Company: SHG
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0001193125-25-089950
Chunk: 48

Company: SHINHAN FINANCIAL GROUP CO LTD
Filing Date: 2025-04-23
Form: 20-F
Chunk 48
---
 amended in

<div align='center'>27</div>

**February 2024, a financial institution has a higher duty to protect credit information, meaning information necessary to assess the creditworthiness of the counterparty to financial transactions and other commercial transactions. Such regulations have considerably restricted a financial institution’s ability to transfer or provide the information to its affiliate or holding company, and quintuple damages can be imposed on a financial institution for a leakage of such information. In addition, under the Electronic Financial Transaction Act, as last amended in September 2023 with effect from September 2024, a financial institution is primarily responsible for compensating its customers harmed by the financial institution’s cyber security breach, even if the breach is not directly attributable to the financial institution. Amendments to three major data privacy laws (the Personal Information Protection Act, the Act on the Promotion of Information and Communications Network Utilization and Information Protection and the Act on the Use and Protection of Credit Information) were passed in 2020, expanding the scope of personal information that may be shared among financial institutions, and cyber security and ensuring confidentiality of customers’ information have become more important than ever for financial institutions. We maintain an integrated system that closely monitors customer information to ensure compliance with data protection laws and regulations as well as our internal policies.

If a cyber or other security breach were to happen with respect to us or any of our subsidiaries, it may result in litigation by affected customers or other third parties (including class actions), compensation for any losses suffered by victims of cyber security attacks, reputational damage, loss of customers, heightened regulatory scrutiny and related sanctions, more stringent compliance with the present and future regulatory restrictions, and other costs related to damage control, reparation and reinforcement of information security systems, any of which may have a material adverse effect on our business, results of operations and financial condition.

Our customers may become victims to “voice phishing” or other financial scams, for which we may be required to make monetary compensation and suffer damage to our business and reputation.

In recent years, financial scams known as voice phishing have been on the rise in Korea. While voice phishing takes many forms and has evolved over time in terms of sophistication, it typically involves the scammer making a phone call to a victim under false pretenses (for example, the scammer pretending to be a member of law enforcement, an employee of a financial institution or even an abductor of the victim’s child) and luring the victim to transfer money to an untraceable account controlled by the scammer. More recently