2007 REGISTRATION DOCUMENT

RISK MANAGEMENT3Risk management framework■ internal procedures and databases providing a framework for(i) managing legal risk, in close collaboration with the Compliancefunction for all matters which also fall under their responsibility, and(ii) overseeing the activities of the Group’s legal staff. At the endof 2004, a procedures database detailing all internal procedures inFrench and in English was set up on the Group intranet with accessrights for all employees;■ legal reviews, which are carried out in Group entities to ensure thatlocal systems for managing legal risks are appropriate, procedures areproperly applied, and tools correctly used. Regular visits are made,particularly to countries deemed the most vulnerable, in order tocheck the effectiveness of the systems developed by internationalunits for managing legal risks;■ internal reporting tools, document templates and analytical models,which are upgraded on an ongoing basis by Group Legal Departmentand contribute to the analysis of operational risk.The Legal function was reorganised at the end of 2007 to allow increasedoversight of the Group’s Legal Department and bring front-line legalstaff closer to the core businesses and divisions. The reorganisationmeans that legal risks can be managed more effectively, both withinand outside France.Tax riskIn each country where it operates , BNP Paribas is bound by specific localtax regulations applicable to companies engaged for example in banking,insurance or financial services.The Group Tax Department is a global function, responsible for overseeingthe consistency of the Group’s tax affairs. It also shares responsibility formonitoring global tax risks with Group Finance and Development. TheGroup Tax Department performs second-tier controls to ensure that taxrisks remain at an acceptable level and are consistent with the Group’sreputation and profitability objectives.To ensure its mission, the Group Tax Department has established:■ a network of dedicated tax specialists in 12 countries completed by taxcorrespondents covering other countries where the Group operates;■ a qualitative data reporting system in order to manage tax risks andassess compliance with local tax laws;■ regular reporting to Group Executive Management on the use made ofdelegations of authority and compliance with internal standards.The Group Tax Department co-chaured the Tax Coordination Committeechaired by Group Finance and Development. The Tax CoordinationCommittee also includes the Compliance function and may involvethe core businesses when appropriate. The committee is responsible foranalysing key tax issues for the Group and making appropriate decisions.Group Finance and Development is obliged to consult the Group TaxDepartment on any tax issues arising on transactions processed.The Group Tax Department has also drawn up procedures covering allcore businesses, designed to ensure that tax risks are identified, addressedand controlled appropriately. Tax risks may arise at Group level or fromspecific customer product or service offerings developed by the Group’sentities. To ensure these risks are addressed effectively, the Group TaxDepartment relies among other on:■ the tax risk management framework. The tax risk charter is presentedin the form of a mission letter for the territory tax manager whenthere is one or in the form of a mission letter for the Group TaxDepartment authority to the head of core business with regard toentities that do not have a dedicated tax manager. The latest isupdated regularly to reflect changes in the charter applicable toTerritory Chief Executives;■ procedures for validation by the Group Tax Department for all newproducts featuring a material tax component, together with all newactivities and “specific” transactions structured in France or abroad;■ procedures for procuring independent tax advice;■ definition of operational tax risk incidents and their common filingand reporting;■ definition and disclosure of groupwide tax rules and regulations, andvalidation of any framework agreement or internal circular/documentpresenting specific tax issues;■ tax audit reporting procedures;■ control procedures relating to the delivery of tax opinions andadvice.Information security< Contents >Information is a bank’s key commodity and effective management ofinformation security risk is vital in an era of near full-scale migration toelectronic media, growing demand for swift online processing of evermore sophisticated transactions, and widespread use of the internetor multiple networks as the primary interface between a bank and itsindividual or institutional customers.Incidents reported in different countries involving banking and credit cardindustries highlight the increased need for vigilance. This topic has beenreiterated by regulations and case law on data protection.Information security at BNP Paribas is managed in accordance with aseries of Group security policies rolled down to each individual businessline. These policies take into account any regulatory requirements andthe risk appetite of the business in question, and are governed by theGroup’s general security policy which draws on ISO 27001 (formerlyISO 17799). Each business line manages information security in the sameway, based on common objective indicators, periodic controls, residualrisk assessments and action plans. This approach is part of the permanentand periodic control framework set up for each banking activity pursuantto CRBF regulation 97-02 (amended in 2004) in France and similarregulations in other countries.Each of BNP Paribas’ business lines is exposed to some specific formof information security risk, with some risks common to all businesses.The Group’s policy for managing these risks takes into consideration thespecific nature of the business, often made more complex by legallyand culturally-specific regulations in the different countries in whichthe Group does business.Like most global banking players, the Group’s online retail bankingbusinesses suffered a number of phishing/pharming attacks in 2007, asin previous years. All large-scale attacks were countered, with no harmwhatsoever to our customers, thanks to the continuing reinforcementof existing awareness, prevention, detection and remedial measures.Although we did not see a significant rise in either the number or type ofattacks over the year, the Group’s businesses remain vigilant and continueto invest in measures that will allow them to keep one step ahead ofsecurity threats without increasing complexity for the internet user. Inall countries where it has retail banking operations, BNP Paribas playsan active role in raising users’ awareness of the intrinsic dangers of theinternet and of the key measures that can be taken to mitigate thesedangers, by establishing a direct dialogue with customers and workingclosely alongside public authorities and professional or communityassociations.12345678910112007 Registration document - BNP PARIBAS 77