Société Générale / Risk report 2021 - Pillar 3 2020

13 COMPLIANCE RISK, LITIGATION COMPLIANCE PILLAR 3 - 2021 | SOCIETE GENERALE GROUP | 220 Lastly, Societe Generale Group has appointed a Data Protection Officer (DPO). Reporting to the Head of Group Compliance, and the main contact for the Personal Data Protection Authority (the CNIL in France), he or she is responsible for ensuring sound Group compliance in terms of personal data protection. He or she has a network of local DPOs and Correspondents throughout the Group entities, and must support them on security issues and personal data usage. As part of his or her duties, the DPO regularly reviews a number of indicators, notably the number and nature of right exercise requests, the internal training completion rate, and the local DPO certification programme launched at the end of 2018. Other regulatory risks MEDIATION The Group employs several methods to inform customers of mediation, one of the alternative dispute resolution measures, including a permanent notice on the back of customer bank account statements. Every entity involved is obliged to comply with the independent mediator’s decision. RISK AND REMUNERATION POLICY Since the end of 2010, in accordance with the regulatory framework defined by European Directive CRD3, Societe Generale has implemented a specific governance to determine variable remuneration. The rules introduced by this directive apply not only to financial market professionals, but to all persons whose activity is likely to have a substantial impact on the risk profile of the institutions which employ them, including those exercizing control functions. The regulatory framework defined by the European Directive CRD4 has applied since 1 January 2014. It does not modify the rules determining the variable remuneration of persons whose activity is likely to have an impact on the risk profile of the Group and of the employees who exercise control functions. The above-mentioned principles and governance remain in place within the Group. According to the principles approved by the Board of Directors as proposed by the Compensation Committee, the remuneration mechanisms and processes for the identified population not only factor in the financial results of the transactions undertaken, but also how these results are generated: control and management of all risks and adherence to compliance rules. Control function employees are remunerated independently of the results of the transactions that they control, and according to criteria specific to their activity. Variable remuneration includes a non-deferred portion and a deferred portion. The acquisition of the deferred portion of the variable remuneration is subject to three conditions: a minimum length of service, a minimum level of financial performance of the Company and/or the activity, and appropriate management of risks and compliance (malus and clawback provisions). All deferred variables of the regulated population are subject to a non-payment clause to sanction any excessive risk-taking or behaviour deemed unacceptable. A clawback clause enables Societe Generale, subject to applicable regulations, to request the return of deferred variables, in part or in full, after the holding period and for a five-year period after their allocation was included in the Group’s plan for deferred variable remuneration allocated for 2020. At least 50% of this remuneration is paid in shares or equivalent securities. The purpose of these payment methods is to align the remuneration with the Company’s performance and risk horizon. The Risk Division and Compliance Division help define and implement this policy. In particular, every year they independently assess the main activities of Wholesale Banking, and of French and International Retail Banking, and the principal risk takers, together with the desk managers subject to the Separation and Regulation of Banking Activities Act and the Volcker Rule in relation to their risk management and compliance. These assessments are reviewed by General Management and taken into account when determining the amounts of variable remuneration. Furthermore, Societe Generale has implemented a specific system and governance aimed at the holders of trading mandates to ensure that the remuneration policy genuinely factors in the requirements of the Separation and Regulation of Banking Activities Act of 26 July 2013 and the Volcker Rule. In keeping with our historical approach and in accordance with the recommendations of the Committee of European Banking Supervisors, several regulatory principles - the portion of deferred remuneration, the acquisition of which is subject to conditions of presence, the minimum performance of the Group and the activity, and appropriate risk and compliance management - apply to a wider population than the regulated population depending on the level of variable remuneration, notably across the scope of Wholesale Banking. In addition, the Group’s annual employee appraisal tool has included a Conduct and Compliance section since 2018, enabling managers to factor in cases of non-compliant employee behaviour with respect to risk management, quality of service and respecting customers’ interests. Where an employee has failed to observe conduct and compliance rules, the manager must draft and implement a dedicated action plan to assist him or her. The results of this specific appraisal measure are crucial in determining the employee’s career path and remuneration. The consideration given to risks in the remuneration policy is presented every year to the Risks Committee, and a Director sitting on the Risks Committee also sits on the Compensation Committee. Management of reputational risk The management of reputational risk is governed by an internal directive signed by the Societe Generale Group Chief Executive Officer. The control system is intended to prevent, identify, assess and control this risk. It is coordinated by the Compliance Division, which: supports Group employees, and more particularly the Compliance p Control Officers of the businesses, in their strategy for preventing, identifying, assessing and controlling reputational risk; offers and updates training programmes to raise awareness of p reputational risk; develops a reputational risk dashboard that is communicated p quarterly to the Risk Committee of the Board of Directors, based on information from the businesses/Business Units and support functions/Service Units (in particular the Human Resources, Communications, Legal, Corporate Social Responsibility and Data Protection Departments).