Banco de Chile seeks to maintain a risk profile that ensures the sustainable growth that is aligned with its strategic objectives, maximizing value creation and guarantee its long-term solvency. Global risk management takes into consideration the different business segments served by the Bank, being approached from a comprehensive and differentiated perspective.

Our risk management policies are established in order to identify and analyze the risks faced by the Bank, set appropriate risk limits, alerts and controls, monitor risks and compliance with limits and alerts in order to carry out the necessary action plans. Through its administration policies and procedures, the Bank develops a disciplined and constructive control environment. Policies as well as risk management standards, procedures and systems are regularly reviewed, and with strict adherence to compliance with the current regulatory framework.

For this, the Bank has teams with extensive experience and knowledge in each area associated with risks, ensuring comprehensive and consolidated management of the same, including the Bank and its subsidiaries.

Credit, Market and Operational Risk Management are at all levels of the Organization, with a Corporate Governance structure that recognizes the relevance of the different risk areas that exist.

The Bank’s Board of Directors as the maximum authority is responsible for establishing risk policies, the Risk Appetite Framework, and the guidelines for the measurement criteria and follow up of risks. Also, it approves the risk limits and contingency plans for each of the risks. Moreover, it approves the following policies: Credit risk policy, policy for complex products and services, operational risk policy, business continuation policy, outsourcing policy, market risk policy and liquidity risk policy. Likewise, it approves the provision models, Additional Provisions Policy and pronounces annually on the sufficient provisions. Additionally, approves the policy of capital management for the monitoring, control, administration and the management of the bank´s capital. Also, it ratifies the strategies, functional structure and comprehensive management model of Operational Risk and guarantees the consistency of this model with the Bank’s strategy and proper implementation of the model in the organization. Along with this, it has approved the risk management policy of the model together with the development framework, validation and follow up of the models. Furthermore, it establishes the Subsidiary Risk Control Policy, describing the supervision scheme that the Bank applies to the relevant subsidiaries to control the risks that affect them. For its part, the Administration is responsible both for the establishment of standards and associated procedures as well as for the control and compliance with the disposed by the Board of Directors, ensuring that there is consistency between the criteria applied by the Bank and its subsidiaries, maintaining strict coordination at the corporate level and informing the Board of Directors in the defined instances.

The Bank’s Corporate Governance considers the active participation of the Board, acting directly or through different committees made up of Directors and Senior Management. It is permanently informed and becomes aware of the evolution of the different risk management areas, participating through its Finance, International and Financial Risk, Credit, Portfolio Risk Committee, Higher Committee of Operational Risk and Capital Management, in which the status of credit, market and operational risks and the Bank’s capital management are reviewed.

The following sections describe the different committees of Directors and Administration mentioned.

Risk Management is developed by the Corporate Risk Division, which by having highly experienced and specialized teams, together with a solid regulatory framework, allows for optimal and effective management of the matters they address.

It should be noted that in August 2024, the Corporate Risk Division was established, which consolidates the previous risk divisions that existed in the bank. The division contributes to providing effective governance to the Corporation’s main risks, with a focus on optimizing the risk-return relationship, ensuring business continuity and generating a robust risk culture, identifying potential losses derived from the non-compliance of counterparties, movements in market factors or the lack of adequacy of processes, people or systems, contributing comprehensively to capital management.

Likewise, it continually manages risk knowledge from a comprehensive approach, in order to contribute to the business anticipating threats that may damage the solvency and quality of the portfolio, promoting a unique risk culture towards the Corporation through training and permanent education.

Within this Division, the Bank’s risk functions are integrated as follows, ensuring, at the same time, the correct segregation of functions and independence:

Manages the regulatory body, policies, standards and procedures of credit risk, adapting the established requirements and processes, for all segments transversally in the Bank. Likewise, it carries out reviews of the quality of the credit process applied to retail banks and the continuous training of executives.

In addition, it is responsible for managing the sale of assets recovered by the Bank, coming from credit recovery processes.

Likewise, it manages risk information and provides it to the different government bodies and interested areas for decision-making and contributes to providing effective governance to the Corporate Risk Division projects, ensuring regulatory compliance and the correct execution of the projects. themselves, as well as being responsible for the management control of the Corporate Risk Division.

Additionally, this Area is responsible for managing the process of calculating provisions for credit risk, ensuring the correct execution of the processes and analysis of the results obtained.

Conducts an independent review, evaluating the quality of the data, modeling techniques, compliance with regulatory provisions, its insertion within the institution and existing documentation. It monitors the performance of the models and monitors each stage of the life cycle of the models within its scope, with the final purpose of generating mechanisms that allow it to measure and manage the level of model risk to which the Bank is exposed.

Finally, the internal control function has the responsibility of carrying out an evaluation of the design and operational effectiveness of controls, to comply with regulatory requirements.

As part of the Global Control Management, there is the Business Continuity Management, which is responsible for managing, controlling and administering recovery strategies in the event of contingency situations, and is also responsible for maintaining the crisis governance model, sustains the continuity of services and related critical operations to the Bank’s payment chain, through a comprehensive and resilient model that includes plans and controlled tests in order to reduce the impact of disruptive events that may affect the bank. Additionally, there is the role and responsibilities of the Information Security Officer (ISO), with an independent function in charge of designing and implementing through monitoring of realized tasks of the organizational units responsible for the information security, cybersecurity and technological risks.

Additionally, the Bank has the Cybersecurity Division, which is responsible for defining, implementing and reporting the progress of the Strategic Cybersecurity Plan in line with the Bank’s business strategy, with one of its main focuses being to protect internal information, of its clients and collaborators.

This Division is made up of the Cybersecurity Engineering and Architecture Management, the Cyber Defense Management and the Technological Risk and Cyber Intelligence Management. The Cybersecurity Management and Subsidiaries Control Department is also part of the division, as a control unit. Section 5 of this Note describes the responsibilities of the indicated Managements

Committees of Directors and Bank Administration

In general terms, the objectives of this committee are to monitor and continuously review the liquidity status and, trends in the most important financial positions, as well as the their associated results, and and their price and liquidity risks that will be generated. Some of its specific functions include, the review of the proposal to the Board of Directors of the Risk Appetite Framework (RAF), the Financing Plan and the structure of limits and alerts for price and liquidity risks, reviewing and approving the Comprehensive Risk Measurement (CRM) for subsequent due review in the Capital Management Committee and later approval by the Board of Directors, the design of policies and procedures related to the establishment of limits and alerts for price risk and liquidity risk; reviewing the evolution of financial positions and market risks; monitoring limit excesses and alert activations; ensuring adequate identification of risk factors in financial positions; ensuring that the price and liquidity risk management guidelines in the Bank’s subsidiaries are consistent with those of the latter, and that these are reflected in their own policies and procedures.

The credit approval process is done mainly through various credit committees, which are composed of qualified professionals and with the sufficient attributions to take decisions required.

Each committee defines the terms and conditions under which the Bank accepts counterparty risks and the Corporate Risk Division participate independently and autonomously of the commercial areas. They are constituted according to the commercial segments and the amounts to approve and have different meeting periodicities.

Within the risk management structure of the Bank, the maximum approval instance is the Credit Committee of Directors. Its functions are to resolve all credit transactions associated with customers and economic groups with approved lines of credit in excess of UF750,000, and to approve all credit transactions where the bank’s internal regulations require approval from this Committee, except for any special powers delegated by the board to management.

The Portfolio Risk Committee must understand the composition, concentration and risks attached to the bank’s loan portfolio, from a global, sectoral and business unit perspective, review and approve the comprehensive risk measurement (CRM) and the Credit Risk Appetite Framework (RAF) in the area of credit risk; It must review the main debtors, their delinquency, past-due portfolio and impairment indicators, together with the write-offs and loan portfolio provisions for each segment. It must propose differentiated management strategies, as well as analyzing and agreeing on the and analyze credit policy proposals that will be approved by theto be approved by the board of directors. This committee also reviews and ratifies the approvals of management models and methodologies Also, this committee is responsible for reviewing and ratifying the approvals of management models and methodologies previously carried out by the Technical Committee for the Supervision of Internal Models, as well as proposing the regulatory models and methodologies for final approval by the Board of Directors.

The Senior Operational Risk Committee makes any necessary changes to the processes, controls and information systems that support the bank’s transactions, in order to mitigate operational risks, and assure that areas can appropriately manage and control these risks.

This committee has many functions dedicated to supervising appropriate operational risk management at the bank and its subsidiaries, and for implementing the policies, standards and methods associated with the bank’s comprehensive operational risk management model. It plans initiatives to develop it and publishes them throughout the bank. It promotes a culture of operational risk management within the bank and its subsidiaries; review and approve the comprehensive risk measurement regarding Operational Risk. It approves the bank’s operational risk appetite framework; ensures compliance with the current regulatory framework, in matters that are limited to Operational Risk; become aware of the main frauds, incidents, events and their root causes, impacts and corrective measures accordingly; ensure the long-term solvency of the organization (business continuity plans, informations security and cybersecurity, controls, among others), avoiding risk factors that may jeopardize the continuity of the Bank. To decide about new products and services, and to verify the consistency of the operational risk management policies, business continuation, information security and cybersecurity across the bank’s subsidiaries, monitors their compliance, and reviews operational risk management at subsidiaries; become aware of the level of risk to which the bank is exposed in its outsourced services, sanction the selection of the model to carry out stress tests and scenario selection methodologies and evaluate the results, among others.

The main purpose of this committee is to assess, monitor and review capital adequacy in accordance with the principles in the bank’s capital management policy and its risk framework, to ensure that capital resources are adequately managed, the CMF’s principles are respected, and the bank’s medium-term sustainability.

Among other functions, this committee must ensure compliance with the main guidelines to be used for the construction of models; analyze the adopted criteria and review and approve methodologies associated with non-regulatory models, which must be submitted to the Portfolio Risk Committee for consideration, for final ratification; In the case of regulatory models, this Committee is limited to its review, leaving approval in the hands of the Portfolio Risk Committee and subsequently the Board of Directors. He is also in charge of ensuring compliance with the model monitoring guidelines, which are also approved by the board of directors.

Its main function is to establish and supervise the model risk management framework the corresponding at the institutional level. Among other matters, this committee reviews and discusses the identification and evaluation of model risk based on aggregate results, ensures the updating of the institutional inventory of institutional models and methodologies, and submits the Model Risk Management Policy to the Board of Directors for review and approval.

The committee is empowered to trigger the necessary changes in the processes, procedures, controls and information systems that support the operation of Banco de Chile, in order to mitigate its operational risks, ensuring that the different areas properly manage and control these risks. Among the main functions of the Operational Risk Committee are: the development of the comprehensive operational risk management model, including the items regarding the security of the information, continuation of the business and the suppliers where it needs to ensure the implementation and/or updating the regulatory framework related to Policies and Statutes, plans and initiatives for the development of the model and its dissemination in the organization; promote a culture of operational risk management at all levels of the Bank; become aware of the results obtained in the comprehensive measurement of operational risk; review the operational risk appetite framework; ensure the current regulatory framework in matters that are limited to operational risk; review the level of exposure to operational risk of the Bank and the main risks to which it is exposed; become aware of the main frauds, incidents, operational events and their root causes, impacts and corrective measures as appropriate, as well as operational risk assessments; propose, agree on and/or prioritize strategies to mitigate the main operational risks; ensure the long-term solvency of the organization; (plans of continuation of the business, security of the information, controles, etc.),avoiding those factors that could endanger the continuation of the bank. ensure that Operational Risk policies are aligned with the Bank’s objectives and strategies; become aware of the level of risk to which the bank is exposed in its outsourced services, among others.

The risk management processes of the entire Bank are permanently audited by the Internal Audit Area, which examines the sufficiency of the procedures and their compliance. Internal Audit discusses the results of all evaluations with the administration and reports its findings and recommendations to the Board of Directors through the Audit Committee.

Regarding to Credit Risk, loan loss provision and write offs are the fundamental metrics of the credit quality of our portfolio.

Banco de Chile permanently evaluates its loan portfolio, timely recognizing its risks. The bank has a set of guidelines related to modelling techniques for decision model development (scoring, campaigns and collection models), expected credit losses (both under local regulations, as well as under IFRS 9) and stress testing. These guidelines and the resulting models are approved by the Board of Directors.

As a result of this evaluation, on both individual and group portfolios, expected credit losses are determined.

The individual portfolio encompasses companies that due to their size, complexity or indebtedness, require a more detailed and a case-by-case analysis. Each obligor is assigned one of 16 risk categories (according to qualitative criteria based on the Bank’s internal credit rating system and a scale proposed by the regulator), in order to establish its expected credit losses in a timely and appropriate manner. The review of these classifications is carried out permanently considering the financial situation, payment behavior and the environment of each client.

The group portfolio encompasses natural persons and smaller companies. These assessments are carried out monthly through statistical models that estimate the appropriate level of expected credit losses. The consistency of these models is assessed through an independent validation and, subsequently, through the model monitoring process (i.e. retrospective tests) that compare actual vs expected losses.

In 2024, the Bank implemented minor changes to the criteria for identifying a significant increase in credit risk (SICR). These adjustments resulted in an insignificant change in our ECL estimates.

The monitoring and control of risks are carried through a set of limits established by the Board of Directors. These limits reflect the Bank’s business and market strategy, as well as the level of risk that it is willing to accept.

Credit risk considers the likelihood that the counterparty in the credit operation will not be able to fulfill its contractual obligation due to incapacity or financial insolvency, and this leads to a potential credit loss.

The Bank seeks an adequate risk-return relation and an appropriate balance of the risks assumed, through a permanent credit risk management considering the processes of admission, monitoring and recovery of the loans granted. Establishes the risk management framework for the different business segments it serves, responding to regulatory demands and commercial dynamism, being part of the digital transformation and contributing from a risk perspective to the various businesses addressed, through a vision of the portfolio that allows managing, resolving and controlling the business approval and monitoring process in an efficient and proactive manner.

In the business segments, the application of additional management processes is taken into consideration, to the extent required, for those financing requests that that will have a greater exposure to environmental and/or social risks.

The Bank integrates the socio-environmental criteria in its evaluations for the granting of financing destined to the development of projects, whether national or regional and that can generate an impact of this type, where they are executed. For the financing of projects, they must have the corresponding permits, authorizations, patents and studies, according to the impact they generate. In addition, the Bank has specialized units for serving large clients, through which the financing of project development is concentrated, including those of Public Works concessions that contemplate the construction of infrastructure, mining, electrical, real estate developments that can generate an environmental impact.

During 2024, progress was made in identifying the risks associated with climate change, generating heat maps for the individual portfolio, associated with exposure to Physical and Transition Risks. Likewise, within the framework of the development of the first National Taxonomy commanded by the Ministry of Finance, the Bank has advanced in the construction of a Classification Framework for Sustainable Financial Products and Services, with the objective of classifying the economic activities associated with said loans, using predefined selection criteria.

Credit policies and processes materialize in the following management principles, which are addressed with a specialized approach according to the characteristics of the different markets and segments served, recognizing the singularities of each one of them:

Based on these management principles, the Corporate Risk Division contributes to the business and anticipates threats that may affect the solvency and quality of the portfolio, delivering timely responses to clients, maintaining the solid fundamentals that characterize the Bank’s portfolio in its different segments. and products.

The credit risk management process consists of the stages of Admission, Monitoring and Recovery or Collection for the retail and wholesale business segments served by the Bank.

In the retail segments, admission management is carried out mainly through a risk evaluation that uses scoring tools and an appropriate credit attribution model to approve each operation. These evaluations, for natural persons without a business line and clients in the SME segment, take into consideration the level of indebtedness, the payment capacity and the maximum acceptable exposure for the client, through information on payment behavior, indebtedness in the financial system and business and financial information, as applicable.

Additionally, the bank has proactive admission processes for a diverse portfolio of clients. These consist of mass evalution of clients through statistical models of eligibility and payment capacity, generating credit offers aligned with the strategies defined. This makes possible to have preapproved credit offers available through multiple channels taking into consideration the business plan and the relation between risk and return.

While in the Wholesale segments, the management of admission is carried out through an individual analysis of the client and also the relationship with the rest of the entities of the same group that corresponds the client (if aplicable) is considered. This individual analysis or if aplicable analysis of the group, takes into consideration among other factors the capacity to generate cash, the financial situation with emphasize on the equity solvency, the levels of exposure, variables of the industry, evaluation of the shareholders and the management, the specific aspects of the operations like the structure and term of the financing, products and guarantees. The mentioned evaluation is supported by a rating model that permits greater homogeneity in the client analysis and their group.

There are also specialized areas of segments that by their nature need the knowledge of an expert, such as real estate, construction, agriculture, finance, international, among others. These experts support the preparation of the operations having certain tools designed to meet the needs of the specific characteristics of the businesses and their respective risks.

From granting a credit until it expires, it is necessary to have a follow up of the behaviour and financial situation of the debtor with emphasis on its payment capacity, as the situation of the client and associated risk change over time. The follow up is an action within the credit process that permits that the bank acts in a proactive way if any signs of impairment in the portfolio at global level are detected or if the capacity of the debtor to comply with its obligations is affected.

In order to properly follow up, methodologies and tools for diverse segments that the bank participates, have been developed, those then permit a proper management of its credit portfolio.

In the retails segments, the control and follow up concentrate on monitoring the main indicators of the portfolio and analysis of the groups, reported in the management reports, generating relevant information for the decisión making in different occasions defined. At the same time special follow ups are generated according to the relevants facts of the environment.

While in the wholesale segments, in a centralized way, a permanent follow up is carried out through management tools at individual level taking into consideration the business segments, economical sectors, based on the periodically updated client and industry information. Through this process the alarms are generated that guarantee the correct and prompt recognition of the risk in the portfolio of individuals. The specific conditions established in the admission at the moment of approval like the financial covenants, coverage of certain guarantees and others, are monitored.

Additionally, in the admission area, simultaneous follow up tasks are carried out that permit the monitoring of the development of the operations from the beginning until recovering the capital, having as the objective to make sure that the portfolio´s risks are correctly and promptly identified, at the same time managing proactively the cases with higher risks.

The Bank has specific regulations related to customer collection and normalization, which ensure the quality of the portfolio in accordance with credit policies, and the desired risk appetite framework and strict adherence to the current regulatory framework. Through collection management, the clients with temporary cash flow problems are favored, debt normalization plans are proposed for viable clients, so that it is possible to maintain the relationship in the long term once their situation is regularized. The recovery of assets at risk is maximized and the necessary collection actions are carried out, in a timely manner, to ensure the recovery of debts or reduce the potential loss.

In the retail segments, the Bank defines refinancing criteria through the establishment of predefined renegotiation guidelines to resolve the debt issues of viable clients with payment intentions, maintaining an adequate risk-return relationship, along with the incorporation of robust tools to differentiated collection management, in accordance with institutional policies and with strict adherence to the current regulatory framework.

In the wholesale segments, when detecting clients that show signs of deterioration or non-compliance with any condition, the commercial area to which the client belongs, together with the Corporate Risk Division, establish action plans for their regularization. In those cases of greater complexity where specialized management is required, the Special Asset Management area, belonging to the Corporate Risk Division, is directly in charge of collection management, establishing action plans and negotiations based on the particular characteristics of each customer.

We produce own models which are used for credit risk management purposes, known as the pre-settlement exposure (PSE). Generally, the PSE is computed as follows:

PSE = Maximum (CMTM + CEF * Notional, 0)

CMTM: Current Mark-to-Market of the transaction

Notional: Transaction notional amount

CEF: Credit Exposure Factor, which reflects the peak exposure within the life of the transaction, under 95% of confidence level.

The portfolio approach is taken into account when computing exposures of several transactions closed with one single counterpart.

Credit mitigating conditions for derivative transactions have become popular in the local financial markets. There are financial institutions that have accepted early termination clauses, and netting is also possible with corporations when appropriate documentation under a regular Master Agreement is signed.

Collateral agreements have been requested by certain banks for inter-banking transactions within other financial institutions, but its effective application under Chilean Law make advisable not to include it in the exposure measurement.

Derivative transactions closed with counterparts residing abroad (mostly global banks) are documented utilizing ISDA and CSA. Netting and cash collateral above a certain threshold level are the typical credit mitigations schemes in place for this kind of transactions.

This metric is used for measuring, limiting, controlling and reporting credit exposures by counterparty.

The maximum exposure to credit risk, by client or counterparty, without taking into account guarantees or other credit enhancements as of December 31, 2024 and 2023, does not exceed 10% of the Bank’s effective equity.

The following tables show credit risk exposure per balance sheet item, including derivatives, detailed by both geographic region and industry sector as of December 31, 2024: