Note: Document translated from Spanish. In the event of a discrepancy, the Spanish version prevails.

4    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    5

6    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    7

8    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    9

10    2024 Pillar 3 Disclosures Report

bn€

2024 Pillar 3 Disclosures Report    11

12    2024 Pillar 3 Disclosures Report

This section looks at general aspects applicable to Grupo Santander and describes the governance for approval and publication of the Pillar 3 report, in addition to the disclosure criteria used in the report.

The Basel framework consists of 3 pillars:

•Minimum Capital requirements (Pillar 1)

•Supervisory review (Pillar 2)

•Market discipline (Pillar 3).

The Santander Pillar 3 Disclosure report is a public document that is published on the Group's corporate website in order to fulfil the regulatory requirements within the scope of Basel. Specifically, the reporting standards are set by Part Eight of the Capital Requirements Regulation (CRR) 575/2013 and complementary European Banking Authority (EBA) Guidelines. In addition, the report considers the Regulation (CRR II) 2019/876 amending Regulation 575/2013.

The Pillar 3 report includes a set of disclosure requirements which are intended to provide analysts, investors, shareholders and other market agents with KPIs and risk information to improve their ability of assessing the banks risk profile and capital adequacy.

The timely publication of this information is considered as a booster of transparency within financial institutions and contributes to the adequate functioning of financial markets.

This document should be read in conjunction with the Annexes of Pillar 3 and the Annual report, which have been published on the website (www.santander.com).

On 27 June 2023, an agreement was reached between the Council of the European Union and the European Parliament on the proposal put forward by the European Commission on 27 October 2021 on the banking package. The banking package includes amendments to the Capital Requirements Regulation (CRR III) and to the Capital Requirements Directive (CRD VI).

The banking package implement the latest Basel III reforms, which underpin a robust regulatory framework, efficient supervision and enhanced risk control by credit institutions. Following the CRDVI/CRR III, the EBA was asked to work on the layer of the regulatory products that ensures a technical implementation of the prudential framework, including amendments to the disclosure requirements.

On November 2024, the Regulation 2024/3172 was approved by Commission laying down implementing technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to public disclosures by institutions of the information referred to in Part Eight, Titles II and III, of that Regulation, that will apply from 1 January 2025.

In addition, in February 2025 the EBA published its Implementing Technical Standards (ITS) on the Pillar 3 data hub (P3DH), which will centralise prudential disclosures by institutions through a single electronic access point on the EBA website from June 25.

Grupo Santander has a formal policy on the Pillar 3 disclosures which defines the requirements, the development process, the frequency and the associated governance in accordance with the Directive 2013/36/EU, Regulation (EU) no. 2019/876 of 20 May 2019 (the EU Regulation or CRR II) amending Regulation (EU) no. 575/2013, as well as the law on supervision and capital requirements (10/2014) of the Banco de España.

This policy has been prepared in compliance with the criteria established in the Guidelines on Materiality, Proprietary, Confidentiality and Frequency of the Information by the European Banking Authority in accordance with Article 432, sections 1 and 2 and Article 433 of Regulation (EU) 575/2013.

The Pillar 3 disclosures report relies on a range of defined processes relating to the internal control framework, with duties and responsibilities for review and certification of the information contained in the report at several levels of the organisation.

Additional information regarding Grupo Santander's system of internal control over financial reporting (SCI) can be found in the 'Corporate governance' chapter of the 2024 Annual report.

2024 Pillar 3 Disclosures Report    13

The information contained in this report has been subject to an ex-ante review by the External Auditor, who in their report have not declared any findings regarding the reasonableness of the information detailed and the compliance with the information requirements established in the European Capital Directive and Regulation.

The conclusions are presented to the audit committee prior to its approval. In addition, this report is included in the recurring annual plan review of internal audit.

The report has been reviewed by the capital committee and the audit committee at their meeting on 13 February 2024, as well as by the board of directors' meeting on 15 February, prior to its final approval at the board of directors' meeting on 19 February 2024.

The board of directors of Santander certifies that the publication of the Pillar 3 disclosures report is compliant with the guidelines in Part Eight of Regulation (EU) 575/2013 and consistent with the “Pillar 3 Disclosures Policy” adopted by the board of directors.

No exceptions have been applied for the publication of information considered proprietary or confidential.

Furthermore, a quarterly report is published which includes a set of information complying with the internal policy and criteria established in the European Banking Authority guidelines about disclosure frequency.

The Pillar 3 disclosures report is available in the Shareholders and Investors section of the Santander website (www.santander.com), under "Financial and economic information".

14    2024 Pillar 3 Disclosures Report

Banco Santander, S.A. is a legal entity subject to the rules and regulations applicable to banks operating in Spain. In addition to its direct operations, Banco Santander, S.A. is the holding company of a group of banking subsidiaries engaged in a range of business activities. The European Central Bank (ECB) is the supervisor of the Grupo Santander on a consolidated basis.

The Capital Requirements Regulation (CRR) and its modifications (hereinafter referred to as CRR), Capital Requirements Directive (CRD) and its modifications, and its transposition through Banco de España Circular 2/2016, on supervision and capital adequacy, are applicable at a consolidated level to the entire Grupo Santander.

Refer to Appendix III, CRR Mapping, for all aspects for which disclosure is required under Part Eight of the CRR, as amended but that are not applicable to Santander. These are reported as “N/A” (not applicable).

This report has been prepared in accordance with current 31.12.2024 European regulations on capital requirements (CRR2).

The ratios presented in this report have been calculated using the transitional CRR2 and IFRS 9 implementation schedules.

There are differences regarding some metrics between the regulatory information in this report and the information in the annual report:

•The credit risk exposure measurements used for calculating regulatory capital requirements include:

◦Current and future risk exposures arising from future commitments (contingent liabilities and commitments) and changes in market risk factors (derivative instruments).

◦The mitigating factors for these exposures (netting agreements and collateral agreements for derivative exposures, and collateral and personal guarantees for on-balance-sheet exposures).

•The criteria used in classifying non-performing exposures in portfolios subject to advanced models for calculating regulatory capital are more conservative than those used for calculations for the segregated view provided in the annual report.

•ESG disclosure in Pillar 3 follows the Implementing Technical Standards (ITS) defined by the EBA for this purpose and it is not necessarily aligned with the management criteria reported in other Group’s ESG reports.

On 19 June 2024, the final update of the banking package was published in the Official Journal of the European Union Regulation (EU) 2024/1623 (CRR3) amending the CRR2

Finally, Appendix III shows the compliance with the various applied ITS which are in force and Appendix IV refers to the regulatory framework and the according articles on which the disclosed information is based.

In the Financial and economic information / Pillar 3 section of the Group's website, all tables including the Appendix, which are published in this document, are available in an editable format.

In addition to the consolidated information presented in this report and ECB requirements, (following article 13 of the CRR, Application of disclosure requirements on a consolidated basis) Santander large subsidiaries that meet at least one of the following criteria publish information at solo basis on their websites.

•The institution is a global systemically important entity (G-SIB);

•The institution has been identified as a systemically important entity (O-SII) in accordance with Article 131(1) and (3) of Directive 2013/36 EU;

•The institution is one of the three largest entities in terms of total value of assets in the Member State in which it is established;

•The institutions total assets on a solo or sub-consolidated basis is equal to or greater than EUR 30 billion.

Based on the criteria above, each subsidiaries in the European Economic Area (EEA) such as Portugal, Poland and Santander Consumer Germany or subsidiaries outside EEA such as Argentina, Brazil, Mexico, the UK and Uruguay publish their Pillar 3 reports.

Santander Consumer Finance (subconsolidated basis) discloses information related to articles 437, 438, 440, 442, 450, 451, 451a y 453 available in their website.

The additional disclosures for the large subsidiaries (in accordance with Article 4 No. 146 and 147 CRR) can be found within the Pillar 3 reports of the respective subsidiary as published on the corresponding website.

Each banking subsidiary is directly regulated by their local banking supervisors, who set and monitor their local capital and liquidity adequacy requirements. In most jurisdictions non-banking financial subsidiaries are also subject to the supervision and capital requirements of local regulatory authorities.

The regulators of the Group’s banking entities outside the EEA are at varying stages of implementation of the Basel framework. Local regulation in 2024 may have been implemented on the basis of Basel I, II or III.

For more information about the international Group structure see Appendix II.

2024 Pillar 3 Disclosures Report    15

Credit institutions must meet a series of minimum capital and liquidity requirements. These minimum requirements are regulated by the European Capital Requirements Regulation (CRR) directly applicable under the Spanish legal system, and by the Capital Requirements Directive (CRD).

On 19 June 2024, the final update of the banking package was published in the Official Journal of the European Union Regulation (EU) 2024/1623 (CRR3) amending the CRR as regards requirements for credit risk, credit valuation adjustment risk, operational risk, market risk and the output floor and also Directive (EU) 2024/1619 (CRD6), amending the CRD as regards requirements for supervisory powers, sanctions, third-country branches, and environmental, social and governance risks.

The update of the banking package aims firstly to implement Basel III final reforms and, secondly, to enhance the standardisation of banking supervision in the European Union (EU).

The CRR3 introduces greater sensitivity to standardised metrics, to reduce the variability of risk-weighted assets between institutions using internal models for capital requirement calculation and facilitate the comparability among banks. The main changes introduced are as follows:

•Output floor: A risk-weighted assets floor is introduced, consisting of 72.5% of the total risk exposure amount calculated using standardised methods. The aim is to limit variability and excessive reduction in capital consumption in institutions that apply internal models. The regulation includes a transitory period to give institutions sufficient time to adapt.

•Standardised credit risk method: The CRR3 introduces greater risk sensitivity by creating specific exposure classes, and greater granularity in the range of applicable RWs, such as the new treatment of exposures guaranteed by immovable property. In addition, the minimum CCF is increased from 0% to 10%, with a transitional arrangement for the necessary accumulation of capital.

•IRB credit risk approach: The escalation factor is eliminated from the Risk Weight Asset (RWA) calculation formula and opens the possibility for an entity to use this approach for some exposure classes instead of requiring the implementation of IRB in all portfolios. Also, the F-IRB approach is made obligatory for low-default exposure classes (institutions and companies with revenue greater than €500 million). In addition new floors are introduced for the PD and LGD parameters to limit their variability.

•Credit risk mitigation: Clarity in the recognition of personal guarantees if exposures towards the guarantor and debtor are treated using different credit risk approaches (standard approach, F-IRB, A-IRB or slotting).

•Operational risk: The methods existing up until the 31 December 2024 have been replaced by a single Standardised Measurement Approach based on the business indicator. The new approach (SMA) consists of the Business Indicator Component (BIC), which multiplies the Business Indicator (BI) with an escalation factor (between

12% and 18%) depending on the institution's BI volume. The BI has 3 components: ILDC, SC and FC. The loss component (ILM) in the Basel Framework has been disregarded in the new Regulation, as the European regulatory authority made use of the discretion permitted by the Basel Framework. The CRR3 also includes: (i) the possibility of calculating a separated ILDC, for which a supervisory approval is required; and (ii) a transitional period where institutions can continue applying the current ASA until the separated ILDC calculation is granted by the ECB.

The goal of achieving more robust supervision and protection of financial stability in the CRD6 is expressed in a series of provisions concerning: fit-and-proper requirements, extending the scope by revising certain definitions and additions on the establishment of third-country branches in the EU in order to achieve greater regulatory harmonisation and better supervision of this type of entities.

The CRR3 and CRD6 came into force on 9 July 2024. Although early implementation was established for certain provisions, such as certain definitions that may affect the scope of consolidation or the capital requirements for crypto assets exposures, most of the changes were not applicable until 1 January 2025. At the same time the regulatory authority has imposed a delay for certain changes, due to issues resulting from difficulty in their implementation by institutions or to level the playing field with respect to other comparable jurisdictions. Specifically, the new regulation for the market risk capital calculation approach (FRTB), linked to the standards already published by the Basel Committee on Banking Supervision (BCBS) in 2017, will be delayed to 1 of January 2026 at the earliest. The Commission and the Council, without opposition from the Parliament, have issued a delegated act stipulating a delay of 12 months for the application of this standard, which is generating uncertainty regarding the form, content and date of implementation of this approach in other comparable jurisdictions, such as the UK and US.

This delay, which was published in July 2024, is accompanied by a delay in the rules regulating the Trading and Banking Book Boundary allocating instruments between investment and trading books for prudential purposes, the definition of trading and investment desks, the rules regarding the prudential recognition of internal risk transfers between investment and trading books, the treatment of structural FX and newest market risk reporting and disclosure framework.

For the calculation of the output floor banks have to use the FRTB SA model for calculating the market share of the output floor and compare it with the results from the internal model or CRR2 market standardised model, depending on the use by each institution. Therefore, this is the only metric in which FRTB SA is, as today official and binding.

Other provisions, such as the new regulation on calculating capital by Credit Valuation Adjustment (CVA) risk, which significantly impact the capital requirements, are not affected by this delay and have come into force as of 1 of January 2025.

The changes regarding the CVA mainly affect the methodological modifications for capital calculation and establish a new standard model based on sensitivities aligned with the new standard model for calculating capital requirements for market risk.

16    2024 Pillar 3 Disclosures Report

The new Regulation contains several mandates to the EBA to prepare level 2 or 3 standards (regulatory technical standards, implementing technical standards and guidelines) which give further details on particular aspects of the regulation. In this regard, at the end of 2023 the EBA published the EBA Roadmap, segmented into four stages, in which the changes of the banking package have to be implemented. The EBA will address legal deadlines for the according changes (up to four years after the implementation of the CRR3 and CRD6). Additionally, at the end of 2024 the EBA published its timeline for 2025, defining the guidelines for the implementation of the mandate in this year. The EBA will also be revising and updating the SREP guidelines.

In addition to the publications resulting from the implementation of the banking package in June 2024, the EBA published an update of the report on monitoring of AT1, T2, MREL and TLAC, which provides guidance on the prudential assessment of the instruments other than CET1 instruments and other aspects regarding the eligibility criteria and the terms and conditions of those issuances.

In terms of resolution regulation, Institutions must have an adequate funding structure to ensure that, in the event of financial distress, the institution has sufficient liabilities to absorb losses in order to recover or resolve its positions, while ensuring the protection of depositors and financial stability. For this purpose global systemically important institutions must therefore meet several minimum loss-absorbing requirements, e.g. Total Loss-Absorbing Capacity (TLAC), Minimum Requirement for own funds and Eligible Liabilities (MREL), which are regulated by the CRR and by the Bank Recovery and Resolution Directive (BRRD).

The regulation on the prudential treatment for global systemically important banks was published on 25 October 2022. This modified both the CRR and the BRRD regarding the prudential treatment of global systemically important banks (G-SIBs) with a multiple point of entry (MPE) resolution strategy, as well as the methods for indirect subscription of eligible instruments (Daisy Chains) to meet the minimum requirement for own funds and eligible liabilities. This regulation, known as the 'Quick Fix', covers the following two objectives:

•The inclusion in BRRD and CRR of references to third country subsidiaries to adjust the deduction for the holding of TLAC instruments issued from subsidiaries in third countries based on the excess TLAC/MREL existing in those subsidiaries, as well as the adjustment where the sum of the requirements for own funds and eligible liabilities of G-SIBs under an MPE strategy is higher than the theoretical requirement for the same group under a single point of entry (SPE) strategy. The latter adjustment is based on a comparison between the two possible resolution strategies.

Additionally, for the subsidiaries in jurisdictions without a resolution regime in place, the Regulation provides a transitional period until 31 December 2024. During this transitional period the institutions may adjust the deductions based on the excesses above the capital requirements in subsidiaries in third countries, if they meet certain requirements.

•Inclusion of a deduction scheme for MREL instrument holdings through entities of the same resolution group other than the resolution entity. This regulation sets a deduction for the intermediate entity (Daisy Chains) that repurchases instruments, and, if there is such a deduction,

the intermediate entity is obliged to issue the same amount as it is repurchasing, transferring the internal MREL needs to the resolution entity, which will cover it with external MREL.

This Regulation is applicable from the 14 November 2022, except for the provisions relating to Daisy Chains, which applies from the 1 January 2024.

In April 2024 Directive (EU) 2024/1174 was published, which amends the Daisy Chain Act to exclude daisy chain requirements in some cases, e.g. institutions that would prefer liquidation rather than resolution.

Additionally, in 2024 the SRB amended the MREL policy to adapt it to the latest amendments involving daisy chains, among other aspects.

The Deposit Guarantee Schemes (DGSs) are regulated by the Deposit Guarantee Schemes Directive (DGSD), which has not undergone any significant changes since its publication in 2014. The Directive aims to harmonise the DGSs of the Member States, thus ensuring stability and balance in the various different countries. The Directive creates an appropriate framework for depositors to have improved access to DGS through the establishment of a clear scope of coverage, shorter repayment periods, the requirement of a reliable information and robust funding requirements of the DGS. This Directive is transposed into Spanish law by Royal Decree 2606/1996, with additional amendments set forth in Royal Decree 1041/2021.

To guarantee customers' deposits, the DGS collect available financial means in the form of contributions that members institutions have to make at least once a year. These annual contributions are established depending on the total covered deposits and the risk profile faced by the institutions involved in the DGS. The method for calculation contributions is set out in the EBA Guidelines (EBA/GL/2023/02). After the target level of 0.8% of the amount of covered deposits was reached, with the contributions raised until 2023, the Spanish DGS has not required the additional contribution to its institution's deposits compartment (however, it will require a contribution to its securities compartment in February 2025 according to institution's data as of December 2024).

Lastly, on 18 April 2023, the European Commission published its proposal to review the Crisis Management and Deposit Insurance (CMDI) framework. Specifically, several proposals have been submitted:

•Early intervention measures, conditions for resolution and funding for the resolution measure;

•The scope of deposit coverage, prelation order of the loss absorbency of the deposits, use of funds of the deposit guarantee schemes, cross-border cooperation and transparency; and

•Certain aspects of the minimum requirement for own funds and eligible liabilities.

These proposals imply amending regulations such as:

•CRR;

•BRRD;

•Single Resolution Mechanism Regulation (SRMR), which establishes uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism (SMR) and a Single Resolution Fund;

2024 Pillar 3 Disclosures Report    17

•DGSD.

The Council agreed on 19 June 2024 on its position on the revision of the CMDI, which includes a broad set of measures aiming to strengthen the current EU crisis management framework. The trialogue process was initiated in December 2024.

Since the publication of the European Commission's action plan supporting EU climate and sustainable development goals for 2030, several different regulatory measures have been drawn up with the aim of generating an optimum framework for the development of sustainable finance.

In 2024 the Commission Delegated Regulation (EU) 2023/2486 was implemented, which establishes technical criteria for determining the conditions under which an economic activity qualifies as contributing substantially to the four environmental objectives that were pending development (sustainability and protection of water and marine resources, transition to a circular economy, pollution prevention and control, and protection and restoration of biodiversity and ecosystems). Also the Commission Delegated Regulation (EU) 2023/2485 was implemented, which incorporates regulations under which a series of new economic activities (not previously included in the 2020 Taxonomy Regulation) qualify as contributing substantially to the two Taxonomy climate objectives (climate change mitigation and climate change adaptation).

In addition to developing the classification of sustainable activities listed in the Taxonomy, from a prudential perspective, the CRR3 has introduced new requirements for integrating ESG risks in this framework, in particular including definitions, a "more ecological" infrastructure supporting factor, climate considerations in guarantee assessments and additional mandates to assess whether the prudential treatment of exposures related to assets or liabilities subject to the impact of environmental or social factors should be adjusted. To assess precisely whether specific prudential treatment is required, the CRR3 provides three mandates for creating the reports that assess data availability for the exposure classes, evaluating the actual risk situation of exposures that affect environmental factors compared with the risk situation of other exposures and the potential effects of prudential treatment on financial stability. If considered necessary after publication of these reports, a legislative proposal to amend the current prudential framework may be submitted to the Commission by 31 December 2026 to ensure a prudential framework which will continue supporting financial stability and a sustainable transition.

Furthermore, the CRR3/CRD6 regulatory package contains additional disclosure obligations concerning ESG, obligations on reporting to competent authorities and the obligation to establish specific plans for addressing short-, medium- and long-term financial risks derived from ESG factors, including generated risks as a consequence of the transition period.

In 2024 the EBA held a consultation on the Guidelines on the management of ESG risks. As result several points have been concluded: reference methodology for the identification and measurement of ESG risks, minimum standards and reference methodology for the management and monitoring of ESG risks, and transition plans addressing the key aspects included in the new CRD6.

At the international level and particularly regarding reporting obligations on climate risks, it is important to note that the Basel Committee published a consultation paper at the end of 2023 proposing a series of qualitative and quantitative requirements which should be disclosed in the entities' Pillar 3 reports. In this document the Committee acknowledges that precise, consistent and quality climate data is still evolving. However the Committee believes that the disclosure requirements will expedite the availability of said information and will facilitate banks' prospective risk assessments.

Other regulatory initiatives approved in 2024 or that are in the final stage of being approved by European institutions include the following:

•The Review of the Energy Performance of Buildings Directive, which targets to expedite the transition of Member States' real estate portfolio and seeks greater standardisation in Energy Performance Certificates, and will be transposed in May 2026.

•The proposal on ESG ratings to regulate the transparency and integrity of environmental, social and governance (ESG) rating activities, which was adopted in the Regulation on the transparency and integrity of ESG rating activities. This regulation was published in November 2024 and is expected to be implemented in the third quarter of 2026.

•Publication of the Regulation (2023/2631) on European green bonds that sets forth uniform requirements (use of funds, disclosure requirements etc.) for bond issuers to use the name "European Green Bond" or "EuGB" and will apply from 21 December 2024.

•The proposed Regulation establishing the European Single Access Point (ESAP), which will help investors and other stakeholders access information about companies. This Single Access Point will offer centralised digital access to financial and sustainability information that has been published by European companies.

•In response to the European Commission's request in 2022 concerning the greenwashing risk and supervision of sustainable finance policies, in September 2024 the EBA published the final report on greenwashing monitoring and supervision. This report contains bests practices and recommendations to mitigate the risk of greenwashing and to ensure that information on sustainability is comprehensive and clear. Institutions must also take a proactive approach to incorporating ESG risks in their comprehensive risk management framework.

•The ESMA published in May 2024 Guidelines on funds' names using ESG or sustainability-related terms. The aim is to specify the circumstances under which funds' names that use terms related to ESG or sustainability comply with the requirements established therein.

The aim of laying the foundations for the creation of a competitive digital future in the European Union has continued to drive the creation of a regulatory framework to that end. Regarding the extending of the use of technologies promoting innovation and competitiveness, new developments can be highlighted (initiatives which should have been initiated in 2024 or were published during this year) and grouped according to subjects:

18    2024 Pillar 3 Disclosures Report

For Markets in cryptoassets the (MiCA) establishes a common framework in Europe for the issue, custody and exchange of these assets. This regulation, although it has been in force since June 2023, is effectively implemented from December 2024, except for the rules on asset-reference tokens and e-money tokens which were applicable from June 2024.

Due to the increase in international crypto assets activities, significant adjustments have also been made to the prudential framework. Following the publication of the Basel standards, the European regulation needs to be adapted to incorporate them. Therefore, the CRR3 includes the mandate to the Commission to issue a legislative proposal by 30th June 2025 that incorporates international standards on the prudential regulation applicable in Europe. Until that framework is fully integrated, the CRR3 has set out a transitional framework for calculating own funds that will be applied until the Basel standards are incorporated. The implementation of this temporary treatment is pending more comprehensive elaboration in a technical standard to be issued by the EBA.

Apart from the treatment of exposures to this type of assets, the regulation also covers obligations concerning reporting to the competent authorities and disclosure to preserve transparency and market discipline. All these provisions have to be implemented before the enforcement date of the CRR3, and compliance is obligatory from 9 July 2024.

The preparation of a potential digital euro continued during 2024 and will go on until October 2025. The following milestones are included: finalisation of the operating rules for the digital euro framework and selection of suppliers that would be able to develop the necessary platform, the infrastructure and also multiple trials aimed at introducing a digital euro in the future. The decision, as to whether to issue a digital euro, will be assessed in November 2025. A regulation from 2023 is currently proposed by the European Commission which would permit and regulate the launch of the digital euro.

The European Artificial Intelligence (AI) Act, which regulates the use of AI technology in both the public and private sectors, was approved in 2024. It will be implemented two years after its entry into force, i.e. 2 August 2026, except for the following specific provisions, which will be implemented early: prohibition of AI systems that pose unacceptable risks, 6 months after approval; code of practice, 9 months after approval; governance and applications relating to general-purpose AI, 12 months after approval and, finally, high-risk AI systems must comply with the requirements and obligations 36 months after entry into force.

The Digital Operational Resilience Act (DORA), which is in force but will not be implemented until 17 January 2025, establishes a risk management framework for technology service providers that provide services to financial institutions and also imposes common cybersecurity requirements. This regulation comprises five key pillars: Information and Communication Technologies (ICT) risk management; classification and reporting of incidents relating to ICT; digital

operational resilience tests; third-party risk management and information exchange between financial institutions.

The RTS and ITS (regulatory and implementation technical standards), which develop the DORA Regulation, have been finalized in 2024 and published in two batches. The first batch of the RTS covers the ICT risk management framework, the criteria for ICT incident classification, specification of the policy on ICT services which support essential functions(*) and the draft ITS on the register of information. The second batch covers the criteria for specifying threat-led penetration testing (TLPT)(*), the templates, content, format, deadlines and procedures for major ICT incident reports, criteria for determining the composition of the joint examination team (JET), harmonisation of the conditions for performing supervision activities, and guidelines on both cooperation on supervision and estimation of the costs generated by major ICT incidents. All these rules implementing the DORA Regulation have been published as Delegated Acts of the European Commission except for the two marked with (*), which are expected to be published in early 2025.

The regulatory framework, that reinforces payment services, has continued to make progress with the introduction of additional requirements for payment institutions in 2024, to strengthen the legal framework already established by the PSD2 and to adapt to users' requirements in recent years, with a growing trend for electronic payments.

The legislative package contains two proposals: an update to the Payment Services Directive (PSD3) and a Payment Services Regulation (PSR), which introduce changes in the foundational framework of the European payments market. The proposed directive (PSD3) addresses rules on authorisation, licensing and supervision of payment institutions (including those for electronic money), while the proposed regulation (PSR) focuses on rules on the provision of payment services by payment service providers (PSPs). Their approval is expected in the first half of 2025.

The Instant Payments Regulation came into force on 8 April 2024. It establishes measures to facilitate and universalise instant transfers in euro within the EU. The target of this regulation is for instant payments to be more accessible, secure and affordable for consumers and companies, allowing funds to be transferred within less than 10 seconds at any time of day between Member States. This regulation establishes a precise calendar for compliance with obligations. Specifically, payment service providers that are located in a Member State with the euro as currency must provide the instant transfer receipt service from 9 January 2025 and the transfer sending service from 9 October 2025. Service providers that are located in a Member State not using the euro must provide the instant transfer receipt service from 9th January 2027 and the transfer sending service from 9 July 2027. An addition to the main amendments introduced by the regulation is the obligation to provide the payer, free of charge, as of 9th October 2025, with the service of verifying the IBAN of the beneficiary's account and the name of the beneficiary given by the payer is correct or shows any discrepancies.

The payment services have changed considerably over the last few years due to the increase in electronic payments in the European Union and the entry of new providers in the

2024 Pillar 3 Disclosures Report    19

market. Thanks to digital technologies, but also to the paradigm shift, a data economy in increasingly digital environments has been promoted. New regulations have been developed to address these advances. In June 2023, the European Commission published a legislative proposal introducing a new regulation on the creation of a framework for Financial Data Access (FiDA). This framework aims to establish rules on accessing, sharing, regulating and using particular categories of customer data in the financial sector, to define rules for the authorisation and operation of financial information suppliers and to determine the rights and obligations of users, data subjects and also financial information service providers. Its scope of application will be all the categories of data covered by the regulation and the types of institutions when they act as data managers or users. This proposal, which will continue to be negotiated by European co-legislators, will serve as a specific, standardised framework for Union-wide access to financial data, establishing regulations on the access, exchange and use of certain categories of customers' data in financial services, among other such matters.

Another significant development regarding data is the Data Act, which is a regulation designed to improve the EU data economy and boost a competitive data market by making data (especially industrial data) more accessible and usable, encouraging data-driven innovation and increasing data availability. This regulation gives users of connected products (companies or persons who own, lease or rent a product of this type) greater control over the data they generate, while maintaining incentives for those who invest in data technologies. This regulation will be applicable from 12 September 2025.

The European Digital Identity (EUDI) Regulation has been in force since 20th May 2024. This regulation provides a unique and secure digital wallet that can contain national digital identities and other certificates, provide access to a secure and reliable electronic identification and also share the stored electronic documentation.

20    2024 Pillar 3 Disclosures Report

The Official Journal of the European Union published on 19 June 2024 the regulatory package on Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT), which strengthens the existing EU anti-money laundering framework, improves the detection of suspicious transactions and activities and closes loopholes in the current regulatory framework. The new features include an extension of anti-money laundering rules to new regulated entities, such as the majority of the crypto assets sector, luxury goods merchants, and football clubs and agents. In addition, stricter due diligence requirements are established, beneficial ownership is regulated and a limit of €10,000 is set for cash payments, among other matters.

This regulatory package consists of:

•the Regulation (EU) 2024/1620 establishing a new European AML/CFT authority known as AMLA, which will be responsible for direct and indirect supervision of regulated entities in the financial sector. The creation of AMLA will ensure effective and adequate supervision of regulated entities that pose a high risk with regard to money laundering and terrorism financing, strengthen common supervisory approaches for all other regulated entities, and support and coordinate Financial Intelligence Units (FIUs). This regulation will be applicable from 1st July 2025, and AMLA is expected to be fully operational and initiate its direct supervision duties on 1 January 2028.

•The Regulation (EU) 2024/1624, which will be directly applicable, introduces changes to achieve better harmonisation and convergence in the application of regulations on anti-money laundering and countering the financing of terrorism throughout the EU. Thus, EU requirements are harmonised in areas such as customer due diligence, transparency requirements regarding beneficial ownership, information obligations and internal control measures for regulated entities, and the list of regulated entities is extended, among other aspects. This regulation will be applicable from 10 July 2027, although for exceptions it will be applicable from 10 July 2029.

•The Directive (EU) 2024/1640 (known as AMLD 6), a mechanisms to be put in place by Member States for the prevention of money laundering or terrorist financing. Specific rules are established on access to beneficial ownership registers, a framework for FIUs and national supervision of anti-money laundering, and rules on cooperation on AML/CFT and on the treatment of certain personal data categories (data protection), among other aspects. The Member States must transpose this Directive by 10 July 2027, bar some exceptions.

2024 Pillar 3 Disclosures Report    21

This section covers the qualitative requirements LIA - Explanations of differences between accounting and regulatory exposure amounts and LIB - Other qualitative information on the scope of application.

The following information is a summary of the main acquisitions and disposals of ownership interests in the share capital of other entities and other significant corporate transactions performed in the last three years or pending to be completed:

•Tender offer for shares of Banco Santander México, S.A., Institución de Banca Múltiple, Grupo Financiero Santander México.

•Agreement for the acquisition of a significant stake in Ebury Partners Limited.

•Purchase by SHUSA for shares of Santander Consumer USA.

•Acquisition of Amherst Pierpont Securities LLC, a U.S. fixed-income broker dealer

•Agreement for the sale of the stake in Caceis (2024)

•Accelerated placement of ordinary shares of Santander Bank Polska (2024)

For more information on the main acquisitions and disposals of holdings in other companies and other major corporate transactions by Santander last year, refer to the 'Auditor´s report' section of the 2024 Annual Report.

Santander entities are consolidated using a different method for accounting consolidation.

For the purposes of calculating the capital adequacy ratio based on the nature of their business activities, the Group companies included in the prudential scope of consolidation are consolidated using the full consolidation method, with the exception of jointly controlled entities, which use proportionate consolidation. All companies that cannot be consolidated based on their business activities are accounted for using the equity method and are treated as equity exposures.

The basis of the information used for accounting purposes differs from that used for calculating regulatory capital requirements. Risk exposure measurements may differ depending on the purpose of the calculation, such as financial reporting, regulatory capital reporting and management information. The exposure data included in the quantitative disclosures in this document is used for calculating regulatory capital or leverage ratio.

The companies using a different consolidation method, depending on the regulations applied (table LI3), are listed in Appendix VI of this document.

22    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    23

The difference in total assets between the public and the reserved scopes is not material (-EUR 16,794 Bn) and corresponds to the exclusion of non financial institutions (-EUR 26,088 Bn) and the inclusion of jointly controlled (+EUR 13,572 Bn) and intra/group entities (-EUR 4,278 Bn).

In addition, the sum of the carrying amounts of certain items is greater than the carrying amounts under the scope of prudential consolidation, as the financial assets held for trading and the financial assets at fair value through profit or

loss are subject to the capital requirements of more than one risk category under the regulatory scope.

The main differences between the carrying amounts in the financial statements and the exposures for prudential purposes are shown below:

This table shows a breakdown of the differences between the amounts of exposures for prudential purposes and the carrying amounts according to various parameters.

As shown in the table, the main cause for the deviation is the amount from the off-balance sheet items (+EUR 394.490 billion) and the application of CCFs (-EUR 310.530 billion).

Further the regulatory add-on (+EUR 59.567 billion) and the differences resulting from the various offsetting rules (-EUR 63.839 billion) are also applied.

The reconciliation of the public and non-public balance sheets (table CC2) is shown in table 4.

24    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    25

26    2024 Pillar 3 Disclosures Report

2024 Pillar 3 Disclosures Report    27

28    2024 Pillar 3 Disclosures Report