Welcome to Mega Securities

In accordance with the Securities Firm Risk Management Practice Guidelines and Mega Financial Holding Co., Ltd.'s Risk Management Policy and Guidance Principles, the policy implementation is reviewed regularly and irregularly each year. Amendments to this policy are reviewed by the Risk Management Committee (hereinafter referred to as "the Committee") and the Risk Control Department of the financial holding parent company, approved by the Board of Directors, and reported to the Risk Management Committee of the financial holding parent company for record.

In accordance with Mega Financial Holding Co., Ltd.'s Risk Management Policy and Guidance Principles, annual risk management objectives are established, reviewed by the Committee and the Risk Control Department of the financial holding parent company, approved by the Board of Directors, and reported to the Risk Management Committee of the financial holding parent company for record.

To effectively manage the Company's overall risk and regulate the risk management system, these rules are established in accordance with the Securities Firm Risk Management Practice Guidelines, Mega Financial Holding Co., Ltd.'s Risk Management Policy and Guidance Principles, and the Company's Risk Management Policy. The content consists of nine chapters: General Provisions, Risk Management Organizational Structure and Responsibilities, Risk Management Process, Definition and Management Mechanisms of Various Risk Types, Risk-based Performance Management, Risk Management Information System, Risk Information Disclosure, Business Crisis Response Measures, and Supplementary Provisions. These rules are approved by the Board of Directors after review and approval by the Committee, and reported to the financial holding parent company for record.

The Committee is established in accordance with the Company's Risk Management Rules to oversee the planning, supervision, and implementation effectiveness of company-wide risk management policies. This organizational charter is approved by the Board of Directors after review and approval by the Committee, and reported to the financial holding parent company for record.

Each department of the Company shall conduct various businesses in accordance with the Risk Management Rules, and may consider business characteristics and complexity to formulate risk management implementation guidelines for internal departmental risk management measures, which shall be approved by the General Manager. However, regulations that are required by the Risk Management Rules and applicable company-wide shall be approved by the Chairman.
When the Company launches new business types, in addition to requiring Board of Directors approval, departments must conduct various risk assessments and review amendments to the Risk Management Rules or Risk Management Implementation Guidelines.

The Company has established product line authorization limits, total loss limits, and total risk value limits in its Risk Management Rules, which have been approved by the Board of Directors. Risk limits for each product line and department are allocated and approved through coordination among relevant departments convened by the General Manager, and are implemented accordingly for control purposes. Additionally, the Company's capital adequacy ratio management target must not fall below 250%.

The Company has established appropriate credit risk management systems, including authorization structures and reporting processes at all levels, operational content, pre-transaction credit assessment, credit rating management, post-transaction credit monitoring, and procedures for handling limit breaches. The Risk Management Office supervises the implementation of risk management mechanisms and systems across all departments in accordance with the Risk Management Rules and Credit Supervision Management Measures.

Annual risk limits, loss limits, and Value at Risk limits (VaR 99%, 1 day) for holding securities and derivative financial instruments must be allocated with reference to various quantitative indicators of each department or product line, and are approved after coordination among relevant departments convened by the General Manager.
The Company has established appropriate market risk management systems, including authorization structures and reporting processes at all levels, operational content, trading scope, market risk measurement methods, market risk limits and their approval levels, and procedures for handling limit breaches. The Risk Management Office supervises the implementation of risk management mechanisms and systems across all departments in accordance with the Risk Management Rules.

Regarding proprietary positions, to avoid concentration risk, the Company has established limits and early warning mechanisms in its Risk Management Rules for securities balances issued by single companies and single industries, as well as total credit risk exposure to single clients, single groups, and single countries, and ensures effective implementation.
Regarding funding liquidity, the Company establishes liquidity risk management mechanisms based on principles including business characteristics and scale, asset-liability structure, funding deployment strategy, diversification of funding sources and terms, and legal regulations, to ensure maintenance of adequate liquidity under both normal and stress scenarios and control cash flow gaps across all periods within established limit ranges.

Each department establishes standard operating procedures according to their product risk characteristics, trading operation controls, and related procedures to establish internal control standards and control points.

The Company has established appropriate climate risk management systems, including authorization structures and reporting processes, operational content, pre-transaction risk assessment, climate sensitivity classification management, post-transaction monitoring, and procedures for handling limit breaches. The Risk Management Office supervises the implementation of risk management mechanisms and systems across all departments in accordance with the Risk Management Rules.

Regular and irregular maintenance of the legal compilation system, updating regulatory amendments from competent authorities and tracking the impact of regulatory changes on the Company and its business, while strengthening legal consultation, coordination, and communication channels and conducting regulatory education and training programs.

1. In accordance with Article 36-2 of the Financial Supervisory Commission's "Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets," the Company has established the position of Chief Information Security Officer and set up a cross-departmental information security team. The Company has formulated an information security policy that is disclosed on its official website and reviewed annually. Any amendments must be approved by the Board of Directors. Annual comprehensive information security implementation reports are integrated into the matters to be declared in the Internal Control System Declaration and reported to the Board of Directors. In accordance with the Taiwan Stock Exchange's "Establishment of Information and Communication Security Inspection Mechanisms for Securities Firms," information security policies and related management standards have been formulated.
2. To ensure the Company's information and communication security, the Company has established various information and communication security management measures including:
   
   1. The core system has implemented an Information Security Management System and passed SGS ISO 27001 certification; the core system has implemented a Business Continuity Management System and passed BSI ISO 22301 certification, with continuous maintenance of certificate validity.
   2. Implementation of IDS/IPS (Intrusion Detection and Prevention Systems), WAF (Web Application Firewall), and SOC (Security Operations Center) to enhance security monitoring and defense. Regular execution of system and webpage vulnerability scanning and penetration testing to ensure system security protection.
   3. Annual commissioning of information vendors to conduct third-party laboratory security testing for mobile applications to strengthen APP information security.
   4. Enhancement of staff security awareness: conducting education, training, and promotion on information security-related topics for all staff, and regularly conducting email social engineering drills for all staff to maintain a deception success rate below 5%.

By calculating the equivalent amounts of various operational risks (market risk, credit risk, operational risk) and qualified net capital, the Company evaluates overall risk tolerance and appropriateness of risk management as a basis for adjusting risk positions and risk management policies. As of December 31, 2024, the Company's capital adequacy ratio was 338%, with market risk equivalent amount of NT$3,031,267,356, credit risk equivalent amount of NT$1,284,463,255, and operational risk equivalent amount of NT$930,288,540. The annual capital adequacy ratio ranged from 299% to 352%, all meeting the early warning threshold of above 270%. The capital adequacy ratios from January to December 2024 are shown in the following table:

Total amount (New Taiwan Dollar plus various foreign currencies) cumulative maturity structure analysis reports are compiled regularly to track and control risk management target indicators and are reported to the Committee. As of December 31, 2024, the Company's total cumulative maturity structure analysis report is as follows. The results show that when extreme market conditions occur, the Company's cumulative funding gap as a percentage of total assets does not exceed the limits.

Based on December 31, 2024, the Company's stress test capital adequacy ratio was 277%, which is greater than the statutory capital adequacy ratio, and the test passed.

Unit Currency: NT$ Billion

As of December 31, 2024, the Company's proprietary trading and underwriting holdings in high carbon emission industry securities totaled NT$3.24 billion in cost, representing 8.38% of the Company's total proprietary trading and underwriting securities investment of NT$38.668 billion, complying with the regulation of not exceeding 27% of the Company's total proprietary trading and underwriting securities investment. Statistics are shown in the following table:

Unit Currency: NT$ Billion