Governance Supporting Our Proactive Human Resources

Preparing for Increasingly Varied and Complex Risks

Reinforcing Risk Management
Basic Policy
In the areas of “strengthening credit risk management” and “market risk control,” we seek
to enhance our risk/return management and to assure appropriate returns commensuratewith risk.
In the area of “anti-money laundering and anti-terrorist financing,” we have reinforced ourefforts to protect against risk by establishing a “Countermeasures Policy” to prevent serious
violations that could occur in the absence of effective internal control systems, thus avoiding
potential loss of public confidence and significant damage to our corporate value.

Fiscal 2023 Action Plan
External environment
Increased
geopoliticalrisks
Changesin laws andregulations

Fiscal 2023 Action Plan
We are directing efforts to reinforcing the soundness of the Group’smanagement and the appropriateness of its operations through adequate
risk management and flexible decision-making in today highly uncertain
business environment.
Measures to combat money
laundering and terrorist financing

Strengthening credit risk
management

Goal to beachieved
Anorganizationthatcontrols risk
appropriately

Measures to combat money laundering and terrorist financing
Recent years have brought increasing demand from the international community for measures to combat money laundering andprevent financing of terrorism. In this context, we have positioned money laundering prevention as one of our most importantmanagement issues. We have appointed the officer in charge of the department responsible for overseeing measures to preventmoney laundering as the AML General Bank Manager. We also aim to improve the effectiveness and sophistication of our money
laundering prevention by, for example, establishing the “Policy Against Money Laundering and Terrorist Financing” as a fundamental
Group policy.
In response to the emerging financial crimes that are becoming more complex and sneakier, meanwhile, we are also striving tomaintain safe, highly convenient financial services by enhancing our preventive measures to prevent our customers from accidentally
becoming involved in any financial crimes.
Policy Against Money Laundering and Terrorist Financing
1. Organizational structure(1)	The Bank shall position money laundering prevention as one of its most important
issues for management and shall endeavor to implement all possible anti-money
laundering measures.
(2)	The Bank shall establish a centralized management system by designating a person
responsible and a supervisory department for money laundering prevention and shall
respond to the relevant issues in a cross-organizational manner through coordinatedefforts of the departments involved.

4. Reporting of suspicious transactions
The Bank shall confirm and determine whether transactions reported by its branch offices
or detected through transaction monitoring are suspicious and shall notify the authorities
immediately if it determines that the transactions are suspicious.

2. Risk-based approach
The Bank shall employ a risk-based approach to appropriately identify and assess money
laundering and other risks and shall implement mitigation measures commensurate withthe risks.

6. Management and employee training
The Bank shall conduct ongoing training programs to educate its officers and employees
fully with respect to money laundering to raise their levels of expertise and assure proper
responses.

3. Customer management policy
The Bank shall establish a system for conducting confirmation appropriately at the time oftransactions and other customer management measures in accordance with the applicablelegal and regulatory requirements. It shall also examine and analyze customer transaction
records periodically and implement necessary customer management measures.

7. Compliance auditing
The independent Internal Audit Department shall conduct regular audits of the Bank’s
money-laundering prevention and related systems, and the Bank shall draw on the resultsof the audits to improve its systems further.

5. Correspondent bank management
The Bank shall collect information on correspondent banks, assess it in an adequate
manner, and take proper measures in response to the risks associated with it. It shalleliminate any relationships with spurious banks that have no actual business operations.

Strengthening credit risk management
Credit risk is the risk of incurring losses due to a decrease or loss of the value of assets stemming from deterioration of the financial
condition of the creditor. We contribute to our customers’ development through solutions based on our “know your customer”
efforts, offering thorough financial and/or core business support to improve the quality of the Group’s assets at the same time.

44 Nanto Report 2023, the integrated report of Nanto Bank

About Nanto Bank

Governance Supporting OurDeveloping Human
Value Creation by theResources for Value Creation Group’s Human Resources Proactive Human Resources

Our Shared Vision

Consolidated FinancialStatements

GovernanceRisk management systems

Credit risk
management

Integrated risk management

Risks andopportunities

Performance

Operational risk
management

Integrated risk management system

To reinforce our ability to manage the risks we face in our banking business, Nanto Bank has
Market risk
Liquidity risk
management
management
assigned responsibility for each risk to an appropriate department and established the Risk
Management Division to handle them in an integrated manner by determining the various risks’Administrative risk management
individual positioning and magnitude and responding to each promptly and accurately.
(Thorough, accurate office work)
In our commitment to risk management, we have specified basic risk management
System risk management(Response to system failures/prevention ofpolicies through various directives, including our “Integrated Risk Management Regulations.”
unauthorized use)
Legal risk management
To realize integrated risk management in which risks are quantified on a unified scale(Monitoring of legal compliance)
and the amount of each is controlled to an appropriate level in relation to equity capital in
Human risk management(Response to personnel and labor problems)consideration of management strength, we determine the risk capital allotment (capital
Tangible asset risk management
allocation amount) for each type of risk semi-annually within the range of equity capital, and(Response to impairment of tangible assets)
Rumor risk management
control each risk amount (value at risk = VaR, etc.) to ensure that it falls within the scope of(Response to false assertions circulating in thecapital. The ALM Committee evaluates the status of each risk at its monthly meetings as partmarket and among customers)of efforts to achieve more efficient, effective risk / return management, and systems are in place
to exercise appropriate controls for ensuring management stability and improving profitability from the perspective of effective use of capital.
Risk management organization(As of June 30, 2023)

Audit and Supervisory Committee

Board of Directors

Emergency countermeasures meetings

Various management meetings(Alert countermeasures meetings)

Committees

ALM Committee

Operational Risk Management Committee(ALM Subcommittee)(Operational Risk Management Subcommittee)

Compliance Committee(Compliance Subcommittee)

SystemRisk management system

Compliance structure

Supervisorydepartments

Risk Management Division

Compliance Control Department

Classification(departmentin charge)

Credit risk

(Risk ManagementDivision)

Market risk

(Risk ManagementDivision)

Liquidity risk

(Risk ManagementDivision)Operational risk (Risk Management Division)
Administrative risk
(Business SupportDepartment)

System risk
(IT StrategyDepartment)

Legal risk

(Compliance ControlDepartment)

Human resources risk Tangible asset risk
(Personnel andGeneral Affairs
Departments)(Personnel and GeneralAffairs Departments)

Compliance
Reputation risk

(Corporate PlanningDepartment)

Operations
departments

Headquarters departments, sales branches, consolidated subsidiaries

InternalAudit DivisionInternal Audit Division(ComplianceControl Department)

External audits and auditors

Internal auditing system
Enhancing and reinforcing our risk management require implementing the PDCA cycle to ensure its effective functioning forautonomous improvement, with the Risk Management Division and the operations departments, including the individual offices andbranches, checking and balancing each other for various risks.
The Internal Audit Division responsible for internal auditing seeks to ensure sound management and appropriate operations
by monitoring the occurrence of risks in each business, verifying its PDCA cycle functions, and recommending improvements asnecessary to promote better, stronger risk management.

Crisis management system
The Bank’s risk management systems discussed here are further augmented by its Crisis Management Plan, which is accompanied by a responsemanual for each type of crisis compiled to facilitate appropriate responses to crises that may impact our business, including natural disasters such aslarge-scale earthquakes, system failures, and epidemics of infectious diseases. In the event of a crisis, the Emergency Countermeasures Committee orCountermeasures Headquarters gathers information depending on the degree of the crisis, and issues centralized guidance and orders to minimize its
impact on operations.
We also implement measures to ensure the Bank’s ability to continue providing customer services as one of the service providers playing an essential
role in maintaining social functions. These include such measures as enhancing our facilities to enable continued operation, even in the event of a disaster,and ensuring the effectiveness and continuous improvement of our Crisis Management System through crisis management drills and other measures.

Nanto Report 2023, the integrated report of Nanto Bank45

Governance Supporting Our Proactive Human Resources

Preparing for Increasingly Varied and Complex Risks

Commitment to strict compliance
Compliance systems reinforcement
Compliance must always be ensured in observance of not only laws, government ordinances, and internal rules, but also of ethicaland social norms. It is imperative that banks fulfill their social responsibilities and public missions in good faith. At Nanto Bank, we areimplementing the following measures to ensure our full compliance with any and all applicable rules:	Being fully aware of our public mission and social responsibility as a financial institution, Nanto Bank seeks to gain the trust of its
stakeholders, including its regional community and shareholders, by positioning compliance with laws and regulations as the mostimportant issue for management. To this end, we have formulated “Basic Guidelines” and a “Code of Conduct” as corporate policies,
with which all the Bank’s officers and employees must comply.	In order to define a basic framework for our compliance systems, we have clarified our stance toward compliance with laws andregulations, not only by establishing compliance regulations but also by formulating disciplinary regulations that show the fairness andtransparency of our disciplinary actions.	We have established a Compliance Committee chaired by the President to serve as a cross-sectional organization within the Bank
that discusses and decides important matters related to compliance, as well as a supervisory department responsible for planning andsupervising compliance.	Each fiscal year, we prepare a compliance program as a concrete, practical plan for achieving compliance, after which we investigate
the program’s implementation status and make appropriate revisions.	The Bank is pursuing efforts to optimize operation of its compliance hotline, a whistle-blower system established for purposes of
prevention and early detection and correction of violations of laws and regulations.	We have compiled a “Compliance Handbook” to serve as a detailed guide to maintaining compliance, and we are following up withefforts to foster a compliance mindset by distributing the handbook to all our management and general personnel, and by holding
regular group training and study sessions at every workplace.	In accordance with our resolute attitude toward antisocial forces that threaten the order and safety of civil society, we have formulated
a set of “Regulations for Dealing with Antisocial Forces, Etc.” to establish and maintain a system that eliminates any relationships withantisocial forces.

Cyber security initiatives
The Bank has compiled a policy on cyber security initiatives to reinforce its protection against cyber-attacks and other such threats.
Action Initiatives
With cyber-attacks threatening to become increasingly serious in the future, we recognize optimizing our cyber security to ensure the safety of our customers and assets as an important
issue for management. Nanto Bank’s CSIRT* plays a central role in ongoing Bank-wide efforts to implement effective cyber security related to the mid-term “road map” as well as to enhance
our readiness to respond promptly to cyber-attacks.
*CSIRT: A security organization designed to respond to incidents related to computer securityManagement involvement
Our Information Asset Management Regulations stipulate that the executive in charge of the IT Strategy Department shall be thegeneral manager of CSIRT. We have been prioritizing development of a cyber security framework under the leadership of theBank’s management in a proactive manner. Participants in the Bank’s CSIRT meetings discuss our progress in realizing our midterm roadmap and annual plan for cyber security, as well as conditions in the surrounding environment and other issues. Amongother precautions, the number of confirmed cyber-attacks and content of all internal and external trends are reported to the CSIRT
General Manager and the Operational Risk Management Committee.

Outsourcing management
We use cloud services or external information systems that meet our information system security standards only after examining thesecurity measures they employ. In addition, we routinely review such introduced services as a follow-up regimen.

Audit structure
The Audit Department and a major consulting firm conduct joint cyber security audits to facilitate advanced audits meeting recent
trends in possible threats to financial institutions. Issues identified in such auditing processes will then be constantly dealt with inaccordance with the Nanto Bank CSIRT’s annual schedule, and the Audit Department monitors the status of efforts to strengthen
cyber security management systems throughout the Bank’s organizations.

46 Nanto Report 2023, the integrated report of Nanto Bank