Policies and certifications

In order to prove the consistency of our processes with the best domestic and international standards, Intesa Sanpaolo obtained various types of certification from recognised external organisations.

CERTIFICATION	SCOPE OF APPLICATION

ISO 26000	International standard to which the bank adheres since 2014 dedicated to the integration of social responsibility in corporate practice. These are non-certifiable guidelines, in line with the concept of responsibility which does not include obligations but guidance. The areas covered by ISO26000 are: governance of the organization, human rights, worker protection, environment, fairness of management practices, issues relating to customers, community involvement and development
ISO 37001	International standard of reference for organisations in relation to the prevention of corruption and operational tool that adds to the anti-corruption measures already envisaged, at the regulatory level, by individual countries. Certification active since 2019
UNI ISO 45001:2018	Since 2017 the Occupational Health and Safety Management System has undergone an annual inspection by an independent third party which certifies its compliance with current legislation and industry standards. In 2018 has been extended to all branches and in 2019 the transition from the previous standard (BS OHSAS 18001) to the current one has been made.
UNI CEI EN ISO 50001:2018	Energy Management System (SGE) certification. Certification active since 2012
UNI EN ISO 14001:2015	Environment management system certification. Certification active since 2005
GEEIS-Diversity	Gender Equality European & International Standard is an international certification of the Arborus Association issued through Bureau Veritas and aimed at evaluating the commitment of organizations to include and foster all forms of diversity. The certificate, obtained in June 2021, refers to all the banks and companies of the Group in Italy.
ISO 27001	The ISO / IEC 27001: 2013 standard specifies the requirements for a correct definition, implementation, management and improvement over time of an Information Security Management System.
ISO 22301	The ISO standard specifies the requirements for effectively designing, implementing and managing a Business Continuity Management System.
eIDAS (Standard Conservation)	In Italy, AgID has decided to include the digital preservation system (Documentary Conservation in accordance with the law) within the eIDAS.
eIDAS (Trust Services)	The EU eIDAS (Electronic IDentification Authentication and Signature) Regulation aims to provide a regulatory basis at EU level for trust services and electronic identification instruments of member states.
PCI DSS Service Provider	The PCI-DSS standard is a standardized set of security requirements that organizations handling payment card data must comply with.
EURIBOR	The Corporate Governance Code issued by EBF and its annex define the general rules and safety levels applicable to the calculation process of the Euribor index, as well as the specific rules applicable to banks that contribute to the calculation of the Euribor index.
TARGET2	TARGET2 is the new technical platform for Europayments, launched in November 2007. Critical Participants (including Intesa Sanpaolo) have a commitment to self-certify annually that the security of the TARGET2 infrastructure is aligned with the ISO / IEC 27001: 2013 standard.
CAI	The creation of an IT archive, defined as the Interbank Alarm Center, is required in Legislative Decree no. 507 of 12/30/99. The subsequent Regulation of the Governor of the Bank of Italy of 29/01/02 defines the requirements that the Banking Institutions must comply with to ensure the security of the information system of the archive itself.
SWIFT	SWIFT has introduced the Customer Security Program (CSP) for its customers to combat Cyber threats, in particular possible fraud.

Last updated 14 June 2021 at 11:24:06