Ethics and governance

Adhering to a robust ethical framework

The Group conducts its business in an ethical and responsible manner. It remains vigilant in ensuring compliance with regulations, internal rules and procedures, and the ethical principles governing its activities. To ensure that all its employees act with integrity, the Group has established a Code of conduct that brings together all the principles guiding the behavior and professional activities of its teams.

This Code of Conduct, approved by the Board of Directors, is implemented through specific codes of conduct or charters, notably to ensure fair practices, anti-corruption and tax integrity. Since 2014, the Group has also promoted responsible advocacy, as defined in several charters and collective statements, and publishes its Responsible lobbying charter for responsible representation to public authorities and representative institutions.

Implementing an appropriate governance framework

The Board of Directors and General Management are the Group’s main governance bodies of Societe Generale. The Board of Directors sets the strategic direction for the Group’s activities, ensures their implementation by General Management, and reviews them at least once a year. These strategic directions incorporate the Group’s values and Code of Conduct, which it approves, as well as the main priorities of the policies pursued in the areas of corporate social responsibility, human resources, information systems and organization. It also ensures adherence to the highest standards in terms of ethics and risk management.

General Management manages the Company and represents it in its dealings with third parties. Its role notably includes defining and executing the strategic plan to strengthen the Group’s sustainable performance, with the support of the Executive Committee.

Adopting voluntary environmental and social principles and standards

Societe Generale has defined Environmental and Social (E&S) General Principles, which set out the framework applicable to the Group’s activities that may have environmental or social impacts through the products and services it offers. To manage the environmental and social risks potentially associated with its activities, the Group complements these General Principles with sector policies. These sector policies define the specific standards and criteria that the Group applies in sensitive sectors.

The Group has also been a signatory to the Equator Principles since 2007, a common framework for managing environmental and social impacts that enables financial institutions to identify, assess and manage such impacts in transactions within its scope. The Group also takes part in various coalitions and working groups on international banking standards, notably under the auspices of the United Nations, including the Principles for Responsible Banking since 2019 and the Net-Zero Banking Alliance since 2021.

Respecting human rights

Respecting human rights is an integral part of the Group’s corporate social responsibility, both towards its employees and in its relationships with suppliers and in the conduct of its activities.

The Group is committed to complying with applicable legal and regulatory requirements on human rights in the territories in which it operates.

In addition, the following international frameworks and conventions provide guidance for the Group’s approach to human rights:

• OECD Guidelines for Multinational Enterprises;
• United Nations Guiding Principles on Business and Human Rights (UNGPs) of 16 June 2011, and the “Protect, Respect and Remedy” framework;
• United Nations Declaration on the Rights of Indigenous Peoples;
• United Nations Sustainable Development Goals.

The Group also supports international initiatives aimed at clarifying the role of companies, particularly in the banking sector, in respecting and promoting human rights:

• as a signatory of the United Nations Global Compact (UNGC) since 2003, the Group supports the ten UNGC fundamental principles, including Principles 1 to 6 related to Human Rights and Labour;
• Societe Generale endorsed in 2007 the Equator Principles, which is a common risk management framework adopted by financial institutions, for determining, assessing and managing E&S risks attached to large-scale projects. Societe Generale is committed to implementing the Equator Principles in its internal E&S policies, procedures and standards. This includes applying specific requirements for clients’ human rights diligence.

In compliance with the duty of care applicable to parent companies and ordering entities, the Group implements a Duty of Care Plan aimed at identifying, preventing and mitigating severe impacts on human rights, fundamental freedoms, health and safety, and the environment. This plan, together with the report on its implementation – including risks related to human rights violations inherent to its activities – is presented in Societe Generale’s annual Universal Registration Document.

The Group also publishes on its website an annual Statement on Modern slavery and human trafficking, highlighting the main actions implemented to prevent their occurrence.

The Group participates in industry forums and initiatives to promote respect for human rights and enhance understanding of the related challenges for the financial sector.

For more information, please refer to: Statement on Human Rights

Ensuring data protection

Societe Generale places particular importance on the protection of personal data. The governance of personal data processing within the Group is aligned with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). A governance framework and a set of internal standards governing the data protection system, applicable to entities falling within the scope of Article 3 of the GDPR, have been defined.

For more information, please refer to:

• Data protection
• Universal Registration Document 2026, pages 354 and 358

From a cybersecurity perspective, the data collected by the Group are classified according to their level of sensitivity. Both organizational and technical protection measures are defined based on this classification and applied to the various data processing activities throughout the data lifecycle.

For more information, please refer to:

• Innovation and digital
• Universal Registration Document 2026, pages 354 and 358