About this Report Chairman's Foreword Corporate Management Report Appendices Governance Consolidated Financial Company Financial Statements Statements a minimum. We assess the integrity of our customers and of our business objectively, we provide suitable products to our customers and we do not engage in non-sustainable business activities. Protect profit and profit growth. Rabobank's business strategy is strongly related to its cooperative roots. We aim to generate healthy profits while also realizing the highest standards for our members, customers and for society. Maintain a solid balance sheet. Sound balance sheet ratios are essential to ensuring continuity in servicing our customers under sustainable and favorable conditions. Protect Rabobank's identity and reputation. A solid reputation is essential to maintaining stakeholders' fundamental trust in the bank. Make healthy risk-return decisions in line with the strategic objectives. Make transparent choices based on where capital and resources can be used most efficiently or appropriately with respect to sectors or concentrations. These priorities are strongly interwoven, and fully depend on maintaining sound governance and risk culture throughout the Top Risks Risk The Risk of Digital change Cyber Security IT Disruption Sustainability Economic uncertainties Regulatory impact Perception skills Risk Appetite Rabobank's Risk Strategy is embedded in a set of Strategic Risk Statements directly linked to the Strategic Framework 2016-2020 along the four strategic themes of complete customer focus, rock-solid bank, meaningful cooperative and empowered employees.These themes define the high-level boundaries ofthe risk appetite within which we must operate. The Risk Appetite Statement (RAS) further specifies the Strategic Risk Statements and defines the levels and types of risk Rabobank is willing to accept to achieve its business objectives. The RAS articulates Rabobank's overall desired level of risk exposure, both quantitatively and qualitatively, and is used in all business activities to assess the desired risk profile against the risk-reward profile of a given activity. Rabobank's Group level risk appetite is an integral part ofthe bank's strategy and is incorporated in the organization. Delivering long-term customer value requires a solid balance sheet, cost efficient funding and supporting the bank's profitability and a good reputation. At the same time, maintaining a solid balance sheet requires healthy profitability and a sound reputation. Risks Related to Our Strategy Rabobank's risk management activities are an integral part of strategy design and execution. New strategic initiatives may open exciting opportunities, but the expected rewards must be balanced against the related risks. The digitalization ofthe banking environment does bring along risks not encountered before. Rabobank keeps track of external developments and closely monitors how (future) risks might impact the realization of our strategic objectives. Regular, structural top-down and bottom-up risk assessments are performed to identify various types of risks, and specific stress tests are conducted to calculate the impact of adverse scenarios. An integrated overview of these risks, changes to them and measures taken to address them are discussed periodically in the Managing Board and Supervisory Board: Group Information Security Office, Cloud Strategy, Cyber Security Threat Elimination Program (STEP), Controlled test attacks on our live critical core systems, Integrated protection for Rabobank websites Department Sustainability, Climate Change Oversight Committee, Deep dives Climate Change Impact (Credit), Regulatory Oversight, Capital prioritization, MTP, Regulatory Markets Infrastructure (RMI), CARE (incl. COB CDD), Risk Control Framework (RCF), Enhancing Control, Modelling Landscape Rabo RIGHT, Speak up, Integrity (SIRA) culture assessments, Projects: Risk Control Framework (RCF), Performance Health, XFT Leadership, KPIs, Ethics Office, Diversity inclusion organization's budget planning where it influences day-to-day risk-taking. Entity-specific risk appetite statements further specify the group risk appetite at entity level. The several material types of risk inherent in the bank's business model and strategic plan are actively identified, assessed, mitigated and monitored. Nevertheless, unforeseen developments could always impede the overall business plan. On an aggregated level however, the risk appetite is articulated for capital, profitability and reputational impact with the following guiding principles: We are a strongly capitalized bank, with prudent buffers above regulatory requirements to protect senior bond holders against the (unlikely) event of bail-in. We do this cost- Increased competition in financial services enabled by lowered barriers and technical possibilities Loss of data or disruption of our services caused by cyber security threats and the changing IT landscape Climate events and transition to a more sustainable society Economic conditions and (geo)political tensions Tightened and additive effect of regulations Dissatisfied customers and outrage in society caused by our own behavior and inadaptability to change Economic conditions and (geo)political tensions Portfolio management, Medium Term Planning (MTP) process, risk appetite, Risk assessments, Limits, Stress testing, Capital and liquidity planning Managed by e.g. Bankieren 3.0, IT Portfolio management. Digital Transformation projects Annual Report 2018 - Management Report 61

Annual Reports Rabobank | 2018 | | pagina 63