Company: SHG
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0001193125-25-089950
Chunk: 190

Company: SHINHAN FINANCIAL GROUP CO LTD
Filing Date: 2025-04-23
Form: 20-F
Chunk 190
---
 and systems or from other external events. Similarly, we define operational risk as the risks related to our overall management other than credit risk, market risk, interest rate risk and liquidity risk. These include risks arising from system failure, human error, non-adherence to policy and procedures, fraud, inadequate internal controls and procedures or environmental changes and resulting in financial and non-financial loss. We monitor and assess operational risks related to our business operations, including administrative risk, information technology risk (including cyber security risk), managerial risk and legal risk, with a view to minimizing such losses.

To effectively manage operational risk, we have established group-wide operational risk management policies and standardized management criteria. Each of our subsidiaries develops and maintains an operational risk management system, taking into account the size and complexity of each subsidiary. To ensure an appropriate level of operational risk management, we set operational risk limits for each subsidiary and regularly report the status of limit utilization to our Risk Management Committee.

Additionally, we have established and are currently implementing the following procedures for identifying and reporting operational risks:

(a) Recognition and Measurement: We proactively identify and manage the operational risks inherent in our business, taking into account factors such as scale and complexity.

(b) Monitoring and Control: To effectively manage operational risks within appropriate levels, we conduct regular monitoring. Our management identifies, monitors and controls the operational risks associated with individual business units through the risk management meetings conducted by our holding company.

(c) Reporting: In accordance with regulations and guidelines pertaining to operational risks, we report our operational risk management activities periodically, as well as when any significant operational risk management activities arise, to the Group Risk Management Committee.

We have established a three-tier control system which we refer to as the three lines of defense:

(a) Business Units: Responsibilities are assigned to identify, evaluate and manage the operational risks inherent in products, sales activities, operations, and systems to ensure effective overall operational risk management.

(b) Operational Risk Management Division: This division is responsible for developing strategies to identify, assess, control and mitigate operational risks.

(c) Internal Audit: An independent review is conducted to ensure that the operational risk management activities of the business units and the operational risk management division are executed effectively.

In accordance with our operational risk management policy, our subsidiaries periodically report to our management and board of directors the status of operational risk management, including self-assessments of risk controls, key risk indicators, operational risk loss events, ICT risks and third-party outsourcing risks, reflecting the unique characteristics and risk levels of each subsidiary. Additionally, we have calculated operational risk