BASES GENERALS QUE HAN DE REGIR LA CON VOCATÒRIA D’UN CONCURS PER A LA PROVI-

Operational risk is the risk of loss resulting from shortcomings or failure in internal procedures, human error, information systems or external events. It includes legal risk but not strategic or reputational risk.

I. Objectives and policy

The operational risk system, adjusted to each Group entity, comprises the following components common to the entire Group:

• governance of the operational risk management function: supervision of the system by the Executive Management (via the Operational Risk Committee or the operational risk unit of the Internal Control Committee), role of Risk Management and Permanent Controls officers (Crédit Agricole S.A. and entities) in system oversight and co-ordination, responsibilities of entities in controlling their risks through the network of Operational Risk Managers;

• identification and qualitative assessment of risks through risk mapping, and the use of indicators to monitor the most sensitive processes;

• collection of operational loss data and an early-warning system to report significant incidents, which are consolidated in a database used to measure and monitor the cost of risk; • calculation and allocation of regulatory capital for operational risks at consolidated and entity

level;

• periodic production of an operational risk scorecard at entity level, plus a Group summary.

II.

Risk management: organisation and supervision system

The organisation of operational risk management forms part of the overall Risk Management and Permanent Controls function: Operational risk officers, most of whom now cover permanent risk monitoring, report to the heads of Risk Management and Permanent Controls in the various entities.

Crédit Agricole Group uses an operational risk scorecard covering most of its business lines. This scorecard shows the main sources of risk affecting most business lines, along with exposure profiles differentiated by subsidiary and business line: recurring risk, mainly arising from external fraud involving payment systems in retail banking or stock market errors in asset management, higher risk in corporate and investment banking (counterparty litigation and capital markets) and factoring (external fraud).

It also reflects the effect of action plans designed to reduce the impact of exceptional risks (i.e. by strengthening information systems and controls when encountering high unit losses primarily affecting asset management and factoring operations) and to reduce the frequency of recurring risks (electronic banking fraud and heightened monitoring of external fraud in the consumer finance businesses).

Initiatives taken to counter internal fraud in 2007, in particular at Crédit Agricole CIB, have been extended through implementation of a system to bring the risk thereof under further control. Measures include reviewing authorisation procedures, strengthening early-warning systems and creating an anti-fraud unit in the Compliance function.

Concerning the part involving identification and qualitative assessment of risk, a new risk mapping campaign was initiated. In collaboration with the Group’s legal function, legal risks were mapped in addition to operational and compliance risks. As every year, the results of these risk mapping efforts will be analysed by each entity in the course of the first quarter 2010 and will give place to a presentation to the operational Risk Management Committee.

To improve operational risk tools even further and promote overall consistency in the Risk Management and Permanent Controls function, an Intranet-based mapping tool was made available to the entities. This tool is closely integrated with the SCOPE permanent controls tool (sharing of the same framework, cross- reporting, etc.), making it possible to comfort the choices of methodology in the link between risk mapping and risk management (permanent controls, action plans, etc.). Similarly, the current loss compilation tool will be migrated to an Intranet tool in 2010.

Lastly, concerning calculation and allocation of regulatory capital, the application chain was secured and automated; an operational risk information system evolution plan will be implemented in 2010 and 2011.

The AMA model will be back-tested every six months by a special committee for the purpose of analysing the model’s sensitivity to changes in the risk profile of the entities. The committee has identified areas where improvements are possible, especially in modelling the historical loss experience. Working groups are already engaged on these tasks, and work on them will continue through the first half of 2010.

III. Methodology

The principal entities of the Crédit Agricole Group use the advanced measurement approach (AMA): Crédit Agricole CIB, Amundi, LCL, Sofinco, Finaref and all of the Regional Banks. The Commission Bancaire approved the Group’s use of AMA in 2007.

Convergence work has begun in preparation for the integration of Société Générale’s asset management business into the new joint entity, Amundi.

The scope of entities using the AMA calculation method is increasing. Agos, the Italian subsidiary of Sofinco, adopted AMA in the first half of 2009, and work continues on integrating Cariparma into the system.

For the entities remaining on the standard approach (TSA), the weighting coefficients used in calculating the capital requirement are those recommended in the Basel Accord.

AMA regulatory capital requirements calculation

The advanced measurement approach for calculating capital requirements with respect to operational risk has the following objectives:

• increase control over the cost of operational risk, and prevent exceptional risks across the Group’s various entities;

• determine the level of capital corresponding to the risks measured, which may be lower than that calculated using the standard approach;

• promote improvements in permanent controls through the monitoring of action plans.

The systems implemented within the Group aim for compliance with all qualitative criteria (making risk measurement an integral part of day-to-day management, independence of the risk function, periodic disclosure of operational risk exposures etc.) and Basel II quantitative criteria (99.9% confidence interval over a 1-year period; incorporation of internal data, external data and analyses of scenarios and factors reflecting the operating environment; incorporation of risk factors that influence the statistical distribution, etc.).

The AMA model for calculating capital requirements is based on a “Loss Distribution Approach” actuarial model, which is unique to the Group. The largest entities handle their own capital allocation based on centrally defined principles.

Internal factors (change in the entity’s risk profile) are taken into account depending on: • the entity’s organisational changes;

• changes in risk mapping;

• an analysis of the history of internal losses and the quality of the risk management system, in particular via the Permanent Controls Function.

Concerning external factors, the ORX consortium database, which catalogues losses at 50 or so banks throughout the world including Crédit Agricole, is analysed so as to track incidents at other institutions. Depending on the results of this analysis, the stress tests developed in the various Group entities are adjusted.

The model was designed and developed according to the following principles: • it must form an integral part of the risk policy;

• it must be pragmatic, i.e. the methodology must be applicable to real operating conditions;

• it must have educational value, in order to encourage appropriation by the Executive Management and business lines;

• it must be robust, i.e. it must be able to give estimates that are realistic and stable from one year to the next.

The model has been regularly validated by the Crédit Agricole Group’s Standards and Methodology Committee, chaired by the Head of Group Risk Management and Permanent Controls.

IV. Exposure

Breakdown of operational losses by Basel risk category

Group Crédit Agricole (2007 2008 2009)

7%

22%

4%

42%

21%

1%

2%

Labour practices and workplace safety Customers, products and business practices Property damage

Business and systems dysfunctions

Execution, delivery and administration processes

Excluding exceptional events (notably, rogue trading in New York in 2007)

Generally, the exposure to operational risks reflects the pattern of principal activities at the Crédit Agricole Group:

• substantial exposure in the execution risk category, due largely to market volatility that increases the likelihood of greater losses on erroneous transactions;

• marked exposure to external fraud, essentially in retail banking via card fraud; • moderate exposure to commercial disputes.

V.

Insurance and coverage of operational risks

The Crédit Agricole Group has obtained insurance coverage for its operational risks to protect its assets and profits. For high-intensity risks, Group policies from major insurance companies are taken out by Crédit Agricole S.A. for its subsidiaries, and by Camca for the Regional Banks. These policies harmonise the way in which personal and property risks are transferred and the implementation of specific professional civil liability and fraud insurance programmes for each business line. Business-line subsidiaries are responsible for managing lower intensity risks themselves.

In France, insurance of operating assets (property and IT equipment) includes third-party liability cover for buildings with the highest exposure to the risk of damage. This insurance is supplemented by special guarantee lines for civil operating liability.

Crédit Agricole S.A. has renewed its insurance policies for operating loss, fraud and securities risks, Group professional civil liability, and civil liability for executive officers.

Basel II eligible policies contribute to reducing the amount of capital that must be held against operational risks (within the 20% authorised limit).

High-frequency and low-intensity risks that cannot be insured on satisfactory financial terms are retained in the form of deductibles or are mutualised within the Crédit Agricole Group by its captive reinsurance subsidiaries.