It is important to recognize sustainability-related risks in light of business characteristics and risk profile, and to manage them based on appropriate evaluation to achieve the core concept of "creating a prosperous future through financial and capital markets" in the Vision 2030.

Climate-related risks, one sustainability-related issue, include not only climate phenomena, but also factors such as political and social responses and economic structures, which all interrelate. For example, the transition process to a decarbonized society includes effects to stocks and interest rates with changes in the overall economy (market risk). The transition also will affect the business and financial conditions of companies responding to climate change (credit risk), meaning climate-related risks could be a factor in inducing or increasing various existing risks. As such, we consider the effects of climate-related risks in our existing risk management framework. The definitions and management processes for various risks are as follows.

Market risk refers to the risk of incurring losses due to market fluctuations, which affect the value of stock prices, interest rates, foreign exchange rates, and commodity prices.

In terms of the Group's trading business, by providing market liquidity the Group acquires compensation while at the same time taking on market risk through the holding of a certain amount of financial assets. The Group implements suitable hedges to curtail fluctuations in profits and losses. However, as hedges may fail to function effectively in times of stress, the Group sets limits on Value at Risk^*1 (VaR: Maximum expected loss under certain confidence level) and loss estimates under various types of stress test^*2 to ensure that they are within the scope of equity capital, after taking into consideration financial conditions and such factors as the business plans and budgets of subject departments. The Group also sets limits on such facets as position and sensitivity.

The departments in charge of the Group's trading services calculate positions and sensitivity for the purpose of assessing their own market risk, and monitor such. Meanwhile, risk management departments also monitor the status of market risk, confirm whether risk falls within the established limits, and report on such to management on a daily basis.

We carry out stress tests based on shortened scenarios from the NGFS to analyze and assess the effects of climate-related risks on trading positions. We will continue to improve these efforts in a timely manner.

• *1The maximum possible loss of a given trading portfolio with a given probability over a given time horizon.
• *2Calculate the Group's maximum losses based on scenarios of the most significant market fluctuations of the past and due to scenarios based on hypothetical risk events.

Credit risk refers to the risk of losses caused in cases where a counterparty of a trade or the issuer of a financial product held by the Group suffers a default, or credibility deteriorates.

The credit risks generated in the trading business of the Group consist of counterparty risk and issuer risk.

Because the Group provides financial instruments, manages assets and makes investments, the Group is exposed to the risk that various instrument and transaction exposures concentrate on a specific counterparty. If the counterparty's credit situation worsens, the Group may incur significant losses. Therefore, the Group has established the upper limit on total exposure to any counterparty and periodically monitors such limit.

In regard to counterparty risk, the Group has established the upper limit on the credit-equivalent exposure that can be tolerated for each counterparty and periodically monitors such credit-equivalent exposure.

In addition, the Group measures total counterparty risk. The Group monitors the risk amount related to the issuer risk of financial instruments held for market-making.

We will enhance the assessment of our exposure to potential climate-related risks.

Operational risk is the risk of losses that occur when internal processes, people, and systems do not perform adequately or do not function; it can also arise from external events.

The Group classifies operational risks into the categories of operations risk, systems risk, information security risk, compliance risk, legal risk, human resources risk, tangible assets risk, and monitors them by assigning departments responsible for individual risks. We work to reduce operational risk in response to the business characteristics of each Group company.

Also, we have formulated a BCP to prioritize the resumption and continuation of critical operations in the event of disruptions caused by earthquakes, fires, wind and flood damage, abnormal weather, terrorism, large-scale blackouts, or major infectious diseases affecting our headquarters, branches, or data centers. This plan ensures the safety of customers and employees, asset protection, and the continuation of essential operations^*. Specifically, we have established a top-tier backup center and a system to maintain critical operations at alternative offices if headquarters functions are disrupted.

In Addition, when developing new products, we assess their appropriateness from an ESG perspective.

• *The essential operations include: (1) Market settlement of already contracted but unsettled transactions, (2) Withdrawal operations, (3) New order processing for selling and redeeming products (domestic listed stocks, MRF, government bonds for individuals, and ordinary deposits), and customer orders for selling and covering margin trades.

Reputational risk refers to the possibility of the Group sustaining unforeseen losses and the Group's counterparties being adversely affected due to a deterioration of its reliability, reputation, and assessment caused by the spread of rumors or erroneous information. There are no uniform procedures for managing reputational risk because it can emanate from a variety of sources.

The Group has established various regulations under its Disclosure Policy, with particular emphasis on the management and provision of information. It has also set up the Disclosure Committee within the Company.

Each Group company is obligated to report information that could turn into reputational risk to the Disclosure Committee. That way, the Company can obtain and centrally manage information, and it disseminates accurate information in a prompt manner according to the decisions of the Disclosure Committee.

The Group strives to keep abreast of problems and occurrences that may affect its reputation risk so that if and when such problems occur, their impact on the Group can be minimized. It also acts to ensure that erroneous and inaccurate information is properly corrected, and that it responds appropriately to libel and other issues. The Group has public relations and investor relations systems in place to prevent and minimize risks regarding its reputation.

We will analyze and assess the effects of climate-related risks on our reputation.

As a global financial institution, the Group has established a business strategy and consistent risk-taking guidelines and introduced the Risk Appetite Framework (RAF) to strengthen risk governance. The RAF defines the types and total amounts of risk that the Group should willingly accept to achieve its revenue goals and business strategy as risk appetite and uses it as a common language within the Company about the risk-taking policy in general. After documenting the RAF as the Risk Appetite Statement, the Board of Directors deliberates and decides, and this statement is reviewed twice yearly.

Climate-related risks have been included in this statement since FY2021. With this inclusion, climate-related risks are properly identified, assessed, and effectively monitored based on their risk profile.

The risk events that require particular attention in light of the Group's business characteristics are selected and managed as top risks. The management of the Company visualize the risk events that are identified and sorted out by relevant departments based on risk events collected from both inside and outside the Company as candidates for top risks, to enable the management to understand and discuss extensive risks when selecting the top risks. Moreover, the Group's Directors and Corporate Executive Officers identify and extract such candidates for top risks by making a forward-looking evaluation of the level of effects on the Group's performance and the possibility that such risk events will occur.

Given the increasing importance of the effects of climate change on the management of financial institutions and the stability of the financial system, the Group positions it as one of our top risks.

To strengthen our management system for environmental and social risks, including preserving the global environment and biodiversity and protecting human rights, the Group has formulated the Environmental and Social Policy Framework. This framework covers new investments, loans, and underwriting of bonds and stocks issuance and defines businesses for which the financing is prohibited and restricted.

When providing financing, we carry out initial ESG due diligence on the eligible projects. If it is deemed that additional confirmation is required as a result of the assessment, enhanced ESG due diligence is implemented to determine whether or not to provide financing. Where carrying out the project in question could risk severely damaging the Group's corporate value, additional discussions are held by the executive management to make a final decision on financing.

This framework will be reviewed regularly based on trends in Japan and overseas.