1. Implementing the Group Operational Risk approach in the Central European subsidiaries
Maria Louise Arscott
Operational Risk Management
Beograd May, 16th

2. Disclaimer
Statements in this presentations are to be intended as exclusive opinions of the author and do not represent those of Intesa Sanpaolo Group

3. Agenda Introduction Operational Risk Framework
Basel II in Central European Subsidiaries
Open Items and Conclusions

4. Intesa Sanpaolo One of the leading Banking Groups in Europe
Market capitalisation as at
Loans to customers as at
(€ bn)
(€ bn)
Ranking Eurozone
Ranking Eurozone
HSBC
156.2
RBS
695.3
UBS
95.6
HSBC
659.2
RBS
93.6
HBOS
561.1
SCH
86.3 1
Barclays
552.6
UniCredit
75.8 2
SCH
523.3 1
BNP Paribas
75.6 3
C. Agricole
455.4
(1) 2
Intesa Sanpaolo
75.0 4
ABN Amro
443.3 3
Barclays
71.4
UniCredit
441.3 4
Crédit Suisse
65.8
BNP Paribas
393.1 5
BBVA
65.3 5
Intesa Sanpaolo
327.4
(2) 6
ABN Amro
64.3 6
UBS
316.6
Soc. Générale
62.3 7
Soc. Générale
288.6 7
HBOS
59.2
Commerzbank
287.1 8
Deutsche Bank
55.2 8
Lloyds TSB
280.4
C. Agricole SA
50.1 9
BBVA
256.6 9
~18 million clients, of which ~11 million in Italy and ~7 million abroad
Source: 2006 Annual Reports. Sample including publicly traded European banking groups except for ING and Fortis (characterised by significant insurance business) (1) As of December (2) Pro-forma to include the effects of the transactions with Crédit Agricole

5. Intesa Sanpaolo Group Business Plan 2007-2009
Net operative incomes growth at 7% per year
Operative costs decreasing by 0,4% per year
Cost/Income from 52% to 42% in 2009
RWA at 9% per year
ROE growing from 15% to 21%
Core Tier 1 Ratio at 6,5% in 2009
High return to shareholders
Sustainable revenue growth

6. Branch market share and ranking
Intesa Sanpaolo Group
Unique customer reach in Italy
Branch market share and ranking 84 9%
176
19% 35
36%
1,282
21%
709
21%
Rank. 1 1 1 1 1
628
24%
383
11%
159
17%
121 5%
182
16%
137
25%
37%
24%
16%
23%
100%
122
18%
434
17%
Largest domestic branch network
branches: ~5,700
market share: 17.5%
clients: ~11 million 23
16%
280
20%
457
119
17%
29% 34
14%
Best branch footprint in Italy
market share >15% in 15 regions out of 20
Leveraging on historical local brands as well as on a strong national brand
Scale effect in almost all activities 91
17%
197
11%
5-10%
10-15%
15-20%
>20%
Source: Bank of Italy for market shares. Data as of 2006 year-end pro-forma to include the effects of the transactions with Crédit Agricole

7. Sanpaolo IMI Bank Romania RUSSIA – SME Specialist
Intesa Sanpaolo Group
Significant presence abroad
ALBANIA – Ranked 2nd
ABA - BIA
~7 million clients
~1,250 branches
CROATIA – Ranked 2nd
PBZ
SERBIA - Ranked 2nd
BIB - Panonska
Russia
SLOVAKIA - Ranked 2nd
VUB
HUNGARY - Ranked 2nd
CIB - IEB
Slovakia
Hungary
Romania
Slovenia
EGYPT - Ranked 4th
Bank of Alexandria
BOSNIA HERZEGOVINA
Ranked 5th - UPI - LTG
Croatia
Serbia
Bosnia
SLOVENIA - Ranked 7th
Banka Koper
Albania
ROMANIA - Ranked 22nd
Sanpaolo IMI Bank Romania
Egypt
RUSSIA – SME Specialist
KMB

8. Why Central Eastern Europe
Intesa San Paolo Business Plan for Foreign Banks Division
Significant growth in Romania and Russia
Strengthen position in Slovenia and Bosnia
Consolidate primary positioning in Croatia, Albania, Hungary, Slovakia and Serbia with focus on excellence in term of Cost/Income and EVA
New strategic acquisition where already present or in large emerging countries in line with revenue Group strategy
Extend the most advanced mechanisms of direction, management and control to all Banks
Realize Group revenue synergies (leveraging on Centres of Excellence, Customer Satisfaction, unit for commercial product and process development)
Realize cost synergies (rationalize processes and structure, costs)

9. Agenda Introduction Operational Risk Framework
Basel II in Central European Subsidiaries
Open Items and Conclusions

10. Project approach Basel II Project Management Use Test and Validation
Phase 1
Phase 2
Phase 3
Phase 4
Plan
Framework Design and Implementation
Use test and
validation
Monitoring
and control
Corporate Governance/ Risk Management
Organization
Internal policies
Processes
Dedicated applications and procedures
Basel II Implementation Main Project
Approach
Models
Roll-Out and Change Management
Basel II Project:
Gap analysis
Impact Analysis
Master plan Basel II
Use Test and Validation
Monitoring and Control
Data management
Data
Reporting
IT Systems
Validation Process
Basel II Project Management

11. Basel II Project Structure
Other project references:
PMO
IT Systems
Internal Validation
Internal Auditing
Operational Risk
(G. Mignola)
Operational Risk
Coordination
Group
Framework OR
(Albanese)
OR Core Processes
(Orio)
TSA
(Venturino)
AMA
(Ugoccioni)
Deliverables
Risk Governance Guidelines
Compliance with other policies and laws (Audit, BCP...)
Scoping Basel II perimeter
New structure and implant for ORMD/ORA
Core process definition (LDC, AS, VCO, KRI) and related policies
Reporting
Data sources to feed Op Risk database, historical data recovery
Database merging
Courses for ORMD
Support to units going AMA
Feeding for reporting system
Framework implementation documentation
Mapping MINT on BL
Framework implementation documentation
Scoping for BU and other subsidiaries included in AMA perimeter
Approval of framework
Reporting
AMA Validation documents for Regulators

12. Operational Risk Measurement and Management (framework)
Main deliverables
Organizational structure and training program
Internal policies
Classification criteria and unified standards
Measurement model
IT systems
Operational Risk Measurement and Management (framework)

13. Agenda Introduction Operational Risk Framework
Basel II in Central European Subsidiaries
Open Items and Conclusions

14. AMA Roll Out Main Group Units A Phased approach 2008 2009 2010 2011
half 2
half 1
half 2
half 1
half 2
half 1
half 2
half
First Wave
STD
AMA
Second wave
STD
AMA
Third wave
BASIC
STD
AMA

15. Basel II OpRisk local implementation and usage
Project
Execution
HQ ORM Unit responsibilities:
Develop and maintain core processes and procedures
Develop and maintain TSA and AMA model
Develop and maintain internal policies
Coordinate the Application process with the regulators
Publish Documentation
Provide Local ORM training
Report to Group Risk Committee
Local ORM responsibilities
Implement and maintain framework locally
Coordination/Interface with local regulators
Report to local Management
Provide feedback to HQ ORM Unit
HQ ORM Unit responsibilities:
Monitor and report on consolidated data
Estimate Risk Exposure
Support and monitor local ORMs
Interface to Validation Unit
Manage external data
Level 2 controls
Local ORM responsibilities
Interface with HQ ORM Unit
Supervise data collection and validation
Use test and reporting
Effect local controls to make sure the ORM processes and procedures are functioning correctly

16. Challenges Operational Risk is everywhere: high organizational impact
Inertia to changes
Project management and sponsorship (milestone driven approach)
Changes in the surrounding context (organizational restructuring, mergers etc)
Overlapping roles and uncertainty surrounding boundary issues
Regulatory overload
The inputs and outputs should be used in day-to-day management processes (value proposition and use test)
Sustainability when shifting from project to execution
Measurement: modelling is still in its infancy
Validation

17. Agenda Introduction Operational Risk Framework
Basel II in Central European Subsidiaries
Open Items and Conclusions

18. Open Items and final considerations
Home-Host: validation process and timing
Pillar 2
Disclosure
The management of Operational Risk is perceived as a compliance issue and not an opportunity to improve efficiency and protect the brand, thus it is treated as an outsider to business management and allocated a low priority
Operational Risk professionals are at a very challenging stage of their development – have I added any value so far? Will I add value in future? How do I know? What do we want to do when we “grow up”? Benign period?
Accountability and discipline around expected results are key to fulfilling the potential value proposition of proactive OpRisk Management
A firm’s business culture is the most critical element to successful risk management
Risk culture is a component of overall business culture
Is the risk management a cost of doing business or a barrier to doing business ?

19. Thank-you Maria Louise Arscott
Head of Group Operational Risk Management
Banca IntesaSanpaolo
Piazza Paolo Ferrari 10, Milano – Italy