Company: SHG
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0001193125-25-089950
Chunk: 391

Company: SHINHAN FINANCIAL GROUP CO LTD
Filing Date: 2025-04-23
Form: 20-F
Chunk 391
---
. 281

| ITEM 16J. | INSIDER TRADING POLICIES. |

Our board of directors has established insider trading policies and procedures to provide guidance on the purchases, sales and other dispositions of our securities by our directors, officers, employees and other relevant persons, with the goal of promoting compliance with applicable insider trading laws, rules and regulations, and the listing standards of the New York Stock Exchange. A copy of our insider trading policy is annexed to this annual report as Exhibit 11.1.

| ITEM 16K. | CYBERSECURITY. |

1. Risk Management and Strategy Cybersecurity is integrated into our risk management procedures through which we identify, assess, monitor, control, communicate and escalate related risks. As cybersecurity threats continue to evolve, we expect to continue to expend substantial resources to modify or enhance our measures to detect and prevent cybersecurity attacks or to investigate and remediate information security vulnerabilities that are found. The risks posed by cybersecurity threats that could materially affect us, including our business strategy, results of operations or financial condition, are discussed in “Item 3.D. Risk Factors — Other Risks Relating to Us as the Holding Company — Our activities are subject to cyber security risk.” For a description of our information technology system, see “Item 4.B. Business Overview — Information Technology.” We examine cybersecurity threats annually through a professional institution holding a license recognized by the Government, and such examination includes risk assessment to predict potential impact of any identified risks. Action plans are developed based on the results of these evaluation, and after these action plans are implemented the results are reported to our Chief Information Security Officer (CISO). We operate the Information Protection Council, a collaborative body that includes the Information Protection Committee, information security task forces, and our and our subsidiaries’ CISOs, to strengthen cybersecurity governance and ensure alignment across the organization.We report on the status of cybersecurity and ICT operational risk management to the board of directors and management. The main components of such reports consist of (i) findings from periodic security risk evaluations, (ii) results of internal security drills designed to improve responses to breaches, outages, and natural disasters, and (iii) current status of our certifications for information security management systems such as ISO 27001 and ISMS. We have appointed an experienced professional with required qualifications in information security technology and personal data protection as our CISO, in compliance with relevant domestic regulations. As a trusted advisor, the CISO ensures the accuracy of information related to cybersecurity risk, makes final