Third Part Risk Management

GROUP BNPPARIBAS

BNPParibas Group is the top bank in the European Union and a major internationalbanking establishment. It has close to 196,000 employees in 73 countries. InSpain we are more than 5,100 employees within 13 business lines.

RISK HUB

RISK is anintegrated and independent control function of the BNP Paribas Group. It is thesecond line of defense on the risk management activities of the Group which areunder its direct responsibilities, including credit and counterparty risk,market risk, funding and liquidity risk, interest rate and foreign exchangerisks in the banking book, insurance risk, operational risk, and environmentaland social risks.

RISK aimsat being a partner of the businesses by contributing to their sustainabledevelopment, but also a gatekeeper to ensure risks taken remain compatible withthe Group’s Risk Appetite and its strategy.

RISKIberian Hub Madrid is a transversal platform servicing the RISK Function bycovering added-value activities around credit risk, market risk, operationalrisk and data protection. Offering a wide range of services to RISK teams, fromconsulting to cyber security going through data analysis, modelling orartificial intelligence.

BUSINESS AREA OVERVIEW

Located in the RISK Function of BNP Paribas, RISK ORM Network is made up of all the Operational Risk Officers(OROs) acting as the 2nd line of defense within the Group’s operational entities(Poles, Business Lines, Functions, transversal Activities).

RISK ORM 2S (Operational Risk Management) belongs to RISK ORM CIBand is placed under the responsibility of the Head of RISK ORM CIB 2S and theChief Risk Officer for Securities Services.

The department has responsibility for independently challenging andsupervising the Operational Risk management of Securities Services activitieson a worldwide scope. This is achieved through: framing operational riskmethodology and disseminating of risk management culture; assessing theadequacy of the operational risk management set-up; controlling effectivenessof the control environment; contributing to the detection, anticipation andresponse to risks; alerting CIB and RISK stakeholders on any significant riskissue; providing a consolidated view on Securities Services operational risksprofile.

RISK ORM 2S teams are composed of 2 central teams as well as localteams in the different countries where Securities Services has activities.

RISK ORM 2S TTR & 2S Specific is one of the 2 central teams. Asthe second line of defence (2LoD) for Transversal & Technology risks, whichencompasses Fraud, ICT, TPRM and Operational Resilience risks, the team has theresponsibility to identify the key TTR risks of Securities Services and ensureBusiness and IT partners deploy sound risk management to mitigate those risks.Additionally, the team is in charge of several 2S specific topics. The team iscomposed of 4 people located in Paris and Madrid. The team works in closecollaboration with RISK ORM 2S teams, Securities Services teams and RISK ORMCIB teams, in particular with RISK ORM CIB TTR

PURPOSE OF THE ROLE

RISK ORM2S TTR & 2S Specific team 1st missionis to challenge the Operational Risk Management Framework implemented bySecurities Services to mitigate Fraud risks, ICT risks, TPRM risk andOperational resilience framework.

On TPRM(Third Party Risk Management), the team’s role is to check and challenge theframework implemented by Securities Services to assess and mitigate risksrelated to Third Parties. Within the team the role exists to supervise andindependently oversee those risks and to deploy and coordinate Lod2 activitiesamong the RISK ORM 2S network.

RISK ORM2S TTR & 2S Specific team 2nd missionis to provide visibility on the Operational Risk Framework to 2S Clients, andto provide 2S CRO and 2S Executive Management with consolidated overview andregular updates on 2S operational risks profile.

The rolealso encompasses the delivery of those consolidated overview and regularupdates.

SCOPE OF THE ROLE

The scope covered applies to operational risks to which SecuritiesServices is exposed, and for which RISK acts as a second line of defence

KEY RESPONSIBILITIES OF THE ROLE

The oversight framework will encompass the below pillars:
Framework: to review,analyse and challenge Securities Services TPRM framework consistently withGroup Policy pertaining to Outsourcing Risk Management and the Risk Managementof External Suppliers, and validate any exemption to these norms and standards,in alignment with RISK ORM CIB TTR approach

Governance: toparticipate and represent RISK ORM 2S within TPRM committees at CIB and 2Slevel

Risk Identification andAssessment: to challenge and verify Securities Services riskidentification, ensure the consistency of “severe but plausible” scenarios andtheir quantification, to challenge TPRM risks assessment embedded in projectsand new activities

Risk Treatment and Decision: tooversee of the risk treatment process (risk acceptance, risk transfer, riskremediation) and re