At Madrileña Red de Gas we understand and control the risks to which our organisation is exposed, obtaining a comprehensive vision and proactive management of these risks. In this way, we identify not only those events that generate risks, but also those that generate opportunities.

Consequently, and in accordance with our Risk Policy, at Madrileña Red de Gas we have a strategy for comprehensive, effective and proactive risk management

Based on this, we establish the guidelines for action in the integral management of risks, which includes their identification, measurement and control within the tolerance ranges determined, generating value for decision-making related to business processes.

Our risk-management strategy is not limited to any one aspect or circumstance: it is a dynamic process, extending its scope to all strategic and operational aspects of the organisation on an ongoing basis over time.

Thus, for each organisational objective, we identify the key risks that may impede its achievement, subsequently evaluating all events identified from a double perspective: Probability of occurrence and Total Impact (Economic Impact + Reputational Impact).

The assessment process consists, therefore, of locating those events identified that pose a potential threat to the organisation’s Objectives and/or Reputation within our Risk Map, focusing our attention on the ten most material risks.

Compared to previous years, in 2023, the risk related to the new EU regulation for the reduction of methane emissions has appeared in this top 10 of our main risks, as we will see below, along with a new financial risk. However, as in previous years, and unsurprisingly, our biggest risk is regulatory risk.

Our Audit and Risk Committee is responsible for analysing these critical risks, ensuring that our risk exposure is consistent with the strategic positioning required at all times and recommending the development and implementation of specific Action Plans, and identifying Best Practices. This Committee comprises representatives from the Board of Directors of each of our four shareholders, several members of the Management Committee and the risk-management department.

Furthermore, in order to strengthen maturity in the use and analysis of data, and as a basis for analysing trends and potential risks associated with them, we have launched a programme to invest in a team of people to develop analytical and data-management skills. This programme aims to enhance the use of information in our company, focusing especially on its application for decision-making and other crucial aspects of our business operations.

5.1 Regulatory risk

Given that our business—the distribution of natural gas—is a regulated activity, one of the main risks to which our company is exposed results from continuous legislative changes and market restrictions, as well as changes in the distribution model.

Regulated Activity

Modification of the remuneration model for natural gas distribution, as well as intervention in the market (setting quotas, remuneration or other restrictions), are the main regulatory risks related to our business.

On 1 March 2023, as part of its functions of supervision of the energy markets, the National Commission for Markets and Competition (CNMC) published the calendar of regulatory Circulars that may have an impact on aspects of energy policy that are expected to be processed in 2023.

In this regard, Madrileña Red de Gas monitors these publications continuously and closely, adapting to new requirements and/or regulatory changes.

Decarbonisation and energy-transition policies

The common objective of the Member States of the European Union to decarbonise the economy by 2050 has led both the European Commission and the Spanish Government to establish increasingly ambitious measures at the regulatory level, with the firm intention of accelerating the energy transition.

Among these measures is the European Regulation 2023/435 establishing the REPowerEU Fund, which states that this independence is to be achieved in a manner consistent with the European Green Pact and the climate targets for 2030 and 2050.

This is in addition to the recently adopted “Net Zero Industry Act” proposal, which aims to strengthen the production ecosystem for zero-emission technologies.

Additionally, in March, the Member States approved the joint position on the so-called “Gas Package” on the future legislative framework of measures for the decarbonisation of the hydrogen and gas markets. The package, which is expected to enter into force in 2024, consists of two legislative proposals, namely a Regulation and a Directive, that lay down common rules for the internal markets in natural gas, renewable gases and hydrogen. The aim of this legislation is to design the transition of the gas sector towards renewable gases, in particular biomethane and hydrogen, with a view to achieving the goal of climate neutrality by 2050.

Madrileña Red de Gas is keeping abreast of all these new policies, objectives and measures, while at the same time promoting actions within our organisation aimed at meeting our objective of reducing emissions, combating climate change and adapting to the energy transition, as set out in section 5.2 Climate adaptation, resilience and transition of this report.

Another regulatory change that significantly affects us, specifically in the area of methane-emission reduction, is the amendment of Regulation 2019/942, which establishes the European Union Agency for the Cooperation of Energy Regulators. Given the risk posed by this modification, Madrileña Red de Gas has assessed its potential economic impact, through pilot projects for the identification of gas leaks, as well as trying to get the regulator to recognise the potential costs as an increase in remuneration.

Furthermore, although its entry into force is taking some time, at Madrileña Red de Gas we are already actively working to reduce these emissions through our voluntary adherence to the United Nations OGMP 2.0 programme, the objective of which is to achieve a reduction in methane emissions, as detailed in the following section.

Reporting

Another of the changes that Madrileña Red de Gas must face is the new regulatory framework for Corporate Sustainability Reporting established by Directive 2022/2464 (CSRD). This new European legislation, which came into force on 6 January 2023, aims to standardise the sustainability information generated by companies.

Although its transposition into Spanish law is still pending, the reporting requirements established by the Directive will apply to our company as of 2026, when we present our Sustainability Report for the year 2025. Given the need to adapt to the new European Sustainability Reporting Standards (ESRS), our Sustainability Master Plan already includes actions aimed at diagnosing and adapting to future changes.

5.2 Climate adaptation, resilience and transition

Climate Risks and Opportunities

It is widely known and recognised that the continued emission of greenhouse gases will lead to further global warming, which could have catastrophic economic and social consequences. Due to these risks posed by climate change, in 2015 the well-known “Paris Agreement” was signed. This agreement established the need for a global response to these climate threats, joining efforts to limit the increase in temperature to 1.5°C above pre-industrial levels.

According to the World Economic Forum’s Global Risks Report 2023, which presents the results of the latest Global Risk Perception Survey (GRPS), the four most serious risks for the next ten years are environmental.

As the report highlights, the next decade will be characterised by environmental and social crises, driven by underlying geopolitical and economic trends. The “inability to mitigate and adapt to climate change” are considered the most important global risks for the future.

In light of the above, the potential threats derived from climate change are mainly manifested in two ways at Madrileña Red de Gas: those due to the regulatory changes that establish national and European emission- reduction targets, as we have seen above with respect to Regulatory Risks, as well as those derived from the physical impacts of climate change, such as the increase in temperature, which softens winters, and given that our main business is gas to homes and communities for heating and cooking, thus entailing a possible drop in demand for gas and a serious risk for our company.

Based on this, and using the recommendations of the Task Force on Climate-related Financial Disclosures (TCFD) as guidance, our methodology for climate risk analysis and assessment is based on two types of risks:

• Transition risks: The transition to a decarbonised economy may involve extensive policy, legal, technological and market changes in order to address mitigation and adaptation requirements. Consequently, these can pose different levels of financial and reputational risk to organisations.
• Physical risks resulting from climate change: these risks can be acute (tornadoes, hurricanes, floods, etc.) or chronic (temperature rise, sea level rise, etc.) and can have financial implications for organisations, as well as cause direct damage to their assets and indirect impacts on their supply chains.

From the results obtained after carrying out our climate risk assessment, we can state that the overall result is a medium risk level for both perspectives.

While climate change brings with it risks as significant as the above, efforts to mitigate and adapt to climate change also create opportunities for organisations, e.g. more efficient resource management and cost savings, adoption of low-emission energy sources, development of new products and services, access to new markets and building resilience. In this regard, during 2023, we have been working on the assessment and analysis of these opportunities.

Path to neutrality: Reducing our environmental footprint

Achieving climate neutrality by 2050 is the main objective of the European Green Pact. In this regard, the European Climate Law enacts such a target, while setting a reduction in net greenhouse gas emissions by at least 55% by 2030 compared to 1990 levels as an intermediate objective. To achieve all this, all parts of society need to be involved.

Madrileña Red de Gas is fighting against climate change by adopting specific measures to reduce greenhouse gas emissions and contributing to the
achievement of the Sustainable Development Goals

Consequently, at Madrileña Red de Gas we have established our own long-term reduction strategy for our greenhouse gas emissions in order to achieve the emission reduction targets agreed at European level, as well as the rest of the Community objectives related to climate change.

OGMP 2.0 is a comprehensive emissions reporting framework for companies in the oil and gas industry that improves the accuracy and transparency of methane emissions reporting and links it directly to strategic mitigation actions

The basis of this reduction strategy is the annual measurement of our Carbon Footprint for Scopes 1, 2 and 3, accompanied by a reduction commitment as detailed in Chapter 8.2 of this report.

Global Methane Commitment

In line with our commitment to reduce emissions and combat climate change, in 2023 Madrileña Red de Gas joined the Oil & Gas Methane Partnership 2.0 (hereinafter OGMP 2.0), an initiative launched in 2020 by the United Nations Environment Programme (hereinafter UNEP) and which forms part of the European Commission’s Strategy for the Reduction of Methane Emissions .

OGMP 2.0 is a comprehensive emissions reporting framework for companies in the oil and gas industry that improves the accuracy and transparency of methane emissions reporting and links it directly to strategic mitigation actions.

Methane is the second most important greenhouse gas responsible for climate change after carbon dioxide. Indeed, methane’s ability to trap heat in the atmosphere is 86 times greater than that of carbon dioxide. Combating methane emissions is therefore crucial to achieving the 2030 climate targets and the goal of climate neutrality by 2050.

This is key to prioritising methane emission mitigation actions in the sector. If you can’t measure it, you can’t fix it. OGMP 2.0 requires companies to report their methane emissions from all sources, throughout their value chain, with an unprecedented level of accuracy and granularity, while providing them with the credibility to demonstrate real methane emission reductions to industry stakeholders.

OGMP 2.0 has more than 125 companies as members, with assets in more than 70 countries on five continents on five continents.

Governance structure of OGMP 2.0

Steering Group
The governing body of OGMP 2.0. It is made up of representatives of all member companies, as well as non-member companies, including the European Commission, the Environmental Defence Fund (EDF), the Clean Air Task Force (CATF) and UNEP.

The Steering Group, which makes decisions by consensus, is responsible for approving changes to the OGMP 2.0 reporting framework and governance structure, as well as validating the results produced by the technical working groups. It meets at least twice a year to discuss high-level issues relevant to OGMP 2.0, receive updates on the progress of the working groups and discuss OGMP 2.0 trends and achievements.

Advisory Group
The Advisory Group acts as an advisory body to the OGMP 2.0 Steering Group. Its main role is to provide the Steering Group with recommendations on strategic issues related to OGMP 2.0 and to support business and government participation in the Partnership. Its sole objective is to provide advice on key issues. The Advisory Group meets quarterly.

The Advisory Group is chaired by UNEP and comprises nine members: six representatives of the Steering Group Company (two per segment), one representative of the European Commission (DG Energy), one NGO representative (OGMP 2.0 non-member of the company) and one representative of UNEP.

Technical Working Groups and Mirror Groups

In addition to the Steering Group, technical working groups are established when specific guidance is needed, e.g. on reporting or quantification methodologies for specific sources and uncertainty.

The number of representatives of the working group is limited to approximately 10 business and non-business partners. However, all member companies are represented in one of the two mirror groups (one for upstream and one for midstream and downstream). Mirror groups provide an opportunity for all companies to participate at the technical level by submitting comments for the technical working groups to address.

Once a company joins OGMP 2.0, it will be represented at Steering Group meetings, will be introduced to the relevant mirror group to participate in technical discussions and will be invited to participate in the annual OGMP 2.0 implementation conference and quarterly experience sharing workshops.

International Methane Emission Observatory (IMEO)

Data obtained through OGMP 2.0 is one of the key components of the International Methane Emissions Observatory (hereafter IMEO).

IMEO is a key initiative in the implementation of the Global Methane Commitment, an effort led by the European Union and the United States that brings together more than 150 countries, with the aim of reducing global methane emissions by 30% by 2030. In this sense, IMEO promotes actions for methane reduction through the creation of an innovative database of empirically verified methane emissions. IMEO collects and reconciles data from multiple sources, including company reports through OGMP 2.0, satellites, scientific methane measurement studies and national inventories (IMEO methane data).

In this regard, IMEO launched the Methane Alert and Response System (MARS), the first global satellite-based detection and reporting system for major sources of methane emissions worldwide at COP27 (the 27th United Nations Climate Change Conference in 2022), thus enabling relevant stakeholders to act on these sources. In 2023, MARS has already reported more than 120 cases of major emissions on four continents.

OGMP 2.0 requirements

OGMP 2.0 member companies commit to report their methane emissions annually (Scope 1) using the most accurate methods and science-based measurement frameworks, rather than using generic emission factors.

The general requirements for OGMP 2.0 member companies are:

• Define and disclose a methane reduction target (either intensity or absolute).
• Present an implementation plan towards the Gold Standard.
• Report annually on methane emissions from operated and non-operated assets, updating the implementation plan if necessary.

In 2023, a total of 92 oil and gas companies reported their methane emissions data for 2022, including Madrileña Red de Gas.

In order to comply with the above requirements, although it is true that at Madrileña Red de Gas we defined reduction targets, which could be considered ideal reduction ambitions, as far back as 2018, in subsequent years, with the experience obtained in the carbon footprint results, we have made more moderate adjustments to these targets.

To achieve this General Reduction Target, we have defined specific targets in the assets operated by Madrileña Red de Gas as a downstream company, which contribute to the total emissions generated. Madrileña Red de Gas currently operates all its assets (there are no non-operated assets).

On the other hand, with respect to the measurement levels, the value of emissions generated in all our operated assets during the year 2023 has been reported at Level 3.

At Madrileña Red de Gas we have established an absolute General Reduction Target based on the methane emissions generated in 2022 (Base Year), which were 521,166 kg CH4.

Progressively, by 2025, we will incorporate methodologies that enable measurement with Level 4, which may include the use of more accurate measurement technology, engineering calculations based on accurate information, use of methods (recognised reference standards and practices), amongst others. We estimate to be able to start reporting measurements with Level 5 from year 2026 onwards, given the complexity.

Furthermore, in line with the general requirements of OGMP 0.2, and to achieve the reduction targets and measurement levels established, we have defined a five-year Implementation Plan in which we set out the actions required to improve operational performance, the implementation period with the associated specific targets, if any, the area responsible for this implementation, the economic resources associated with the activity to be carried out and the degree of contribution or impact on the reduction commitment.

At present, we carry out inspections of the entire distribution network on a regular basis (every two years) given the impossibility of installing stationary measuring equipment along the distribution network. These inspections are carried out using highly sensitive portable mobile methane leak detection equipment, tracing 100% of our distribution network.

For this reason, during 2023, Madrileña Red de Gas has focused on the search for, and incorporation of, new technologies or alternatives for the detection, measurement and reduction of leaks, drawing up a Plan for the identification of alternatives for the detection and reduction of methane leaks, searching for and contacting possible suppliers that can offer a technology or alternative for determining and quantifying leaks in our distribution network, with the aim of reaching Level 4 measurement for the different sources.

Gold Standard badge

With regard to the Gold Standard, awarded by the OGMP annually, we have fulfilled the following requirements to obtain it:

• We have submitted an OGMP 2.0 compliant Level 1 (or higher) report for all in-scope assets.
• We have established an implementation plan per asset to reach Level 4/5 for all in-scope assets, starting from the date our company formally joined OGMP 2.0.

By fulfilling the two previous conditions, the company reached Gold Standard for the year 2023.

Transforming the sector: promoting and innovating in green energy

As the energy sector is responsible for more than 75% of the EU’s greenhouse gas emissions, increasing the share of renewable energy is a key element in achieving the objective of reducing net greenhouse gas emissions by at least 55% by 2030 and becoming a climate neutral continent by 2050.

The war in Ukraine and its impact on energy markets has forced member states to take accelerated measures to reduce dependence on fossil fuels from Russia. Against this background, the REPowerEU Plan, published in 2022, aims to boost the sustainable production of biomethane, while setting ambitious targets for the production of renewable hydrogen, which is seen as a key factor in the replacement of natural gas, coal and oil.

In addition, to further accelerate the deployment of renewables, the revised Renewable Energy Directive (EU/2023/2413), which raises the EU’s binding renewable target for 2030 to a minimum of 42.5%, up from the previous target of 32%, with the aspiration to reach 45%, came into force in November 2023.

In this context, at Madrileña Red de Gas we firmly believe that it is possible to evolve from natural gas, in an economical, realistic and efficient way, towards the use of totally renewable energy sources such as biomethane and green hydrogen.

The combination of biomethane and renewable H2 could offer effective and sustainable solutions for the transition to cleaner and more environmentally friendly energy in the future.

In this respect, biomethane has already become a renewable transition energy that does not require conversion of the installed condensing boiler fleet. In fact, they can run on biomethane, which does not generate CO2 emissions, and are even prepared to use up to 20% green hydrogen, which is 100% renewable in origin.

Furthermore, these renewable gases can be distributed via the gas infrastructure already in service, with no need for significant investments entailing costs that would be passed on to consumers.

All of the above also represents an opportunity for the economic development of both the Community of Madrid and the country in general.

During the energy transition, biomethane production will have to be increased and, in this area, Spain still needs to install and operate more production plants to meet a demand that is clearly growing.

According to a study carried out in 2023 by the Spanish Gas Association (Sedigas) concerning the biomethane production capacity in Spain, the national production potential of this green gas is currently 163 TWh/year, which would allow around 45% of the national demand for natural gas to be covered. In addition, this would prevent the emission of 8.3 million tonnes of methane that would otherwise be released into the atmosphere naturally as a result of decomposition of the waste reused to generate it.

In this sense, the use of biomethane in the energy mix is essential to meet the established objectives of decarbonisation, providing us with greater energy independence from the outside world, while at the same time contributing to reducing the problems derived from current waste management.

At Madrileña Red de Gas, we are committed to this transition towards the use of gases of renewable origin as a fundamental measure to address the risks arising from climate change, as well as the way to reduce our environmental footprint, as seen from the following initiatives and projects carried out during 2023.

Installation of a green hydrogen boiler for sustainable heating

With the aim of realising an installation to demonstrate the possibility of using a 100% hydrogen boiler, during the second half of 2023 we installed hydrogen combustion equipment at our facilities.

At Madrileña Red de Gas, we have installed a green hydrogen boiler at one of our sites to generate domestic hot water heated using a clean, safe and renewable fuel.

Installation has been carried out with the collaboration of Vaillant, Centralgas, Carburos Metálicos and the Association of Companies in the Installations and Energy Sector (Agremia) at our Alcorcón operations centre.

The boiler is provided by the manufacturer Vaillant, has a power of 25 kW and is equivalent in size and operation to commercial natural gas models. The room where the boiler is located has been prepared as a rest room for our technical staff. The boiler covers the domestic hot water and heating needs of the room. The tap installed in the room allows access to hot water obtained from the combustion of hydrogen, while the radiator of the heating circuit is able to heat the room using this energy.

Inside the room, hydrogen is fed from the storage unit via a copper tube connecting the boiler to the hydrogen cylinders. These bottles (two in parallel) are located in a small room separate from the rest room. The bottles are stored next to the pressure-control panel and there are vents and direct access to the street.

The storage pressure (200 bar) is reduced to the boiler feed pressure (20 mbar) by means of several control stages. The hydrogen supply from the pressure-control system to the boiler is carried out in accordance with current natural gas specifications and regulations.

Inspira Madrid

During 2023, we have continued to make progress in the Inspira Madrid hydrogen generation project, formed by three companies in consortium: Aliara Energía, Fotowatio Renewable Ventures Servicios España and Grupo Ruiz.

SPV Inspira Madrid Hidrógeno Verde S.L. was subsequently created to strengthen the commitment of these three companies, which have a 33.33% shareholding each. The environmental procedures necessary for implementation of the project were initiated through this company.

It should be noted that Inspira Madrid aims to promote renewable hydrogen as an alternative fuel and to face the challenge of the progressive decarbonisation of urban land transport. To meet this challenge, a green hydrogen production plant and a network of at least five refuelling stations will be developed.

European CEF Transport Programme

The project has been submitted to the European grant programme Connecting Europe Facility (CEF) Transport. The CEF programme is a key EU funding instrument for implementation of the European Green Deal and an important enabler towards the EU’s decarbonisation targets for 2030 and 2050. It supports the development of high-performance, sustainable and efficiently interconnected trans-European networks in the fields of transport, energy and digital services. The CEF investments complete the missing links in Europe’s energy, transport and digital backbone.

The CEF benefits citizens in all Member States by making travel easier and more sustainable, by strengthening Europe’s energy security while allowing greater use of renewable energy, and by facilitating cross-border interaction between public administrations, businesses and citizens.

In addition to grants, the CEF offers financial support to projects through innovative financial instruments such as guarantees and project bonds. These instruments create a significant multiplier effect in their use of the EU budget and act as a catalyst for attracting more funding from the private sector and other public-sector actors.

In particular, the CEF Transport is the financing instrument for implementing European transport infrastructure policy. Its objective is to support investments to build new, or rehabilitate and modernise existing, transport infrastructure in Europe.

The objectives of the Trans-European Transport Networks (TEN-T) policy foresee:

• Completion of the Core Network, structured around nine multimodal Core Network corridors, by 2030.
• Completion of the Global Network to provide accessibility to all European regions by 2050.

CEF Transport focuses on cross-border projects and those aimed at removing bottlenecks or bridging missing links in various sections of the Core Network and Comprehensive Network, as well as horizontal priorities such as traffic-management systems.

This programme also supports innovation in the transport system, in order to improve the use of infrastructure, reduce the environmental impact of transport, improve energy efficiency and increase safety. The budget of this mechanism amounts to EUR 25.81 billion.

For more information on CEF Transport, see the following link: https://transport.ec.europa.eu/transport-themes/infrastructure-and-investment/connecting-europe-facility_en

Hydrogen auctions

In turn, the project has been submitted to the first auction under the European Hydrogen Bank, with initial funding of EUR 800 million from emissions trading.

This auction aims to support renewable hydrogen production in Europe by offering fixed premiums per kilogram of hydrogen produced to close the gap between the cost of production and the current market price.

The producers selected will receive subsidies and will be able to earn additional income from the sale of hydrogen on the market for up to ten years. Other types of State aid are prohibited in order to ensure a level playing field between projects. In addition, an “auctions as a service” mechanism is introduced to finance additional projects.

A second round of auctions is planned for 2024, through which the European Hydrogen Bank plans to encourage renewable hydrogen production and imports, unlock private investment and address initial investment challenges in the EU and beyond.

More information on the European Hydrogen Bank can be found at the following link: https://www.miteco.gob.es/es/energia/hidrocarburos-nuevos-combustibles/hidrogeno/european-hydrogen-bank.html

Conversion of the grid and receiving installations from natural gas to hydrogen

As part of the Inspira Madrid project (see above) for the generation and consumption of renewable hydrogen in the municipality of Villanueva del Pardillo, Madrileña Red de Gas has promoted the implementation of an operational project for the conversion of natural gas networks to renewable hydrogen within the gas network of the town centre of this municipality.

The objective of the project is to define the operations to be carried out to transform the natural gas network to renewable hydrogen in terms of both network modifications and use of the necessary resources

We have analysed the 36 kilometres of networks present in the municipality, and the 5170 installations it supplies, in detail to determine both the technical and economic feasibility of distributing 100% hydrogen. Other factors, such as peak hour consumption and permeability of network elements, have been considered to simulate a transformation of the entire network.

The results obtained show that reuse of the polyethylene network with renewable hydrogen is perfectly feasible, although it is true that some improvements would have to be made to the distribution network (replacement and insertion of new sectoring valves, network extensions, installation of vents, condemnation of leakage points and increase in the most penalised diameters in interior installations).

One of the most important factors to consider is the availability of elements such as meters, cooking appliances or installation safety elements. During development of the project, we consulted with manufacturers and commercial brands regarding real examples. We were able to undertake this project, with institutional support and regulatory backing, on a total budget of €12M and a timeframe of no more than one year.

Pryconsa Proyect

In 2022, an agreement was signed between Pryconsa, one of Spain’s leading housing developers, and our company to supply hydrogen to a newly constructed building and use it to cover heating and domestic hot water needs, thus taking a further step towards the decarbonisation of homes through the use of green hydrogen in the Spanish residential sector.

The project has continued to progress during 2023, and together with the firm Arup, the preliminary project for the first renewable H2 installation to generate heat and DHW for 100 homes in the town of Valdemoro, studying the feasibility of the installation design, the design of the storage, the hydrogen-distribution system, the boiler room and the building, has been implemented.

Technical constraints and space limitations have reduced the feasibility of the hydrogen-storage solution. For this reason, we have chosen to study the on-site production of hydrogen by installing an electrolyser, channelling it from the outdoor plot to the central boiler of the development. At the same time, we are continuing to explore other options for storage plots.

Construction of the housing development is scheduled to begin in early 2024, although the engineering project is currently still under development.

CavendisH₂ and Heat Pump Studies

During the 2023 financial year, Sedigas has worked on different studies concerning the feasibility of hydrogen and biomethane in the gas network and their comparison with electric heat pumps. Our company has participated in these studies, together with the other distribution companies.

• The first of these studies is CavendisH2, carried out with the consultancy BIP.

  This study analyses the competitiveness and viability of renewable gases. It was concluded that renewable gases will be competitive in all consumption segments from 2030 onwards and will play a fundamental role in the energy transition in transport and electricity generation, consolidating themselves as the reference option from 2040 onwards.

  It is noted that most infrastructures could run on up to 20% hydrogen, without requiring major adaptation efforts, while a pure hydrogen scenario will require higher investment. In terms of material compatibility, the study using a probabilistic model indicates that more than 97% of the network should be suitable for hydrogen operation.

  Considering all these costs, the CavendisH2 scenario proposes an alternative that would require an annual investment 22% lower than the High Electrification scenario, mainly due to a lower marginal cost of grid reinforcement and a lower marginal cost of retrofitting residential equipment. The scenario with higher penetration of renewable gases would imply less effort in terms of costs.

• The second study, conducted with Arthur D. Little, focused on heat pumps and the competitiveness of natural gas boilers with this system. The main conclusions drawn from the study are as follows:
  • Condensing boilers, fuelled by renewable gases, are a solution that makes it possible to achieve the decarbonisation targets for buildings in Spain for 2030 and 2050.
  • The fuel used give the “green colour” to a technological solution rather than the type of equipment (boiler or heat pump). Boilers are efficient and economical, and their renewable character depends on the fuel they use.
  • Given the type of building and the average purchasing power of the population, decarbonisation using heat pumps will not be possible in Spain given that the investment required for the implementation of heat pump systems can exceed 90% of the average annual income of Madrid households.
  • Promotion of the replacement of atmospheric boilers with condensing boilers, combined with development of the potential of renewable gases in Spain, appears to be the most economically efficient and most likely to be successful alternative for the decarbonisation of Spanish households.

Connecting Biomethane Plants

As mentioned above, biomethane is emerging as one of the best solutions for transformation of the energy mix in the short term, as well as an essential element towards decarbonisation, while contributing to the development of the circular economy as a sustainable alternative to waste treatment.

Biomethane is a 100% renewable gas with a high concentration of methane, which is obtained from biogas produced from biowaste, energy crops, sewage sludge or organic household and industrial waste. As the chemical composition and energetic power thereof are very similar to natural gas, it can be used for the same purposes:

• Injection into the gas grid: mixed with natural gas for use in the heating and transport sectors.
• Electricity production.

In this context, during 2023 Madrileña Red de Gas received several formal requests to connect biomethane plants to our distribution network. One formal application has already been submitted and two are in the pipeline:

• Madrid East zone project: this is the most advanced project and is currently producing biogas. Injection of biomethane into the grid is expected in December 2025.
• Two projects in the south of Madrid: projects in the pipeline, pending official application for connection to the distribution network. Biomethane injections are expected in 2026.

Madrileña Red de Gas also participates in the Sedigas committees on renewable gases, which include biomethane and hydrogen, collaborating in the procedure for connecting biomethane plants to the natural gas network.

Agreement with the Francisco de Vitoria University

In November, we signed a collaboration agreement with the Francisco de Vitoria University to jointly develop, start up and subsequently maintain and operate a renewable hydrogen storage and supply infrastructure in one or several buildings at the University.

Developing and promoting Green Hydrogen is the objective of the agreement signed between the Francisco de Vitoria University and Madrileña Red de Gas to develop green hydrogen technology, from research to implementation and development.

This agreement also seeks to promote the training of future professionals within the technical educational branches taught at this University. The great importance of hydrogen as an energy vector in the coming years will require the training of professionals with knowledge of the subject, thus allowing the project facilities to serve to increase this knowledge. At the same time, we also offer the opportunity for students from technical fields to do their internships in our company.

5.3 Economic, financial and fiscal risk

The economic, financial and fiscal risks that we consider to have the greatest impact on our company during 2023, and have therefore been actively assessed and managed, are as follows:

1. Decrease in natural gas demand and consumption variations.
2. Higher cost of financing due to the prohibition of collateralisation.
3. Tax inspections.
4. Permanent loss of gas balance.

With respect to the above risks, Madrileña Red de Gas is considering several actions to promote demand for natural gas. In this sense, the risk assessment of a decrease in natural gas demand has been updated for the period 2023–2032 (until the end of the next regulatory period) to considering the risk of not reaching the base demand included in the business plan projections for the year 2023, as well as the demand-growth trends according to different scenarios.

We have also updated the risk assessment of higher financing costs due to the prohibition on granting guarantees in order to reflect the current situation derived from the new capital structure. This risk is now the potential increase in financing costs derived from the prohibition on granting guarantees established for Madrileña Red de Gas as a distribution company rather than non-compliance with the mandatory regulatory thresholds. Consequently, our objective is to have a more efficient financial structure that avoids debt subordination and allows for the lowest possible cost of financing.

In relation to the risk of permanent loss in gas balance, associated with structural commercial gas losses relating to domestic customers (mainly due to fraud, anomalies and reduced access to detect malfunctioning gas meters), since we first identified this risk in our corporate risk map, we have made significant progress in mitigating its impact, through fraud detection campaigns, initially in the field, but also using predictive computer modelling to detect potential cases.

The financial impact of this risk is based on two components: the volume of unallowed gas losses and the price of gas used for settlement.

Prior to 2020, the gas market had experienced a long period of sustained low prices, which allowed our company to directly reduce the financial impact. However, from 2021 onwards, gas prices have been rising continuously, with higher volatility, and are affected by the current poor geopolitical scenario. As a result, although losses in 2022 were lower than ever, the high prices represented a similar financial impact to 2016.

We have now incorporated all best practices learned from fraud inspections into administrative and field controls in our daily processes. As a result, we have become a benchmark in the sector in terms of gas-waste reduction given the significant evolution of our company in recent years, as shown in the graphs above.

Finally, the risk related to tax audits is one of the risks assessed in our Annual Accounts Audit by an independent entity. Specifically, during 2023, the following risks were assessed through this audit process:

Significant Risks:

• Recoverability of non-current and intangible assets and goodwill
• Inspections and tax contingencies
• Recoverability of deferred tax assets
• CNMC rulings and contingencies

Other Risks:

• Recognition of regulated revenues
• Impact of regulatory changes
• Bilateral Advance Pricing Agreement (BAPA)
• Cancellation of controls by the administration

As a result of the analysis of the above risks, no significant deviations were detected during the audit.

5.4 Risks related to information security and cyber security

As we are increasingly dependent on technology, we place greater value on the data and information we collect, store and manage. As a result, we are more vulnerable to security leaks and intrusions. Human error, orchestrated attacks by hackers and a malfunctioning of our systems could cause us operational, financial and reputational damage.

Consequently, for a comprehensive and effective management of these risks, we carry out annual analyses of these risks following a methodology based on ISO 27001, considering the catalogue of threats published by the National Cybersecurity Institute (INCIBE) and defining treatment plans for those risks that exceed the defined threshold.

In this way, periodic risk analyses are carried out with a focus on cyber security threats, vulnerabilities and risks affecting information security assets.

Information Security and Personal Data Protection

The protection of information and assets related to the distribution and contracting of natural gas is one of the main objectives of our company. Accordingly, through our Information Security Policy, we are committed to the following principles.

In order to comply with the above commitments, at Madrileña Red de Gas we have an Information Security Management System, which we have implemented and certified in accordance with the ISO 27001 standard, the scope of which also includes our Personal Data Protection Management model. In this regard, during 2023, we have implemented several actions aimed at defining the action plan for the transition to the new version of this standard.

We have also improved the scorecard of management indicators by developing a first executive report on the Information Security System, following the philosophy and guidelines of the other types of Integrated Management System reports. This report covers incident management, physical and environmental security, compliance, supplier relations, asset management, communications security, operations security, human resources security and system process indicators.

With regard to Personal Data Protection, at Madrileña Red de Gas we guarantee the appropriate management of the legal rights of our stakeholders by compliance with current legislation and the definition of the means, structures and procedures to develop the principles established in our Personal Data Protection Policy.

Once again, in 2023, the most relevant activities we have carried out in the area of personal data protection management have focused mainly on the management of data subjects’ rights, incident management and query resolution.

As can be seen in the graph, the number of data-protection enquiries has increased by 78% compared to the previous year.

Similarly, we recorded 7 personal data protection incidents, none of them at the level of a security breach, the investigations of which revealed the need for improvements in the management and processing of personal data.

Information security in our supply chain

As detailed in Chapter 7 Supply Chain of this report, we work with a large number of suppliers and contractors for the performance of various services and activities, whether operational, development or maintenance, etc., who provide us with their technical capabilities and specialised knowledge for an adequate performance with regard to the customer and society in general.

Our Supplier Management Information Security Policy establishes the Principles and Commitments that our suppliers must comply with in relation to the treatment of information during their activities.

Our Supplier Management Information Security Policy establishes the Principles and Commitments that our suppliers must comply with in relation to the treatment of information during their activities

These principles and commitments are also fully integrated into our management model, via:

• The contractual clauses on information security and personal data protection, which cover aspects such as intellectual property, contingency plans, as well as financial penalties for technical breaches.
• The signing of confidentiality agreements.
• Our procurement portal, from which invoices and orders with suppliers are managed.
• Identification of the most sensitive suppliers from the point of view of information security, 17 of them being strategic for our company from this point of view.
• Actions concerning the coordination of business activities on data protection with data processors through meetings, unification of criteria and best-practice agreements.
• Monitoring the information security and data-protection performance of our supplier chain, through the information provided by our supplier pre-qualification portal on the maturity of their privacy policies, as well as through the audit reports carried out by the same.

In this sense, the risk analysis carried out using our supplier pre-qualification tool allows us to assess the current status of our company based on a set of relevant regulatory frameworks and to present it as a legal rating. This analysis focuses on the assessment of the company in terms of privacy and cybersecurity.

During 2023, 46 of our suppliers have been assessed according to the above axes.

Application security

Madrileña Red de Gas does not carry out internal IT developments as all of them are outsourced. Thus:

• We have a procedure for the acquisition, development and maintenance of software, which defines the clauses that must be contained in service contracts, such as ownership of the source code developed, intellectual property rights, quality certification requirements, access rights for auditing and testing prior to implementation in order to verify the quality of the product.
• We carry out application testing, keeping track of the vulnerabilities detected.
• We have a general overview of critical applications in all business areas and an inventory of critical applications with regular reviews.

Cybersecurity

The increase in remote working motivated by the Covid 19 crisis, the digitalisation of processes and the use of artificial intelligence, geopolitical conflicts, etc. are all recent events that have led to a marked evolution, increase and sophistication of cybersecurity threats and cyber-attacks.

Our Cybersecurity Operating Model allows for coverage of all aspects of cybersecurity in our organisation. In addition to the Head of Cybersecurity, supervision thereof is the remit of a Cybersecurity Committee

Our Cybersecurity Operating Model allows for coverage of all aspects of cybersecurity in our organisation. In addition to the Head of Cybersecurity, supervision thereof is the remit of a Cybersecurity Committee.

The Cybersecurity Committee aims to guide and monitor policies, action plans and the dissemination of cybersecurity initiatives, meeting every two months, with the presence of the heads of each business line and representation from the OT environment.

Based on the above, Madrileña Red de Gas has a strategy based on projects derived from annual evaluations. Our company’s cybersecurity strategy is reviewed annually by way of a reassessment process. We also submit it to the Cybersecurity Committee and the Audit and Risk Committee, reporting on the status of the most relevant projects.

Disaster Recovery Simulation

The Disaster Recovery Plan at Madrileña Red de Gas aims to minimise the effects of a disaster on our company’s functions, such that, in the case of any eventuality, it can quickly renew its functions, defining the processes, procedures and responsibilities during the service recovery flow.

During 2023, the simulation performed consisted of the recovery of our SAP system from a disaster, in the shortest possible time and with as few manual tasks as possible, for recovery of the service to the closest point to the disaster, thereby guaranteeing the integrity of the data.

Network Penetration Testing

Network penetration tests are techniques that Madrileña Red de Gas uses to identify, test and highlight security vulnerabilities by imitating an attack on our computer systems and/or our network.
Thus, by performing an external penetration test it is possible to determine the state of an organisation’s perimeter security, as well as the risks to which it could be exposed. This process attempts to demonstrate how far a malicious user could go, without having any knowledge of the organisation. The scope of this external penetration test was all systems published on the Internet concerning our company, without exception.

As a result of these network penetration tests, no critical risk vulnerabilities were identified in 2023.

Contingency and incident simulation: Crisis management

Madrileña Red de Gas has established a management framework to establish the response to a cybersecurity crisis situation. This framework consists, inter alia, of a Cybersecurity Crisis Management Committee and operational incident management procedures depending on the size and impact of the incident.

From August to October 2023, a series of activities were carried out to formalise the company’s crisis management structure and make the model more solid and mature. The activities carried out focused on:

Renewal of cybersecurity audits: Measuring our level of maturity

During 2023, Madrileña Red de Gas has reassessed its level of maturity in Cybersecurity based on Deloitte’s Cyber Industrial Strategy Framework (CISF) v2.0. In the case of the C2M2 evaluation in the OT environment, this is carried out every 2 years, which means that it will take place during 2024.

Specifically, the CISF framework used to identify our security capabilities is based on four pillars.

Traditionally, the most relevant security dimensions have been Governance and Protection, which explains why most organisations have a higher level of maturity in these domains.

The current trend is to assume that, despite the existing level of protection, organisations must be able to detect (Vigilance) security incidents and respond (Resilience) appropriately.

In addition, this framework has 5 maturity levels when quantifying the e-skills of our organisation. The evolution of maturity is logarithmic, rather than linear, and the associated costs are exponential. In fact, it requires a significant effort, large budgets, metrics and indicators to review security status, and a high level of management to achieve levels above 2.5. Consequently, according to Deloitte data, 99% of the companies analysed through this framework are at a maturity level of less than 3.5.

The results of the current Cybersecurity maturity level, compared to the last review in 2022, are shown below, highlighting the evolution in terms of surveillance and resilience capabilities.

Based on these results, and in order to continue on this path of improvement, during 2023 we have identified the level of maturity we aim to achieve in the coming years, as well as strengths and opportunities for improvement.

In this sense, we have established a new Cybersecurity Plan (2024–2026) in which we have defined the action plan that we must implement to progressively increase our level of maturity. The plan is structured on a priority basis, in three successive waves over the time period 2024–2026. Each of these waves includes projects belonging to the four different domains of Deloitte’s CISF v2.0 framework.

Training and awareness-raising

We have a specific Awareness Plan, which includes training in the area of Cybersecurity for all our employees that has been updated with extra content this past year. In addition, new hires are required to undergo cybersecurity training as part of their onboarding.

Thus, through our training platform, we have launched 10 information pills over the course of 2023, including:

• Security updates (Windows, Chrome, etc.)
• How to create complex passwords, using the password manager
• Block endpoint
• QR code recommendations

In addition, once a year, phishing and vishing exercises are conducted to assess the user’s level of vulnerability to these attacks and various security information pills are sent out via email. In this regard, the awareness-raising actions we carried out during 2023 for the entire company were:

• 1 phishing campaign
• 12 microlearning videos

The aim of the phishing campaign is to make all our users aware of the real risk that exists and how easy it is for data to be stolen. Attacks on businesses, both large and small, are a daily occurrence, and the consequences can be disastrous.

The campaign consisted of sending an email informing that a document, specifically an employee discount catalogue, had been shared with us. To do so, we had to click on a link and enter our company email address and password.

The results of this campaign were slightly worse than the previous year, which may be due to a higher level of difficulty in this second campaign, simulating a more internal look and feel.

In any case, as seen above, our objective is to continue to increase the maturity of our system, which will lead to increasingly better results.

With regard to the microlearning videos, these covered different topics (ransomware, family cybersecurity, etc.), all aimed at reinforcing our employees’ knowledge and awareness of cybersecurity.

In addition to the above, cybersecurity behavioural guidelines are reinforced by the regular sending of alert emails to all our employees. These alerts present real cases of security incidents that have occurred in other companies, recommendations from administrations, etc., thereby reminding us of the general guidelines to avoid becoming a victim of cyber-attacks.

Cybersecurity events

Madrileña Red de Gas keeps a record of all cybersecurity events. During this year, there has been an increase in the number of events detected compared to previous years.

In this regard, 18 of the 22 events recorded in 2023 were phishing attempts or suspicious files. There was also a case of a CEO impersonation, two attacks on servers with no consequences, as well as an incident reported by a supplier who indicated that its systems had been breached by a cybersecurity attack but that the established protocols allowed its restoration with no adverse effects.

5.5 Asset Integrity and Criticality Accident Management

Madrileña Red de Gas is fully aware of the importance of preventing, assessing and controlling incidents and accidents that can seriously damage health and the environment, as well as the economy of communities and infrastructures.

The pipeline network for gas distribution is obliged to have the emergency measures established in article 20 of Law 31/95 on the Prevention of Occupational Hazards and in section 6.2. of point 6 of the ITC-ICG 01 “Installations for the distribution of gaseous fuels by pipeline of R.D. 919/2006 (Technical Regulation for the distribution and use of gaseous fuels and its complementary technical instructions)”

In addition, although with a phase-out target of 2024, we still have LPG plants to which the SEVESO III directive applies.

Over the years, we have documented and kept the necessary management systems for risk identification, risk prevention and emergency response up to date, in accordance with the different UNE-EN ISO standards for Management Systems and regulatory requirements.

Our performance has always been evaluated to ensure continuous improvement, seeking efficiency and especially effectiveness in our efforts to minimise risk and its consequences, safeguarding above all people, material assets and the environment, maintaining service and safety pressures on the networks and safeguarding the company’s image.

In line with this spirit of continuous improvement, in 2023 we can highlight the development of the Emergency Plans at a municipal level as a way of increasing the level of efficiency in the response to possible emergencies.

Elaboration of Emergency Plans for the municipal distribution network

In 2023, in addition to the emergency measures established in the occupational risk prevention systems, we have drawn up Emergency Plans at a municipal level in which all possible risks are included and evaluated following the criteria and structure established in the Basic Self-Protection Regulations of R.D. 393/2007.

Legally, there is no compulsory methodology to be adopted for the identification and subsequent risk assessment for this type of installation, and it is possible to use different methods and degrees of systematisation for assessment of the risks involved. For these Emergency Plans, we have followed the criteria established in the Territorial Civil Protection Plan of the Community of Madrid (PLATERCAM) and, specifically, the Guide for the preparation of Municipal Territorial Plans, adapting the semi-quantitative risk-assessment method proposed therein to the type of scenario covered by our Emergency Plans.

For identification and analysis of the own risks, we analyse those originating in the gas distribution pipeline network as a consequence of its operation, or of the activities carried out in it, and which may cause an emergency situation due to different scenarios.

In the analysis of external risks we consider:

• The risks of nature on our facilities
• Risks caused by third party installations as well as by third party works in the vicinity of our premises
• The risks of intrusion and/or antisocial acts

Emergency care in 2023

Our Emergency Control Centre (CCAU) has the necessary human and material resources to receive all emergency alerts and communicate them quickly, clearly and reliably to the teams in charge of responding to the alerts, 24 hours a day, seven days a week.

The notification of an emergency to the command line of the technical services concerned is always carried out in accordance with the Emergency Plan. The CCAU has a telephone system for dealing with emergencies, the calls to which are recorded and saved for two months. Our emergency intervention teams have the technical and operational knowledge to ensure they act correctly, both in the actions to be carried out in transmission and distribution networks and in receiving installations, as well as the occupational risk-prevention specifications related to these actions. The priority of a warning is given according to the level of risk that can be deduced a priori from the information collected on receipt of the warning. This is established in five levels (1, 2, 3, 4 and 5), ranging from immediate action to programmed action, depending on the level of risk or urgency established.

Subsequently, we carry out an analysis of the results and produce the Emergency Reports. This analysis allows for the assessment of response and operational times and serves to identify opportunities for improvement. In addition to these reports, periodic reports are issued, analysing weekly and monthly emergency care activity and calculating ratios that allow the quality of the service to be evaluated.

The analysis of our 2023 interventions, for priorities 1 and 2, shows that we clearly continue to meet our objectives. For priority 1 emergencies, 99.1% were attended in less than 1 hour, far exceeding our quality target of 30 minutes, with 96% attended in less than one hour.

In 2023, we have dealt with a total of 120 breakage notifications in our distribution network by third-party companies, whose resolution is immediate, for safety and environmental reasons, as mentioned above.

The average attention times were 39 minutes. This minimises the potential risk in an emergency situation. The emission of fugitive gas has been limited to 1.12 Gwh, with costs being recovered in virtually all cases.

From our emergency service, we have carried out a total of 9232 preventive actions, commissioned to optimise the available resources, such as rectification of leaks from monitoring, mapping anomalies, inspection of valves, inspection of meters, surveillance of third-party works, among others.

Finally, it is interesting to note that we have detected 72 frauds/manipulations in the emergency department when making emergency alerts.