2007 REGISTRATION DOCUMENT

3 RiskRISK MANAGEMENTmanagement framework< Contents >The availability of information systems is vital to allow BNP Paribas tocontinue operating in a crisis or emergency. In line with its values ofoperational excellence, the Group maintains, develops and regularlyverifies its information back-up capabilities and system robustness inresponse to tighter regulations and extreme stress scenarios (naturaldisasters or other catastrophes, health pandemics, etc.). Its action in thisarea is consistent with the Group’s general business continuity plan.BNP Paribas seeks to minimise information security risk and optimiseresources by:■ setting up a procedural framework for each business line governingday-to-day operations (data production) and software management(existing and new applications);■ raising employees’ awareness of information security imperatives andtraining key players in the appropriate procedures and behaviours ;■ adopting a formal approach for evaluating existing systems andimproving management of security risks through measurable keyperformance indicators and action plans. This approach is applicableto business projects and shared information system architecture andapplications, and is embedded within the Group’s system of permanentand periodic controls;■ monitoring incidents and developing intelligence of technologicalvulnerability and attacks.123COMPLIANCE AND R EPUTATION R ISKSEffective management of compliance risk, which includes a wide varietyof risks including damage to the Bank’s reputation, is high on the Group’sagenda. Compliance is part of the Bank’s internal control frameworkand covers adherence to applicable laws, regulations, codes of conductand standards of good practice. Compliance also involves protectingthe Group’s reputation as well as the reputation of its investors andcustomers; publishing accurate and complete information; ensuringthat members of staff act in an ethical manner and avoid conflicts ofinterest; protecting the interests of its customers and the integrity ofthe financial markets, implementing anti-money laundering procedures,combating corruption and the financing of terrorism; and respectingfinancial embargoes.The Compliance function manages compliance and reputation risksfor all of the Group’s domestic and international businesses. TheCompliance function reports to the Chief Executive Officer and hasdirect, independent access to the Board’s Internal Control and RiskManagement C ommittee .The function includes a central structure in Paris responsible foroverseeing and supervising all compliance matters, and local teamswithin the different divisions and business lines acting under delegatedauthority from the central team. All material Group entities havededicated Compliance teams, at both global and local level. TheCompliance function has grown continuously since 2004, with a 21%surge in employees in 2007 (at constant scope).Management of compliance and reputation risks is based on a systemof permanent controls built around:■ an internal procedures reference manual describing general andspecific procedures, regularly updated to take into account newregulatory banking or financial requirements introduced at global orlocal level. These procedures are designed to safeguard the reputationof the Group and its subsidiaries, ensure the primacy of customerinterests and maintain the integrity of the financial markets.Procedures address matters such as:■ the avoidance of conflicts of interest and the establishment of“Chinese walls” to prevent the unauthorised exchange of sensitiveinformation,■ supervision of customer transactions in order to detect any marketabuse based on specific control definitions and trigger points, or anyoperations related to money laundering, the financing of terrorismor breach of financial embargoes,■ supervision of transactions carried out by staff, particularly on thestock markets.In 2007, the legal and regulatory provisions implementing theMarkets in Financial Instruments Directive (MiFID) into French lawcame into force. These far-reaching changes introduce strict newconduct of business requirements for investment service providers,particularly as regards client categorisation, client relationships,information that may be provided to investors, the suitability ofbanking products and services to client needs, best executionpractices and applicable fees.■ coordination of action taken by the various Group entities to guaranteethe consistency and effectiveness of monitoring systems and tools.■ development of new internal control tools. BNP Paribas is currentlyrolling out (i) the new Regulatory Risk Matrix, which makes it possibleto measure and monitor compliance risk with regard to applicablelaws and regulations; and (ii) new tools designed to prevent moneylaundering, the financing of terrorism and corruption (see below).These new capabilities are key to enhancing the effectiveness ofpermanent controls in respect of compliance risk.■ training initiatives, which are being implemented across the Group andwithin the various divisions and business lines. In 2007, these includedgeneral training sessions looking at the Market Abuse directive andMiFID.BNP Paribas continues to step up its efforts against moneylaundering, terrorism financing and corruption in response to thechanging international environment, proliferation of illegal practicesand tightening of regulations in many countries, coupled with adetermination to safeguard the Group’s reputation:■ procedures and guidelines, particularly concerning financialembargoes or “Politically Exposed Persons” have been reinforced.■ the Anti-Money Laundering unit (part of the Group’s FinancialIntelligence Unit) reported a significant 23% rise in the numberof suspicion reports processed over the period,■ training initiatives have been rolled out across the Group’s entities,with a particular focus on recent acquisitions or companies based insensitive locations. A training programme on managing embargoeswill be launched in the first half of 2008,4567891011782007 Registration document - BNP PARIBAS