Risk Management and Information Security Committee

Effective August 16, 2025, the scope of the Risk Management Committee was expanded to include information security, and it was renamed the “Risk Management and Information Security Committee”(hereinafter referred to as the “Committee”). The Committee comprises at least 3 directors appointed by the Board of Directors (hereinafter referred to as the “BOD”), and more than half of the Committee members are independent directors. The Committee is established to perfect the risk management and information security function of the Company, strengthen corporate governance, and enhance the performance of the BOD. The Committee’s powers are as below:

1. Review the Company’s risk management and information security policies and guidelines
2. Review the Company’s annual risk appetite or the limits that require the BOD’s approval
3. Review the Company’s risk management implementation status, which shall be consolidated by the Risk Management Division and report to the BOD on a quarterly basis
4. Review the Company’s information security implementation status, which shall be consolidated by the Information Security Division and report to the BOD on an annually basis
5. Review other risk management and information security related agendas to be reported to the BOD
6. Implement other matters instructed by the BOD to the Committee for processing

The Committee shall be convened at least once every quarter and may call a meeting at its discretion whenever necessary. It may resolve to appoint attorneys, certified public accountants, or other professionals to offer consulting assistance.