Segunda etapa Planificación

Object of protection Type of coverage / BIS II category covered Policy

Protection of the activity Financial / I Internal fraud and II external fraud Integral Banking Policy (BBB) Cash and securities

Safes Assets/ V Material damages

Civil responsibility /

IV Practices with clients, products and business and V Damage to physical assets

Protection of employees Employees / III Employment practices, health Life and personal accident

and safety at work Health

Product support Products / I Internal fraud and II external fraud Cards

Current accounts Material damages Cars

Civil responsibility Professional indemnity Directors & Officers

152

5. BASEL II CORPORATE PROJECT

Santander has been firmly committed right from the start to the principles behind the Revised Framework of International Convergence of Capital Measures and Rules (Basel II). This framework will enable institutions to conduct internal estimates of capital to ensure solvency in the event of circumstances caused by different types of risk. As a result of this commitment, Grupo Santander has assigned all the human and material resources needed to ensure Basel II is successfully implemented. Several years ago a Basel II team was formed from the Group’s different areas (mainly, Risks, Technology, Financial Controller, Operations, Financial, Internal Auditing – verifying the whole process, as the last element of control of the entity – and Business – above all in everything to do with advanced integration of internal models in management). Furthermore, specific teams have been put together to tackle various specific events so that the project’s most complex aspects are

appropriately managed.

As well as this Basel II operational team, senior management has been very involved from the onset. The Corporate

Supervision Committee, chaired by the Group’s third Vice- Chairman and head of the Risks Division, supervises at the highest level the launch of initiatives in the Basel II corporate project, controlling their milestones of compliance, assigning staff and approving budgets, as well as assuming institutional representation of the Group for these purposes. The

Management Committee and the Board were also informed of the progress made in the project and the implications for the Group of the New Capital Accord.

In the specific case of credit risk, Basel II means recognising, for regulatory capital purposes, the internal models that have been used for management purposes for some time, and which led in their day to their approval, by our regulator, for calculating statistical provisions (known as FONCEI) in certain segments of risk.

Santander has proposed adhering to the Advanced Internal Ratings Based (AIRB) models of Basel II for exposures which represent close to 95% of the Group’s total. The institutions which plan to install this new system for calculating regulatory capital as of January 2008 (the first year allowed by the Bank of Spain) are: Santander (parent bank), Banesto and Abbey whose portfolios account for around 70% of exposure. The rest of the most significant units will gradually adopt the AIRB focus in accordance with the schedule sent to the Bank of Spain and to the various local regulators.

During 2007 supervisory validation was conducted by both the Bank of Spain as well as the Financial Services Authority (FSA). At the end of 2007 the FSA authorised local use of Abbey’s models for the requested segments (portfolios of financial institutions, social housing, retail, including mortgages). In the case of Santander (parent bank) and Banesto, the decision is pending for the entry into force of the relevant regulation which will empower the Spanish supervisor to grant this kind of authorisation.

Given the medium-low risk profile characteristic of Santander’s businesses, very focused on retail banking (SMEs and individual customers), Bank of Spain authorisation is expected to generate significant capital savings in Pillar 1 which establishes the capital requirements for covering credit, market and operational risks. The global savings that will materialise for Santander from

implementing Basel II will depend on the result of the Proposal of Self-Assessment of Capital (which develops Pillar II) which takes into account the impact of the risks not considered in Pillar I as well as the benefits related to diversification by risks, businesses and geographic areas.

Aside from the supervisory validation process, Santander also completed in 2007 the necessary internal technological

developments which envisage for all business units a common structure of data bases and engine of calculation supporting the processes for estimating the parameters (PD, LGD and EaD) and calculating capital at the local and corporate levels. This focus achieved the triple objective of installing in each unit the corporate criteria established, covering the existing local requirements and attaining a synergy in costs through global definitions and developments.

In addition, and although the internal models of risk have been actively deployed for some time in many of the Entity’s processes (setting limits, admission, tracking, pricing and/or calculating risk adjusted returns, according to portfolios), work continued on various initiatives identified for advancing in integrating these models into active management of the Entity in order to extend this practice to all portfolios and further their effects.

As regards the rest of risks explicitly envisaged in Pillar I of Basel II, in Market Risk we continued the lines of work defined some time ago in the Group for authorisation of the internal model – based on calculating VaR – for regulatory purposes (one should remember that Basel I includes recognition of the internal model of Market Risk). In Operational Risk, the Group decided to adopt the standard focus for calculating regulatory capital insofar as the objective of mitigation of this risk is appropriately articulated through all the requirements of this focus. With this objective in mind, work continued on identifying and mitigating this risk in the Group; progress was made in developing corporate tools for self- assessment, setting and tracking of indicators, capturing events, etc.

Pillar II is another important line of work of the Basel II Corporate Project. As well as reviewing the methodology of the Economic Capital model (supported by the Integral Framework of Risks tool), a technological approach to the platform supporting Pillar I is being made so that all the information related to Credit Risk comes from the same source. The Group’s Economic Capital model has already been presented to the European regulators in the countries where Santander conducts activity (Supervisory College). The model is due to be profoundly reviewed by regulators during 2008.

INTERNAL VALIDATION OF INTERNAL RISK MODEL

Internal validation is an unavoidable prerequisite for authorisation from the supervisory body, and consists of a specialised and sufficiently independent unit within the institution obtaining a technical opinion on whether the internal model is appropriate for the purposes used (internal and regulatory) and concluding on its usefulness and effectiveness. Moreover, it must evaluate whether the risk management and control procedures are appropriate for the entity’s strategy and risk profile.

Internal validation also constitutes a fundamental support for the Board’s Committee of Risks and Local Committees of Risks in their responsibilities of authorising the use (management and regulatory) of models and their periodic review, as senior management must ensure the Entity has the appropriate

procedures and systems for monitoring and controlling credit risk. The model covers systems and strategies for classifying clients and operations, estimating the parameters of risk (PD, LGD and EaD), technological systems that make implementation effective and, in general, all relevant aspects for the advanced management of risk (controls, reporting, uses, involvement of senior

management, etc). The purpose of internal validation is thus to review quantitative, qualitative and technological aspects and those related to corporate governance.

The function of Internal Validation is located, at the corporate level, within the Area of Integral Control and Internal Validation of Risk which reports directly to the Group’s Third Vice-Chairman and Chairman of the Board’s Risks Committee. This global function in the Group requires the internal validation of around 160 internal models of Credit Risk, in 13 different units and with nine local regulators. This makes it necessary to apply a common methodology for internal validation, ensuring coherence and consistency in the use of IRB models for calculating capital, both from the internal standpoint as well as the Bank of Spain’s, independent of the degree of decentralisation of its execution, in the face of meeting the requirements of local regulators or because of the very nature of the tests.

This corporate methodology is supported by a series of tools developed internally in Santander which provide a robust framework for its application in all the Group’s units and which automates some verifications so that the revisions are done effectively and efficiently.

Grupo Santander’s corporate framework of internal validation is fully aligned with the criteria for internal validation of advanced models recently issued by the Bank of Spain. The criterion of separation of functions is maintained between Internal Validation and Internal Auditing which, as the last element of control in the Group, is responsible for reviewing the methodology, tools and work done by Internal Validation and to give its opinion on its degree of effective independence.

All the models of Spain-parent bank, Banesto and Abbey UK (36 in all) were internally validated during 2007 so that they could be authorised for regulatory use at the beginning of 2008.

6. ECONOMIC CAPITAL

Traditionally, the concept of economic capital has been contrasted with that of regulatory capital, as this is the one required for the regulation of solvency and which, until formal adoption of the new Basel II capital regulations, has been suffering from an insufficient sensitivity to risk. The new Basel II capital framework is undoubtedly going to bring both concepts closer together.

When calculating economic capital the Bank must decide the level of losses it wants to cover with economic capital (i.e. the level of confidence with which it wants to ensure the continuation of its business). In Grupo Santander’s case, the desired confidence level to be attained with economic capital is 99.97%, above the 99.90% assumed by the regulatory capital formulas proposed in the New Basel Capital Accord. The difference between both levels means assuming a default probability for the Group of 0.03% instead of 0.1%, three times lower than the proposal of BIS II. In terms of external rating, a confidence level of 99.97% requires having sufficient capital to attain a solvency level equivalent to an AA rating, while 99.90% would only allow a rating of A-, given the higher probability of default associated.

The Group’s model of economic capital, quantifies the consolidated risk profile taking into account all the significant risks of activity, as well as the consubstantial diversification effect on a multinational and multi-business group such as Santander. This economic capital model serves as the Group’s base for preparing its Proposal of Self-assessment of Capital in accordance with Bank of Spain regulations under the Basel II Pillar II framework.

Within the framework of the model for the measurement and aggregation of economic capital, the risk of concentration for wholesale portfolios (large companies, banks and sovereigns) is particularly considered.

GLOBAL RISK ANAYSIS PROFILE

The Group’s risk profile at December 31, 2007, measured in terms of economic capital, is distributed by types of risk and the main business units, is reflected below.

Credit activity, which required 48% of the Group’s economic capital, continued to be the main source of risk, followed by the market risk of the equity portfolio, more so as of the end of 2007 because of the treatment provided in the capital model to the stake in RFS Holding (Banco Real).

The distribution of economic capital among the main business units reflects the diversification of the Group’s business. Latin America’s share (25.5%) was lower than in 2006.

The Group’s geographic diversification represents a profit of 23% on the consolidated economic capital and 18% the diversification between different types of risk.

The Group’s risk adjusted return in 2007 was 28.9%. Some methodological aspects of the internal model of economic capital were reviewed during 2007. Bearing in mind these changes, the net variation over 2006 in the global RORAC was +4.6 p.p.

The Group periodically assesses the level and evolution of the creation of value (CV) and the risk adjusted return (RORAC) of its main business units. The CV is the profit generated above the cost of capital employed, and is done so by the following formula:

Creation of value = Economic profit – (average EC x cost of capital)

The economic profit is obtained by making the necessary adjustments to attributable profit so as to extract just the recurrent profit that each unit generates in the year of its activity. The cost of capital, which is the minimum remuneration required by shareholders, can be calculated objectively by adding to the risk-free return the premium that shareholders require to invest in our Group. This premium will essentially depend on the degree of volatility in the price of our shares in relation to the market’s performance. The cost of capital calculated for 2007 is 9.7%.

All the main business units obtained in 2007 a RORAC higher than the cost of capital. The relative share of each business unit in the total value created (as previously defined, the value created represents the economic profit that exceeds the cost of capital) by the Group at December 31, 2007 is shown below.

The Group also conducts capital planning with the main objective of obtaining future projections of economic and regulatory capital and so assess situations of sufficiency of capital. Results’ forecasts for the Entity are incorporated to the various scenarios in a coherent way, both with their strategic objectives (organic growth, M&A, pay-out ratio, etc) as well as the economic picture and in the face of stress situations, and possible capital management strategies are identified that enable the Bank’s solvency situation to be optimised as well as the return on capital.

154