Grupo Bancolombia has identified the following Emerging Risks as the most representative:

The Bank’s ability to attract and retain specialized talent could impact some business objectives.

The increasing demand of non-traditional competitors in the labor market, such as Fintech companies and Neobanks; and the flexible work arrangements such as remote work and preference for telecommuting, pose a challenge for the Bank to design schemes that enable the well-being, cohesion and culture of employees to acquire and retain staff on a cost-effective basis with specialized knowledge in a variety of technological information areas, including data science, quantitative resources, information security and other technical areas in order to update the Bank’s business models to develop new products and services.

Potential Business Impact: Possibility of losses caused by the impacts of new work practices, nonconformity, dissatisfaction, or lack of sense of belonging given the cost associated to attract and retain talent, as well as the one required to train existing talents.

Also, the lack of specialized workforce to fill positions in various areas could negatively affect the Bank’s ability to deal with future challenges, slow the digital business strategy execution, including development of new products and affect the Bank’s results of operations.

Mitigation Actions:

1. High Potential and Specialized Talent: Promote the talent mobility according to the strategic priorities to develop and retain them.

2. Succession plans: Seeks to identify high potential talents, critical positions and map all professional employees in order to generate actions tailored to each talent.

3. Recruitment strategies: Identify specialized profiles that are not necessarily on an active job search that can offer the organization a competitive advantage for the development of critical knowledge.

4. Employer Branding strategy: The organization efforts have been focused on:

• New Generations: Intended for university students.
• General Public: Provide to the community information about the Bank as employer.

5. Wellness strategy: Improvement of the quality of life of the bank employees though health, labor employment security and welfare programs.

6. Flexible work arrangements.

7. Compensation model: System of variable remuneration, based on the creation of added value.

ESG risks could affect the Bank’s financial condition and results of operations.

Sustainability is gaining importance in society and is increasing focus on topics such as climate change, social inequality, and corporate misconduct, generating rapid changes in market sentiment, in addition, the COVID-19 pandemic has highlighted the importance of good governance practices associated with the evaluation and supervision of non-financial and emerging risks, that is why an inadequate management of environmental, social and/ or corporate governance aspects in the Bank’s activities, could generate an impact on its relationship groups which includes its shareholders, customers, employees, suppliers and society in general.

Potential Business Impact:

Physical: The rise in the frequency and severity of climate events; may impact the value of the Bank’s properties; and/or disrupt the Bank’s operations and other activities through prolonged outages. Such events, may also have an impact on our customers, which could amplify credit risk by diminishing borrowers’ repayment capacity or collateral values.

Transition: Changes in policies; regulations, technologies and market preferences could impact the bank's financial condition because of changes in the composition of the loan portfolio, and possible impairments in sectors in transition.

Social: Gaps in equity, diversity and inclusion increases the resentment within societies resulting in both peaceful and non-peaceful demonstrations against institutions that can compromise business continuity.

Governance: Evaluation and supervision of non-financial and emerging risks, to comprehensively identify, monitor and control their impacts. Mishandling these can affect the company's stability.

Mitigation Actions:

Climate Change

• Financing program for the transition to a low carbon economy.
• Corporate policy for its loan portfolio related to sectors with high impact on climate.
• Identified physical and transition risks in sectors in its loan portfolio and investments.

Social

• Quality of life for our employees, suppliers, and customers programs.
• Through financial inclusion initiatives, the bank provides free financial services for people to empowered and improve their quality of life.
• Fundación Bancolombia provides scholarships for rural youth.

Governance

• The Bank has a sustainability division that coordinates and drives the ESG agenda in accordance with our corporate strategy and policies.
• The Bank stablished: anti-fraud and anti-corruption policy, integrity and compliance manual and financing of political parties’ policy.
• All AUM of the Bank will be invested in strategies driven by ESG criteria by 2025.
• Sustainable credit line and funding strategy. We have issued four green or sustainable bonds.

The following risks, are the most significant emerging risks could have a long-term impact (at least three years) on Grupo Bancolombia’s business and financial results:

Digital misinformation could adversely affect the Bank’s reputation as well as its operational and financial results.

Detailed definition: The increase in digital interconnection has increased the spread and distribution of digital content such as texts, photos, audio and videos, some of which are used with the intent to, among other purposes, commit fraud. Such digital misinformation can affect organizations, such as the Bank, if used to blackmail or defame the Bank’s reputation.

Impact on business: The disseminate of digital misinformation about the Bank could affect the trust of customers and other interest groups in financial services and products offered by the Bank, negatively impact the growth of deposits, third party asset management and credit products which will ultimately affect the Bank’s fees and commissions and thus, its economic performance.

Risk reduction countermeasures: In order to control and mitigate the economical and reputational implications of the digital misinformation risk, the Bank makes effort to improve the risk management process through the development of methodologies to allowing analyse and profile of customer segments and other interest groups which might be affected by misleading, false or inaccurate information. In addition, the Bank providing timely, transparent and easily accessible information to its different interest groups about fees, banking services and the Bank’s overall performance.

Changes in banking laws and regulations in Colombia and in other jurisdictions in which the Bank operates could adversely affect the Bank’s consolidated results.

Detailed definition: The widespread lack of trust in public institutions of a substantial percentage of the population, whether due to lack of representation, corruption or otherwise, and including as a result of the social and economic instability generated by the pandemic, has exacerbated the trend of polarization and distrust in governments.

Impact on business: These factors increase the possibility of violent protest and broader support for leaders who could focus their political agenda on rules that seek to regulate financial institutions and their business practices to a greater extent, including the amounts of fees and commissions that can be charged. If the Bank is prohibited or otherwise limited (including by limits with respect to pricing) from continuing to charge the clients for certain products or services, including specified types of transactions, or from imposing charges for products or services that might be introduced in the future, the Bank’s income level and financial condition could be adversely affected.

Risk reduction countermeasures: As mitigation measures, the Bank closely monitors regulatory initiatives and projects that could have significant impacts on financial sector and their activities. In addition, the Bank coordinates and leads the relationship with authorities, business associations and other interest groups to serve as allies and play an important role in the new regulatory agenda-setting.

Grupo Bancolombia has identified the following Emerging Risks as the most representative:

The Bank’s ability to attract and retain specialized talent could impact some digital business objectives.

The current economic landscape requires workforces to exhibit new skills and attributes such as creativity, innovation and flexibility, which are necessary to adapt the Bank’s operations to constant technological advances, and to update the Bank’s digital business models and strategies to develop new products and services. To respond to these trends, many companies, including financial institutions as the Bank, are struggling to engage employees with specialized knowledge in a variety of technological information areas, including data science, quantitative resources, information security and other technical areas, in which it is becoming more difficult to acquire and retain staff on a cost-effective basis.

The Bank’s strategic objectives are linked to their human talent. Specifically, the development of new products, services and digital tools demands that its human talent specialized capabilities to carry out the relevant process, enabling to achieve competitive advantages with respect to its competitors.

While the Bank has implemented strategies to attract and retain experienced and skilled professionals, the lack of specialized workforce to fill positions that require this kind of knowledge in various areas could negatively affect the Bank’s ability to deal with future challenges, slow the digital business strategy execution, including development of new products and affect the Bank’s results of operations.

Mitigating Actions

• High Potential Talent: It is the Talent Planning strategy program, that allows to respond in an effective and planned way to the organization needs. The program’s purpose is to promote the talent mobility according to the strategic priorities and to develop them and retain them with the intention of letting them to achieve their career goals and holding key positions within the organization.
• Through Employer Branding strategy, the organization efforts have been focused on three target audiences:

  1. Specialized Talent: It refers to the talent with specialized knowledge attraction strategies, which consist in the participation and sponsorship of specialized events about technology, analytics and artificial intelligence, aiming to gather talents with this type of knowledge and collecting information to hire them to cover vacancies requiring this kind of technical capabilities.

  2. New Generations: It is a program intended for university students to participate in the resolution of real challenges regarding strategic knowledge of the organization, such as cybersecurity, consumer behavior, software architecture, analytics and artificial intelligence and digital tendencies as cloud, devops and robotics during a given period, with the purpose of attracting, building up and creating loyalty on specialized talent. In addition, the Bank has implemented and sponsored partnerships with foundations that provide support to young people trough educational programs in technological knowledge areas, to enable their introduction to the labor market. One of these programs was designed exclusively for women and seeks to contribute to the gender gap reduction in technology areas within the organizations.

  3. General Public: The purpose of this activity is providing the wider community with information about the Bank as employer, through the communication in social networks of the pillars supporting the employees value proposal. This activity is performed through a weekly publication of organic content relating sustainability, work environment, work climate and new working methods.

• Succession plans for the timely coverage of critical and strategic positions for the organization. The succession strategy seeks to identify high potential talents, critical positions and map all professional employees of the Bank in order to generate actions tailored to each of the talents that the organization has.
• Recruitment strategies: identify new recruitment channels in order to recognize specialized profiles that are not necessarily on an active job search and that can offer the organization a competitive advantage for the development of critical knowledge.

As a result of climate change and evolving consumer trends, the Bank may need to modify its value proposition and credit risk management

Addressing climate change, and learning how certain industries accelerate such change, has become a mainstream discussion topic in the last decade and the focus of increasing attention by various environmental groups and governments in recent years. This focus has influenced, and will continue to influence, how societies approach this issue and has caused, and will likely continue to cause, changes in consumer consumption trends, with an expected shift to products and services offered by companies that offer environmentally sustainable business models.

Social and environmental activists are increasingly targeting different businesses, including financial services companies such as the Bank, with public criticism for their relationships with clients that are engaged in certain sensitive industries, including businesses whose products contribute are or are perceived to contribute to climate change, or whose activities negatively affect or are perceived to negatively affect the environment.

The reputational harm to clients that offer products or services or engage in activities that are perceived to be have harmful effects on the environment or to accelerate climate change may cause their businesses to deteriorate, could potentially reduce their creditworthiness and result in an increase in the Bank’s allowances for loan losses. In order to address this risk, the Bank may need to prioritize the funding of industries whose activities do not present these risks. The commercial, risk and sustainability teams of the Bank take active steps to mitigate these risks and to adapt the Bank’s lending and investment activities to align more closely with evolving concerns regarding climate change and the protection of the environment. However, any resulting shift in patterns of loan origination trend may cause a reduction in the Bank’s loan portfolio as the Bank makes the transition to greater funding to businesses with more sustainable business models. Conversely, if the Bank is unable to shift its loan origination activities in the manner described above, it may become a target of public criticism and suffer reputational harm which in turn may cause certain clients and customers to cease doing business with the Bank, impair the Bank’s ability to attract new clients or expand its relationship with existing ones.

Mitigating Actions

• Defining and implementing financing policies and strategies for clients that are engaged in certain sensitive industries whose products are perceived to contribute to climate change to stimulate these industries transformation towards environmentally sustainable standards.
• Defining the appetite for financing unconventional renewable energies in the markets where the Banks has a presence, to contribute to the energy grids transformation and stimulate the investment in clean energies.

Grupo Bancolombia has identified the following Emerging Risks as the most representative:

Information Security Risk and Potential Business Impact

The Bank is subject to information security risk and look at it as an emerging risk of the technological or cybernetic category, given the likelihood of an economic or non-economic loss resulting from an assault on the confidentiality, integrity and availability of the information processed by the Bank. This type of risk may result in unauthorized access to privileged information, attacks on the technological infrastructure with the aim of stealing information, committing fraud or interfering with the regular service by not having the data required to guarantee the operation of the business. Additionally, the interruption of the services affecting our clients or users due to exploitation and materialization of vulnerabilities in the platforms, such as ransomware events.

In Bancolombia information security risk has increased due to the proliferation of new technological trends, the use of the internet and telecommunications components to carry out financial transactions and the increase and sophistication of organized crime activities, hackers, terrorists and other external parties. Despite the information security risk occurring in the world, Bancolombia considers it as an emergent risk because is relative, and is currently changing and being developed by hackers. Actually, Bancolombia is defining new processes, politics and the organizational structure to mitigate the possible impacts of that risk.

As of the date of this report, the Bank has not faced a cyber-attack with a material impact on its sensitive information which negatively affects the business or customers. However, we can’t guarantee that the measures, initiatives and procedures described above will be effective in preventing or mitigating possible future attacks or threats to the technological infrastructure. However, the entire strategy that has been defined to identify and manage this type of risk, allows us to be prepared to respond timely and effectively to any threat which may have a negative impact on the security of information in the cyber environment.

Mitigating Actions

The Bank has implemented a cybersecurity control and management system that is constantly improving and has been designed to identify and protect our sensitive information or critical assets seeking to anticipate, identify and compensate threats, as well as respond and recover capabilities or services that could be affected by a cybersecurity incident. The system includes features such as: perimeter security devices; security mechanisms of endpoint and malicious software, including different controls to protect information such as intrusion prevention systems, data protection platforms, control of internet navigation, controlled access to the network, virtual private networks, encryption, multifactor authentication schemes, systems and security techniques in backup copies; constant monitoring and continuous evaluation of the technological infrastructure through software and hardware updates, penetration tests and ethical piracy that seek to identify and mitigate vulnerabilities proactively; a security operations center 24 hours a day, 7 days a week to detect, analyze, respond, inform and prevent cybersecurity incidents on platforms that support sensitive information, as well as forensic computer services, intelligence and threat search, among others. In addition, the Bank has obtained an insurance policy designed to cover certain damages for itself or third parties as a result of the loss of data derived from these types of attacks.

The information security risk management system in the cyber environment is designed under the model of three lines: a stage of risk identification, executed by the leader of the technological component and security managers from the first line of defense; supervision, monitoring, evaluation and analysis of the potential impact of the risk, executed from the second line (risk areas) and the review of the effectiveness of the controls developed from the third line of defense by the internal audit.

The Bank’s senior management is committed to cybersecurity risk management, through a clear strategy, the allocation of human, technical and financial resources and a clear definition and disclosure of responsibilities regarding security. Also, Senior management has formed a cybersecurity and information Security Committee, responsible for approving and promoting the most important policies, strategies and projects; being informed and making decisions about associated controls, periodically evaluating the strategic and tactical plans of compliance, the review, approval and prioritization of initiatives or decisions as well as the prioritization of the use of the allocated budget. This Committee is formed by seven vice presidents of the following vice presidencies: Bancolombia’s Corporate Services Vice-presidency, Banistmo’s Corporate Services Vice-presidency, BAM’s Corporate Services Vice-presidency, Banco Agrícola’s Corporate Services Vice-presidency, Administrative and Security Services Vice-presidency, Human Resources Vice-presidency (corporate) and the Risk Corporate Vice-Presidency (corporate).

The framework used for managing cyber-security risks is designed under practices of international frameworks and standards issued by the National Institute of Standards and Technology (NIST) in NIST 800-30 and NIST Cybersecurity Framework, by the International Organization for Standardization (ISO) in ISO-27032, as well as the definitions established by the Bank.

Loss of key human talent or inability to attract and retain new talents as a result of work styles and aspirations of the young generations

Our business involves operations that cover a variety of disciplines and demands an integral structure, with specialized knowledge, from top management, administrative positions, and operational areas. Therefore, it is required that the board of directors, the senior management and all our employee workforce have knowledge in those necessary disciplines for our operations. Globalization and interconnection through disruptive technologies have caused changes in the labor market. Younger generations seek workplaces with creativity, flexibility and high remuneration, which could translate into an increasing migration rate of key talents. Additionally, there is a trend of continuous turnover of young people who do not seek a stable work, but develop their profession with learnings and constant challenges.

While we have succeeded in attracting experienced, skilled professionals and our talent turnover level is low, lose any key member of our management team or the failure to attract and retain new talents, could affect our operations because of the cost of train them again to reach the learning curve; plus, this could decelerate the execution of our business strategy, including the development of new products.

The Bank faces the risk of losing a competitive advantage due to human capital leak, especially from critical positions where there are wide gaps of knowledge of current employees with regard to potential candidates. Some critical talent needs are also the most expensive and scarcest to hire. Among the risks we see feasible, it is the difficulty of hiring people with knowledge in systems engineering, analytics and big data.

The bank is grappling with a series of interrelated risks from a rapidly transforming business environment. Addressing the main business challenges involves hiring new talents that are scarce, and retain key talents within the organization in order to ensure the continuity of the Bank’s operation.

Mitigating Actions

Talent Planning Methodology: It allows the bank to identify, develop and locate people in the right position, with the knowledge, aptitudes, attitudes and necessary skills that guarantee high performance and the achievement of business results.

• Succession plans to cover the strategic and critical positions in the organization. The succession strategy seeks to identify high potential talents and critical positions, as well as mapping all professional employees of the Bank in order to generate actions tailored to each of the talents that the organization has.
• Employer Branding Management shows the organization as one of the most attractive companies to work with; we intend to communicate our cultural DNA so that new applicants align with our interests and aspire to work with us. We also develop other unconventional ways to attract talent, such as: company-university partnerships, student seedbeds and disruptive selection processes; this strategies seek to attract young talents with specialized knowledge that are difficult to find through conventional selection processes.
• Recruitment strategies: identify new recruitment channels in order to recognize specialized profiles that are not necessarily on an active job search and can offer the organization a competitive advantage for the development of critical knowledge.
• New ways of working: developing new ways and methodologies of work that allow employees flexibility at work and achieve outstanding results through networking and the use of digital media for communication. Also, empower employees to make quick and effective decisions to promote agility in the development of our processes.
• Competitive salaries: develop salary scale that allows the attraction and retention of specialized talent according to the standards of the labor market. In this way we manage to compete for talent with fair salaries and we managed to retain the most critical employees for the development of our business.