# 1. Board of Directors and Risk Control Committee

The Board of Directors has the ultimate responsibility for the risk management of the Company. The Board of Directors is mainly responsible for advancing the construction of risk culture; considering and approving the basic system of the comprehensive risk management of the Company; appointing chief risk officer; considering and approving major issues of the Company’s risk management, such as risk preference, risk tolerance, significant risk limit and information disclosure; reviewing and evaluating risk management reports and their implementation, etc. The Board of Directors may delegate its Risk Control Committee to fulfill part of its function of comprehensive risk management.

# 2. Senior Management (Including Chief Risk Officer) and Risk Management Committee

The senior management of the Company is responsible for organizing and implementing various works in comprehensive risk management in the operation and management process, which mainly performs the following duties:

(1) establish a risk management system and make timely adjustment;

(2) establish a healthy operation management structure for the Company’s comprehensive risk management, clarifying the duty allocation of risk management among various departments, and establish a working mechanism that features effective checking and balance and good coordination among the departments;

(3) establish a complete information technology system and data quality control mechanism;

(4) establish a performance assessment system for all staff that covers the effectiveness of risk management;

(5) formulate the specific execution plans for risk management according to the risk preference, risk tolerance and significant risk limit approved by the Board to ensure the effective implementation of the plans; monitor its progress, analyze reasons in a timely manner and handle it according to the authorizations granted by the Board;

(6) regularly assess the overall risk of the Company and various types of material risk management conditions, resolve problems that are found in risk management and report to the Board.

The Company establishes a Risk Management Committee under the senior management, which is responsible for the overall risk monitoring and management of the Company within the scope of authorization of the Board and management, formulating and adjusting the risk management decisions of the Company, approving new business and risk limits, and making decisions and approvals for important matters involving risk management.

The Company establishes a chief risk officer who is a senior management officer of the Company and is appointed and removed by the Board. The main responsibilities of the chief risk officer include:

(1) organize and implement the overall risk management of the Company;

(2) review and approve the Company’s risk management plan and risk measurement methods, models and indicators;

(3) organize the formulation of the Company’s internal risk management system and policies, and evaluate major market, credit, liquidity and other risks;

(4) organize investigation and inquiry for hidden risks existing in business operation and management activities; report major hidden risks that discovered to the president of the Company in a timely manner, and put forward rectification opinions to the person-in-charge of other relevant departments; possesses the authority to report to the Board and its Risk Control Committee or the chairman of the Supervisory Committee had the major hidden risks or the rectification of hidden risks fails to meet the standards.