Internal Control Mechanisms

Internal control serves as the overarching system that allows the Bank and its Group to ensure comprehensive risk management while striving to meet strategic objectives. This function is crucial for the bank's organisational and cultural integrity, which is why all staff are made aware of its significance and role in the bank's daily operations.

 It comprises a range of measures designed to continuously ensure:

• The verification of internal operations and procedures, including administrative and accounting processes
• The measurement, management, and monitoring of risks
• The reliability in generating, processing, disseminating, and preserving accounting and financial data
• The effectiveness of internal channels for circulating documentation and information, as well as for external dissemination

The objectives of this system are to:

• Ensure compliance with laws, regulations, and ethical and professional standards
• Compliance with internal policies, following the guidelines approved by the Board of Directors and the instructions of Senior Management
• Maintain the quality and efficiency of the bank's internal operations and processes
• Ensure the reliability of both internal and external reporting
• Foster an efficient control culture among all bank employees
• Safeguard the security of operations

Organisation:

The Entity's internal control system is founded on the coexistence of a permanent control system and a periodic control system. These systems are separate and independent, yet complementary and coordinated. This internal control system is organised around a structure that ensures:

• Complete hierarchical and functional independence of the internal audit function (third line of defence) from the executive bodies (first line) and the permanent control functions (second line)
• Absolute independence of the permanent control functions (second line of defence) from the executive bodies (first line), with direct access to the Chief Executive Officer

Additionally, both functions have direct and unrestricted access to the Joint Audit and Risk Committee.

Permanent Control System:

The Permanent Control System operates on two levels:

First line of defence, which includes: operational teams (front, middle, and back offices), department heads, and the Chief Risk Management Officer (CRMO), who leads the first line of defence and is responsible for day-to-day risk management

Second line of defence, consisting of: Permanent Control, Regulatory Compliance, Finance and Accounting, IT, Legal functions, and the Global Risk Control function (CRO). The CRO leads the second line of defence and serves as an independent risk control function. This role involves analysing, monitoring, and reporting risks and must remain independent from business units, while still working closely and collaboratively with them

Periodic Control System:

The third line of defence consists of the Internal Audit function. It operates independently from the operational functions, with the primary mission of assessing the effectiveness of the bank's internal control system through an objective, rigorous, and impartial approach.

These various levels of control are supported by appropriate governance, embodied by the Internal Control Coordination Committee (I3C). This committee ensures comprehensive and coherent coordination of the actors and the outcomes of controls across different levels of the organisation.