While pursuing profitability and growth, the Group considers it important to appropriately identify, evaluate, and effectively manage the various risks associated with its business. By maintaining a sound financial and earnings structure that balances risk and return, and by appropriately managing not only short-term risks but also risks that may materialize over the medium to long term—such as climate-related risks—we aim to sustainably improve our corporate value.

Risk Management System

Based on a basic risk management policy, each Group company manages risk according to the characteristics and scale of its business, while the Risk Management Department and the departments responsible for each risk at Daiwa Securities Group Inc. monitor the risk management systems and risk status of each Group company. The status of each company's risks identified through monitoring, and issues in each company's risk management system, are reported as needed to the CRO, selected from among the executive officers. The CRO issues corrective instructions, verifies the effectiveness of risk management systems, and revises them as necessary, according to the scale, characteristics, and risk status of each company's business. The CRO is responsible for reporting risk to the CEO and does not concurrently serve as the head of internal audit or as a member of the Audit Committee.

At the Group Risk Management Committee—a subcommittee of the Executive Management Committee of Daiwa Securities Group Inc.—the risk status of each company is reported and policies and specific measures related to risk management are deliberated and decided. Risk management processes are also discussed and revised at this Committee. Although the Committee is constituted separately from the Audit Committee, its content is also reported to the Audit Committee. There were no changes to risk management processes in FY2025.

Climate-related risks involve many mutually interacting factors—not only climate phenomena but also political and social responses and economic structures. For example, effects on equities and interest rates from economy-wide change during the transition to a decarbonized society (market risk), and effects on companies' business and financial condition from responding to climate change such as the transition to decarbonization (credit risk), mean that climate-related risks can cause or amplify existing risks. We therefore consider the effects of climate-related risks within our existing risk management framework. The definitions and management processes of each risk are as follows.

Market risk is the risk of incurring losses from fluctuations in the prices of equities, interest rates, foreign exchange, commodities, and the like. In the Group's trading business, we earn compensation by providing market liquidity while bearing market risk through holding certain financial assets. We conduct hedges as appropriate to curb profit-and-loss volatility; however, because hedges may not function effectively in times of stress, we set limits so that loss estimates from Value at Risk (VaR)^*1 and various stress tests^*2 remain within the scope of equity capital, taking into account financial conditions and the business plans and budgets of the relevant departments. We also set limits on positions and sensitivities. The departments responsible for trading calculate and monitor positions and sensitivities to grasp their own market risk, while the risk management department also monitors market risk, confirms that it is within the set limits, and reports to management daily. To analyze and assess the impact of climate-related risks on trading positions, we conduct stress tests using the NGFS short-term scenarios, and will continue to improve our approach as appropriate.

• *1VaR is the maximum loss statistically expected within a certain probability due to future price changes, assuming a certain position is held for a certain period.
• *2Stress tests calculate the significant losses that could occur to the Group based on scenarios of large past market fluctuations or hypothetical stress events.

Credit risk is the risk of incurring losses due to the default of a counterparty of a financial transaction or the issuer of a financial product held, or due to changes in creditworthiness. Credit risk in the Group's trading business includes counterparty risk and issuer risk. For counterparty risk, we set an upper limit on the acceptable credit-equivalent amount for each counterparty group and monitor it regularly, and we also measure the total risk amount of counterparty risk. We also monitor the risk amount of issuer risk for financial products held through market-making. Because the Group provides products and manages and invests assets, various product and transaction exposures may concentrate on a specific counterparty group; if that group's credit situation deteriorates, significant losses may occur, so we set a limit on total exposure to any single counterparty group and monitor it regularly. Going forward, we will advance the sophistication of assessing potential climate-related risks in the Group's exposures.

Operational risk is the risk of losses arising from inadequate or failed internal processes, people, and systems, or from external events. The Group classifies operational risk into operations risk, systems risk, information security risk, compliance risk, legal risk, human resources risk, and physical assets risk, and manages each by assigning a responsible department. As business operations become increasingly sophisticated and diversified, and as the use of technology and systems continues to expand, various operational risks are emerging and the importance of operational risk management is increasing year by year.

We also carry out appropriate operational risk management—such as conducting Risk Control Self-Assessments (RCSAs)^*1—at major Group companies based on Daiwa Securities Group Inc.'s operational risk management regulations, and take necessary measures such as tightening authority, mechanizing processing to reduce human error, and developing operational manuals. We strive to mitigate operational risks in a manner appropriate to the business characteristics of each Group company. In addition, anticipating a case in which the head office (headquarters functions), branches, or data centers are damaged and unable to function due to the shutdown of social infrastructure from earthquakes, fires, wind and flood damage, abnormal weather, terrorism, large-scale blackouts, or serious infectious diseases, we have formulated a BCP to prioritize the resumption and continuation of critical operations^*2 from the perspectives of maintaining securities market functions and customers' living and economic activities. In accordance with this BCP, we seek to ensure the safety of customers and employees and protect their assets. Taking into account the public role of a securities company, we are committed to maintaining critical operations. We have established a top-tier backup center and a system to continue critical operations at alternative offices or via telework even if headquarters functions are paralyzed. When planning new products, we also incorporate a flow to confirm appropriateness from an ESG perspective.

• *1RCSA identifies, grasps, and evaluates operational risk using prescribed risk assessment sheets, analyzes risk by frequency and impact, and evaluates and verifies the effectiveness of risk mitigation measures.
• *2Critical operations to be prioritized for resumption/continuation are: (1) market settlement of already-contracted but unsettled transactions; (2) withdrawal operations; and (3) as new order-taking operations, customer orders to sell or redeem products (domestic listed stocks, MRF, government bonds for individuals, ordinary deposits) and to cover short margin positions.

Reputational risk is the risk that the Group's credibility, reputation, or evaluation deteriorates due to rumors or erroneous information, causing unforeseen losses and adverse effects on the behavior of the Group's counterparties. Because it can arise from various events, management methods are not necessarily uniform. Particularly from the perspective of information management and provision, we have established various regulations based on our Disclosure Policy and set up a Disclosure Committee at Daiwa Securities Group Inc. Each Group company is required to report information that could give rise to reputational risk to the Disclosure Committee, enabling Daiwa Securities Group Inc. to grasp and centrally manage information and to disseminate timely and accurate information based on the Committee's decisions. If such risk materializes, we work to grasp the situation and minimize its impact on the Group, appropriately correct errors or inaccurate information, and respond appropriately to slander and the like, maintaining public relations and IR systems to prevent and minimize risk. Going forward, we will advance the analysis and assessment of the impact of climate-related risks on the Group's reputation.

Financial institutions that operate globally are required to ensure sufficient soundness to exercise their financial intermediation functions even in times of economic or market stress. To be adequately prepared for stress, it is necessary to secure sufficient liquidity and equity capital commensurate with various risks even in normal times. Under this environment, the Group has introduced a Risk Appetite Framework (RAF). The Group's RAF is documented as the "Risk Appetite Statement," deliberated and decided by the Board of Directors, and we work to embed it Group-wide and raise the level of the management system. Quantitative risk appetite indicators are deliberated and decided by the Board of Directors as part of the Risk Appetite Statement and reviewed twice a year. Audits of the Board of Directors and of management's execution of duties regarding the RAF are conducted by the Audit Committee. Climate-related risk has been addressed in this Statement since FY2021, whereby climate-related risks are appropriately identified and assessed according to their risk profile and effectively managed.

RAF Concept Chart

To strengthen the management and governance system for environmental and social risks—including the conservation of the global environment / biodiversity and respect for human rights—the Group has formulated the Environmental and Social Policy Framework. This framework covers new investments, loans, and underwriting of bonds and stocks issuance ("financing") by the Company and its major Group companies, and defines prohibited and restricted businesses.

When providing financing for applicable projects, we conduct initial ESG due diligence. If it is determined that further verification is required as a result of the assessment, we will apply enhanced ESG due diligence to determine whether to provide financing. If the implementation of the project may have a serious impact on the corporate value of the Group, the executive management will discuss further and make a final decision on whether to provide financing. Even after new investments and loans have been provided, we will perform regular screenings for child labor, forced labor, and human trafficking at investees and/or borrowers; if such facts are identified, we will request corrective and preventive measures through dialogue and carefully consider whether to continue financing. The framework is reviewed regularly, at least once a year, based on implementation experience and changes in the external environment, with deliberations by the Board of Directors to ensure more rigorous operations.