Société Générale / Risk report 2021 - Pillar 3 2020

2 RISK FACTORS RISK FACTORS PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 20 OPERATIONAL (INCLUDING RISK OF INAPPROPRIATE CONDUCT) 2.2.4 ANDMODEL RISKS At 31 December 2020, risk-weighted assets subject to operational risk amounted to EUR 49.2 billion, or 14% of the Group’s total RWA. These risk-weighted assets relate mainly to Global Markets & Investor Services (67% of total operational risk). Between 2016 and 2020, the Group’s operational risks were primarily concentrated in five risk categories, representing 93% of the Group’s total operating losses over the period: fraud and other criminal activities (34%), mainly comprising external frauds, execution errors (23%), disputes with authorities (16%), errors in pricing or risk assessment, including model risk (12%) and commercial disputes (9%). The Group’s other categories of operational risk (unauthorised activities in the markets, failure of information systems and loss of operating resources) remain minor, representing 7% of the Group’s losses on average over the 2016 to 2020 period. See section 10.3 Operational risk measure of the present document for more information on the allocation of operating losses. 2.2.4.1 The Group is exposed to legal risks that could have a material adverse effect on its financial position or results of operations. In the case of alleged non-compliance with applicable laws and regulations, the Group and certain of its former and current representatives may be involved in various types of litigation, including civil, administrative, tax, criminal and arbitration proceedings. The large majority of such proceedings arise from transactions or events that occur in the Group’s ordinary course of business. There has been an increase in client, depositor, creditor and investor litigation and regulatory proceedings against intermediaries such as banks and investment advisors in recent years, in part due to the challenging market environment. This has increased the risk, for the Group, of losses or reputational harm arising from litigation and other proceedings. Such proceedings or regulatory enforcement actions could also lead to civil, administrative, tax or criminal penalties that could adversely affect the Group’s business, financial position and results of operations. In preparing its financial statements, the Group makes estimates regarding the outcome of civil, administrative, tax, criminal and arbitration proceedings in which it is involved, and records a provision when losses with respect to such matters are probable and can be reasonably estimated. It is inherently difficult to predict the outcome of litigation and proceedings involving the Group’s businesses, particularly those cases in which the matters are brought on behalf of various classes of claimants, cases where claims for damages are of unspecified or indeterminate amounts, or cases involving unprecedented legal claims. Should such estimates prove inaccurate or should the provisions set aside by the Group to cover such risks prove inadequate, the Group’s financial position or results of operations could be adversely affected. The provision recorded in the Group’s financial statements for public rights disputes amounted to EUR 334 million at 31 December 2020. For a description of the most significant ongoing proceedings, see Chapter 13 Compliance and reputational risk, Litigations of the present document and Notes 8.3.2 Other provisions and 9 Information on risks and litigation of Chapter 6 of the 2021 Universal Registration Document. 2.2.4.2 Operational failure, termination or capacity constraints affecting institutions the Group does business with, or failure or breach of information technology systems, especially cyber-attacks, could have an adverse effect on the Group’s business and result in losses and damages to its reputation. The Group relies heavily on communication and information systems to conduct its business and this is reinforced by the widespread use of remote banking. Any dysfunction, failure, interruption of service or breach in security of its systems, even if only brief and temporary, could result in significant disruptions to the Group’s business. Such incidents could result in significant costs related to information retrieval and verification, loss of revenue, loss of customers, litigation with counterparties or customers, difficulties in managing market operations and short-term refinancing, and ultimately tarnish to the Group’s reputation. The Group is exposed to the risk of operational failure or capacity constraints in its own systems and in the systems of third parties, including those of financial intermediaries that it uses to facilitate cash settlement or securities transactions (such as clearing agents and houses and stock exchanges), as well as those of clients and other market participants. The interconnectivity of multiple financial institutions with clearing agents and houses and stock exchanges, and the increased concentration of these entities, increases the risk that an operational failure at one institution or entity may cause an industry-wide operational failure that could adversely affect the Group’s ability to conduct business and could therefore result in losses. Industry concentration, whether among market participants or financial intermediaries, can exacerbate these risks, as disparate complex systems need to be integrated, often on an accelerated basis. The Group is also exposed to the risk of fraud, mainly external and relating to credit risks, methods of payment (cheques and credit/debit cards) and cybercrime through fraudulent attempts to break into its information systems. Every year, the Group experiences numerous cyber-attacks to its systems, or via those of its clients, partners or suppliers. The Group could be subject to targeted and sophisticated attacks on its IT network, resulting in embezzlement, loss, theft or disclosure of confidential or customer data (in particular in violation of the European Data Protection Regulation, “GDPR”). Such actions are likely to result in operational losses and have an adverse effect on the Group’s business and results of operations. The Group also continues to follow the IBOR reform, which aims to ensure the continuity of contracts indexed on interbank rates. This reform still presents uncertainties concerning the timing and precise conditions of the transition between current and new indices, as well as changes that could be applicable to transactions indexed to current indices. This could lead to changes in the value of contracts, operational disruptions related to the management of interests, consequences to the accounting of transactions and their tax or prudential treatment, the need to update IT tools, etc. This reform could thus have an impact on the activities and results of the Group. See Information security risks of section 10.1 Organisation of operational risk management, Quantitative data of section 10.3 Measurement of operational risk for a breakdown of operational risk losses, and section 10.4 Risk- w eighted assets and capital requirements of the present document.