Operational Resilience

In response to potential human-induced or natural disasters, management crises, and cybersecurity incidents, SinoPac Holdings and its subsidiaries have established the "Management Crisis Emergency Response Measures" and the "Emergency Response Rules", and conduct regular drills to mitigate the impact of incidents, restore normal operations as quickly as possible, and safeguard the rights and interests of customers and shareholders.

Risk incident category and impact analysis

Category	Incident	Impact or influence on business/operations	Response plan
Human-induced or natural disasters	Political events, strikes, wars, fires, floods, storms, earthquakes, pandemics, etc.	Climate change leads to extreme weather conditions that increase the likelihood of natural disasters. Possible impacts include damage to company premises and equipment as well as loss of customers and investment targets. Heightened geopolitical risks may lead to drastic political, social, or economic changes, which affect financial markets and reduce corporate profits.	Business continuity mechanisms SinoPac Holdings has defined four levels of alert in accordance with the “Natural Disaster Emergency Response Guidelines” and established the safety and maintenance supervision team, emergency response team, epidemic prevention and communication command center, emergency notification mechanism operating procedures, and business continuity backup mechanisms. Disaster adaptation/mitigation measures and plans Identify high-risk areas and strengthen resilience of buildings structures, waterproofing, and electrical facilities to prevent disasters, and set up a safety maintenance network for business sites to enable immediate reporting of disasters and prevent losses from criminal activities caused by disasters. In addition, we have taken out commercial fire insurance and comprehensive electronic equipment insurance to offset losses in affected sites. Continue to track the cumulative scenario analysis results of physical risks and include the climate history data as a reference for the relocation, setup, and purchase of own real estate.
Management crises	Fraud derived from poor internal control, liquidity crisis, material financial loss, bank run or imminent bank run.	The occurrence of sudden cash demand, abnormal deposit withdrawals, large capital loss, and severe liquidity shortage due to a systemic risk crisis may jeopardize normal operations and damage the interests of depositors and investors.	SinoPac Holdings has set up a “Crisis Management Team” with the President as the convener to plan and supervise the implementation of the emergency response plan. It continuously evaluates market liquidity conditions with respect to risk events, defines three types of situations, namely moderate, severe and very severe illiquidity based on the severity, and plans contingency measures according to the severity of the conditions.
Cybersecurity	Data leakage or tampering, system service interruption, unauthorized network access, computer virus infection, etc.	Interrupted information system operations due to major physical disasters (e.g., earthquakes and fires) or network attacks resulting in personal information leakage, customer data alteration, system crash, network outage, etc., may result in loss of business reputation and disruption of operations.	SinoPac Holdings has established emergency response mechanisms for information security incidents and personal data protection incidents. In the event of an information security incident or personal data protection incident, the Company shall immediately handle the incident in accordance with the "Emergency Response Rules" and follow relevant internal and external reporting procedures.