant problem has been identified to date, the risk management systems are subject to the risk of operational failure, including fraud. Some risks are subject to a more qualitative analysis, which may prove inadequate and thus expose Groupe BPCE to unexpected losses.

Actual results may vary compared to assumptions used to prepare Groupe BPCE’s financial statements, which may expose it to unexpected losses.

In accordance with current IFRS standards and interpretations, Groupe BPCE must base its financial statements on certain estimates, in particular accounting estimates relating to the determination of provisions for non-performing loans and advances, provisions for potential claims and litigation, and the fair value of certain assets and liabilities. If the values used for the estimates by Groupe BPCE prove to be materially inaccurate, in particular in the event of major and/or unexpected market trends, or if the methods used to calculate these values are modified due to future changes in IFRS standards or interpretations, Groupe BPCE may be exposed to unexpected losses.

Information on the use of estimates and judgments is provided in Note 2.3 “Use of estimates and judgments” to the consolidated financial statements of Groupe BPCE in the 2022 universal registration document.

Groupe BPCE generates 11% of its net banking income from its insurance businesses. The net banking income from life and non-life insurance activities amounted to €2,927 million for the year 2022, compared to €2,860 million for 2021.

A deterioration in market conditions, and in particular excessive interest rate increases or decreases, could have a material adverse impact on the personal insurance business and income of the Group.

The main risk to which Groupe BPCE’s insurance business subsidiaries are exposed in their personal insurance business is market risk. Exposure to market risk is mainly related to the capital guarantee as applicable to euro-denominated savings products.

Among market risks, interest rate risk is structurally significant for BPCE Assurances, as its general funds consist primarily of bonds. Interest rate fluctuations may:

As a result of the allocation of general funds, the widening of spreads and the decline in the equity markets could also have a significant unfavorable impact on the results of Groupe BPCE’s life and health insurance business, through the recording of provisions for impairment due to the decline in the valuation of investments at fair value through profit or loss.

A mismatch between the loss experience expected by the insurer and the amounts actually paid by the Group to policyholders could have a significant adverse impact on its non-life insurance business and on the personal protection insurance portion of its insurance business, as well as its results and its financial position.

The main risk to which Groupe BPCE’s insurance business subsidiaries are exposed in connection with these latter activities is underwriting risk. This risk results from a mismatch between i) claims actually recorded and benefits actually paid as compensation for these claims and ii) the assumptions used by the subsidiaries to set the prices for their insurance products and to establish technical reserves for potential compensation.

The Group uses both its own experience and industry data to develop estimates of future policy benefits, including information used in pricing insurance products and establishing the related actuarial liabilities. However, actual experience may not match these estimates, and unforeseen risks such as pandemics or natural disasters could result in higher-than-expected payments to policyholders. In this respect, changes in climate phenomena (known as “physical” climate risks) are subject to particular vigilance.

In the event that the amounts actually paid by the Group to policyholders are greater than the underlying assumptions initially used to establish provisions, or if events or trends lead the Group to modify the underlying assumptions, the Group may be exposed to more significant liabilities than expected, which could have a negative impact on the non-life insurance business for the personal protection portion, as well as on the results and financial position of the Group.

The various actions taken over the last few years, particularly in terms of financial coverage, reinsurance, business diversification and management of investments, have also contributed to the solidity and resilience of the solvency of BPCE Assurances. It should be noted that the deterioration of the economic and financial environment, in particular the decline in the equity markets and the level of interest rates, could adversely affect the solvency of BPCE Assurances, by adversely affecting future margins.

Groupe BPCE is subject to significant regulation in France and in several other countries around the world where it operates; regulatory measures and changes could have a material adverse impact on Groupe BPCE’s business and results.

The business and results of Group entities may be materially impacted by the policies and actions of various regulatory authorities in France, other governments of the European Union, the United States, foreign governments and international organizations. Such constraints may limit the ability of Groupe BPCE entities to expand their businesses or conduct certain activities. The nature and impact of future changes in such policies and regulatory measures are unpredictable and are beyond Groupe BPCE’s control. Moreover, the general political environment has evolved unfavorably for banks and the financial industry, resulting in additional pressure on the part of legislative and regulatory bodies to adopt more stringent regulatory measures, despite the fact that these measures may have adverse consequences on lending and other financial activities, and on the economy. Because of the continuing uncertainty surrounding the new legislative and regulatory measures, it is not possible to predict what impact they will have on Groupe BPCE; however, this impact may be highly adverse.

Groupe BPCE may have to reduce the size of some of its activities to comply with new requirements. New measures are also liable to increase the cost of compliance with new regulations. This could cause revenues and consolidated profit to decline in the relevant business lines, sales to decline in certain activities and asset portfolios, and asset impairment expenses.

The purpose of the 2019 adoption of the final versions of the Banking Package was to align prudential requirements for banks with Basel III standards. The implementation of these reforms may result in higher capital and liquidity requirements, which could impact Groupe BPCE funding costs.

On November 11, 2020, the Financial Stability Board (“FSB”), in consultation with the Basel Committee on Banking Supervision and national authorities, reported the 2020 list of global systemically important banks (“G-SIBs”). Groupe BPCE is classified as a G-SIB by the FSB. Groupe BPCE also appears on the list of global systematically important institutions (“G-SIIs”).

These regulatory measures, which may apply to various Groupe BPCE entities, and any changes in such measures may have a material adverse impact on Groupe BPCE’s business and results.

Legislation and regulations have recently been enacted or proposed in recent years with a view to introducing a number of changes, some permanent, in the global financial environment. These new measures, aimed at avoiding a new global financial crisis, have significantly altered the operating environment of Groupe BPCE and other financial institutions, and may continue to alter this environment in the future. Groupe BPCE is exposed to the risk associated with changes in legislation and regulations. These include the new prudential backstop rules, which measure the difference between the actual provisioning levels of defaulted loans and guidelines including target rates, depending on the age of the default and the presence of guarantees.

In today’s evolving legislative and regulatory environment, it is impossible to foresee the impact of these new measures on Groupe BPCE. The development of programs aimed at complying with these new legislative and regulatory measures (and updates to existing programs), and changes to the Group’s information systems in response to or in preparation for new measures generates significant costs for the Group, and may continue to do so in the future. Despite its best efforts, Groupe BPCE may also be unable to fully comply with all applicable laws and regulations and may thus be subject to financial or administrative penalties. Furthermore, new legislative and regulatory measures may require the Group to adapt its operations and/or may affect its results and financial position. Lastly, new regulations may require Groupe BPCE to strengthen its capital or increase its total funding costs.

The risk associated with regulatory measures and subsequent changes to such measures is significant for Groupe BPCE in terms of impact and probability, and is therefore carefully and proactively monitored.

BPCE may have to help entities belonging to the financial solidarity mechanism in the event they experience financial difficulties, including entities in which BPCE holds no economic interest.

As the central institution of Groupe BPCE, BPCE is responsible for ensuring the liquidity and solvency of each regional bank (Banques Populaires and Caisses d’Epargne) and the other members of the group of affiliates which have credit institution status subject to French regulations. The group of affiliates includes BPCE subsidiaries, such as Natixis, Crédit Foncier de France, Oney and Banque Palatine. For Groupe BPCE, all entities affiliated with the central institution of Groupe BPCE benefit from a guarantee and solidarity mechanism, the aim of which, in accordance with Articles L. 511-31, L. 512-107-5 and L. 512-107-6 of the French Monetary and Financial Code, is to ensure the liquidity and solvency of all affiliated entities and to organize financial solidarity throughout the Group.

This financial solidarity is based on legislative provisions establishing a legal principle of solidarity with obligation of results requiring the central institution to restore the liquidity or solvency of affiliates in difficulty, and/or all of the Group’s affiliates, by virtue of the unlimited nature of the principle of solidarity, BPCE is entitled at any time to ask any one or more or all of the affiliates to contribute to the financial efforts necessary to restore the situation, and may, if necessary, mobilize up to all the cash and cash equivalents of the affiliates in the event of difficulty for one or more of them.

The three guarantee funds created to cover Groupe BPCE’s liquidity and insolvency risks are described in Note 1.2 “Guarantee mechanism” to the consolidated financial statements of Groupe BPCE included in the 2022 universal registration document. At December 31, 2022, the Banque Populaire and Caisse d’Epargne funds each contained €450 million. The Mutual Guarantee Fund holds €157 million in deposits per network. The regional banks are obligated to make additional contributions to the guarantee fund on their future profits. While the guarantee fund represents a substantial source of resources to fund the solidarity mechanism, there is no guarantee these revenues will be sufficient. If the guarantee funds prove insufficient, BPCE, due to its missions as a central institution, will have to do everything necessary to restore the situation and will have the obligation to make up the deficit by implementing the internal solidarity mechanism that it has put in place, by mobilizing its own resources, and may also make unlimited use of the resources of several or all of its affiliates.

As a result of this obligation, if a member of the Group were to encounter major financial difficulties, the event underlying these financial difficulties could have a negative impact on the financial position of BPCE and that of the other affiliates thus called upon to provide support under the principle of financial solidarity.

Investors in BPCE’s securities could suffer losses if BPCE and all of its affiliates were to be subject to liquidation or resolution procedures.

The EU regulation on the Single Resolution Mechanism No. 806/214 and the EU directive for the recovery and resolution of banks No. 2014/59, as amended by the EU directive No. 2019/879 (the “BRRD”), as transposed into French law in Book VI of the French Monetary and Financial Code, give the resolution authorities the power to impair BPCE securities or, in the case of debt securities, to convert them to equity.

Resolution authorities may write down or convert capital instruments, such as BPCE’s Tier 2 subordinated debt securities, if the issuing institution or the group to which it belongs is failing or likely to fail (and there is no reasonable prospect that another measure would avoid such failure within a reasonable time period), becomes non-viable, or requires extraordinary public support (subject to certain exceptions). They shall write down or convert capital instruments before opening a resolution proceeding, or if doing so is necessary to maintain the viability of an institution. Any write-down or conversion of capital instruments shall be effected in order of seniority, so that Common Equity Tier 1 instruments are to be written down first, then additional Tier 1 instruments are to be written down or converted to equity, followed by Tier 2 instruments. If the write-down or conversion of capital instruments is not sufficient to restore the financial health of the institution, the bail-in power held by the resolution authorities may be applied to write down or convert eligible liabilities, such as BPCE’s senior non-preferred and senior preferred securities.

At December 31, 2022, total Tier 1 capital amounted to €69.7 billion and Tier 2 prudential capital to €12.7 billion. The senior non-preferred debt instruments amounted to €26.8 billion at that date, of which €22.5 billion had a maturity of more than one year and were therefore eligible for TLAC and MREL at December 31, 2022.

As a result of the complete legal solidarity, and in the extreme case of a liquidation or resolution proceeding, one or more affiliates may not find itself subject to court-ordered liquidation, or be affected by resolution measures within the meaning of the “BRRD”, without all affiliates and BPCE also being affected. In accordance with Articles L. 613-29 and L. 613-5-5 of the French Monetary and Financial Code, the judicial liquidation proceedings and resolution measures are therefore brought in a coordinated manner with regard to the central institution and all of its affiliates.

Article L. 613-29 also provides that, in the event of court-ordered liquidation proceedings being brought against all affiliates, the external creditors (of the same rank or enjoying identical rights) of all affiliates would be treated equally according to the ranking of the creditors and regardless of whether they are attached to a particular affiliated entity. As a result, investors in AT1 instruments and other pari passu securities would be more affected than investors in Tier 2 instruments and other pari passu securities, which in turn would be more affected than investors in external senior non-preferred debt, which in turn would be more affected than investors in external senior preferred debt. Similarly, in the event of resolution, and in accordance with Article L. 613-55-5 of the French Monetary and Financial Code, identical depreciation and/or conversion rates would be applied to debts and receivables of the same rank, regardless of their attachment to a particular affiliated entity in the order of the hierarchy recalled above. Due to the systemic nature of Groupe BPCE and the assessment currently made by the resolution authorities, resolution measures would be more likely to be taken than the opening of judicial liquidation proceedings. A resolution procedure may be initiated against BPCE and all affiliated entities if (i) the default of BPCE and all affiliated entities is proven or foreseeable, (ii) there is no reasonable expectation that another measure could prevent this failure within a reasonable timeframe and (iii) a resolution measure is required to achieve the objectives of the resolution: (a) guarantee the continuity of critical functions, (b) avoid material adverse impacts to financial stability, (c) protect State resources by minimizing the use of exceptional public financial support and (d) protect client funds and assets, particularly those of depositors. Failure of an institution means that it does not respect requirements for continuing authorization, it is unable to pay its debts or other liabilities when they fall due, it requires extraordinary public financial support (subject to limited exceptions), or the value of its liabilities exceeds the value of its assets.

In addition to the bail-in power, resolution authorities are provided with broad powers to implement other resolution measures with respect to failing institutions or, under certain circumstances, their groups, which may include (without limitation): the total or partial sale of the institution’s business to a third party or a bridge institution, the separation of assets, the replacement or substitution of the institution as obligor in respect of debt instruments, modifications to the terms of debt instruments (including altering the maturity and/or the amount of interest payable and/or imposing a temporary suspension on payments), discontinuing the listing and admission to trading of financial instruments, the dismissal of managers or the appointment of a temporary administrator (administrateur spécial) and the issuance of new equity or own funds.

The exercise of the powers described above by resolution authorities could result in the partial or total write-down or conversion to equity of the capital instruments and the debt instruments issued by BPCE, or may substantially affect the amount of resources available to BPCE to make payments on such instruments, potentially causing BPCE investors to incur losses.

Tax legislation and its application in France and in countries where Groupe BPCE operates are likely to have an adverse impact on Groupe BPCE’s profits.

As a multinational banking group that carries out large and complex international transactions, Groupe BPCE (particularly Natixis) is subject to tax legislation in a large number of countries throughout the world, and structures its activity in compliance with applicable tax rules. Changes in tax schemes by the competent authorities in these countries could materially impact Groupe BPCE’s profits. Groupe BPCE manages its activities with a view to creating value from the synergies and sales capabilities of its various constituent entities. It also works to structure financial products sold to its customers from a tax efficiency standpoint. The structure of intra-group transactions and financial products sold by entities of Groupe BPCE are based on its own interpretations of applicable tax regulations and laws, generally based on opinions given by independent tax experts, and, as needed, on decisions or specific interpretations by the competent tax authorities. It is possible that in the future tax authorities may challenge some of these interpretations, as a result of which the tax positions of Groupe BPCE entities may be disputed by the tax authorities, potentially resulting in tax re-assessments, which may in turn have an adverse impact on Groupe BPCE’s results.

The Group Risk and Compliance Committee, chaired by the Chairman of the Management Board, met five times in 2022 to review the adequacy of Groupe BPCE’s risk management systems, and validated the annual review of the Group’s risk policies. These systems cover all risks, as described in the Ministerial Order of November 3, 2014 on internal control as amended by the Order of February 25, 2021.

The coverage of risks was found to be adequate, consistent with the risk appetite framework validated by the BPCE Management Board and Supervisory Board, and related closely to the Group’s strategy and budget oversight.

All risks are covered by central and local risk management systems, in line with the Group’s risk appetite and strategy.

Groupe BPCE’s Supervisory Board unanimously approved the Group’s risk appetite framework: quantitative indicators, resilience threshold for each indicator and associated governance. During its annual review, the Supervisory Board examined the Group’s risk appetite in December 2022 and its deliberation was unanimously approved.

Risk appetite guidelines

As a decentralized and united cooperative group, Groupe BPCE structures its activity around share capital, held predominantly by the regional institutions, and centralized market funding, optimizing the resources allocated to the entities.

Groupe BPCE:

Groupe BPCE’s risk appetite is defined as the level of risk it is willing to accept with the goal of increasing its profitability while maintaining solvency. This risk appetite must be aligned with the institution’s operating environment, strategy and business model, while making customer interests the top priority. In determining its risk appetite, Groupe BPCE aims to steer clear of any major pockets of concentration and to optimize capital allocation.

In terms of risk profile, Groupe BPCE incurs risks intrinsically associated with its retail banking and Corporate & Investment Banking activities. Changes to its business model are increasing the Group’s exposure to some types of risks, particularly risks related to asset management and international businesses.

The Group does not conduct business unless it has the associated risks sufficiently under control, nor does it exercise proprietary trading activities. Activities with high risk-reward profiles are strictly controlled.

In all activities, entities and regions of operation, the Group undertakes to meet the highest standards of ethics, conduct, best execution and transaction security.

Risk appetite framework and groupwide implementation

The risk appetite framework is based on a master document providing a qualitative and quantitative description of the risks that Groupe BPCE is willing to assume, and describing the governance and operating guidelines in effect.

The implementation of the risk appetite framework is centered on four key components: (i) the definition of groupwide standards, (ii) the existence of a set of limits in line with those defined by regulations, (iii) the distribution of expertise and responsibilities between the entities and the central institution and (iv) the operation of the governance process within the Group and the different entities, enabling the efficient and resilient application of the risk appetite framework.

The Group’s risk appetite framework is regularly updated (at least annually) and is centered on a series of successive limits associated with separate respective authorization levels, i.e.:

A quarterly dashboard is prepared by the Group’s Risk division, for the purpose of regularly and extensively monitoring all risk indicators and reporting to the supervisory body or/and any committee thereof.

The risk appetite framework is adapted by the entities for consistent groupwide implementation.

The Risk division issues an annual compliance notice to the institutions in their annual draft proposal, ensuring a high level of consistency between the risk appetites implemented locally and that of the Group.

Robust financial strength

Groupe BPCE enjoys high liquidity and solvency levels:

The Group ensures the robustness of this system by implementing global or dedicated stress tests such as those for climate risk management, which are carried out regularly. They are intended to verify the Group’s resilience, particularly in the event of a serious crisis.

Summary of the Group’s risk profile in 2022

The following risks are incurred by the Group because of its business model:

Emerging risks

Groupe BPCE places great importance on anticipating and managing emerging risks in today’s constantly changing environment. To this end, a prospective analysis identifying the risks that could impact the Group is carried out every six months and presented to the Risk and Compliance Committee, followed by the Board’s Risk Committee.

The macroeconomic context has deteriorated sharply since the beginning of 2022 and has led to a more pessimistic view than what was projected in terms of the result generated by the Group’s activities and the level of risk. In addition, the Covid crisis and the consequences of the crisis in Ukraine have profoundly changed the environment in which the Group’s activities are carried out. They have greatly increased the intensity of the shocks caused by the various types of risk affecting our business lines.

The forthcoming slowdown in economic growth, combined with high and potentially long-term inflation, poses an increased risk of a deterioration in credit portfolios, in particular for certain customer segments with vulnerabilities (business sectors sensitive to the secondary effects of the war in Ukraine and/or inflation, customers with an already high level of debt, etc.).

The vigilance regarding interest rate and investment risks is also increased given the highly unfavorable impact that the rise in interest rates and inflation could have on the Group’s profitability in the short and medium term.

The international geopolitical environment is an ongoing source of concern, with various geopolitical tensions continuing to weigh on general economic conditions and fueling uncertainties.

As the economy and financial services have grown increasingly digitized, banks have had to remain constantly vigilant against cyber threats. The sophistication of cyber attacks and potential vulnerability of their IS systems are both major risks for Groupe BPCE, in conjunction with the expectations of the regulatory authority.

The Group is very attentive to changes in the regulatory environment and to the supervisor’s requests, in particular on new provisioning standards, the management and monitoring of leveraged loans, guidelines on non-performing loans, etc.

Climate change is an integral part of the risk management policy, with operational variations being rolled out.

Lastly, operational risks are receiving close attention, notably with the application of crisis management systems when necessary.

Governance of risk management

Risk management is governed by two main bodies at Group level: the Supervisory Board, which is supported by the Board’s Risk Committee, and the Executive Management Committee, of which the Head of Risk Management is a member.

Chaired by the Chairman of the Management Board, the Group Risk and Compliance Committee, an umbrella committee, sets the broad outlines of the risk policy and examines issues related to non-financial risks (specifically those related to banking, insurance and investment service compliance, and to financial security), annually reviews the risk appetite framework, and approves a prospective risk analysis twice a year.

Organization of risk management

Groupe BPCE’s Risk division and General Secretariat – in charge of compliance and permanent control – measure, monitor and manage risks, pursuant to the Ministerial Order of November 3, 2014 as amended by the Order of February 25, 2021, on internal control.

They ensure that the risk management system is effective, complete and consistent, and that risk-taking is consistent with the guidelines for the business (particularly the targets and resources of the Group and its institutions).

These duties are formalized in Groupe BPCE’s Internal Control Charter, an umbrella charter. It is based on the two charters of the control functions, namely the Internal Audit Charter and the Group Risk, Compliance and Permanent Control Charter.

The various departments of the Group Risk division are involved in all risks (credit, financial, operational, climate and non-banking investments) by acting on:

The departments of the Group’s Risk division:

SPECIAL COMMITTEES

Several committees are responsible for defining Groupwide methodology standards for measuring, managing, reporting and consolidating all risks throughout the Group.

Risk governance at Group institutions

The Group’s Risk division and General Secretariat oversee the Group’s risk management, compliance and permanent control functions, focusing on the management of credit, financial, operational, climate and non-compliance risks, extended to business continuity, financial control and information system security functions. They ensure that the risk policies of the affiliates and subsidiaries comply with those of Groupe BPCE.

The Risk and/or Compliance divisions of subsidiaries not subject to the banking supervision regulatory framework are functionally subordinate to Groupe BPCE’s Risk division and General Secretariat.

The strong functional authority is exercised by the Head of Risk Management and by the Secretary General, both members of Groupe BPCE’s Executive Management Committee. It enables risk controls to be performed objectively, as each Group entity’s operational functions are independent from its risk and compliance functions. It also promotes a risk management and compliance culture and the application of shared risk management standards, and ensures that managers are given independent, objective and detailed information on the Group’s risk exposures and any possible deterioration in its risk profile.

Group institutions are responsible for defining, monitoring and managing their risk levels, as well as producing reports and data for submission to the central institution’s Risk division and General Secretariat. They ensure the quality, reliability and completeness of the data used to control and monitor risks at the company level and on a consolidated basis, in line with Group risk standards and policies.

In the course of their work, the Group’s institutions rely on the Group Risk, Compliance and Permanent Control Charter. The charter specifies that each institution’s supervisory body and executive management promote the risk management culture at all levels of their organization.

A twofold assessment of a) risk management functions and b) compliance functions is conducted annually by the Risk Committee of the Groupe BPCE Supervisory Board and sent to the management of the Group’s main establishments.

STANDARD RISK GOVERNANCE STRUCTURE AT A GROUP INSTITUTION

Risk Governance

ORGANIZATION

The Risk Governance and Control department is responsible for coordinating and leading the risk and compliance functions, in conjunction with the Corporate Secretary’s office, and for the second level permanent control of the Risk function within Groupe BPCE. The Risk, Compliance and Permanent Control Charter calls for the Group Risk division and General Secretariat to participate, at their own initiative, in the annual performance assessment of the Heads of the Permanent Control functions, particularly risk and/or compliance, in consultation with the Chairman of the Management Board or the Chief Executive Officer.

The Risk Governance and Control department deploys the entire system on a daily basis and contributes to the overall supervision of Group risks, primarily through:

For coordination purposes, the Risk Governance and Control department relies on a half-yearly report drawn up by the institutions, aimed at ensuring that the various components of the local systems are properly implemented and operate under satisfactory conditions, particularly with respect to banking regulations and Group charters. The findings of this report improve operational efficiency and optimize best practices throughout the Group.

Activities specifically focused on the Lagarde report are being monitored in conjunction with the Group’s institutions. There is also a system in place to monitor anomalies observed at Group institutions, aimed at ensuring that business is conducted properly and the rules of ethics are applied.

Lastly, a global transformation program for the Risk function and the Risk division was initiated in 2022 (called Triple A) in order to optimize and strengthen work in these areas. This program covers all risk areas, including IT and HR.

Risk and compliance culture

To promote and strengthen the risk and compliance culture at all levels, the Risk and Compliance department of the Risk Governance department is focused on developing risk and compliance training and awareness programs at all Group levels, establishing regular communication on risk and compliance issues throughout the Group, and disseminating and measuring the risk and compliance culture.

Macro-level risk mapping of institutions

The macro-level risk map plays a central role in an institution’s overall risk management system: by identifying and rating its risks, in particular through the evaluation of its risk management system, each institution in the Group has its own risk profile and priority risks. This risk-based approach serves to update the risk appetite and the permanent/periodic control plans of Group institutions on a yearly basis.

Action plans targeting high-priority risks are defined with the goal of reducing and/or managing risks.

The results of the macro-level risk mapping process contribute to the Group’s Supervisory Review and Evaluation Process (SREP), by identifying the main risks under the risk management and prudential approach, included in the annual report on internal control, the ICAAP report and the universal registration document (risk factors section).

In 2022, as in previous years, a consolidation of the macro-level risk mapping was carried out for each network. Each institution is able to compare the results of its own macro-level risk mapping with those of its network. Action plans set up by the institutions to address their priority risks were also consolidated.

The macro-risk mapping is integrated into the Priscop permanent control management tool, which makes it possible to automate the risk-control links in the risk management system.

Macro-level risk mapping was performed at Group level in 2022 by consolidating the macro-level risk maps of the parent company institutions and subsidiaries.

Lastly, the Risk Governance and Control department is responsible for validating the Group’s models outside Natixis and the General Secretariat (human resources and Budget) of the Group Risk division.

Consolidated risk oversight

ORGANIZATION

In addition to the risk supervision conducted both individually and by type of risk, Groupe BPCE’s Risk division also performs consolidated monitoring of the Group’s risks. A Group risk dashboard is produced quarterly. It contains a quarterly Group risk dashboard, which is used to monitor the risk appetite defined by the Group as well as for comprehensive monitoring of risks based on an analysis of the Group’s risk profile in each area (mapping of risk-weighted assets, credit risks and counterparty risks – by customer segment –, market risks, structural ALM risks, non-financial risks and risks related to insurance businesses). In addition to the dashboard, a monthly flash report provides the Group with a more responsive and updated overview of Group risks.

The Group Risk division also conducts or coordinates cross-business risk analyses and specific stress tests on the Group’s main portfolios or activities and, if needed, for the entities. It has also developed half-year forward-looking risk analyzes aimed at identifying economic risk factors (known and emerging; international, national and regional), circumstantial threats (regulations, etc.) and their potential impact on the Group. These forward-looking analyses are presented at meetings of the Group Supervisory Board’s Risk Committee.

In addition, it carries out risk measurements on a portfolio basis. It reviews and validates risk models developed internally. Lastly, it contributes to efforts to define internal capital requirements as well as internal and external solvency stress tests aimed at measuring the Group’s sensitivity to a series of risk factors and its resilience in the event of a severe shock, by determining impacts in terms of cost of risk and RWA.

Stress testing system

Groupe BPCE has been developing stress tests since 2011 that can be performed using the risk modules for Group strategic analysis purposes and regulatory purposes.

The Group control system relies on three levels of controls, in accordance with banking regulations and sound management practices (two levels of permanent controls and one level of periodic control), as well as the establishment of consolidated control processes in accordance with provisions approved by BPCE’s Management Board.

STRUCTURE OF GROUPE BPCE’S INTERNAL CONTROL SYSTEM

Permanent control system

The organization of permanent control in the Group is specified in the Internal Control Charter (updated on July 23, 2020) in paragraph 3 and in the DRCCP Charter (updated on December 9, 2021) in paragraphs 2 and 5 in accordance with the Ministerial Order of November 3, 2014 (revised on February 25, 2021), in particular in Article 12.

In terms of governance, the assessment of the permanent control system is the responsibility of the Group Internal Control Coordination Committee (or 3CI or CCFC in its local implementation).

The permanent control system is based on the taxonomy of controls, which includes definitions of control methods.

The system comprises two types of level 1 controls (first line of defense LOD1) carried out by employees carrying out operational activities. These employees identify the risks associated with their activity and comply with the procedures and limits set:

The system also includes two types of level 2 controls (second line of defense LOD2) performed by agents at the central and local levels:

COORDINATION OF PERMANENT CONTROLS IN INSTITUTIONS

In accordance with the Group’s Risk, Compliance and Permanent Control Charter, it is recommended that a permanent control coordination function be set up in each institution or Group head office covering the entire Risk/Compliance/Security area. In the absence of a dedicated department, these missions are the responsibility of the Head of Risk, Compliance and Permanent Control or the Chief Risk Officer and the Head of Compliance, it being understood that the designated Executive Officer remains responsible for the consistency and effectiveness of the control, within the meaning of the Ministerial Order of November 3, 2014 as amended by the Order of February 25, 2021.

COORDINATION OF PERMANENT CENTRAL CONTROLS

In the General Secretariat, the main role of the Group Coordination of Permanent Controls department is to coordinate the Group’s level 1 and 2 permanent control system. In this context, it:

PERMANENT CONTROL CULTURE

The control culture has been strengthened by the implementation of a certification in permanent control of the banking and insurance business lines validated by the external body France Competence. This certification is intended for the level 1 and level 2 permanent control functions but also for the LOD2 functions.

HIGHLIGHTS

- the documentation standard of the Group’s permanent controls, which covers the formalization of their expected results, the control methods and the information necessary for the controller in charge of carrying out the controls;

- the standard on the principles for reporting the results of controls in 3CI/CCFC.

Structure of integrated control functions

The Group Risk division and the Group General Secretariat are responsible for permanent controls at Group level, and the General internal audit for periodic control.

The permanent and periodic control functions of affiliates and subsidiaries, subject to banking supervision, are functionally subordinate, as Consolidated Control departments, to BPCE’s corresponding Central Control divisions and report to their entity’s executive body.

These ties have been formally defined in charters for each function, covering:

The entire system was approved by the Management Board on December 7, 2009, and presented to the Audit Committee on December 16, 2009 and to the BPCE Supervision Board. The Risk, Compliance and Permanent Control Charter was reviewed in December 2021 and the body of standards consists of three Group charters covering all activities:

The Group’s Internal Control Charter is the umbrella charter. It is based on two specific charters:

Internal Control Coordination Committee

The Chairman of the BPCE Management Board is responsible for ensuring the consistency and effectiveness of the internal control system. A Group Internal Control Coordination Committee, chaired by the Chairman of the Management Board, meets periodically.

This committee is responsible for dealing with all issues relating to the consistency and effectiveness of the Group internal control system, as well as the results of risk management and internal control work and follow-up work.

The committee’s main responsibilities include:

The members of the Executive Management Committee in charge of Risk Management (Group Risk division) and of Compliance and Permanent Controls (General Secretariat), and the Head of the General internal audit , are members of this committee. Where applicable, the Internal Control Coordination Committee may hear reports from operational managers about measures they have taken to apply recommendations made by internal and external control bodies.

Periodic control (level 3)

ORGANIZATION AND ROLE OF THE GENERAL INTERNAL AUDIT

DUTIES

In accordance with the duties incumbent on the central institution, and pursuant to the rules of collective solidarity, the General internal audit is responsible for periodically verifying the operation of all Group institutions and providing their executive managers with reasonable assurance of their financial strength.

In that role, it ensures the quality, effectiveness, consistency and efficiency of their control system as well as their risk management. The division’s scope of authority covers all risks, all institutions and all activities, including those that are outsourced.

Its top priorities are to assess and to report to the executive and decision-making bodies of the entities and the Group as a whole on:

Reporting to the Chairman of the Management Board, the General internal audit performs its duties independently of the Operational and Permanent Control divisions.

REPRESENTATION ON GROUP GOVERNANCE BODIES AND RISK COMMITTEES

In the interest of exercising its duties and contributing effectively to the promotion of an auditing culture, the Head of the General internal audit takes part, without voting rights, in the central institution’s key Risk Management Committees.

As indicated above, the Head of the General internal audit is a member of the Group Internal Control Coordination Committee and has a standing invitation to participate in the Supervisory Board’s Risk Committee and the Audit Committee of BPCE, the Risk Committee and Audit Committee of Natixis, and the Risk Committee and Audit Committee of the Group’s main subsidiaries (FSE division, Banque Palatine, Oney, Crédit Foncier, BPCE International).

SCOPE OF AUTHORITY

To fulfill its duties, the General internal audit establishes and maintains an inventory of the Group’s auditing scope, which is defined in coordination with the Internal Audit departments of the Group institutions.

It makes sure that all institutions, activities and corresponding risks are covered by comprehensive audits, performed at frequencies defined according to the overall risk level of each institution or activity, which must not exceed five years for banking activities.

In so doing, the General internal audit takes into account not only its own audits, but also those conducted by the supervisory authorities and the Local internal audit.

The annual audit plan is defined with the Chairman of the BPCE Management Board, and presented to the Group Internal Control Coordination Committee and the Supervisory Board’s Risk Committee. It is also transmitted to the national and European supervisors.

REPORTING

General internal audit audits contain recommendations prioritized by order of importance, which are regularly monitored (at least once every six months).

The division reports the findings of its work to the executive managers of the audited companies and to their supervisory body. It also reports to the Chairman of the Management Board, the Supervisory Board’s Risk Committee and the Supervisory Board of BPCE. It provides them with a report on the implementation of its major recommendations, as well as those of the Autorité de contrôle prudentiel et de résolution (ACPR), the French prudential supervisory authority for the banking and insurance sector, and the Single Supervisory Mechanism (SSM). It sees to the expedient execution of any corrective measures to the internal control system, in accordance with Article 26 of the amended Ministerial Order of November 3, 2014 on internal control, and may call on the Supervisory Board’s Risk Committee to address any measures that have not been executed.

RELATIONS WITH THE PERMANENT CONTROL DIVISIONS OF THE CENTRAL INSTITUTION

In the central institution, the Head of the General internal audit maintains regular relations and shares information with the heads of the units in the scope of inspection, and more specifically with the divisions in charge of level 2 controls.

The heads of these divisions are responsible for notifying the Head of the General internal audit in a timely manner of any disruption or major incident that comes to their attention. The Head of the General internal audit and the Heads of Group Risk Management and Group Compliance and Security notify each other in a timely manner of any inspection or disciplinary procedure initiated by the supervisory authorities and in general of any external audits brought to their attention.

INSPECTION ACTIVITIES IN 2022

The completion of the 2022 audit plan was marked by the resumption of on-site missions and the continuation of the catch-up of international missions.

The General internal audit carried out 93% of its audit plan (compared to 82% in 2021), i.e. 71 of the 75 missions planned, including 6 additional ones added during the year.

The new organization of the function linked to the Pléiade project was put in place for the second wave of missions with the creation of the Natixis CIB Internal Audit department and the functional reporting of CIB, NIM, BPCE Assurances and Natixis Algérie audits to BPCE’s Inspection Générale.

The whistleblowing system, revised in 2021 to support institutions/business lines in the convergence towards “0 late recommendations for all issuers combined”, has been rolled out to institutions and has been stepped up by the General internal audit. It monitors the recommendations of the Supervisors on a quarterly basis and monitors the recommendations issued by itself every six months. It followed up on all the recommendations issued by the third line of defense on the Group (Internal Audits, Group Inspection Générale, former Natixis Inspection Générale and Supervisors) as of December 31, 2022.

AUDIT FUNCTION

STRUCTURE OF THE AUDIT FUNCTION

The General internal audit carries out its duties within the framework of business line operations. Its operating procedures - for the purposes of consolidated supervision and optimal use of resources - are set out in a charter approved by BPCE’s Management Board on December 7, 2009; the latter was redesigned and approved on December 12, 2022.

The aim of this structure is to cover all of the Group’s operational or functional units over a reasonable number of fiscal years, according to the associated risk, and to achieve efficiency between the various complementary audits conducted by the Internal Audits teams of Group entities.

The Local internal audit of the direct affiliates and subsidiaries are functionally subordinate to the General internal audit and report to the executive branch of their entity.

These ties are strictly replicated at the level of each company in the Group, which is itself a parent company.

This strong functional subordination is also based on operating rules and the Group Internal Audit Standards applicable by the entire function. It is reflected as follows:

The following items are transmitted to the General internal audit:

The rules governing oversight of the inspection function between Natixis and the central institution fall within the framework of the Group audit function.

WORK OF THE SUPPORT FUNCTIONS IN 2022

As a corollary of the Pléiade project to restructure Groupe BPCE’s business lines, the widening of the scope of intervention of the Standards & Methods division continued in 2022 with a gradual ramp-up in areas other than Retail, in particular the activities of the new GFS division (Global Financial Services, formerly Natixis), continued monitoring of the recommendations in conjunction with supervisors, and participation in the work to revise the Internal Audit Charter mentioned above as well as the Missions standard (validated by BPCE’s Executive Management Committee on October 25, 2022). The Missions standard now includes the assessment of the quality of data processing in the risk approach (through a data quality assessment and on the basis of the BCBS 239 principles). It also reaffirms the principle of maintaining the audit trail and the traceability of data processing.

In April 2022, the organization of the Data division was reviewed with a new manager and the arrival of new profiles such as a Data Engineer. The division’s ambition is to strengthen its positioning within the Inspection department, to set up a robust data infrastructure using new tools, to facilitate the use of data for the benefit of the audit by accentuating its automation, and increase productivity. New data techniques have emerged in 2022 to increase the share of audit based on data analysis such as the exploration of the NLP (Natural Language Processing) for mass analysis of committee minutes.

The project owner’s activity remained focused on the implementation of the new OMEGA audit mission management tool, replacing SAIG-RECO. The data migration was carried out correctly in October and the various modules (including the multi-year audit plans and the risk assessment of the Internal Audit departments of the institutions as well as the follow-up of recommendations) were put into production in accordance with the set workload plan.

BPCE’s Supervisory Board approved the Group’s Recovery Plan for 2022.

The plan is in line with European regulatory measures on the recovery and resolution of banks and investment firms, and with the provisions of the French Monetary and Financial Code.

The objective of the Recovery Plan is to identify measures to restore the Group’s financial solidity in the event it deteriorates significantly.

The plan presents the options available to the Group to launch a crisis management system. It assesses the relevance of the different options in various crisis scenarios and the methods and resources available for their implementation.

The Recovery Plan is mainly based on the:

This system is monitored and coordinated by a permanent office at BPCE.

The Recovery Plan is kept up to date and approved by the Supervisory Board, aided by its Risk Committee for these purposes.

The Recovery Plan is updated annually on these various components (description of the Group, analysis of scenarios, analysis of the options available).

Credit institutions’ capital is regularly monitored in accordance with regulations defined by the Basel Committee.

These regulations were reinforced following the introduction of Basel III, with an increase in the level of regulatory capital requirements and the introduction of new risk categories.

The Basel III recommendations were incorporated in EU directive 2013/36/EU (Capital Requirements Directive – CRD IV) and Regulation No. 575/2013 (Capital Requirements Regulation – CRR) of the European Parliament and of the Council amended by Regulation (EU) No. 2019/876 (the “CRR2”). As of January 1, 2014, all EU credit institutions are subject to compliance with the prudential requirements set out in these texts.

Credit institutions subject to CRD and CRR are thus required to continuously observe:

These buffers include:

The capital ratios are equal in terms of the relationship between capital and the sum of:

Through December 31, 2019, these ratios were subject to a phase-in calculation aimed at gradually transitioning from Basel 2.5 to Basel III.

In 2022, Groupe BPCE is required to observe a minimum Common Equity Tier 1 ratio of 4.5% under Pillar I, a minimum Tier 1 capital ratio of 6% and, lastly, a minimum total capital ratio of 8%.

Alongside Pillar I minimum capital requirements, Groupe BPCE is subject to additional Tier 1 capital requirements:

Credit institutions must comply with the prudential requirements, which are based on three pillars that form an indivisible whole:

Pillar I

Pillar I sets minimum requirements for capital. It aims to ensure that banking institutions hold sufficient capital to provide a minimum level of coverage for their credit risk, market risk and operational risk. The bank can use standardized or advanced methods to calculate its capital requirement.

REVIEW OF MINIMUM CAPITAL REQUIREMENTS UNDER PILLAR I

Pillar II

Pillar II establishes a process of prudential supervision that complements and strengthens Pillar I.

It consists of:

For 2022, the total capital ratio in force for Groupe BPCE under Pillar II (P2R) is 10.00%, plus a 2.50% capital conservation buffer and a 1% global systemic buffer.

Pillar III

The purpose of Pillar III is to establish market discipline through a series of reporting requirements. These requirements – both qualitative and quantitative – are intended to improve financial transparency in the assessment of exposure to risks, risk assessment procedures and capital adequacy.

Regulatory scope

Groupe BPCE is required to submit consolidated regulatory reports to the European Central Bank (ECB), the supervisory authority for Euro zone banks. Pillar III is therefore prepared on a consolidated basis.

The regulatory scope of consolidation is established based on the statutory scope of consolidation. The main difference between these two scopes lies in the consolidation method for insurance companies, which are accounted for by the equity method within the regulatory scope, regardless of the statutory consolidation method.

The following insurance companies are accounted for by the equity method within the prudential scope of consolidation:

The following insurance companies are accounted for by the equity method within both the statutory and regulatory scopes of consolidation:

In addition, since the second quarter of 2020, the Versailles entity is consolidated using the equity method. This change, which concerns only the regulatory scope, since the entity is still considered to be under control within the meaning of IFRS, follows a detailed analysis of the regulatory texts. The latter stipulate that non-financial entities that do not constitute ancillary services within the meaning of the standard are accounted for using the equity method for the purposes of reporting ratios. This decision, approved by the Group’s bodies, allows for an alignment of the scopes used to calculate liquidity and solvency.

EU CC2 ‒ TRANSITION FROM ACCOUNTING BALANCE SHEET TO PRUDENTIAL BALANCE SHEET

The table below shows the transition from an accounting balance sheet to a prudential balance sheet for Groupe BPCE at December 31, 2022.

The differences between the statutory and regulatory scopes of consolidation can be attributed to restatements for subsidiaries excluded from the regulatory scope of consolidation (see description of regulatory scope of consolidation below) and the reincorporation of intra-group transactions associated with these subsidiaries.

Regulatory capital

Regulatory capital is determined in accordance with Regulation No. 575/2013 of the European Parliament of June 26, 2013 on capital (“CRR”) amended by Regulation (EU) No. 2019/876 (“CRR2”).

It is divided into three categories: Common Equity Tier 1, Additional Tier 1 capital and Tier 2 capital. Deductions are made from these categories.

These categories are broken down according to decreasing degrees of solidity and stability, duration and degree of subordination.

BPCE 01 – REGULATORY CAPITAL

A detailed breakdown of regulatory capital by category, as required by Implementing Regulation No. 1423/2013, is published at the following address: https://groupebpce.com/en/investors/results-and-publications/pillar-iii.

Details of debt instruments recognized as additional Tier 1 and Tier 2 capital, other instruments eligible for TLAC, as well as their characteristics, as required by Implementing Regulation No. 1423/2013 are published at https://groupebpce.com/en/investors/results-and-publications/pillar-iii.

Common Equity Tier 1 (CET1)

CORE CAPITAL AND DEDUCTIONS

Common Equity Tier 1 consists of:

The following deductions are made:

These deductions are supplemented by capital items that are not covered by CRR2.

BPCE 02 – CHANGES IN CET1 CAPITAL

BPCE03 ‒ BREAKDOWN OF NON-CONTROLLING INTERESTS (MINORITY INTERESTS)

Additional Tier 1 (AT1) capital

Additional Tier 1 capital includes:

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holdings.

BPCE04 ‒ CHANGE IN AT1 CAPITAL

Tier 2 capital

Tier 2 capital consists of:

Deductions comprise equity interests in eligible banking, financial and insurance institutions, according to the rules on allowances for these holdings.

BPCE 05 – CHANGES IN TIER 2 CAPITAL

In accordance with Regulation No. 575/2013 (CRR) of the European Parliament as amended by Regulation (EU) No. 2019/876 (the “CRR2”), credit risk exposures can be measured using two approaches:

The methodology applied for IRB approaches is described in greater detail in Section 5 “Credit risk.”

In addition to the requirements related to counterparty risk in market transactions, the regulation of June 26, 2013 provides for the calculation of an additional charge to hedge against the risk of loss associated with counterparty credit risk (CCR). Capital requirements for the Credit Valuation Adjustment (CVA) are determined using the Standardized Approach.

EU OV1 – OVERVIEW OF RISK-WEIGHTED ASSETS

The table below complies with the CRR format, presenting capital requirements for credit and counterparty risks, before the CVA and after the application of risk mitigation techniques.

BPCE06 ‒ RISK-WEIGHTED ASSETS BY TYPE OF RISK AND BUSINESS LINE

EU INS1 ‒ NON-DEDUCTED PARTICIPATIONS IN INSURANCE UNDERTAKINGS

The methods used by Groupe BPCE to calculate risk-weighted assets are described in Section 4.4 “Regulatory capital requirements and risk-weighted assets.”

Regulatory capital and capital ratios

BPCE07 ‒ REGULATORY CAPITAL AND BASEL III PHASED-IN CAPITAL RATIOS

CHANGES IN GROUPE BPCE’S CAPITAL ADEQUACY IN 2022

The Common Equity Tier 1 ratio was 15.1% at December 31, 2022 versus 15.8% at December 31, 2021.

Several exceptional items impacted the Common Equity Tier 1 ratio in 2022:

The change in the Common Equity Tier 1 ratio in 2022 can also be attributed to:

At 15.1%, Groupe BPCE’s Common Equity Tier 1 ratio on December 31, 2022 was also significantly higher than the minimum requirement defined by the European Central Bank (ECB) during the 2022 Supervisory Review and Evaluation Process (SREP). The total capital ratio stood at 17.9% on December 31, 2022, i.e. above the ECB’s minimum requirement, compared to 18.7% on December 31, 2021.

GROUPE BPCE CAPITAL ADEQUACY MANAGEMENT POLICY

Capital and total loss absorbing capacity (TLAC) targets are determined according to Groupe BPCE’s target ratings, in line with prudential constraints.

Capital adequacy management is therefore subject to a high management buffer which not only greatly exceeds prudential constraints on capital adequacy ratios, but is also well below the trigger for the Maximum Distributable Amount.

Capital and TLAC management is thus less sensitive to prudential changes (e.g. not dependent on G-SIB classification). As a result, the Group very predominantly builds its total loss absorbing capacity from CET1 and additionally from subordinated MREL-eligible and TLAC-eligible debt (mainly Tier 2 capital and senior non-preferred debt). The issues of these eligible debts are carried out by BPCE.

Finally, in addition to TLAC, Groupe BPCE carries bail-inable debt, the majority of which is accepted for the calculation of MREL: accordingly, senior preferred debt issued by BPCE is eligible for MREL, with Groupe BPCE leaving the possibility of meeting MREL requirements open, beyond its total loss absorbing capacity, with any bail-inable debt instrument.

The Single Resolution Board set the Group’s MREL requirement in February 2022 (equivalent to 25.05% of the risk-weighted assets), which has now been met with room to spare. As a result, the Group does not need to modify or increase its issuance program.

With regard to the subordination constraint, Groupe BPCE complies with Articles 92a 1(a) and 494 of CRR Regulation No. 575/2013 providing for a requirement of 21.5% of RWA since 2022. The subordination requirement in the leverage base is set at 6.75% since 2022 pursuant to Article 92a 1(b) of the CRR.

CAPITAL ALLOCATION EQUITY AND SOLVENCY MANAGEMENT

The Group implemented action plans over the course of 2022 aimed specifically at ensuring the capital adequacy of its networks and its subsidiaries. BPCE thus subscribed to a Tier 2 issue by Banque Palatine for €25 million and CEGC for €150 million.

LEVERAGE RATIO

The entry into force of the Capital Requirements Regulation, known as CRR2, makes the leverage ratio a binding requirement as from June 28, 2021. The minimum requirement for this ratio to be met at all times is 3%.

This regulation authorizes certain exemptions in the calculation of exposures concerning regulated savings transferred to Caisse des Dépôts et Consignations for the totality of the centralized outstandings and Central Bank exposures for a limited period (pursuant to ECB decision 2021/27 of June 18, 2021).

This last exemption, in force until March 31, 2022, made it possible to avoid the impact of the increase in central bank assets that began at the time of the Covid-19 crisis. The reference date for the calculation of this adjusted requirement was set at December 31, 2019. At December 31, 2021, the Group’s adjusted requirement amounted to: 3.23%.

The leverage ratio is not sensitive to risk factors and as such, it is considered as a measure that complements the solvency and liquidity management system, which already limits the size of the balance sheet. The leverage ratio is projected and managed at the same time as Groupe BPCE’s solvency trajectory. The risk of excessive leverage is also measured in the internal stress test via the projection of the regulatory leverage ratio.

Groupe BPCE’s leverage ratio, calculated according to the capital requirements regulation, known as CRR2, was 5.02% at December 31, 2022, based on phased-in Tier 1 capital.

EU LR1 ‒ LRSUM ‒ TRANSITION FROM BALANCE SHEET TO LEVERAGE EXPOSURE

FINANCIAL CONGLOMERATE RATIO

As an institution exercising banking and Insurance activities, Groupe BPCE is also required to comply with a financial conglomerate ratio. This ratio is determined by comparing the financial conglomerate’s total capital against all the regulatory capital requirements for its banking and insurance activities.

The financial conglomerate ratio demonstrates that the institution’s prudential capital sufficiently covers the total regulatory capital requirements for its banking activities (in accordance with CRR2) and insurance sector activities, in accordance with the Solvency 2 regulation.

The calculation of surplus capital is based on the statutory scope. Insurance company capital requirements, determined for the banking capital adequacy ratio by weighting the equity-method value, are replaced with capital requirements based on the solvency margin. The capital requirements within the banking scope are determined by multiplying the risk-weighted assets by the applicable rate under Pillar II, i.e. 14.77% at December 31, 2022, compared to 14.26% at December 31, 2021.

On December 31, 2022, Groupe BPCE’s surplus capital amounted to €16 billion.

Supervisory Review and Evaluation Process

SREP-ICAAP PROCESS

As the supervisory authority under Pillar II, the ECB conducts an annual assessment of banking institutions. This assessment, referred to as the Supervisory Review and Evaluation Process (SREP), is primarily based on:

Based on the conclusions of the SREP carried out by the ECB in 2022, Groupe BPCE shall maintain a consolidated Common Equity Tier 1 ratio of 9.53% on January 1, 2023, including:

The corresponding total capital requirement will be 13.53% (excluding Pillar II guidance).

The results obtained using these two approaches confirmed the Group’s financial soundness and no capital buffer is necessary in addition to the existing regulatory buffers.

Outlook

The objectives of the new 2021-2024 strategic plan are, with regard to the Common Equity Tier 1 ratio, to exceed 15.5%, and with regard to the subordinated MREL ratio (i.e. TLAC), to exceed 23.5%.

The Group remained on the list of G-SIBs (Global Systemically Important Banks) in November 2022.

MREL – TLAC

In addition to capital adequacy ratios, ratios aimed at verifying the Group’s capacity to carry out a bail-in in the event of default are implemented via the Minimum Requirement for own funds and Eligible Liabilities (MREL) and Total Loss Absorbing Capacity. This second ratio is known as TLAC, according to the terminology of the Financial Stability Board, and in Europe it is defined in the BRRD directive and the CRR regulation as subordinated MREL. Groupe BPCE has established internal monitoring of these indicators.

The senior unsecured debt at more than one year and the Group’s equity make up the numerator of the MREL ratio. The Group’s current MREL requirement was received in February 2022.

The updated total MREL requirement was set at 25.05% of the Group’s risk-weighted assets. The total MREL ratio reached 30.4% at December 31, 2022, compared with 31.1% at December 31, 2021.

For subordinated MREL, the numerator only includes junior liabilities through senior non-preferred debt because BPCE has renounced for the time being the use of a senior preferred debt allowance.

The TLAC ratio serves the same purpose as subordinated MREL and only applies to G-SIBs. CRR2, published at the same time as BRRD2, transcribed TLAC into positive law in the form of a minimum subordinated MREL requirement applicable to G-SIBs. As indicated above, the Group has set its own TLAC target above the regulatory requirement, which is 21.53% of RWAs in 2023, i.e. 18% plus the 3.53% solvency buffers.

TLAC (Total Loss Absorbing Capacity) amounted to €109.5 billion at the end of December 2022. The subordinated MREL ratio was 23.8% on December 31, 2022 compared to 24.8% on December 31, 2021.

The detailed quantitative disclosures relating to capital management and capital requirements in the following tables enhance the information in the previous section under Pillar III.

EU LI3 ‒ EXPLANATION OF DIFFERENCES BETWEEN THE STATUTORY AND PRUDENTIAL SCOPE OF CONSOLIDATION

All companies consolidated by the equity method are associates.