Risk management approach

Bank Pekao has a risk management strategy described in ICAAP Policy – Principles of risk and capital management (hereinafter „ICAAP Policy”), adopted by the Bank’s Management Board and approved by the Bank’s Supervisory Board. This document sets out the main elements of a comprehensive approach to the risk related to the Bank’s operations and resulting from the adopted business strategy, both at the level of the Bank and the entire Bank Group. The ICAAP policy defines the identified types of risk and criteria for considering them as significant, indicating the objectives and accompanying principles of risk management, the target risk structure related to the business as well as the accepted level and structure of risk, determined within the adopted risk appetite.

Each identified risk is assessed in terms of its significance and – if considered significant – it is measured (if it is classified as measurable risk) or assessed (in the case of risks that are difficult to measure) and monitored and controlled in accordance with the methods and procedures established for a given type risk. Risk assessment and measurement methodologies are designed to maintain compliance with applicable legal requirements, supervisory guidelines and best practices.

The Bank applies formalized risk mitigation limits in line with the adopted risk appetite and defines the rules of conduct in the event of exceeding the limits. The management information system in place allows the level of risk to be monitored. The Bank’s organizational structure is adapted to the size and profile of the risk incurred by the Bank. In managing the risks of the Group, the Bank oversees the risks associated with the activities of its subsidiaries.

In the risk management system in place at the Bank, the Bank’s Management Board is responsible for the development, implementation and effective functioning of risk management processes and the internal capital estimation process, adjusted to the size and profile of the risk incurred (risk appetite), taking into account the risk of subsidiaries. The Management Board of the Bank is regularly informed about the current risk profile of the Bank, about the largest exposures and concentrations of credit exposures.

The Bank’s Supervisory Board, supported by the Risk Committee, supervises the risk management system and assesses its adequacy and effectiveness. Moreover, the Supervisory Board supervises the compliance of the Group’s risk-taking policy with the strategy and financial plan.

The risk management strategy (including risk appetite) and the risk management system at the Bank are subject to regular reviews and necessary updates in order to maintain their adequacy in relation to the scale and complexity of the Bank’s activities.

The risk management system functioning in the Bank is an integral part of the Bank’s management system. Risk management streamlines decision-making processes while ensuring that decisions are consistent with best market practices and applicable regulatory requirements.

Reputation protection is of key importance for the Bank due to the potential impact of this risk on the financial results and capital of the Bank, but also due to the role of the Bank as a public trust institution. In accordance with the guidelines of the ICAAP Policy, which defines reputation risk as material, Pekao Bank has implemented a separate regulation relating to this type of risk(Principles of reputation risk management in Pekao Bank).

Reputation is an assessment of the Bank’s image, i.e. the way the Bank is perceived at a given moment by the environment, which includes customers, counterparties, investors, shareholders, regulators and the general public. The image is not only a marketing concept, but also a business concept – the acceptance of the Bank by market participants and the resulting support for sales of products and services depends on the image. The Bank’s reputation risk is therefore understood as the risk of a negative perception of the Bank’s image, which results in a loss of the Bank’s current or future revenues or loss of capital.

Reputation risk is secondary in nature and is closely correlated with other risks present in the Bank’s daily operations, such as credit, operational, market, liquidity and compliance risks. For each of the above-mentioned types of risk, actions potentially affecting the risk of losing reputation have been defined. Among the most important of these are:

By its nature, reputational risk is classified as a hard-to-measure risk. In line with the ICAAP Policy it is not subject to quantitative measurement. The day-to-day management of the Bank’s reputation risk comes down to managing the primary types of risk, supported by qualitative assessment, monitoring, reporting and mitigating the Bank’s reputational risk.

Bank Pekao consistently reduces the risk of losing reputation, among others by:

• application of an appropriate credit policy (taking into account, among others, sectors of the economy in which the Bank is not involved in financing),
• implementation and application of best practices and ethical principles, incl. Principles of Good Banking Practice of the Association of Polish Banks, Canon of Good Financial Market Practices, Best Practices of Companies Listed on the WSE and of the Pekao Group Code of Conduct which defines a set of basic values and standards of conduct for the Bank’s employees in order to ensure the highest standards of service provision and protection of the Bank’s reputation,
• promoting knowledge of legal regulations, ethics and corporate governance rules among the Bank’s employees and their proper application, conducting training on compliance risk,
• managing conflicts of interest,
• counteracting corruption
• preventing the use of the Bank’s activities for purposes related to money laundering or terrorist financing,
• fraud management (with particular emphasis on internal fraud) by preventing, detecting and combating fraud, minimizing its effects and conducting actions to detect its perpetrators, as well as, in justified cases, notifying law enforcement authorities,
• ensuring an appropriate level of information security, in particular with regard to customers’ personal data, as well as ensuring that only authorized individuals have access to this information,
• taking actions and initiatives aimed at increasing the level of customer satisfaction,
• managing the process of considering customer complaints,
• management by objectives (setting goals for the Bank’s employees in sales and managerial positions regarding the quality of service and customer satisfaction),
• analysing new products and services as well as marketing campaigns in terms of reputational risk,
• consulting with the Management Board and Supervisory Board of the Bank and on activities significant for the Bank’s reputation.

The Bank’s reputation management is a continuous process in which all organizational units and employees actively participate. The Bank’s statutory bodies and organizational units directly responsible for primary risk types play a special role in this process, in line with the competences resulting from separate internal regulations of the Bank. Regularly conducted since 2020 at the request of the Bank, the monitoring of Pekao brand indicators and the company’s image profile indicates a stable position compared to the competition. Bank Pekao is at the forefront of banking brands with the best spontaneous awareness; and its image profile defines it as a traditional, Polish and trustworthy bank.