Overview As a financial services provider, we are exposed to various risks related to our lending and trading businesses, our funding activities and our operating environment, principally through Kookmin Bank, our banking subsidiary. Our goal in risk management is to ensure that we identify, measure, monitor and control the various risks that arise, and that our organization adheres strictly to the strategies and procedures which we establish to address these risks. Under our internal regulations pertaining to our consolidated capital adequacy ratio and internal standards for risk appetite and internal capital under Basel III, we identify the following eight separate categories of risk inherent in our business activities: credit risk, market risk, operational risk, interest rate risk, liquidity risk, credit concentration risk, reputation risk and strategic risk. Of these, the principal risks to which we are exposed are credit risk, market risk, liquidity risk and operational risk, and we strive to manage these and other risks within acceptable limits. Organization We have a multi-tiered risk management governance structure. Our Risk Management Committee is ultimately responsible for group-wide risk management, and directs our various subordinate risk management entities. The Risk Management Council coordinates the implementation of policies set forth by the Risk Management Committee with the relevant risk management units of our subsidiaries. The Subsidiary Risk Management Committee of each of our subsidiaries, based on the Risk Management Committee’s policies, determines risk management strategies and guidelines for such subsidiary and directs the activities of the subsidiary’s risk management units within the risk guidelines set at the group level. Each Subsidiary Risk Management Committee generally receives inputs from the respective risk management units of such subsidiary, which report to the Risk Management Committee. The following chart sets out our risk management governance structure as of the date of this annual report: Risk Management Committee Our Risk Management Committee is a board-level committee that is responsible for overseeing all risks and advising the board of directors with respect to risk management-related issues. The committee consists of four non-executive directors (one of whom serves as the chairman of the committee), and convenes on a quarterly basis. Its major roles include: • establishing risk management policies in accordance with the directives of the board of directors; • determining our target risk appetite; • allocating risk capital to each subsidiary and approving our subsidiaries’ risk limits; • reviewing the level of risks we are exposed to and the appropriateness of our risk management systems and operations; and • reviewing recovery and resolution plans. 188 Table of Contents Risk Management Council Our Risk Management Council is responsible for coordinating with the risk management units of our subsidiaries to ensure that they implement the strategies, guidelines and limits established by the Risk Management Committee. The Risk Management Council is comprised of our chief risk management officer and the chief risk management officers of all of our subsidiaries. It operates independently from all business units and convenes on a quarterly basis. Its responsibilities include: • analyzing our risk status by using information provided by our subsidiary-level risk management units; • deliberating adjustments to the integrated risk capital allocation plan and risk limits for each of our subsidiaries; and • coordinating issues relating to the group-wide integration of our risk management functions. Subsidiary Risk Management Committees Each of our subsidiaries has delegated risk management authority to its Subsidiary Risk Management Committee. Each Subsidiary Risk Management Committee measures and monitors the various risks faced by the relevant subsidiary and reports to that subsidiary’s board of directors regarding decisions that it makes on risk management issues. It also makes certain strategic risk-related decisions regarding the operations of the relevant subsidiary, such as setting total exposure limits, allocating credit risk limits and market risk-related limits and determining which market risk derivatives instruments the subsidiary can trade. The major activities of each Subsidiary Risk Management Committee include: • determining and monitoring risk strategies, guidelines, limits and tolerance levels and the level of subsidiary risk in accordance with group policy; • reviewing and analyzing the subsidiary’s risk profile; • setting limits for and adjusting the risk capital allocation plan and risk levels for each business unit within the subsidiary; and • monitoring compliance with our group-wide risk management strategies at the business unit and subsidiary level. Credit Risk Management Credit risk is the risk of expected and unexpected losses in the event of borrower or counterparty defaults. Credit risk management aims to improve asset quality and generate stable profits while reducing risk through diversified and balanced loan portfolios. We determine the creditworthiness of each type of borrower or counterparty through reviews conducted by our credit experts and through our credit rating systems, and we set a credit limit for each borrower or counterparty. We assess and manage all credit exposures. We measure expected losses and internal capital on assets (whether on- or off-balance sheet) that are subject to credit risk management and use expected losses and internal capital as management indicators. We manage credit risk by allocating credit risk internal capital limits. In addition, we control credit concentration risk exposure by applying and managing total exposure limits to prevent excessive risk concentration to particular industries or borrowers. Credit exposures that we assess and manage include loans to borrowers and counterparties, investments in securities, letters of credit, bankers’ acceptances, derivatives and commitments. Our risk appetite, which is the ratio of our required internal capital to our estimated available capital, is approved by the Risk Management Committee once a year. Thereafter, we calculate internal capital every month for all of our subsidiaries and on a holding company level based on attributed internal capital in accordance with the risk appetite as approved by the Risk Management Committee, and measure and report profiles of credit risk on a holding company level and by subsidiary regularly to our senior management, including our Risk Management Committee. 189 Table of Contents We use expected default rates and loss given default rates to determine the expected loss rate of a borrower or counterparty. We use the expected loss rate to make credit related decisions, including pricing, loan approval and establishment of standards to be followed at each level of decision making. These rates are calculated using information gathered from our internal database. With respect to large corporate borrowers, we also use information provided by external credit rating services to calculate default rates and loss given default rates. Our credit risk management processes include: • establishing credit policy; • credit evaluation and approval; • industry assessment; • total exposure management; • collateral evaluation and monitoring; • credit risk assessment; • early warning and credit review; and • post-credit extension monitoring. Credit Evaluation With respect to corporate loans, Kookmin Bank evaluates the ability of all loan applicants to repay their borrowings before it approves any loans, except for loans fully guaranteed by letters of guarantee issued by the Credit Guarantee Fund and the Korea Technology Credit Guarantee Fund, for loans fully secured by deposits and for other loans similarly guaranteed or secured. Kookmin Bank assigns each borrower or guarantor a credit rating based on the judgment of its experts or scores calculated using the appropriate credit rating system. Factors that Kookmin Bank considers in assigning credit ratings include both financial factors and non-financial factors, such as its perception of the borrower’s ability to meet its payment obligations, risks relating to the industry in which the borrower operates, management and operational risks relating to the borrower, the borrower’s financial flexibility and the borrower’s level of reliability based on its transaction history. With respect to retail loans, Kookmin Bank assigns credit ratings based on its internal information regarding the borrower that has been accumulated as well as external information gathered from credit bureaus relating to various criteria, such as the borrower’s profession, annual income, credit card overdue information and transaction history involving both Kookmin Bank and other financial institutions. The credit rating process differs according to the type, size and characteristics of the borrower. Kookmin Bank uses its internally developed credit rating systems to rate potential borrowers. As the characteristics of each customer segment differ, Kookmin Bank uses several credit rating systems for its customers. The nature of the credit rating system used for a particular borrower depends on whether the borrower is an individual, a SOHO customer, a small- and medium-sized enterprise or a large company. For large companies and small- and medium-sized enterprises, Kookmin Bank has 17 credit ratings ranging from AAA to D for risk management purposes. For retail customers, it has 13 credit ratings ranging from grade 1 to grade 13. Based on the credit rating of a borrower, Kookmin Bank applies different credit policies, which affect factors such as credit limit, loan period, loan pricing, loan classification and provisioning. Kookmin Bank also uses these credit ratings in evaluating its bank-wide risk management strategy. Factors Kookmin Bank considers in making this evaluation include the profitability of each company or transaction, performance of each business unit and portfolio management. Kookmin Bank monitors the credit status of borrowers and collect information to adjust its ratings appropriately. If Kookmin Bank changes a borrower’s credit rating, it will also change the credit policies relating to that borrower and may also change the policies underlying its loan portfolio. 190 Table of Contents Retail Loan Approval Process Mortgage Loans and Secured Retail Loans. Branch staff employees of Kookmin Bank forward loan applications to processing centers and Kookmin Bank’s processing center staff reviews mortgage loans and retail loans secured by real estate or guarantees. However, in the case of loans secured by deposits with Kookmin Bank, its branch staff approves such loans. Kookmin Bank makes lending decisions based on its assessment of the value of the collateral, debt service capability and the borrower’s score generated from its credit scoring systems. For mortgage loans and loans secured by real estate, Kookmin Bank evaluates the value of the real estate offered as collateral using a database it has developed that contains information about real estate values throughout Korea. Kookmin Bank also uses information from a third party provider about the real estate market in Korea, which gives it up-to-date market value information for Korean real estate. In addition, Kookmin Bank’s processing center staff employees review the value of real estate provided by the evaluation system to ensure there are no significant discrepancies. Kookmin Bank bases decisions regarding the approval of such loans primarily on the results of its credit scoring systems. For loans secured by deposits, Kookmin Bank will generally grant loans up to 95% of the deposit amount if it holds the deposit. Kookmin Bank generally decides whether to evaluate a loan application within three to five days after recording the relevant information in its credit scoring systems. Unsecured Retail Loans. Kookmin Bank reviews applications for unsecured retail loans in accordance with its credit scoring systems. These automated systems evaluate loan applications and determine an appropriate pricing for the loan. The major benefits of using a credit scoring system are that it yields uniform results regardless of the user and that it can be used effectively by employees who do not necessarily have extensive experience in credit evaluation. The staff of Kookmin Bank’s processing centers reviews the results of the credit scoring system based on information input by its branch staff and, if approved, issues the loan. Kookmin Bank’s credit scoring systems take into account factors including the borrower’s income, assets, profession, transaction history (with both it and other financial institutions) and other relevant credit information. The systems rank each borrower in an appropriate grade, and that grade is used as a factor in deciding whether to approve loans as well as to determine loan amounts. Kookmin Bank generally bases its decisions on the results of its credit scoring systems to evaluate applications. Corporate Loan Approval Process We approve corporate loans at different levels of our organization depending on the size and type of the loan, the credit risk level assessed by the credit rating system, whether the loan is secured by collateral and, if secured, the value of the collateral. The lowest level of authority is the branch staff employee of Kookmin Bank, who can approve small loans and loans that have the lowest range of credit risk. Larger loans and loans with higher credit risk are approved by higher levels of authority depending on where they fall in a matrix of loan size and credit risk. Depending on the size and terms of any particular loan or the credit risk relating to a particular borrower, more than one entity may review the application, although generally loan applications are reviewed only by the entity having corresponding authority to approve the loan. Kookmin Bank evaluates all of its corporate borrowers by using credit rating systems, except for applicants whose borrowings are fully secured by deposits or applicants who have obtained third-party guarantees from the government or certain other very highly rated guarantors. See “—Credit Evaluation.” For owner-operated enterprises, or small office home office customers (which we refer to as SOHOs), Kookmin Bank has put in place a credit rating system known as Small Office Home Office Corporate Rating 191 Table of Contents System, or SOHO CRS. For other small- and medium-sized enterprises, Kookmin Bank has put in place a similar credit rating system known as Corporate Rating System, or CRS. For large corporations, Kookmin Bank has put in place a similar credit rating system known as Large Corporate Rating System, or LCRS. For financial institutions, certain non-profit organizations and public institutions, Kookmin Bank has put in place a credit rating system known as Financial Institute, Non-profit, Public Corporate Rating System, or FNP CRS. The SOHO CRS, the CRS, the LCRS and the FNP CRS models consist of the following four parts: • Financial Model. The financial model uses financial ratios such as stability ratio, profitability ratio and cash flow ratio to make credit determinations. • Non-financial Model. The non-financial model uses various qualitative and quantitative factors, such as future repayment capability, industry-related risks, management-related risks and operation-related risks, to evaluate borrowers. • CEO Evaluation Model. The CEO evaluation model is relevant for the SOHO CRS in particular (including business entities without external audits), and evaluates the credit information of the individual owner of SOHOs by reviewing such owner’s personal information, bank transaction records and external credit ratings. • Default Signal Check Model. The default signal check model checks factors that have low frequency of occurrence but are highly likely to lead to a default in the event of an occurrence. The results of the default signal check model may be used to cap a borrower’s credit grade. Credit Card Approval Process We make decisions on all credit card approvals based on the Financial Supervisory Service standard of review for payment ability (such as the occupation and income of the applicant), as well as a combination of KB Kookmin Card’s internal application scoring system and a credit scoring system developed by independent credit bureaus. KB Kookmin Card’s application scoring system reflects various credit information, including basic customer information (such as credit history), transaction history with it, if any, delinquency and transaction history with other card companies and financial institutions and credit information provided by Korea Credit Information Services and other credit bureaus. KB Kookmin Card also considers repayment ability, total assets, total outstanding borrowings and the length of the applicant’s relationship, if any, and past contribution to our profitability, if any. The credit scoring system developed by credit bureaus, reflects various sources of information regarding the credit risk of customers, including delinquency and transaction history with other credit card companies and financial institutions. On the basis of the standard of review for payment ability and the combination of the scores from our application scoring system and the credit scoring system developed by independent credit bureaus, KB Kookmin Card establishes, among other things, the term of any new approvals, initial limits and differentiation of fee rates with respect to its credit cards. KB Kookmin Card’s systems allow it to differentiate applicants into groups that receive immediate credit card approval or rejection, or that may require it to further investigate that applicant’s credit qualifications. The initial limits of new applicants are based on their estimated disposable income, which is based on their occupation and the value of their personal assets. KB Kookmin Card applies its fee rates to applicants differently according to risk premium and profitability. Total Exposure Management We establish and manage total exposure limits for industries, chaebols and corporations, as well as certain small- and medium-sized enterprises, in order to efficiently manage financial assets and to optimize our credit 192 Table of Contents portfolio. Kookmin Bank establishes total exposure limits for (i) main debtor groups designated by the Financial Supervisory Service, (ii) groups to which Kookmin Bank has total exposure of ￦70 billion or more, (iii) enterprises that belong to a main debtor group or large enterprises, in both cases to which Kookmin Bank has total exposure of ￦40 billion or more, (iv) small- and medium-sized enterprises to which Kookmin Bank has total exposure of ￦30 billion or more and (v) other groups or individual enterprises designated by the head of Kookmin Bank’s Risk Management Group as necessary. Kookmin Bank establishes total exposure limit by reviewing factors such as industry, size, cash flows, financial ratios and credit ratings, while establishing exposure limits for industries by reviewing the sales growth rate and risk concentration for each industry. The total exposure limits for a specific industry are set following approval by Kookmin Bank’s Risk Management Council after review by the Credit Risk Management Subcommittee, while the exposure limits for a specific company or company group are set during the review of their credit application by the relevant approval authority. Kookmin Bank’s maximum exposure limit is within 25% of its Tier I and Tier II capital for a single group, and within 10% of its Tier I and Tier II capital for a single corporation. We manage and control exposure limits on a daily basis. The principal system that we use for this purpose is the Total Exposure Management System. This system allows us to monitor and control our total exposure to corporations, chaebols and industries. Kookmin Bank monitors its exposure to large corporations and companies affiliated with the 41 largest highly-indebted business groups (such groups being the main debtor groups in Korea designated as such by the Financial Supervisory Service based on their outstanding exposures) to which it has an exposure of ￦40 billion or more, small- and medium-sized enterprises to which it has an exposure of ￦30 billion or more, and also its exposure to 143 business groups, which comprise the 41 largest highly-indebted business groups as well as 102 business groups to which it has exposures (in the form of securities or loans) of ￦70 billion or more. We also monitor our exposure across 37 industries. Our Total Exposure Management System integrates all of our credit-related risk including credit extended by our overseas branches and affiliates. The assets subject to the system include all Won-denominated and foreign currency-denominated loans, all assets in trust accounts except specified money trusts, guarantees, trade-related credits, commercial paper, corporate bonds and other securities and derivatives. Collateral Evaluation and Monitoring System Kookmin Bank uses the Collateral Evaluation and Monitoring System to manage the liquidation value of collateral it holds. The Collateral Evaluation and Monitoring System is a computerized collateral management system that can be accessed from Kookmin Bank’s headquarters and its branches. Using this system, Kookmin Bank can more accurately assess the actual liquidation value of collateral, determine the recovery rate on its loans and use this information in setting its credit risk management and loan policies. Kookmin Bank can monitor the value of all the collateral a borrower provides and the value of that collateral based on its liquidation value. When appraising the value of real estate collateral, which makes up the largest part of Kookmin Bank’s collateral, Kookmin Bank consults a regularly updated database provided by a third party that tracks the prices at which various types of real estate in various regions of Korea are sold. Kookmin Bank appraises the value of collateral when it makes a loan, when the loan is due for renewal and when events occur that may change the value of the collateral. Credit Risk Management and Monitoring Kookmin Bank’s Credit Risk Department establishes loan portfolio policies and appropriate credit risk limits, including those applicable to internal capital and total exposures to certain assets and business groups, to prevent excessive credit risk. It also analyzes and monitors our loan portfolios on a regular basis to preemptively manage any risk, and continually monitors our management of such portfolios to ensure high credit quality. In addition, it implements an industrial risk management plan by monitoring industry trends and evaluating industry ratings. It also separately manages high-risk products, such as real estate project financing loans and over-the-counter derivative products, by setting appropriate limits. 193 Table of Contents Credit Review Kookmin Bank’s credit review function is independent of the business groups which manage our assets. Its Credit Review Department: • reviews internal credit regulations, policies and systems; • analyzes the credit status of selected loan assets and verifies the appropriateness of the credit evaluations/approvals made by branches and headquarters; and • evaluates the corporate credit risk of potentially insolvent companies. More specifically, Kookmin Bank’s Credit Review Department continually reviews the financial condition of selected borrowers with respect to their current debt, collateral, business, transactions with related parties and debt service capability. Based on such review, Kookmin Bank may adjust the borrower’s credit rating, lending policy or asset quality classification of the loan provided to the borrower, depending on the applicable circumstances. Kookmin Bank also regularly reviews other aspects of the lending process, including industries and regions in which its borrowers operate and the quality of its domestic and overseas assets. Kookmin Bank’s industry reviews focus on growth, stability, competition and ability to adapt to a changing environment. Based on the results of a particular industry review, Kookmin Bank may revise the total exposure limit assigned to that industry and lending policy for each company within that industry. When a review takes place, Kookmin Bank may adjust not only the credit ratings of its borrowers based on a variety of factors, but also asset quality classification, credit limits and its credit policies. Credit review results are reported to Kookmin Bank’s chief risk management officer and its Risk Management Committee on a quarterly basis. Kookmin Bank’s Credit Review Department also conducts on-site reviews of selected branches that are experiencing increasing delinquency ratios and bad debts. During these visits Kookmin Bank examines the loan processes and recommends improvement plans and appropriate follow-up measures. Also, based on guidelines provided by the Financial Supervisory Service to all Korean banks, Kookmin Bank operates a corporate credit risk assessment program to facilitate the identification of weak companies and possible commencement of corporate restructuring. Through this program, Kookmin Bank, together with other banks, is able to detect symptoms of financially troubled companies at an early stage, assess related credit risk and support the normalization of companies that are likely to turnaround through a workout process, or seek to liquidate those companies that are not likely to recover. Kookmin Bank’s Credit Review Department also analyzes issues related to credit risk and provides information necessary for the formulation of effective credit policies and strategies and for effective credit risk management. Market Risk Management The major risks to which we are exposed are general interest rate risk on debt instruments and interest bearing securities, credit spread risk and foreign exchange risk and, to a lesser extent, stock price risk. The financial instruments that expose us to these risks are securities and financial derivatives. We are also exposed to interest rate risk and liquidity risk in Kookmin Bank’s banking book. We divide market risk into risks arising from trading activities and risks arising from non-trading activities. Kookmin Bank’s Risk Management Council establishes overall market risk management principles. It has delegated the responsibility for the market risk management for trading activities to the Market Risk Management Subcommittee of Kookmin Bank, which is chaired by Kookmin Bank’s chief risk management officer. This subcommittee meets on a regular basis each month and as required to respond to developments in the market and the economy. Based on the policies approved by Kookmin Bank’s Risk Management Council, the Market Risk Management Subcommittee reviews and approves reports as required that include trading profits and losses, position reports, limit utilization and sensitivity analysis results for our trading activities. 194 Table of Contents Kookmin Bank’s Risk Management Council is responsible for interest rate and liquidity risk management for its non-trading activities. The council meets on a regular basis and as required to respond to developments in the market and the economy. Members of the Risk Management Council, acting through Kookmin Bank’s Risk Management Department, review Kookmin Bank’s interest rate and liquidity gap position monthly, as well as the business profile and its impact on asset and liability management. To ensure adequate interest rate and liquidity risk management, we have assigned the responsibilities for our asset and liability risk management to Kookmin Bank’s Risk Management Department in Kookmin Bank’s Risk Management Group, which monitors and reviews the asset and liability operating procedures and activities of Kookmin Bank’s Financial Planning Department, and independently reports to the management on the related issues. Market Risk Management for Trading Activities Our trading activities consist of: • trading activities for our own account to realize short-term trading profits in Won-denominated debt and equities markets and foreign exchange markets based on our short-term forecast of changes in the market situation; and • trading activities involving derivatives, such as swaps, forwards, futures and option transactions, to realize profits primarily from selling derivative products to our customers and to hedge market risk incurred from those activities. We use derivative instruments to hedge our market risk and, to a limited extent, to make profits by trading derivative products within acceptable risk limits. The principal objective of our hedging strategy is to manage our market risk within established limits. We use the following hedging instruments to manage relevant risks: • to hedge interest rate risk arising from its trading activities, the Capital Markets Group of Kookmin Bank occasionally uses interest rate futures (Korea Treasury Bond Futures) and interest rate swaps; • to hedge interest rate risk and foreign exchange risk arising from our foreign currency-denominated asset and liability positions as well as our trading activities, the Capital Markets Group of Kookmin Bank uses interest rate swaps, cross-currency interest rate swaps, foreign exchange forwards and futures, Euro-dollar futures and currency options; and • to change the interest rate characteristics of certain assets and liabilities after the original investment or funding, we use swaps. For example, depending on the market situation, we may choose to obtain fixed rate funding instead of floating rate funding if we believe that the terms are more favorable, which we can achieve by entering into interest rate swaps. We generally manage our market risk at the portfolio level. To control our exposure to market risk, we use internal capital limits set by Kookmin Bank’s Risk Management Committee for Kookmin Bank and at the group level within Kookmin Bank, position and stop loss limits set by Kookmin Bank’s Risk Management Council for Kookmin Bank and at the group level within Kookmin Bank, and position, stop loss and sensitivity limits (PVBP, Delta, Gamma, Vega) set by Kookmin Bank’s Market Risk Management Subcommittee at the department or desk level within Kookmin Bank. We prepared our risk control and management guidelines for derivative trading based on the regulations and guidelines promulgated by the Financial Supervisory Service. In addition, we have implemented internal processes which include a number of key controls designed to ensure that fair value is measured appropriately, particularly where a fair value model is internally developed and used to price a significant product. See Notes 4.4 and 6 of the notes to our consolidated financial statements. For example, each year, Kookmin Bank’s Risk Management Department reviews the existing pricing and valuation models, with a focus on their underlying modeling assumptions and restrictions, to assess the appropriateness of 195 Table of Contents their continued use. In consultation with Kookmin Bank’s Trading Department, the Risk Management Department recommends potential valuation models to Kookmin Bank’s Fair Value Evaluation Committee. Upon approval by Kookmin Bank’s Fair Value Evaluation Committee, the selected valuation models are reported to its Market Risk Management Subcommittee. We monitor market risk arising from trading activities of our business groups and departments. Kookmin Bank uses an integrated market risk management system to manage market risks for both Won-denominated trading operations and foreign currency-denominated trading operations. Basel III Standardized Method. Commencing in 2023, Kookmin Bank replaced the use of daily VaR with the Basel III standardized method to measure market risk. Under such method, Kookmin Bank measures its market risk capital by aggregating (i) risk capital measured using the sensitivities-based method, (ii) default risk capital and (iii) residual risk add-on capital: • risk capital measured using the sensitivities-based method represents the linear and non-linear losses that can result from adverse changes in interest rates, credit spreads, equity prices, foreign exchange rates and commodities prices; • default risk capital represents the losses that can result from any unexpected default of an entity not contemplated under the sensitivities-based method; and • residual risk add-on capital represents any other losses that are not contemplated under the sensitivities-based method or are not considered to result from the risk of default. The following table shows Kookmin Bank’s market risk capital for each category of market risk as of December 31, 2024 and 2025: Risk categories Risk Capital 2024 2025 (in billions of Won) Sensitivities-based method General interest rate risk ￦ 108.5 ￦ 108.1 Equity risk 5.9 15.6 Commodities risk 0.0 0.0 Foreign exchange risk 179.5 138.8 Credit spread risk: non-securitizations 122.8 164.7 Credit spread risk: securitizations (non-correlation trading portfolio) 1.0 0.3 Credit spread risk: securitizations (correlation trading portfolio) 0.0 0.0 Default risk 52.3 63.1 Residual risk add-on 1.1 1.2 Total ￦ 471.1 ￦ 491.8 Stress testing. In addition, we use stress testing to assess our market risk exposure to abnormal market fluctuations. Abnormal market fluctuations include significant declines in the stock market and significant changes in the general level of interest rates. As the Basel III standardized method assumes normal market situations, stress testing is an important way to supplement this method since it does not cover potential loss if the market moves in a manner that is outside our normal expectations. Stress testing projects the anticipated change in value of holding positions under certain scenarios assuming that no action is taken during a stress event to change the risk profile of a portfolio. According to Kookmin Bank’s stress testing, we estimate that as of December 31, 2025, Kookmin Bank’s trading portfolio could have lost ￦650 billion for an assumed short-term extreme decline of approximately 25% in the equity market and an approximate 71 basis point decrease in the Korean treasury bond rates under an abnormal stress environment. 196 Table of Contents We monitor the impact of market turmoil or any abnormality by conducting stress tests and confirming that the results are within our market risk limits. If the impact is large, Kookmin Bank’s chief risk management officer may request that our portfolio be restructured or other appropriate action be taken. Interest Rate Risk Interest rate risk from trading activities arises mainly from our trading of Won-denominated debt securities. Our trading strategy is to benefit from short-term movements in the prices of debt securities arising from changes in interest rates. As our trading accounts are marked-to-market daily, we manage the interest rate risk related to our trading accounts using market value-based tools such as sensitivity analysis through a price value of a basis point method. Under Basel III, interest rate risk can be divided into general interest rate risk and credit spread risk. General interest rate risk arises from fluctuations in the risk-free yield curve, which is caused by fluctuations in the general macroeconomic environment. Credit spread risk arises from fluctuations in the credit spread of the underlying assets, and is further divided into credit spread risks for (i) non-securitized positions, (ii) correlation trading portfolios and (iii) non-correlation trading portfolios, depending on the underlying asset. Foreign Exchange Risk Foreign exchange risk arises because we have assets and liabilities that are denominated in currencies other than Won, as well as off-balance sheet items such as foreign exchange forwards and currency swaps. Our assets and liabilities denominated in U.S. dollars, Japanese Yen, Euro, Chinese Renminbi and Indonesian IDR have typically accounted for the majority of our foreign currency assets and liabilities. The difference between our foreign currency assets and liabilities is offset against forward foreign exchange positions, currency options and currency swaps to obtain our net foreign currency open position. Kookmin Bank’s Risk Management Council and Market Risk Management Subcommittee oversee Kookmin Bank’s foreign exchange exposure for both trading and non-trading purposes by establishing a limit for this net foreign currency open position, together with stop loss limits. The following table shows Kookmin Bank’s non-consolidated net open positions at the end of 2024 and 2025. Positive amounts represent long positions and negative amounts represent short positions. The net open positions held by subsidiaries other than Kookmin Bank are not significant. As of December 31,(1) 2024 2025 (in millions of US$) Currency: U.S. dollars US$ 216.1 US$ (212.5 ) Japanese Yen 1.3 (3.8 ) Euro 25.8 99.6 Chinese Renminbi 72.4 57.6 Indonesian IDR 713.6 455.5 Others 86.8 112.3 Total US$ 1,115.9 US$ 508.8 (1) Amounts prepared on a non-consolidated basis. Equity Price Risk Equity price risk results from our equity derivatives trading portfolio in Won since we do not have any trading exposure to shares denominated in foreign currencies. 197 Table of Contents The equity derivatives trading portfolio in Won consists of exchange-traded stocks and equity derivatives under strict limits on diversification as well as position limits and stop loss limits. Kookmin Bank’s Risk Management Council and Market Risk Management Subcommittee set annual and monthly stop loss limits that are monitored by Kookmin Bank’s Risk Management Department. In order to ensure timely action, the stop loss limit of individual securities is monitored by the relevant middle office. As of December 31, 2025, Kookmin Bank’s equity trading position was ￦38.3 billion. Derivative Market Risk Our derivative trading includes interest rate and cross-currency swaps, foreign exchange forwards, stock index and interest rate futures and currency options. These activities consist primarily of the following: • sales of tailor-made derivative products that meet various needs of our corporate customers and related transactions to reduce our exposure resulting from those sales; • taking positions in limited cases when we expect short-swing profits based on our market forecasts; and • trading to hedge our interest rate and foreign currency risk exposure as described above. Market risk from trading derivatives is not significant since our derivative trading activities are primarily driven by customer deals with very limited open trading positions. Market Risk Management for Non-Trading Activities Interest Rate Risk Our principal market risk from non-trading activities is interest rate risk. Interest rate risk arises due to mismatches in the maturities or re-pricing periods of these rate-sensitive assets and liabilities. We measure interest rate risk for Won and foreign currency assets and liabilities in our bank accounts (including derivatives) and our principal guaranteed trust accounts. Most of our interest-earning assets and interest-bearing liabilities are denominated in Won and our foreign currency-denominated assets and liabilities are mostly denominated in U.S. dollars. Our principal interest rate risk management objectives are to generate stable net interest revenues and to protect our asset value against interest rate fluctuations. We principally manage this risk for our non-trading activities by analyzing and managing maturity and duration gaps between our interest-earning assets and interest-bearing liabilities. In addition, we use hedging instruments for interest rate risk management for our non-trading assets and liabilities. Interest rate gap analysis measures expected changes in net interest revenues by calculating the difference in the amounts of interest-earning assets and interest-bearing liabilities at each maturity and interest resetting date. We perform interest rate gap analysis for Won-denominated and foreign currency-denominated assets and trust assets on a monthly basis or more frequently when deemed necessary. Interest Rate Gap Analysis. We perform interest rate gap analysis based on interest rate repricing maturities of assets and liabilities. However, for some of our assets and liabilities with either no maturities or unique characteristics, we use or assume certain maturities, including the following examples: • With respect to asset maturities, we assume remaining maturities of prime rate-linked loans with remaining maturities of over one year to be one year and use the actual maturities for prime rate-linked loans with remaining maturities of less than one year. 198 Table of Contents • With respect to liability maturities, we use last 120 months’ average balance to segregate “non-core” and “core” demand deposits. We assume “non-core” demand deposits to have remaining maturities of one day or less, and we assume “core” demand deposits to have remaining maturities between one month and five years. The following table shows Kookmin Bank’s interest rate gap for Won-denominated accounts and foreign currency-denominated accounts as of December 31, 2025. As of December 31, 2025 0-3 Months 3-6 Months 6-12 Months 1-3 Years Over 3 Years Total (in billions of Won, except percentages) Won-denominated Interest-earning assets: Loans ￦ 125,640 ￦ 98,286 ￦ 78,004 ￦ 32,442 ￦ 43,112 ￦ 377,484 Securities 7,523 6,461 11,137 31,570 13,339 70,030 Others 6,280 2 0 12 0 6,294 Total ￦ 139,443 ￦ 104,749 ￦ 89,141 ￦ 64,024 ￦ 56,451 ￦ 453,808 Interest-bearing liabilities: Deposits ￦ 152,228 ￦ 50,758 ￦ 86,586 ￦ 61,236 ￦ 46,551 ￦ 397,359 Borrowings 12,562 0 0 0 0 12,562 Others 18,979 4,220 6,140 4,520 2,538 36,397 Total ￦ 183,769 ￦ 54,978 ￦ 92,726 ￦ 65,756 ￦ 49,089 ￦ 446,318 Sensitivity gap (44,326 ) 49,771 (3,585 ) (1,732 ) 7,362 7,490 Cumulative gap (44,326 ) 5,445 1,860 128 7,490 % of total assets (9.8 )% 1.2 % 0.4 % 0.0 % 1.7 % Foreign currency-denominated Interest-earning assets: Due from banks ￦ 28,939 ￦ 3,709 ￦ 2,909 ￦ 2,668 ￦ 4,816 ￦ 43,041 Loans 2,729 561 1,065 3,149 3,844 11,348 Securities 12,570 72 159 230 321 13,352 Total ￦ 44,238 ￦ 4,342 ￦ 4,133 ￦ 6,047 ￦ 8,981 ￦ 67,741 Interest-bearing liabilities: Deposits ￦ 21,672 ￦ 6,593 ￦ 6,848 ￦ 3,341 ￦ 2,912 ￦ 41,366 Borrowings 10,781 3,765 4,094 6,586 3,241 28,467 Others 1,957 0 0 0 0 1,957 Total ￦ 34,410 ￦ 10,358 ￦ 10,942 ￦ 9,927 ￦ 6,153 ￦ 71,790 Sensitivity gap 9,828 (6,016 ) (6,809 ) (3,880 ) 2,828 (4,049 ) Cumulative gap 9,828 3,812 (2,997 ) (6,877 ) (4,049 ) % of total assets 14.5 % 5.6 % (4.4 )% (10.2 )% (6.0 )% Duration Gap Analysis. We also perform duration gap analysis to measure and manage interest rate risk. Duration gap analysis is a more long-term risk indicator than interest rate gap analysis, as interest rate gap analysis focuses more on accounting income as opposed to the market value of the assets and liabilities. We emphasize duration gap analysis because, in the long run, our principal concern with respect to interest rate fluctuations is the net asset value rather than net interest revenue changes. In 2025, our Won-denominated asset and liability duration gap was positive and it moved between +0.104 years and +0.203 years. Accordingly, our net asset value would have declined (or increased) between ￦460 billion and ￦905 billion if interest rates had increased (or decreased) by one percentage point. 199 Table of Contents For duration gap analysis we use or assume the same maturities for different assets and liabilities that we use or assume for our interest rate gap analysis. The following table shows Kookmin Bank’s duration gaps and net asset value changes when interest rates decrease by one percentage point as of the specified dates, on a consolidated basis. Won-denominated Asset Duration Liability Duration Duration Gap Net Asset Value Change Date (in years) (in years) (in years) (in billions of Won) June 30, 2025 1.034 0.890 0.183 ￦ 821 December 31, 2025 0.995 0.902 0.128 584 Foreign currency-denominated Asset Duration Liability Duration Duration Gap Net Asset Value Change Date (in years) (in years) (in years) (in billions of Won) June 30, 2025 1.042 0.761 0.252 ￦ 162 December 31, 2025 1.036 0.764 0.245 170 We set interest rate risk limits using the Interest Rate Risk in the Banking Book, or IRRBB, method, as described below, with respect to expected asset and liability positions based on our annual business plans. The Risk Management Department in Kookmin Bank’s Risk Management Group submits interest rate gap analysis reports, duration gap analysis reports and interest rate risk limit compliance reports monthly to Kookmin Bank’s Risk Management Council and quarterly to Kookmin Bank’s Risk Management Committee. The following table summarizes Kookmin Bank’s interest rate risk, taking into account asset and liability durations as of December 31, 2025. As of December 31, 2025 3 Months or Less 3-6 Months 6-12 Months 1-3 Years Over 3 Years Total (in billions of Won, except percentages and maturities in years) Won-denominated: Asset position ￦ 139,443 ￦ 104,749 ￦ 89,141 ￦ 64,024 ￦ 56,451 ￦ 453,808 Liability position 183,769 54,978 92,726 65,756 49,089 446,318 Gap (44,326 ) 49,771 (3,585 ) (1,732 ) 7,362 7,490 Average maturity 0.054 0.375 0.763 1.881 8.491 Interest rate volatility 2.25 % 2.25 % 2.25 % 2.25 % 2.25 % Amount at risk 1,950 817 (689 ) (458 ) (977 ) 642 Foreign currency-denominated: Asset position ￦ 44,238 ￦ 4,342 ￦ 4,133 ￦ 6,047 ￦ 8,981 ￦ 67,741 Liability position 34,410 10,358 10,942 9,927 6,153 71,790 Gap 9,828 (6,016 ) (6,809 ) (3,880 ) 2,828 (4,049 ) Average maturity 0.048 0.375 0.805 2.076 7.166 Interest rate volatility 2.00 % 2.00 % 2.00 % 2.00 % 2.00 % Amount at risk 10 (48 ) (110 ) (118 ) 615 348 IRRBB Analysis. Since November 2019, banks, including Kookmin Bank, have been required to adopt the standards of the IRRBB issued by the Basel Committee on Banking Supervision for calculating interest rate risk exposure. Such requirements were adopted in order to promote more financial stability for banks by requiring them to maintain a sufficient level of capital through a more robust risk management system. Kookmin Bank estimates its interest rate risk pursuant to such standards by calculating the changes in economic value of equity 200 Table of Contents and the changes in net interest income based on various interest rate risk scenarios. Under this method, Kookmin Bank’s interest rate risk exposure was ￦990 billion as of December 31, 2025. For additional information, see Note 4.4 of the notes to our consolidated financial statements included elsewhere in this annual report. Foreign Exchange Risk We manage foreign exchange rate risk arising from our non-trading operations together with such risks arising from our trading operations. See “—Market Risk Management for Trading Activities—Foreign Exchange Risk” above. Liquidity Risk Management Liquidity risk is the risk of insolvency or loss due to a disparity between the inflow and outflow of funds resulting from, for example, maturity mismatches, obtaining funds at a high price or disposing of securities at an unfavorable price due to lack of available funds. We manage our liquidity in order to meet our financial liabilities from withdrawals of deposits, redemption of matured debentures and repayments at maturity of borrowed funds. We also require sufficient liquidity to fund loans, to extend other credits and to invest in securities. Our liquidity management goal is to meet all our liability repayments on time and fund all investment opportunities even under adverse conditions. To date, we have not experienced significant liquidity risk. We maintain liquidity by holding sufficient quantities of assets that can be liquidated to meet actual or potential demands for funds from depositors and others. We also manage liquidity by ensuring that the excess of maturing liabilities over maturing assets in any period is kept to manageable levels relative to the amount of funds we believe we could raise by issuing securities. We seek to minimize our liquidity costs by managing our liquidity position on a daily basis and by limiting the amount of cash at any time that is not invested in interest-earning assets or securities. We maintain diverse sources of liquidity to facilitate flexibility in meeting our funding requirements. We fund our operations principally by accepting deposits from retail and corporate depositors, accessing the call loan market (a short-term market for loans with maturities of less than 90 days), issuing debentures and borrowing from the Bank of Korea. We use the majority of funds we raise to extend loans or purchase securities. Generally, deposits are of shorter average maturity than loans or investments. For Won-denominated assets and liabilities, we manage liquidity using a cash flow structure based on holding short-term liabilities and long-term assets. Generally, the average initial contract maturity of our new Won-denominated time deposits was less than one year, while during the same period most of our new loans and securities had maturities over one year. We manage liquidity risk within the limits set on Won and foreign currency accounts in accordance with the regulations of the Financial Services Commission. The Financial Services Commission generally requires Korean banks, including Kookmin Bank, to maintain a liquidity coverage ratio of not less than 100%. The Financial Services Commission defines the liquidity coverage ratio as the ratio of highly liquid assets to total net cash outflows over a 30-day period. The highly liquid assets and total net cash outflows included in the calculation of the liquid coverage ratio are determined in accordance with the “Standards for Calculation of Liquidity Coverage Ratio” under the Detailed Regulation on the Supervision of the Banking Business. In addition, the Financial Services Commission requires Korean banks, including Kookmin Bank, to maintain a foreign currency liquidity coverage ratio of not less than 80%. Kookmin Bank’s Financial Planning Department is responsible for daily liquidity management with respect to its Won and foreign currency exposure. It reports monthly plans for funding and operations to the Asset 201 Table of Contents Liability Management Committee of Kookmin Bank, which discusses factors such as interest rate movements and maturity structures of its deposits, loans and securities and establishes strategies with respect to deposit and lending rates. The following table shows Kookmin Bank’s liquidity coverage ratio and foreign currency liquidity coverage ratio on an average balance basis for the month of December 2025 in accordance with Financial Services Commission regulations: Liquidity coverage ratio: 30 Days or Less (in billions of Won, except percentages) Highly liquid assets (A) ￦ 85,352 Cash outflows (B) 103,762 Cash inflows (C) 23,955 Total net cash outflows (D = B-C) 79,807 Liquidity coverage ratio (A/D) 106.95 % Minimum limit 100.00 % Foreign currency liquidity coverage ratio: 30 Days or Less (in millions of US$, except percentages) Highly liquid assets (A) US$ 4,931 Cash outflows (B) 11,738 Cash inflows (C) 8,783 Total net cash outflows (D = B-C) 2,955 Liquidity coverage ratio (A/D) 166.87 % Minimum limit 80.00 % The Risk Management Department in Kookmin Bank’s Risk Management Group reports whether it is complying with these limits monthly to Kookmin Bank’s Risk Management Council and quarterly to Kookmin Bank’s Risk Management Committee. Operational Risk Management Overall Status There is no complete consensus on the definition of operational risk in the banking industry. We define operational risk broadly to include all financial and non-financial risks, other than credit risk, market risk, interest rate risk and liquidity risk, that may arise from our operations that could negatively impact our capital, including the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events as defined under Basel III. Our operational risk management objectives include not only satisfying regulatory requirements, but also providing internal support through the growth of a strong risk management culture, reinforcement of internal controls, improvement of work processes and provision of timely feedback to management members and staff throughout the group. Each of our subsidiaries manages operational risks related to its own business, and we regularly monitor them. Kookmin Bank, our banking subsidiary, uses an operational risk management framework meeting the Basel III standards. Specifically, Kookmin Bank calculates its operational risk-weighted assets under the Basel III standardized method, pursuant to which it: • calculates its operational risk-weighted assets on a quarterly basis using its business indicator components, or BICs, and internal loss multipliers, or ILMs; • monitors operational risk in terms of Key Risk Indicators, or KRIs, using tolerance levels for each indicator; 202 Table of Contents • executes integrated compliance and operational risk Control Self Assessments, or CSAs, that enhance the effect on internal controls, which Kookmin Bank employees are able to access and use for process improvement; • collects and analyzes internal and external loss data; • conducts scenario analyses to recognize the operational risks for incidents with a high probability of potential loss and to identify weaknesses and areas of improvement; • manages certain insurance-related activities relating to insurance strategies established to mitigate operational risk; • examines operational risks arising in connection with the development of, changes in or discontinuance of products, policies or systems; • uses a detailed business continuity plan covering all of its operations and locations to prepare against unexpected events, including an alternate back-up site for use in disaster events as well as annual full-scale testing of such site; • refines bank-wide operational risk policies and procedures; • provides appropriate training and support to business line operational risk managers; and • reports overall operational risk status to our senior management. While Kookmin Bank’s Risk Management Department advises relevant business units with respect to the review of and suggested improvements on related operational processes and procedures, each of Kookmin Bank’s relevant business units has primary responsibility for the management of its own operational risk. In addition, the Operational Risk Unit, which is part of Kookmin Bank’s Risk Management Department, monitors bank-wide operational risk. Kookmin Bank also has business line operational risk managers in all of its subsidiaries, departments and branches who periodically conduct CSAs and monitor KRIs. For example, Kookmin Bank has developed KRIs relating to customer data protection, which are applied and monitored at all domestic branches and offices. In addition, in order to strengthen risk management of its overseas operations, Kookmin Bank designates expert auditors for overseas branches and conducts internal audits designed especially to check key risks identified for each overseas branch. Kookmin Bank has also established a risk CSA system for overseas branches, pursuant to which all employees (including locally hired staff) of such branches are required to perform a risk CSA on a quarterly basis.  Furthermore, Kookmin Bank regularly monitors operational risks related to new businesses as well as existing operating processes and seeks to develop appropriate new KRIs and risk CSA measures on an ongoing basis. Through such methods, Kookmin Bank is able to ensure proper monitoring of operational risk in each of its business groups and overseas operations. Internal Control To monitor and control operational risks, we maintain a system of comprehensive policies and have put in place a control framework designed to provide a stable and well-managed operational environment throughout our organization. We have in place a prescribed leave policy for employees in certain high-risk categories to safeguard against fraud and to check for weaknesses in internal controls. In addition, we maintain an external whistleblower “ombudsman” channel to encourage whistleblowing and voluntary reporting of fraudulent behavior. As part of our efforts to strengthen our internal reporting system, we amended our whistleblower policy in May 2023 to expand the scope of reportable subjects, explicitly stipulate the rewards for such reporting and require mandatory investigations of any violations of the duty to report financial incidents. Furthermore, in August 2025, we strengthened our protection of whistleblowers by specifying the types of retaliatory actions that are prohibited against whistleblowers. Each of our subsidiaries establishes its own internal control system in accordance with the group-level internal control principles. Our Compliance Supporting Department is responsible for monitoring and advising 203 Table of Contents our subsidiaries regarding their internal control systems. Our Audit Committee, which consists of four non-executive directors, is an independent authority that evaluates the effectiveness and efficiency of our group-wide internal control systems and business processes and monitors our subsidiaries’ compliance with such systems and processes, as well as reviews the reliability of our financial statements to secure the transparency and stability of our management (including through the activities of our independent auditors). Supplementally, pursuant to certain amendments made to the Act on the Corporate Governance of Financial Companies aimed at strengthening the internal control systems of financial companies in Korea, which became effective in July 2024, we established an Internal Control Committee under our board of directors in March 2025. The Internal Control Committee is mainly responsible for establishing and amending our strategies and standards relating to internal control, ensuring that our management take appropriate managerial actions required for the effective functioning of internal control related to their respective responsibilities set forth in a “Responsibilities Map” prepared by us in accordance with the amended rules, and overseeing steps to improve any deficiencies identified in our internal control systems. However, the Audit Committee continues to oversee matters relating to internal control over financial reporting, among others. We have also established group-wide internal guidelines with respect to our subsidiaries’ reporting requirements. Our subsidiaries review their operations and their level of compliance with internal control systems and business processes on a periodic basis and, as part of this process, they are required to report any problems discovered and any remedial actions taken to our chief compliance officer, who is responsible for reporting to our Audit Committee or Internal Control Committee, as necessary. Based on the results of these reports, or on an ad hoc basis in response to any problem or potential problem that it identifies, the Audit Committee may direct a subsidiary to conduct an audit of its operations or, if it chooses to do so, conduct its own audit of those operations. The Audit Committee interacts on a regular basis with our Audit Department, Internal Control Committee, Compliance Supporting Department and our independent auditors. In carrying out these duties, the Audit Committee ultimately protects our property for the benefit of our shareholders, investors and customers by independently monitoring our management. Our Audit Department supports our Audit Committee in monitoring our accounting and business operations and overseeing the management of our subsidiaries’ internal control systems by performing the following activities: • general audits, which include full-scale audits of the overall operations performed according to an annual audit plan, and sectional audits of selected operations; and • special audits of troubled or weak operations, which are performed when our Audit Committee or executive officer responsible for audits deems it necessary or pursuant to requests by our board, executive officers or supervisory authorities, such as the Financial Supervisory Service. The Financial Supervisory Service periodically conducts a general examination of our operations. It also performs specific audits on particular aspects of our operations, such as risk management, credit monitoring and liquidity, as the need arises. We and our subsidiaries have in the past been subject to, and may in the future be subject to, the receipt of warning notices or the imposition of penalties in connection with our or our subsidiaries’ failure to comply with the applicable laws or rules, regulations and guidelines of the Financial Supervisory Service. Kookmin Bank’s Audit Department is the execution body for its audit committee and supports Kookmin Bank’s management objectives by auditing the operations of its branches using a risk analysis system and reviewing the operations of its headquarters and subsidiaries through the use of “risk-based audit” in accordance with the “business measurement process” audit methodology, which requires that the Audit Department evaluate the risk and process of its business units and concentrate its audit capacity with respect to high risk areas. As a result of recent regulatory trends, Kookmin Bank’s Audit Department is continuing its efforts to establish an advanced audit system and value-added internal audit by introducing risk-based audit techniques. In addition, in December 2024, Kookmin Bank newly established an internal control committee in order to enhance its internal control systems. Our Compliance Supporting Department operates a compliance system to ensure that all of our employees comply with the relevant laws and regulations. This system’s main function is to establish and manage our compliance program, educate employees and management and improve our internal control process. 204 Table of Contents Legal Risk We consider legal risk as a part of our operational risk. The uncertainty of the enforceability of the obligations of our customers and counterparties creates legal risk. Changes in laws and regulations could also adversely affect us. Legal risk is higher in new areas of business where the law is often untested in the courts, although legal risk can also increase in our traditional business to the extent that the legal and regulatory landscape in Korea is changing and many new laws and regulations governing the financial industry remain untested. Our Compliance Supporting Department seeks to minimize legal risk by using stringent legal documentation, employing procedures designed to ensure that transactions are properly authorized and consulting legal advisers. IT System Operational Risk The integrity of our IT systems, and their ability to withstand potential catastrophic events, are crucial to our continuing operations. Accordingly, we are continuing to strengthen our disaster recovery capabilities. In order to minimize operational risks relating to our IT systems, we have implemented a multi-CPU system that runs multiple CPUs simultaneously on-site and ensures system continuity in case any of the CPUs fails. This system backs up our data systems at an off-site location on a real-time basis to ensure that our operations can be carried out normally and without material interruption in the event of CPU failure. Also, in order to protect our Internet banking services from system failures and cyber attacks, we process our Internet transactions through two separate data processing centers. We currently test our disaster recovery systems every six months, with the comprehensive testing covering our branches and the main IT center’s disaster recovery system, and our Infrastructure System Department monitoring all of our computerized network processes and IT systems. In addition, we monitor and report on any unusual delays or irregularities reported by our branches. Kookmin Bank currently tests its disaster recovery systems on a quarterly basis, and its Information Security Department is responsible for the daily monitoring of its information security system. Our business operations regularly conduct IT security inspections with respect to such operations and have implemented measures to identify and respond collectively to security breach attempts, such as hacking attempts. Furthermore, KB Kookmin Card and Kookmin Bank have each established technical as well as management-related standards governing information protection under which they operate their businesses. In particular, at Kookmin Bank, we have taken steps to establish a comprehensive security system aimed at detecting and responding to internal and external threats to its IT system and have implemented network segregation on the computers of all employees so that Intranet and Extranet functions are segregated. We have endeavored to enhance protection of customer data by using personal identification numbers internally generated and managed by Kookmin Bank in all customer financial transactions, in lieu of the resident registration numbers of its customers, and by amending forms and templates to minimize collection of potentially sensitive customer data. Kookmin Bank’s chief information security officer is responsible for ensuring protection of information assets and technologies and reducing IT risks. At KB Kookmin Card, we have taken steps to strengthen its information security infrastructure by implementing a solution to prevent attacks on its website and a security system to prevent unauthorized access to local networks and information. As part of its efforts to strengthen its operational processes and procedures for customer information protection and to ensure compliance with relevant laws and regulations, KB Kookmin Card continually conducts annual status reviews, monthly information security inspections, information protection training for its employees and officers and mock training sessions for responding to malicious e-mails. Kookmin Bank and KB Kookmin Card have each obtained ISO 27001 certification, which relates to information security. Kookmin Bank has also obtained ISO 20000 certification, which relates to information technology service management, and BS 25999 (now ISO 22301) certification, which relates to business 205 Table of Contents continuity management. Kookmin Bank is the first Korean bank to have obtained all three such international certifications and it continually renews such certifications following annual reviews. In addition, we, Kookmin Bank and KB Insurance have each obtained ISMS certification, which relates to information security management, and KB Securities, KB Kookmin Card, Kookmin Bank and KB Capital have obtained ISMS-P certification, which relates to personal information in addition to information security management. KB Kookmin Card has also obtained PCI DSS certification, which relates to the protection of credit card data, and ISO 27701 certification, which relates to the management of personally identifiable information. We implement various year-round education programs and training sessions designed to raise the information security awareness of both management and employees. For further information regarding our cybersecurity measures, see “Item 16K. Cybersecurity.”