Overview of Risk Management The business activities of Nomura Group are exposed to various risks, including market risk, credit risk, operational risk, and other risks arising from external factors. Below is an outline of our risk management framework. Risk Characteristics Nomura recognizes that unexpected losses from business operations may erode the capital of Nomura Group due to various risks, including market risk, credit risk, operational risk, and model risk. Additionally, liquidity risk may arise if a decline in the Group’s creditworthiness or adverse market conditions make it difficult to secure necessary funding. Furthermore, strategic risk could affect current and future earnings, capital, liquidity, enterprise value, and the reputation of Nomura Group due to poor management decisions, hasty or mistaken business advancements, or inaction in response to changes within the industry or external environment. Additional risks that may affect Nomura are described in Item 3. D. “Risk Factors.” Risk Management Policy Nomura’s fundamental principle is that all employees should regard themselves as principals of risk management and actively engage in the management of risks at all organizational levels. Nomura’s aim is to promote a proactive risk management culture throughout the organization and to limit risks within its defined risk appetite. Risk Management Procedures • Nomura calculates, aggregates, reports, and monitors management information related to risk to support sound decision-making. • The Risk Management Division and Finance Division are responsible for regularly compiling the status of positions in line with risk appetite and ensuring appropriate data management. • Management information spans various risk categories and is produced using multiple risk management techniques. • The risk management framework consists of risk appetite, governance and oversight, management of financial resources, management of risk categories, and processes to measure and control risks. Overview of Risk Management Structure Nomura has established a framework designed to manage its risk aimed at maintaining financial soundness and enhancing enterprise value. 155 Table of Contents Three Lines of Defense Framework: • First Line of Defense: All executives and employees in the front office are primarily responsible for risk management. • Second Line of Defense: The risk management department supports and monitors first line activities and reports to senior management. • Third Line of Defense: The independent internal audit department examines and evaluates risk management activities and reports findings to the Audit Committee. Setting Risk Appetite: Based on its management strategy, Nomura determines the types and levels of risk it is willing to assume and reviews these regularly. Nomura’s Risk Appetite is jointly submitted by the Chief Risk Officer (“CRO”) and the Chief Financial Officer (“CFO”) to the Executive Management Board (“EMB”) for approval. It is then to be further reviewed at the Board Risk Committee (“BRC”) based on the BRC’s authority to consent to the relevant proposal raised by the executive side. Limit Frameworks The establishment of robust limit monitoring and management is central to the appropriate monitoring and management of risk. The limit management frameworks incorporate escalation policies to facilitate approval of limits at appropriate levels of seniority. The Risk Management Division and the Finance Division are responsible for day-to-day operations of these limit frameworks including approval, monitoring, and reporting as required. Business units are responsible for complying with the agreed limits. Limits apply across a range of quantitative measures of risk and across risk categories such as market risk, credit risk and model risk. Committee Governance Nomura has the EMB as a body to deliberate on or determine management strategy, the allocation of the management resources and important management matters of Nomura. The Group Risk Management Committee (the “GRMC”) operates, upon delegation from the EMB, for the purpose of deliberating on or determining important matters concerning enterprise risk management of Nomura and thereby assuring the sound and effective management of Nomura’s businesses. The GRMC consists of the Group CEO, one representative executive officer other than the Group CEO appointed by the Committee Chairman, the Chief Compliance Officer, the CRO, the CFO, Division Heads and persons designated by the Committee Chairman as the members of the Committee. An organizational framework and committee structure is in place to facilitate effective business operations and management of the firm’s risks. Please also see Item 6.C. “Board Practices.—Information Concerning Directors” in this annual report for a description of the respective roles of the Board of Directors and the Board Risk Committee in risk management. Risk Categories and Definitions Nomura categorizes risks as follows and has established departments to manage each type: • Financial Risk: Credit risk, market risk, model risk • Non-Financial Risk: Operational risk, reputational risk • Liquidity Risk: Liquidity risk • Other Risks: ESG (Environmental, Social, Governance), strategic risk and other risks 156 Table of Contents Financial and non-financial risks are described in more detail below. For further information on funding and liquidity risk management, see Item 5.B. “Liquidity and Capital Resources.—Funding and Liquidity Management” in this annual report. Credit Risk Risk Characteristics Credit risk is defined as the risk of loss arising from an obligor’s default, insolvency, or legal proceedings that prevent the obligor from fulfilling its contractual obligations according to the agreed terms. This includes both on and off-balance sheet exposures. It is also the risk of loss arising through credit valuation adjustment associated with deterioration in the creditworthiness of a counterparty. Risk Management Policy Nomura has designed a risk management framework designed to allow it to take on appropriate credit risk in alignment with its risk appetite. • Credit Risk Management (“CRM”) expresses the creditworthiness of a counterparty or debtor by assigning internal ratings based on the results of individual credit analyses. These internal ratings are linked to the probability of default and are used to calculate the amount of credit risk-weighted assets (“RWA”). • Credit exposures arising from counterparties are managed through credit limits set based on internal ratings. The scope of credit risk management includes transactions with counterparties, as well as loans, private equity investments, fund investments, investment securities, and various bonds and equities that are deemed to require credit risk management. Nomura’s credit risk primarily arises from derivative transactions and securities lending transactions. Procedures Credit risk management at Nomura is conducted through the following procedures: • Internal Rating Assignment and Updates: CRM evaluates the creditworthiness of counterparties based on detailed due diligence and analysis concerning the counterparty’s business environment, competitiveness, and strengths and flexibility in management and finance. Credit analysts also consider the organizational structure of the target and any explicit or implicit credit enhancements. Credit analysts are responsible for assigning internal ratings and reviewing them at least once a year. • Setting Credit Limits: CRM establishes credit limits for counterparties based on internal ratings. • Exposure and Limit Management: Nomura’s credit risk management system calculates and aggregates credit exposures at both the counterparty and group levels. This allows CRM to monitor and manage the usage of credit limits and exposure concentration risk on a daily basis, ensuring that appropriate reporting mechanisms are in place in case of limit breaches. 157 Table of Contents Overview of the Management Structure Nomura manages credit risk at both the global and legal entity levels, establishing the following structure: Policies, etc.: • Under a risk management framework based on risk appetite, matters related to the basic policy on credit risk management, risk measurement methods, approval authority for credit limit setting, and monitoring are defined in global policies, standards, and procedures. • These policies are established through appropriate approval procedures by the GRMC, etc., and they define the basic policy of credit risk management as well as the approval authority for credit limit setting. Credit Risk Management (CRM): • CRM is a global organization within the Risk Management Division responsible for managing credit risk and reports to the CRO. • CRM is responsible for the implementation, maintenance and management of the policies. Credit Risk Mitigation Measures Risk Characteristics and Risk Management Policy • Please refer to “Credit Risk” Overview of Procedures and Structure Nomura mitigates credit risk through means such as collateral, guarantees, and credit derivatives. Collateral Agreements • To further reduce credit risk, Nomura utilizes collateral agreements. • These agreements help ensure that Nomura can receive collateral from counterparties at the commencement of transactions or in response to changes in exposure levels or other relevant circumstances. Master Netting Agreements • Nomura enters into Master Netting Agreements with many counterparties, which consist of the standard agreements set forth by the International Swaps and Derivatives Association or similar contracts (collectively referred to as “Master Netting Agreements”). • By entering into Master Netting Agreements, Nomura is able to net receivables and payables, thereby reducing the potential loss amount arising from a counterparty’s default. 158 Table of Contents Credit Risk to Counterparties in Derivatives Transaction The credit exposures arising from Nomura’s trading-related derivatives as of March 31, 2026 are summarized in the table below, showing the positive fair value of derivative assets by counterparty credit rating and by remaining contractual maturity. The credit ratings are internally determined by Nomura’s CRM. Billions of yen Years to Maturity Cross- Maturity Netting(1) Total Fair Value Collateral obtained Replacement cost(3) Credit Rating Less than 1 year 1 to 3 years 3 to 5 years 5 to 7 years More than 7 years (a) (b) (a)-(b) AAA ¥ 6 ¥ 15 ¥ 11 ¥ 4 ¥ 45 ¥ (73 ) ¥ 8 ¥ 1 ¥ 7 AA 401 438 482 671 3,626 (4,887 ) 731 134 597 A 457 344 270 219 1,127 (1,929 ) 488 186 302 BBB 378 171 105 66 488 (504 ) 704 257 447 BB and lower 104 189 73 35 41 (238 ) 204 740 — Other(2) 90 20 28 1 29 (170 ) (2 ) 21 — Sub-total ¥ 1,436 ¥ 1,177 ¥ 969 ¥ 996 ¥ 5,356 ¥ (7,801 ) ¥ 2,133 ¥ 1,339 ¥ 1,353 Listed 924 138 213 42 0 (557 ) 760 126 634 Total ¥ 2,360 ¥ 1,315 ¥ 1,182 ¥ 1,038 ¥ 5,356 ¥ (8,358 ) ¥ 2,893 ¥ 1,465 ¥ 1,987 (1) Represents netting of derivative liabilities against derivatives assets entered into with the same counterparty across different maturity bands. Derivative assets and derivative liabilities with the same counterparty in the same maturity band are net within the relevant maturity band. Cash collateral netting against net derivative assets in accordance with ASC 210-20 “Balance Sheet—Offsetting” and ASC 815 “Derivatives and Hedging” is also included. (2) “Other” comprises unrated counterparties and certain portfolio level valuation adjustments not allocated to specific counterparties. (3) Zero balances represent instances where total collateral received is in excess of the total fair value; therefore, Nomura’s credit exposure is zero. Market Risk Market risk is the risk of loss arising from fluctuations in market risk factors (such as interest rates, foreign exchange rates, and prices of securities) that result in changes in the value of financial assets and liabilities held (including off-balance-sheet items). Overview of Market Risk Management Policy, Procedures, and Structure Methods for Identifying, Evaluating, Managing, and Mitigating Risks, and Monitoring Hedge Effectiveness • Nomura employs various statistical tools to measure and monitor market risk, including Value at Risk (“VaR”). Sensitivity analysis and stress testing are also utilized as assessment tools. Sensitivities indicate the potential change in portfolio value due to standard shifts in market risk factors. These sensitivities are asset class-specific and are not typically aggregated across different risk factors. Stress testing allows for the analysis of portfolio risk and tail risk, incorporating non-linear effects and enabling aggregation across risk factors at any level of the organization, from group level to business divisions and trading desks. • Market risk is monitored through daily reports and other management information provided to business units and senior management, ensuring compliance with established limits. The market risk management function is carried out by a dedicated market risk department that operates independently of the front office, creating a robust framework for the effective identification, analysis, reporting, and 159 Table of Contents management of market risk. The utilization of market risk limits is reported in accordance with the Market Risk Limit Procedure, covering all levels of business hierarchy and legal entities. • If the utilization of market risk limits exceeds pre-approved thresholds, the front office collaborates with the market risk department to develop an action plan, obtain approval, and execute it. Any limit breaches are reported to relevant stakeholders and committees in accordance with established policies. Value at Risk (VaR) VaR is a measure used to estimate the potential loss due to unfavorable movements in market factors such as equity prices, interest rates, credit spreads, foreign exchange rates, and commodity prices, along with their associated volatilities and correlations. • Methodology Assumptions Nomura uses a globally consistent VaR model for measuring total trading VaR across the organization. The historical simulation method is employed, applying historical market movements over a two-year period to current exposures to generate one-day profit and loss distribution. This distribution is then utilized to estimate potential losses with required confidence levels. The VaR model maintains its reliability even when high-quality data is not available through a proxy logic system. • VaR Backtesting The performance of Nomura’s VaR model is regularly monitored to ensure its fitness for purpose. The main method for validating VaR is through backtesting, which involves comparing actual losses over one day to the corresponding VaR estimate. The backtest results are reviewed monthly by the Risk Management Division. • Limitations and Advantages of VaR The primary advantage of VaR is its ability to aggregate risks across different asset classes. However, it is a backward-looking measure that inherently assumes that recent distribution and correlations adequately represent potential future movements. VaR is suitable for liquid markets but has limitations regarding rapidly changing market variables. Consequently, VaR may not fully capture the impact of significant adverse events. Nomura acknowledges these limitations and uses VaR as one component of a broader market risk management strategy. VaR metrics: 95% Confidence Interval One-day VaR data using the confidence level of 95% for the year ended March 31, 2026 is presented below. The following graph shows the daily VaR over the last six quarters for substantially all of Nomura’s trading positions: 160 Table of Contents The following tables show the VaR as of each of the dates indicated for substantially all of Nomura’s trading positions: Billions of yen 31-Mar 2025 2026 Equity ¥ 2.0 ¥ 4.5 Interest rate 2.1 2.9 Foreign exchange 1.5 1.1 Subtotal 5.6 8.5 Less: Diversification Benefit (1.8 ) (2.7 ) VaR ¥ 3.8 ¥ 5.8 Billions of yen For the twelve months ended March 31 2025 2026 Maximum daily VaR(1) ¥ 6.9 ¥ 7.7 Average daily VaR(1) 5.2 5.1 Minimum daily VaR(1) 3.5 3.1 (1) Represents the maximum, average and minimum VaR based on all daily calculations for the year ended March 31, 2026. Non-Trading Risk A major market risk in Nomura’s non-trading portfolio relates to equity investments held for the purpose of maintaining business relationships and promoting business over the long term. These equity investments are primarily influenced by fluctuations in the Japanese stock market. One method that can estimate the market risk in this portfolio is to analyze market sensitivity based on changes in the TOPIX, which is a leading index of prices of stocks on the Tokyo Stock Exchange. Nomura conducts regression analysis, over the past 90 days, on the relationship between movements in TOPIX and fluctuations in the market prices of equities held to maintain business relationships and promote business. Based on this analysis, for each 10% change in TOPIX, the fair value of these operating equity investments was expected to decrease by approximately ¥7.7 billion as of March 31, 2025, and by approximately ¥11.2 billion as of March 31, 2026. TOPIX closed at 2,658.73 points as of March 31, 2025, and at 3,497.86 points as of March 31, 2026. This simulation is based on regression analysis against TOPIX for Nomura’s entire portfolio of equity investments held for these purposes; therefore, actual results may differ from these estimates due to price fluctuations of individual equities. Operational Risk Operational risk is defined as the risk of financial loss or non-financial impacts, such as violations of laws and regulations or deterioration of the reputation of Nomura, arising from inadequate or failed internal processes, people, systems, or from external events. This risk includes compliance, legal, IT, cyber and information security, fraud, third-party, and other non-financial risks. Although this definition excludes strategic risk (the risk of loss arising from poor strategic management decisions) and reputational risk, operational risks can still significantly affect the group’s reputation, creating a close relationship between operational and reputational risk. 161 Table of Contents Overview of Risk Management Policy and Procedures Nomura has established a management framework for identifying, assessing, managing, monitoring, and reporting operational risk. This framework is supervised by the GRMC with delegated authority from the EMB. The operational risk management framework consists of the following components: Foundation of the Risk Management Framework • Policy Framework: Clearly establishes the fundamental principles for managing operational risk and details how adherence to these standards will be monitored. • Training and Awareness: Initiatives aimed at improving understanding of operational risk management throughout the organization. Key Risk Management Activities • Event Reporting: A process used to identify and report events that lead to, or could potentially lead to, losses or gains arising from inadequate or failed internal processes, people, systems, or external events. • Risk and Control Self-Assessment (RCSA): This process involves identifying the inherent operational risks the business faces, evaluating the key controls established to mitigate those risks, and formulating additional measures as necessary. The Operational Risk Management (ORM) team is responsible for developing the RCSA process and supporting its implementation within business units. • Key Risk Indicator (KRI): Metrics used to monitor exposure to operational risk and trigger appropriate responses if predefined thresholds are breached. • Scenario Analysis: A process used to assess and quantify potential high-impact, low-probability operational risk events and identify actions necessary to enhance the control environment. Outputs from the Risk Management Activities • Analysis and Reporting: A critical aspect of the ORM team’s role is to analyze and report on operational risk information provided by business units, and work with them to develop action plans for risk mitigation. • Operational Risk Capital Calculation: Nomura calculates the required operational risk capital in alignment with Basel regulations and local regulatory requirements. Model Risk Model Risk is the risk of financial loss, incorrect decision making, or damage to the firm’s credibility arising from model errors or the incorrect or inappropriate application of models. To effectively manage Model Risk, Nomura has established a Model Risk Management Framework that governs the development, management, validation, approval, usage, ongoing monitoring, and periodic review of the firm’s models. Key aspects of the Framework are as follows: • Model Development and Validation: Prior to the introduction of new models and any material changes to approved models, independent validation is required from a team separate from the model development team. The thresholds for determining the materiality of model changes are defined in the procedures of Model Risk Management. • Independent Validation: The model validation team evaluates the appropriateness of the models through various analyses, identifies model limitations, and quantifies the associated model risk. This process ensures the reliability and safety of the models. 162 Table of Contents • Risk Mitigation: At the time of approval by the model validation team, conditions such as usage restrictions, model reserves, and capital adjustments are applied to mitigate risk. This ensures that the models are financially sound. • Periodic Evaluation and Monitoring: Approved models undergo regular validation procedures, with ongoing performance monitoring playing a crucial role in continuously assessing the appropriateness of the models. • Governance and Approval: The Model Risk Management Committee is responsible for Model Risk Management provide overall oversight, scrutiny, governance, and ultimate approval of validated models. Through these measures, Nomura has established a robust management structure for Model Risk, enhancing its ability to identify and manage both financial and non-financial risks effectively.