Overall economic risk and risks resulting from global economic conditions

Currently, there are still considerable uncertainties, in particular due to a possible further deterioration in the global macroeconomic outlook. The inflationary environment ‒ which is also attributed to the Ukraine war‒ continues to pose the risk of significantly rising energy, material supply and transportation costs. However, this risk has decreased, mainly due to the inclusion of expected additional costs in corporate planning and an easing of the situation on individual procurement markets, particularly the one for energy.

With deconsolidation of Fresenius Medical Care, Fresenius Group's assets in Russia and Ukraine amounted to less than 1% of its total assets as of December 31, 2023. Therefore, the direct impact of the Ukraine war on Fresenius' remaining business is limited.

Nevertheless, the Ukraine war is still accompanied by a very distinctive threat situation for cyber security, especially with regards to critical infrastructure, such as healthcare facilities, in countries that support Ukraine. Therefore, the risk of cybersecurity attacks on our systems and data is still increased. In general, Fresenius is affected to a minor extent by economic fluctuations. We expect demand for our life-saving and life-sustaining products and services to continue to grow.

In addition, Fresenius aims to achieve a balanced distribution of business in the major regions of the world and between established and emerging markets. The risk situation of our business segments depends in particular on the development of the markets relevant to them. We therefore also carefully monitor and assess country-specific political, legal and financial conditions, particularly in the current macroeconomic environment. This applies, for example, to our receivables portfolios in countries that are experiencing budgetary problems due to their indebtedness or countries that are exposed to hyperinflation.

Overall, the aforementioned factors could have a negative impact on our assets, liabilities, financial position and financial performance.

Despite the aforementioned effects, from today's perspective the global economic development does not pose a risk for the going concern of the Fresenius Group.

Risks in the healthcare sector

Risks related to changes in the health care sector are of major importance to the Fresenius Group. The main risks are the financing of health care systems and the corresponding reimbursement systems, as well as the development of new products and therapies.

Financing of health care systems - reimbursement rates and prices

In our largely regulated business environment, changes in legislation, including those relating to reimbursement, can have a drastic impact on our business success.

National insurance systems are financed very differently. For example, healthcare systems in Europe and the British Commonwealth countries are generally based on one of two funding models: the system with a mandatory employer and employee contribution, and the predominantly tax-funded system.

In the Asia-Pacific region, universal health care ("UHC") is at various stages of implementation, so reimbursement mechanisms can vary significantly from country to country (and even from province to province and city to city). In Latin America, health care systems are funded by public or private payers, or a combination of both.

In the hospital market in Germany, the current system of purely volume-dependent remuneration via flat rates per case is to be converted into a mixed remuneration system. The plan is to limit remuneration based on flat rates per case to 40%. In future, an average of 60% of the remuneration is to be distributed independently of performance via so-called retention flat rates (including the care budget). These retention costs are intended to cover the fixed costs associated with the provision of structures in the hospital care area. The clinics are largely occupied by statutory health insurance funds and pension insurance providers. The continued existence of contracts with these institutions therefore influences the success of Helios Germany. We keep a close eye on legislative activities and planning and work together with the state healthcare organizations. To a considerable extent, occupancy in the hospitals is provided by statutory health insurance funds and pension insurance institutions. The continuation of contracts with these institutions therefore influences the success of Helios Germany. We keep a close eye on legislative activities and planning and work together with the state healthcare organizations.

As part of the Nursing Personnel Strengthening Act (PpSG), nursing costs were removed from case rates (DRG) from 2020 and the costs of patient-centered care were reimbursed in full by the health insurance funds via separate care budgets. As early as 2021, each additional or increased bedside care position was fully refinanced by payers, and the care budget's inclusion criteria were changed.

As negotiations with the payers on the care budgets have largely not yet been concluded, this gives rise to a potential risk to the assets, liabilities, financial position and financial performance.

The allocation of nursing staff to the care budget has been adjusted to the current definitions of nursing specialist and nursing assistant or other professions in the Nursing Staff Lower Limits Ordinance (PpUGV).

From 2025, the nursing budget for bedside care will only fund nursing staff who have 1-3 years of training.

Nursing assistants with less than one year of training or further training will no longer be financed via the nursing budget from 2025. Funding will then once again be provided on a fixed-rate basis as part of DRG remuneration.

In contrast, from 2025, all midwives and maternity nurses will also be financed within the framework of the nursing budget in the amount of the actual costs.

Furthermore, hospitals can individually agree a surcharge of up to 4% for implementing measures that reduce the burden on nursing care. The hospital must both describe the reduction in nursing care per measure and calculate the expected savings. This usually involves digital and technical measures that reduce or support nursing measures.

In the German market, Helios Germany is observing a general trend towards outpatient treatment, which could lead to lower case number growth for inpatient treatments. To take account of this trend, Helios Germany is expanding outpatient services in a separate division. A decline in case numbers could have an adverse effect on our business and operating profit. Close monitoring of developments in both the inpatient and outpatient areas makes it possible to act accordingly.

Our private hospital chain Quirónsalud in Spain operates hospitals, among other things, via PPP (Public-Private Partnership) contracts. These are part of the public healthcare system in Spain. The company has thus been assigned responsibility for certain areas of healthcare for Spanish citizens with statutory health insurance. In return, Quirónsalud receives remuneration in the form of a per capita flat rate or a fee for the respective service provided. The payment for the services of our private hospitals in Spain and Latin America is largely based on fixed-term contracts with private insurance companies. A deterioration in conditions, the loss of a contract or the insolvency of a payer can have a significant impact on our assets, liabilities, financial position and financial performance of our clinics.

Savings in the reimbursement of health care services may also have a negative impact on the sales prices of Fresenius Kabi's products. Due to the high share of the US market in Fresenius Kabi's turnover, changes in the government reimbursement system can have a significant impact on our business. 

Changes in legislation, reimbursement practices and health care programs could affect the scope of reimbursement for services, the scope of insurance coverage and the product business. This could have a material adverse effect on our assets, liabilities, financial position and financial performance. Overall, we aim to counteract such potential regulatory risks via benefit enhancements and cost reductions.

Competition and innovation

We face numerous competitors in our health care services business, some of which may possess substantial financial, marketing or research and development resources. Competition from new and existing competitors and especially new competitive developments and innovations in technology, pharmaceuticals and care delivery models could materially adversely affect the future pricing and sale of our products and services.

Growing competition, among other things induced by the recovery of some notable competitors, in particular in the U.S. market for generic IV drugs after halts to production, may continue to materially affect the pricing and sale of our products and services. In addition, the introduction of generic or patented drugs by competitors may have an impact on the revenue and operational results of our products.

Generally, the health care sector is characterized by pricing pressure (including from tenders), competition, and efforts to contain costs. These factors could result in lower revenue and adversely affect our assets, liabilities, financial position and financial performance.

In the United States, almost all Fresenius Kabi injectable pharmaceutical products are sold to customers through arrangements with group purchasing organizations (GPOs) and distributors. The GPOs also have purchasing agreements with other manufacturers, and the bidding process for products is highly competitive.

If Fresenius Kabi is not successful in maintaining its existing contracts or if new contracts are concluded on less favorable terms, this could have an adverse effect on our assets, liabilities, financial position and financial performance.

Similar developments with regard to price pressure in the tender business and increasing competition and price reductions are affecting our business in all major markets in Asia. Further expansion of National Volume based Procurement (NVBP) and Provincial Volume based Procurement (PVBP) is expected with one or two rounds annually. Based on the directive from the Chinese State Council, drug price reduction will continue to be one of the major measures to further contain health care costs in a market in which volumes are steadily growing.

In addition, in mid-2023, ministries and commissions across China implemented a one-year focus on eliminating corruption in the healthcare sector. This leads to uncertainty in the sector, particularly among the medical profession which is currently resulting in a sharp decline in sales in the healthcare sector. This mainly affects products that are not listed in NVBPs or PVBPs.

This development could have a negative impact on our assets, liabilities, financial position and financial performance in the future if Fresenius Kabi is not successful in offsetting these declines in sales, for example through cost savings and efficiency gains in the sales organization and in production.

To ensure our permanent competitiveness, we work closely together with physicians and scientists. Important technological and pharmaceutical innovations are intended to be quickly identified and further developed, if necessary, also by adapting our business strategy. Moreover, we secure our competitiveness by ongoing analyzes of our market environment as well as the regulatory framework. The market activity, especially our competitors' products and newly launched dialysisDialysisForm ​of ​renal ​replacement ​therapy ​where ​a ​semipermeable ​membrane ​– ​in ​peritoneal ​dialysis ​the ​peritoneum ​of ​the ​patient, ​in ​hemodialysis ​the ​membrane ​of ​the ​dialyzer ​– ​is ​used ​to ​clean ​a ​patient’s ​blood.-related products are thoroughly monitored. The cooperation between the various technical, medical and academic institutions within our company also ensures our competitiveness.

The introduction of new products and services or the development of superior technologies by competitors could make our products and services less competitive or even superfluous and thus have a material adverse effect on their sales, the prices of the products and the scope of the services. This also applies to the introduction of generic or patented drugs by competitors, which could have an impact on sales and earnings. Cooperation with doctors and scientists enables us to take up on and promote important technological innovations.

This means that we are always informed about the latest developments in alternative treatment methods so that we can evaluate our corporate strategy and adapt it if necessary.

Operating risks

Our operational business around the world is exposed to a number of risks and extensive government regulation, which include, among others:

• The quality, safety, and efficacy of medical and pharmaceutical products, supplies, and therapies;
• The operation and licensing of hospitals, other health care facilities, manufacturing facilities, and laboratories;
• The planning, construction, equipping, and management of pharmaceutical and medical-technological production facilities;
• The planning, construction, equipping and management of health care facilities;
• Permits from public authorities and monitoring of clinical and non-clinical research and development activities;
• Product approvals and regulatory approvals for new products and product modifications;
• Audits and reviews by enforcement authorities of compliance with applicable pharmaceutical legislation;
• Compliance with due diligence obligations, warranty obligations, and product liability regulations;
• The accurate reporting of and billing for reimbursements by government and private insurers;
• Discounting reimbursable pharmaceutical and medical device products and reporting drug prices to government agencies;
• The labeling and designation of pharmaceutical products and their marketing;
• Attracting qualified personnel;
• Compensation of medical personnel and financial arrangements with physicians and establishments that arrange patient referrals;
• Access to collection, publication, use, and security of health-related information and other protected data;
• Limitation of our ability to make acquisitions or certain investments and the conditions for transactions of this nature.

If Fresenius fails to comply with laws or regulations, this may give rise to a number of consequences, including monetary penalties, increased compliance costs, exclusion from governmental reimbursement programs, or a complete or partial curtailment of our authorization to conduct business, any of which could have a material adverse effect on our business reputation, assets, liabilities, financial position and financial performance. Significant risks of operations for the Fresenius Group are described in the following sections.

Production and distribution as well as quality of products and services

Compliance with product specifications and manufacturing regulations is ensured by our quality management systems, which are structured in accordance with the internationally recognized quality standards ISO 9001 and ISO 13485 and take into account relevant international and national regulations. We implement them by means of internal standards such as quality and work procedure manuals. Regular internal and external audits are carried out at the Groups' production sites and distribution companies to check compliance. This covers all requirements and regulations, from management and administration to production and clinical services, right through to patient satisfactionPatient satisfactionFresenius ​Vamed ​measures ​the ​level ​of ​patient ​satisfaction ​in ​the ​VAMED ​healthcare ​facilities ​and ​the ​overall ​patient ​satisfaction ​with ​the ​services ​offered ​in ​the ​VAMED ​healthcare ​facilities. ​Each ​patient ​receives ​a ​questionnaire ​at ​or ​immediately ​after ​discharge, ​which ​contains ​16 ​standardized ​questions ​that ​are ​evaluated ​for ​the ​patient ​satisfaction ​target.. Our production facilities comply with the Good Manufacturing Practice (GMP) requirements of the markets they supply. Our facilities are audited by local public health authorities such as the U.S. Food and Drug Administration (FDA) or the European Medicines Agency (EMA) and other authorities. If an authority identifies any deficiencies, Fresenius will immediately take comprehensive and appropriate rectifying measures.

Non-compliance with the requirements of these authorities in our production facilities or at our suppliers could lead to regulatory actions, such as warning letters, product recalls, production interruptions, monetary sanctions, or delays in new product approvals. Any of these regulatory actions could adversely affect our business reputation and our ability to generate revenue and result in significant expenses.

With its early warning system, Fresenius evaluates any quality-related information from various risk areas to identify risks at an early stage and take corrective and preventive actions. For this purpose, Fresenius Kabi uses global safety officers, databases in which complaints and side effects are logged, internal and external audits, and key performance indicators used for internal control purposes and the optimization of quality processes. In this way, safety profiles of the products can be created and evaluated worldwide.

Product recalls, for example, are initiated as a risk-minimizing measure in cooperation with the responsible regulatory authority; at the same time, the cause of the recall is analyzed thoroughly. Corrective action may be taken to avoid the circumstances that led to the recall occurring again in the future.

In addition, changes made to requirements and regulations by regulatory authorities, such as those affecting our production processes, can lead to lower production volumes during any transitional period or jeopardize production.

Production could also be adversely affected by events such as natural disasters, infrastructure disruptions, regulatory rulings, supply disruptions, such as of raw materials, or technical failures. To minimize these risks, stocks are built up, for example to bridge any gaps in the event of short-term problems.

Potential risks arising from the start-up of new production sites or the introduction of new technologies are countered through careful planning, regular analysis, and continual progress reviews.

Providing medical services in our hospitals and rehabilitation clinics is generally subject to inherent risks. For example, disruptions to processes, also due to causes such as natural disasters or technical failures, involve risks for patients and the clinic. In addition, there are operational risks, for example regarding hygiene. We counteract these risks with strict operating procedures, continual personnel training, and patient-oriented work procedures. At Fresenius Helios, for example, a structured hygiene management system is in place to ensure that infections within the hospital are avoided and their spread prevented as quickly as possible. Furthermore, we are constantly striving to improve the standard of patient treatment through our quality management systems.

Further information about our quality management processes can be found in the separate Group Non-financial Report.

Procurement

In the procurement sector, potential risks arise mainly from price increases, dependencies on individual suppliers or the lack of availability of raw materials and goods, for example due to interrupted supply chains, as we saw in the wake of the Ukraine war and the current threat to various supply routes. We counter these risks by appropriately selecting and working together with our suppliers, through long-term framework agreements in certain purchasing segments, and by bundling volumes within the Group.

We counter the risk of poor-quality purchased raw materials, semi-finished products, and components mainly by requiring our suppliers to meet strict quality standards. This includes a structured qualification process, which comprises audits, document and advance sample inspections, as well as regular quality controls of deliveries. We only purchase high-quality products with proven safety and suitability from qualified suppliers that conform to our specifications and standards.

Evaluating our risks and our management measures, we also take into account new regulatory requirements and legal conditions, such as the Act on Corporate Due Diligence Obligations in Supply Chains, which became effective in Germany in 2023.

Personnel

Fresenius addresses potential shortages of qualified personnel through appropriate employer branding measures, as well as recruitment, upskilling, and retention of qualified staff.

In order to increase the awareness and attractiveness of the Fresenius Group, our employer branding relies on a mix of different formats. The centrepiece is the multi-award-winning Group careers page with job advertisements and video, image and text information about the Fresenius Group. In addition, we are represented on all relevant social media channels and selected online career portals with profiles and our own career content.

As provider in the healthcare sector, we want to be an attractive employer for young people and their start in professional life.

To reach the student target group, we implement specific university marketing activities. These include, for example, specialized lectures at universities by Fresenius employees, print and online ads and event formats at our target universities. Furthermore, we offer young academic talent the opportunity to gain initial practical experience and to establish contacts within our company in the context of internships and working student positions before or during their studies or in the context of their final papers.

To promote internal career development and keep internal job opportunities as transparent as possible the global, internal job portal "stayFresenius" is available.

To ensure a sustainable supply of qualified staff, we offer, for example, targeted programs for young academic talent with subsequent retention programs, as well as comprehensive apprenticeships for students who just graduated high school.

With more than 6,600 apprentices and dual students, Fresenius is one of the biggest training companies in Germany. Fresenius offers 37 apprenticeships and 31 study programs throughout Germany. The number of our apprenticeships and study program offerings was further expanded nationwide.

We provide information about our apprenticeship and study program offerings on our career website, as well as at our respective training locations through various marketing activities and vocational orientation offers (such as the career guidance app Aivy, vocational information days, and the Night of Apprenticeship).

Depending on the customer and market structure, our business segments place very different demands on concepts and measures for personnel development. We strengthen employee loyalty to our company by offering our employees attractive development opportunities and fringe benefits and variable compensation and working-time models. In addition, we promote international and interdisciplinary cooperation.

By using target-group-specific measures, Fresenius addresses the overall shortage of specialized hospital personnel. We thereby aim to recruit qualified and dedicated personnel, thus ensuring our high standard of treatment quality.

Since January 1, 2019, the German hospital market has also been subject to the Ordinance on the Minimum Requirements for Nursing Personnel in Hospitals (PpUGV).

This ordinance stipulates minimum staffing levels for nursing personnel in certain areas of the hospital. Further statutory regulations on minimum personnel levels in additional hospital departments with beds may further intensify competition for qualified nursing staff.

Helios Germany is therefore working intensively on additional measures to make it particularly attractive as an employer for nursing staff. These include the compatibility of family and career (e.g., through childcare facilities at hospital sites or the option of part-time work), attractive further and advanced training opportunities, occupational health management, and career opportunities.

The Spanish hospital market is also in parts experiencing a shortage of qualified nursing staff. Quirónsalud is undertaking various measures to recruit and retain employees. This includes personnel marketing measures, personnel development programmes, market-driven remuneration and other measures to attract and retain qualified medical professionals.

Risk associated with research and development and product approval

The development of new products and therapies always carries the risk that the ultimate goal might not be achieved, or it might take longer than planned. This is particularly true for our biosimilar products from Fresenius Kabi. The development of biosimilar products entails additional risks, such as significant development costs and the still-developing regulatory and approval processes. Regulatory approval of new products requires comprehensive, cost-intensive preclinical and clinical studies.

Furthermore, there is a risk that regulatory authorities either do not grant, or delay, product approval, or withdraw an existing approval. In addition, adverse effects of our products that may be discovered after regulatory approval or registration may lead to a partial or complete withdrawal from the market, due either to legal or regulatory actions or our voluntary decision to stop marketing a product.

For example, following feedback from the European Medicines Agency (EMA), risk mitigation measures for HES products from Fresenius Kabi (controlled dispensing of hydroxyethyl starch (HES) medicines to accredited hospitals, training and letters to health care professionals and warnings on packaging) were initiated in 2019. Based on the results of a study investigating the routine use of HES in accredited clinics, the EMA had advocated a suspension of the marketing authorization of HES-containing solutions, against which Fresenius Kabi has lodged an appeal. However, the EU countries were allowed to decide for themselves whether to implement the suspension of marketing authorization immediately or to make use of an 18-month transitional period.

Follow-up studies as well as similar measures could also be taken by authorities in non-EU member states. Two regulatory studies have been conducted to evaluate the long-term safety and efficacy of our HES products in surgical and severely injured (trauma) patients. The respective study results have been submitted to the Federal Institute for Drugs and Medical Devies (BfArM), which has confirmed that the requirements for lifting the suspension of the market authorisation have been met. The products may be authorised again in Germany.

The Fresenius Group spreads its risk widely by conducting development activities in various product segments. We also counteract risks from research and development projects by regularly analyzing and assessing development trends and examining the progress of research projects. Furthermore, we strictly comply with the legal regulations for clinical and chemical-pharmaceutical research and development.

With IV drugs, it is also crucial that new products are continually brought to the market in a timely manner. Therefore, we monitor the development of new products on the basis of detailed project plans and focus on achieving specific milestones. In this way, we can take countermeasures if defined targets are called into question.

Fresenius Kabi is exposed to typical patent-related risks. These include insufficient protection by patents of the technologies and products we develop, which could enable competitors to copy our products without having to bear comparable development costs.

Financial risks

Currency and interest rate risks

Our global orientation gives rise to a variety of foreign currency risks. In addition, the financing of our business activities may give rise to interest rate risks which may also affect the value of our assets, in particular goodwill.

In order to limit these risks, we use, among other things, derivative financial instruments. We restrict ourselves to marketable instruments traded over the counter and use them exclusively to hedge underlying transactions, not for trading or speculative purposes. Transactions are conducted within limits approved by the Board of Management, which are set depending on the counterparty's rating. For further information on the management of foreign currency risk and interest rate risk, please refer to the Notes to the Consolidated Financial Statements.

Our foreign currency management is based on a policy approved by the Board of Management. It defines the objectives, organization and sequence of the risk management processes. In particular, it defines who is responsible for identifying foreign currency risks, entering into hedging transactions and regular risk management reporting. The responsibilities correspond to the decision-making structures in the Group's other business processes. Decisions on the use of derivative financial instruments in interest rate management are generally made in close consultation with the Board of Management. With a few exceptions due to foreign exchange regulations, transactions with derivative financial instruments are carried out under the control of the Group Treasury of the Fresenius Group. They are subject to strict internal supervision. This ensures that the Management Board is always fully informed about all material risks and about existing hedging transactions.

In general, Fresenius is highly hedged against foreign currency and interest rate risks: Of the Group's financial liabilities as of December 31, 2023, approximately 83% were protected against an increase in interest rates by fixed-rate financing or interest rate hedges. Thus, around 17% were subject to interest rate risk. A sensitivity analysis shows: If the reference interest rates relevant for Fresenius increase by 0.5 percentage points, this will affect the Group's net income by about 0.65%.

As a global group, Fresenius is subject to foreign currency translation effects. In view of the strong U.S. business, the relationship between the U.S. dollar and the Euro plays a special role. Foreign currency exchange risks are not hedged. A sensitivity analysis shows that a change in the US dollar to the Euro of 1 cent would have an annual effect of around €20 million on Group sales, around €4 million on EBIT and around €3 million on the consolidated result.

As a globally operating company, we have production capacities in all major foreign currency regions. In the service businesses, our sales and cost base match to a high degree. Transaction risks in foreign currencies are quantified and managed using a cash flowCash flowFinancial ​key ​figure ​that ​shows ​the ​net ​balance ​of ​incoming ​and ​outgoing ​payments ​during ​a ​reporting ​period.-at-risk model. This analysis is based on the foreign currency cash flows that are reasonably likely to occur in the next twelve months, less any hedging that has been performed. As of December 31, 2023, the Fresenius Group's cash flow at risk was €25 million, i.e., with a probability of 95%, a potential loss from foreign currency cash flows in the next twelve months will not exceed €25 million.

Further information on financial risks can be found in the Annex to the consolidated financial statements.

Financial and non-financial reporting

As a stock-listed company, Fresenius has the obligation to publish regular (quarterly) financial reports in accordance with current IFRS regulations. There is a risk that Fresenius does not comply with current IFRS regulations and / or that our reports do not represent true and fair financial reporting due to accounting errors.

In addition, Fresenius is exposed to risks due to non-financial reporting requirements. From 2024, the guidelines on sustainability reporting for companies and the corresponding, comprehensive European standards on sustainability reporting will become binding for Fresenius.

Taxes and duties

As a global corporation, Fresenius is subject to numerous tax laws and regulations. Risks arising therefrom are identified and evaluated on an ongoing basis. Any changes in tax regulations or adjustments resulting from tax audits and additional duties, import levies, and trade barriers could lead to higher taxes and duties.

In 2023, the Minimum Tax Act (MindStG) was passed in Germany, which serves to implement the Council Directive (EU) 2022 / 25234 to ensure global minimum taxation based on the OECD Pillar Two Model. Comparable laws have been passed in many other countries in which Fresenius conducts business activities. Based on current analyses, the Fresenius Group estimates that the Pillar Two regulations may only have a minor impact on a small number of foreign subsidiaries. Accordingly, the Fresenius Group assumes that the application of the current Pillar Two rules will not have a substantial impact on the consolidated tax rate of the Fresenius Group in the financial years from 1 January 2024 onwards.

Other risks

Data protection

Fresenius' business activities are also subject to data protection regulatory requirements. This includes compliance with the General Data Protection Regulation (GDPR) as well as compliance with other country-specific data protection regulations. Breaches of these regulations or of the GDPR can result in substantial fines, damage to reputation, and loss of trust.

The core element of data protection is the secure and lawful processing of personal data in accordance with these regulatory requirements. In addition to patient data, this also includes the personal data of employees as well as that of contractual partners and further persons.

Risk areas include compliance with data protection principles, information obligations, data subjects' rights, risk analysis regulations, and the documentation of data processing activities, as well as ensuring secure data processing, including the establishment of an appropriate level of data protection in national and international data transfers.

To comply with legal requirements, Fresenius has implemented comprehensive data protection management systems, which provide the appropriate technical and organizational measures and controls for the protection of personal data. Fresenius SE & Co. KGaA and all business segments maintain data protection organizations in accordance with their organizational and business structures. This includes especially independent data protection officers reporting to the respective company's management.

Consequently, the business segments have implemented processes and standards also based on their organizational and business structures that provide internal guidelines for processing personal data in a secure and appropriate manner.

Resulting from increasing internationalization, the dependence of data protection and IT security / cybersecurity is considered within the data protection organization by ensuring aligned and effective collaboration between the respective departments.

In addition, the individual data protection management systems also include appropriate control measures in order to adequately check compliance with regulatory and internal requirements.

Information technology and cybersecurity risks

Digital information is a cornerstone and enabler for our global business as one of the leading healthcare groups. Ongoing digitization and digital transformation offer great opportunities for healthcare - with innovative technological and therapeutic approaches that improve patients' treatment paths. Fresenius is continuously digitizing its processes, opening up new markets with digital product solutions, and taking into account that digitization is associated with cyber risks that can affect confidentiality, integrity, or availability.

We continuously strive to strengthen our resilience to cyberattacks and reduce our cyber risks to avert harm to our patients, customers and the company. To this end, we conduct regular risk analyses along our value chains, assess the cyber threat landscape and its implications for our infrastructures, critical systems and data in order to derive adequate risk mitigation measures.

The overarching cyber risks that affect the Fresenius Group holistically include the theft and disclosure of personal and patient data, as well as trade secrets, attacks and associated failures of our IT infrastructures and applications, e.g. through malware, or the targeted manipulation of data. In addition, cyber risks exist in connection with the business activities of our respective business units: In the product business, these relate to the disruption of production and logistics processes and the theft of intellectual property. In our healthcare facilities, cyber risks relate to patients, their patient data and the medical products or devices used. The unavailability of IT systems in critical situations or the compromise of medical devices could negatively affect patient safety and treatment effectiveness.

The loss of sensitive data or non-compliance with data protection laws, regulations and standards could damage our competitive position, our reputation and the company as a whole. Furthermore, Fresenius or one of its Group companies could be subject to substantial fines in the event of a data protection breach. To comply with all legal requirements, we have implemented comprehensive data protection management systems that provide for the appropriate technical and organizational measures and controls to protect personal data.

Our stakeholders have great confidence in the cyber security of our products and services. To minimize cyber risks, we have implemented security architectures and concepts that include preventive, detective and reactive measures. We can detect cyber threats at an early stage through monitoring mechanisms in our networks as well as on our end devices, such as desktops, servers, and mobile devices, among others. The security of applications that process sensitive patient or personal data is regularly checked by so-called penetration tests and red-teaming exercises that simulate targeted attacks. Critical systems, such as central communication systems or clinical information systems, are subject to special protection concepts that can, for example, offset the failure of a system. Further information on our cyber security strategy, organization and measures can be found in our separate non-financial Group report.

Risks from acquisitions, investments and transformations

The acquisition and integration of companies carries risks that can adversely affect the assets, liabilities, financial position and financial performance of Fresenius. Acquisition processes often include closing conditions, including but not limited to antitrust clearance, fulfillment of assurances and warranties, and adherence to laws and regulations. Non-compliance with such closing conditions by either party to an acquisition could lead to litigation between the parties or with others and thus claims against Fresenius.

Following an acquisition, the acquired company's structure must be integrated while clarifying legal questions and contractual obligations. Marketing, patient services, and logistics must also be unified. During the integration phase, there is the risk that key managers will leave the company and that both the course of ongoing business processes and relationships with customers and employees will be harmed. In addition, change-of-control clauses may be claimed. The integration process may prove more difficult or require more time and resources than expected. Risks can arise from the operations of the newly acquired company that Fresenius regarded as insignificant or was unaware of. An acquisition may also prove to be less beneficial than initially expected. Future acquisitions may be a strain on the finances and management of our business. Moreover, as a consequence of an acquisition, Fresenius may become directly or indirectly liable towards third parties, or claims against third parties may turn out to be non-assertable.

We counter risks from acquisitions by means of structured, detailed due diligence prior to deciding to go ahead with the acquisition and by means of detailed integration plans, as well as with a dedicated integration and project management process afterward so that countermeasures can be initiated in good time if there are deviations from the expected development.

Furthermore, internal restructuring and transformation processes, such as currently at Fresenius Vamed, pose risks that can have a financial impact on the Fresenius Group. These processes are therefore very carefully monitored by appropriate project teams in order to avoid the occurrence of largely unplanned costs as far as possible.

The deconsolidation of Fresenius Medical Care and the associated investment character of the holding gives rise to a dividend risk for the Fresenius Group. This risk may arise from a deviation from the dividend payment planned in the financial planning. Therefore, we monitor market developments closely and adjust potential fluctuations in our financial planning accordingly.

Compliance risks

Fresenius is subject to comprehensive government regulation and control in nearly all countries. In addition, Fresenius must comply with general rules of law, which differ from country to country. There could be far-reaching legal repercussions or reputation damage should Fresenius fail to comply with these laws or regulations.

We must comply in particular with rules and regulations that monitor the safety and effectiveness of our medical products and services. Corruption is a core risk area across all business segments. Antitrust law, data protection, money laundering, sanctions, and the upholding of human rights are further significant risk areas. It is therefore of particular importance to us that our compliance programs and guidelines are strictly adhered to. Through compliance, we aim to meet our own expectations and those of our partners, and to orient our business activities to generally accepted standards and local laws and regulations.

At Fresenius, risk-oriented compliance management systems are implemented in each business segment. These systems take into account the markets in which the respective business segment operates and are tailored to the specific requirements of the business segment. Furthermore, we at Fresenius assess compliance risks using a standardized methodology.

Our compliance programs set binding rules of conduct for our employees. We believe that we have taken adequate measures to ensure that national and international rules are observed and complied with. Nevertheless, even when a comprehensive compliance program is in place, individual cases of misconduct by individual employees or contractual partners cannot be ruled out, which could cause damage to the Company.

Additional risks

Additionally, the following risk areas appear for Fresenius and could have an adverse effect on our business and thus on our assets, liabilities, financial position and financial performance:

• Increased debt and deteriorating liquidity could, among other things, impede the company's ability to pay dividends, arrange refinancing of financial liabilities, or implement the corporate strategy;
• Non-compliance with human rights and related reputational risks;
• risks arising in connection with litigation or official proceedings;

Insurance

In its risk management, Fresenius uses the option to transfer certain risks to external insurers. Fresenius Versicherungsvermittlungs-GmbH is the Fresenius Groups' insurance department, which is organized as a captive insurance broker, and ensures appropriate insurance cover for large parts of the Group. Other sub-groups ensure adequate insurance coverage through their own departments. The aim is to protect the Company's employees and assets against possible hazards within the risk management process by procuring insurance coverage that is appropriate to the risks. To this end, we purchase adequate coverage, taking into account the cost-benefit ratio. For example, Fresenius has all-risk insurance against property damage and loss of earnings due to, for example, fire, storms, water, earthquakes, and other natural hazards, product liability insurance, insurance for volunteers and patients in clinical trials, hospital liability insurance, environmental liability insurance and environmental damage insurance, and directors' and officers' insurance.