Company: SHG
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0001193125-25-089950
Chunk: 46

Company: SHINHAN FINANCIAL GROUP CO LTD
Filing Date: 2025-04-23
Form: 20-F
Chunk 46
---
 the best-in-class cyber security systems and failing to timely and fully rectify any glitches in our information technology systems.

Our activities are subject to cyber security risk.

Our activities have been, and will continue to be, subject to an increasing risk of cyber-attacks, the nature of which is continually evolving. Cyber security risks include unauthorized access, through system-wide “hacking” or other means, to privileged and sensitive customer information, including passwords and account information, and illegal use thereof. Cyber security risk is generally on the rise as a growing number of our customers increasingly rely on our Internet- and mobile phone-based banking services for various types of financial**

<div align='center'>26</div>

transactions. While we vigilantly protect customer data through encryption and other security programs and have made substantial investments to build and upgrade our systems and defenses to address the growing threats from cyber-attacks, there is no assurance that such data will not be subject to future security breaches. In addition, there can be no assurance that we will not experience a leakage of customer information or other security breaches as a result of illegal activities by our employees, outside consultants or hackers, or otherwise.

In order to minimize the risk of security breaches related to customer and our other proprietary information, we have taken a series of group-wide preventive measures, such as the adoption and implementation of a best-in-class information security system and reinforcement of internal control measures. We are fully committed to maintaining the highest standards of cyber security and consumer protection measures and upgrading them continually. We have established and are operating an information security management system for our company and our subsidiaries. We have implemented the ISO 27701 or ISO 27001-certified security management system and obtained the Information Security Management System certification and for most of our subsidiaries. We believe such certifications represent third-party validations that we are in compliance with best-in-class international standards on matters of information security. Our Integrated Cyber Security Monitoring Center’s security management system enables us to continuously monitor for signs of potential cyber-attacks and provides us with advance warnings that will allow us to promptly respond to such attacks. Our security management system continuously monitors for signs of potential cyber-attacks and is designed to provide early warning alerts to enable prompt action by us. In order to prevent intentional and accidental security issues by our employees, we have created a violation monitoring system, reinforcing our security measures by preemptively identifying various scenarios of threats and by collecting and analyzing different types of data that allows us to quickly identify any potential security violations. Moreover, we established a new information security lab within Shinhan