BFF Bank S p A : III Pillar - Public Disclosure – 2020

PILLAR III

Disclosure to the public

2020

Contents

Introduction	2
Section 1 - Risk management objectives and policies (Art. 435 CRR)	5
Section 2 - Scope of application (Art. 436 CRR)	31
Section 3 - Own funds (Art. 437 CRR)	35
Section 4 - Capital requirements (Art. 438 CRR)	42
Section 5 - Exposure to counterparty credit risk (Art. 439 CRR)	48
Section 6 - Capital buffers (Art. 440 CRR)	49
Section 7 - Credit risk adjustments (Art. 442 CRR)	51
Section 8 - Unencumbered assets (Art. 443 CRR)	62
Section 9 - Use of ECAIs (Art. 444 CRR)	65
Section 10 - Exposure to market risk (Art. 445 CRR)	68
Section 11 - Operational risk (Art. 446 CRR)	70
Section 12 - Exposures in equities not included in the trading book
(Art. 447 CRR)	74
Section 13 - Exposure to interest rate risk on positions not included in the trading
book (Art. 448 CRR)	75
Section 14 - Exposure to securitization positions (Art. 449 CRR)	79
Section 15 - Remuneration policy (Art. 450 CRR)	81
Section 16 - Leverage (Art. 451 CRR)	93
Section 17 - Use of credit risk mitigation techniques (Art. 453 CRR)	97
Section 18 - NPE Disclosure (EBA Guidelines)	98
Section 19 - Disclosure on exposures subject to measures applied in
light of the COVID-19 crisis	101
Certification by the Financial Reporting Officer	104

Pillar III 2020

1

Introduction

The Basel Committee Accords ("Basel 3") aimed at strengthening banks' capacity to absorb shocks from financial and economic tensions, improving risk management and governance and strengthening banks' transparency and reporting, entered into force in European Union law with effect from January 1, 2014.

This being said, at Community level, the contents of "Basel 3" were adopted with two distinct pieces of legislation:

• Regulation (EU) No. 575/2013 dated June 26, 2013 ("CRR") - Part eight "Disclosure by institutions" (Arts. 431 - 455) and Part ten, Title I, Chapter 3, "Transitional provisions for disclosure of own funds" (Art. 492) - which governs Pillar I prudential supervision mechanisms and public disclosure rules (Pillar III);
• Directive 2013/36/EU of June 26, 2013 ("CRD IV"), which concerns, inter alia, conditions for access to banking, freedom of establishment and freedom to provide services, the prudential supervision process and additional capital reserves.

The above-mentioned European regulation became applicable in the Italian legal system on the basis of Bank of Italy Circular No. 285 "Supervisory Provisions for Banks" of December 17, 2013 as subsequently amended, which implements the provisions of the CRR and the CRD IV.

Furthermore, the Committee maintained the three-pillar approach underpinning the previous Basel 2 capital accord, expanding it to increase the quantity and quality of intermediaries' capital.

Specifically:

• Pillar I defines the system of capital requirements that banks are required to meet to deal with typical banking risks: credit risk (which also includes counterparty risk), market risk and operational risk.
  This aspect has been strengthened by introducing a definition of higher quality capital and requiring additional capital conservation buffers, with the inclusion of rules on liquidity risk management, for both the short term
  (Liquidity Coverage Ratio - LCR) and the long term (Net Stable Funding Ratio - NSFR), and the introduction of a limit on leverage;
• Pillar II requires banks to set up strategies, control processes and tools for determining, in addition to Pillar I risks, the adequacy of current and future capital. It is the Supervisory Authority's responsibility to verify the reliability and accuracy of the results generated and, where necessary, to take appropriate corrective action. The BFF Group annually submits the "ICAAP/ILAAP Report" to the Bank of Italy, as an autonomous assessment of current and future capital adequacy and the liquidity risk governance and management system in relation to the risks assumed and company strategies;
• Pillar III establishes specific periodic disclosure obligations concerning capital adequacy, risk exposure and the general features of the related systems for the identification, measurement and management of such risks. This aspect has also been revised to introduce increased transparency requirements and more detailed information on the breakdown of regulatory capital and on how the Banking Group calculates its capital ratios.

Pursuant to Article 433 of the CRR, banks shall publish the disclosures required by EU regulations at least on an annual basis, in conjunction with the financial statements.

To this end, the Board of Directors of Banca Farmafactoring has approved a dedicated procedure named "Procedure for Disclosure to the Public (Pillar III)".

Pillar III 2020

2

Pursuant to this procedure, the disclosure to the public should be:

• approved by the Board of Directors before it is made public;
• published on the websitewww.bffgroup.com (Investor Relations Section) at least once a year by the deadline for the publication of the financial statements, and therefore within thirty days of the date of approval of the financial statements by the Shareholders' Meeting.

The Banca Farmafactoring Banking Group (hereinafter, also the "BFF Banking Group") operates primarily in the management and financing of receivables of suppliers of the Public Administration and, in particular, public healthcare systems. The Group is active in Italy, Portugal, Greece, Croatia and France through Banca Farmafactoring, in Spain through BFF Finance Iberia and in Poland, the Czech Republic and Slovakia through BFF Polska and its associates (the "BFF Polska Group").

Banca Farmafactoring meets the obligation of disclosure to the public for the Banca Farmafactoring Banking Group and drafts this document on a consolidated basis based on the above-mentioned regulatory provisions. In accordance with the provisions of the CRR, the scope of consolidation, used solely for prudential supervision purposes, envisages that BFF Luxembourg S.à r.l. is the parent. Therefore, the relative tables will include the information referring to the Banking Group in accordance with the Consolidated Law on Banking ("T.U.B.") as well as the most significant data of the CRR Group reported to the Bank of Italy.

In order to prepare the financial statements and the Pillar III report, for tables that do not refer to prudential supervisory reporting, the reference will continue to be the Banking Group pursuant to the T.U.B.

Please note that:

• Information on the risks to which the Banking Group is exposed and on risk management and control policies is also provided in Part E of the Notes to the Consolidated financial statements at December 31, 2020;
• Information relating to Own funds and banking capital ratios, relating both to the CRR Group and the Banking
  Group pursuant to the T.U.B., is also published in Part F of the Notes to the 2020 Consolidated financial statements;
• Information on governance is also provided in the "Report on Corporate Governance and Ownership
  Structure" published in the "Governance" section of the Banking Group website www.bffgroup.com;
• Information regarding the Banking Group's remuneration and incentive policies is also provided in the "Report on Remuneration" published in the "Governance" section of the Banking Group website.

Please note that, following the elimination of BFF Luxembourg Sarl's shareholding in the Bank in February 2021, the Bank of Italy, via a notice dated February 23, 2021 removed the CRR Group mentioned above from the register of banking groups.

In addition, following the merger of DEPObank S.p.A. on March 5, 2021, the Disclosure to the Public prepared by the merged Bank will be published on the BFF Bank website as soon as possible.

The Disclosure to the Public (Pillar III) is also subject to the certification of the Financial Reporting Officer pursuant to Article 154-bis of Legislative Decree 58/98 (Consolidation Law on Finance, or "TUF").

This document is broken down into 16 sections, which provide qualitative and quantitative information referring to the date of December 31, 2020.The paragraphs for which there is no informational content are not published.

All amounts are stated in thousands of euros, when not specified otherwise.

Pillar III 2020

3