Quantitative and Qualitative Information about Risk Management Risk Culture In order for us to realize and maintain sustainable growth in corporate value, each of our directors, officers and other employees should think and judge on their own if their actions meet the expectations and requirements of customers, markets, and other stakeholders, not just if they are compliant with laws and regulations. We have established the “Behavioral Guideline on Compliance and Risk” for all our directors, officers and other employees to hold onto as a “keystone” of their daily business. Relevant concrete measures to foster a sound risk culture include internal surveys for monitoring the compliance awareness and risk sensitivity of our directors, officers and other employees, as well as communication of messages from top management to employees, internal training, and a commendation system. Risk Appetite Framework We have introduced a Risk Appetite Framework (“RAF”) for controlling SMBC Group-wide risks, that clarifies the types and levels of risk that we are willing to take on or are prepared to tolerate (risk appetite) in order to grow profits. RAF is one of two pillars of our business management alongside business strategies. It functions as a management framework for sharing information on the operating environment and risks facing us among management and for facilitating appropriate risk taking based thereon. Individual risk appetites have been established for specific business units or strategies as necessary based on our overall risk appetite. We have a Risk Appetite Statement that provides a qualitative explanation of our approach to risk taking and risk management for each category: soundness, profitability, liquidity, credit, market, climate-related, reputational, model, operational, and conduct/compliance. We also have quantitative measures (i.e., Risk Appetite Measures) that function as benchmarks for risks that we are considering taking and for risk/return. Risk appetites are decided during the process of formulating business strategies and management policies with the approval of the board of directors. These risk appetites are set based on Top Risks that threaten to significantly impact management and on risk analyses (stress testing) that illustrate the impact if a risk should materialize. In addition, risk register and Key Risk Events (“KRE”) are utilized as part of a system for assessing the risks present in new and existing business activities and for verifying the adequacy of Top Risks, risk appetites, and business strategies. The outlooks for the operating environment and risks and the risk appetite situation are monitored throughout the course of the fiscal year. Risk Appetite Measures and business strategies are revised as necessary. For example, overall risk capital has been selected as an indicator for risk appetite, which displays the soundness of the SMBC Group. Risk capital is the amount of capital required to cover the theoretical maximum potential loss arising from risks of business operations. Overall risk capital is the aggregate of the risk capital amounts for 154 Table of Contents each risk category. Management standards have been set for the upper limit for overall risk capital based on group-wide management strength. Overall risk capital levels are thus monitored throughout the course of each fiscal year to clearly indicate risk-taking capacity and promote the sound taking of risks. In addition, specific risk appetite indicators have been set for credit risk, market risk, liquidity risk, and other risk categories to facilitate appropriate management based on a quantitative understanding of risk appetite. Risk Management Categories We classify risk into the following categories: Credit Risk. Credit risk is the possibility of a loss arising from a credit event, such as deterioration in the financial condition of a borrower, that causes an asset (including off-balance sheet transactions) to lose value or become worthless. Market Risk. Market risk is the possibility that fluctuations in interest rates, foreign exchange rates, equity prices or other market prices will change the market value of financial products, leading to a loss. Liquidity Risk. Liquidity risk is the risk that there may be difficulties in raising funds needed for settlements, as a result of the mismatching of uses of funds and sources of funds or unexpected outflows of funds, which may make it necessary to raise funds at higher rates than normal. Operational Risk. Operational risk is the possibility of losses arising from inadequate or failed internal processes, people, and systems or from external events. Conduct Risk. Conduct risk is the risk that customer protection, market soundness, fair competition, the public interest, and the SMBC Group’s stakeholders will be adversely affected by actions that violate laws, regulations, or social norms. Reputational Risk. Reputational risk is the risk of not meeting the expectations for high ethics, integrity, etc. by the stakeholders (that is, customers, shareholders, market, society, environment, employees, etc.) due to the business of the SMBC Group and the behavior of employees and other related parties, as well as of leading to impairment of the corporate value and decline in trust. Model Risk. Model risk is the risk of potential adverse consequences or financial loss resulting from misinformed decision making based on inaccurate model outputs or using the model inappropriately. Environmental and Social Risk. Environmental and social risk is the risk that environmental and social factors become risk drivers and transmit through various pathways to other risk categories, ultimately resulting in losses to the SMBC Group. This risk includes climate-related risk, nature-related risk and human rights risk. Top Risks We identify risks that threaten to significantly impact management as Top Risks. The selection of Top Risks involves comprehensive screening of risk factors, evaluation of each risk scenario’s possibility of occurrence and potential impact on management, and discussion by the Risk Management Committee and the Management Committee. Top Risks are utilized to enhance risk management by being incorporated into discussions of RAF and the formulation of business strategies and into the creation of risk scenarios for stress testing. 155 Table of Contents Stress Testing We use stress testing to analyze and comprehend the impact on our businesses of changes in economic or market conditions, in order to plan and execute forward-looking business strategies. Based on the identification of Top Risks and discussions with experts, we develop scenarios that assume severe conditions such as deep recessions or market turmoil, in order to assess our risk-taking capacity and verify whether financial soundness can be maintained under stress. In addition, when significant risk events occur during the fiscal year, we swiftly conduct stress tests to explore appropriate response measures. Beyond these assessments, we also carry out detailed stress testing for credit, market, and liquidity risks, using the results to inform and revise our risk-taking policies. We have included climate-related risk, such as natural disasters resulting from extreme weather (physical risks) and carbon-related stranded assets due to the transition to a decarbonized society (transition risks), in our Top Risks. Also, we have conducted scenario analyses to evaluate physical risks related to water disasters and declines in productivity due to rising temperatures, etc. on a global scale, as well as transition risks within the energy, power, steel, automobile, and auto-components sectors to estimate the potential impacts on our financial position. Risk Register A risk register is formulated by each business unit for the purpose of realizing more sophisticated risk governance and enhancing business units’ risk ownership. In formulating these registers, business units communicate with risk management departments to identify the risks present in their business, and these risks are reflected in business strategies after they have been evaluated and the adequacy of measures for controlling them has been verified. Key Risk Events KRE, external events that indicate the increased threat of risks, have been identified to ascertain the symptoms of the potential risks. KRE are utilized to analyze and assess how likely similar cases will occur in SMBC Group and what effects such similar cases will have on SMBC Group, and to enhance our risk management system. Risk Management Systems Based on the recognition of the importance of risk management, top management is actively involved in the risk management process, and systems are in place for verifying the effectiveness and appropriateness of this process. Specifically, the SMBC Group-wide basic policies for risk management are determined by the Management Committee before being authorized by the board of directors, and regular reports are issued to the board of directors by the Group Chief Risk Officer (“CRO”) with regard to the status of risk management based on these policies. Three lines of defense have been defined, and we have clarified related roles and responsibilities of relevant divisions. With these provisions in place, risk management systems have been established based on the characteristics of particular businesses, and measures are being put in place to strengthen and improve the effectiveness of these systems in accordance with these basic policies for risk management. Furthermore, we are strengthening SMBC Group-wide risk management systems through the Group CRO Committee and the Global CRO Committee. 156 Table of Contents Three Lines of Defense The Basel Committee on Banking Supervision’s “Corporate governance principles for banks” recommends “three lines of defense” as a framework for risk governance. Based on this framework, we have clarified the roles and responsibilities of each unit and we are taking steps to achieve more effective and stronger risk management and compliance systems. Our three lines of defense are as follows: First Line. The business units shall be risk owners concerning their operations and shall be responsible for the following roles in accordance with the basic principles provided by Second Line. • Identification and evaluation of risks encountered in the business activities • Implementation of measures for minimizing and controlling risks • Monitoring of risks and reporting within First Line and to Second Line • Creation and fostering of a sound risk culture Second Line. The risk management and compliance departments shall assume the following functions and responsibilities in order to establish the risk management and compliance systems. • Drafting and development of basic principles and frameworks concerning risk management and compliance • Oversight, monitoring, and development of training programs for First Line Third Line. Independent from First Line and Second Line, the Internal Audit Department shall assess and verify the effectiveness and appropriateness of risk management and compliance systems managed and operated by First Line and Second Line, and report these results to the audit committee and the Management Committee. The department shall provide recommendations regarding identified issues or problems. Implementation of Basel Regulation Basel III is an international agreement on minimum capital, leverage, liquidity and other requirements applicable to internationally active banks. The Basel III capital framework was implemented in Japan from March 31, 2013 pursuant to revised capital adequacy guidelines adopted by the FSA, subject to the phase-in of some requirements, as contemplated by Basel III. The Basel III framework is a continuation of Basel II, with multiple approaches to calculating capital requirements; we adopted the advanced IRB approach for measuring credit risk from March 31, 2009, and the standardized measurement approach by using the ILM for measuring operational risk from March 31, 2024. Detailed information on our capital ratios is included in “Item 4.B. Business Overview—Regulations in Japan—Regulations Regarding Capital Adequacy and Liquidity” and “Item 5.B. Liquidity and Capital Resources—Capital Management.” Credit Risk Credit risk is the risk of incurring losses from the decline or loss of the value of an asset (including off-balance sheet items) that is caused by a credit event including but not limited to the deterioration of the financial condition of a borrower. Overseas credit transactions also entail country risk, which is closely related to credit risk. Country risk is the risk of incurring losses caused by changes in political or economic conditions. Credit exposures arise primarily from lending activities such as loans and advances, acquiring investment securities, derivative transactions, and off-balance sheet transactions such as the unused portion of loan commitments. 157 Table of Contents Credit Risk Management System Credit risk is the most significant risk to which we are exposed. The purpose of credit risk management is to keep the credit risk exposure to a permissible level relative to capital, to maintain the quality of assets and to ensure returns commensurate with risk. At the SMBC Group, the Group CRO formulates credit risk management policies each year on the basis of SMBC Group-wide basic policies for risk management. The Credit & Investment Planning Department, responsible for the comprehensive management of credit risk, drafts and administers credit risk regulations including the SMBC Group credit policies, manages non-performing loans (“NPLs”), and performs other aspects of credit portfolio management. Also, the Credit Risk Committee deliberates on matters related to SMBC Group-wide credit portfolios. SMBC Group companies follow the fundamental principles established by us to assess and manage credit risk. Each of SMBC Group companies manages credit risk according to the nature of its business, and assesses and manages the credit risks of individual loans and credit portfolios quantitatively, using consistent standards. At SMBC, our significant banking subsidiary, the Credit & Investment Planning Department within the Risk Management Unit is responsible for the comprehensive management of credit risk. This department drafts and administers credit policies, the internal rating system, credit authority guidelines and credit application guidelines, and manages NPLs, including impaired loans, and performs other aspects of credit portfolio management. The department also cooperates with the Corporate Risk Management Department and the Risk Management Information Department in quantifying credit risk (risk capital and risk-weighted assets) and controls SMBC’s entire credit risk. Further, the Credit & Investment Planning Department aims to stabilize the credit portfolio and manage the risk through credit derivatives, loan asset sales and other instruments. The credit departments of SMBC, in cooperation with branches, conduct credit risk management for loans and manage portfolios. The credit limits they use are based on the baseline amounts that the Credit & Investment Planning Department establishes for each grading category, with particular attention paid to evaluating and managing customers or loans perceived to have particularly high credit risk. The Corporate Research Department engages in research on industries and analyzes the business and financial conditions of borrower enterprises to detect early signs of problems or growth potential. The Credit Administration Department is responsible for handling NPLs of borrowers classified as potentially bankrupt or lower, and formulates plans for workouts, including write-offs, and corporate rehabilitation. The department closely liaises with SMBC Servicer Co., Ltd., an SMBC Group company, which engages in related services to efficiently reduce the amount of NPLs, including through the sales of loans. The Internal Audit Unit of SMBC, operating independently of the business units, audits asset quality, accuracy of grading and state of credit risk management, and reports the results directly to the board of directors, the Management Committee and audit & supervisory committee. SMBC has established the Credit Risk Committee to undertake control of credit risk and to ensure the overall soundness of the loan operations. Credit Risk Management Methods To effectively manage the risk involved in individual loans as well as the credit portfolio as a whole, we first acknowledge that every loan entails credit risk, assess the credit risk posed by each borrower and loan using an internal rating system, and quantify that risk for control purposes. Credit Risk Evaluation At SMBC, the Credit & Investment Planning Department manages an internal rating system for each asset control category set according to portfolio characteristics. For example, credits to commercial and industrial 158 Table of Contents (“C&I”) companies, individuals for business purposes (domestic only), sovereigns, public sector entities, and financial institutions are assigned an “obligor grade,” which indicates the borrower’s creditworthiness, and/or “facility grade,” and indicates the collectability of assets taking into account the transaction conditions such as guarantee/collateral, and tenor. The business units determine an obligor grade by first assigning a financial grade using a financial strength grading model and data obtained from the obligor’s financial statements, including net worth and cash flows. The financial grade is then adjusted taking into account the actual state of the obligor’s financial position and qualitative factors to derive the obligor grade. The qualitative factors mainly include the expected future cash flows taking into account factors such as historical loss information, the appropriateness of the borrower’s business plan or operational improvement plan, the status of progress of its plan, and the overall support from financial institutions. In the event that the borrower is domiciled overseas, internal ratings for credit are made after taking into consideration the country rank, which represents an assessment of the credit quality of each country based on its political and economic situation, as well as its current account balance and external debt. Obligor grades and facility grades are reviewed once a year and as otherwise necessary, such as when there are changes in the credit situation. Our subsidiaries carry out credit risk evaluations in line with SMBC. There are also grading systems for loans to individuals such as housing loans and structured finance including project finance, where the repayment source is limited to the cash flows generated by a particular business or asset. For example, the obligor grade of housing loans is determined taking into account various relevant factors such as proportion of the repayment to revenue, proportion of down payment to the value and past due information. The Credit & Investment Planning Department of SMBC centrally manages the internal rating systems, and designs, operates, supervises and validates the grading models. It validates the grading models (including statistical validation) of main assets following the procedure manual once a year to ensure their effectiveness and suitability. Quantification of Credit Risk At SMBC, credit risk quantification refers to the process of estimating the degree of credit risk of a portfolio or individual loan taking into account not just the obligor’s probability of default (“PD”), but also the concentration of risk in a specific customer or industry and the loss impact of fluctuations in the value of collateral, such as real estate and securities. Specifically, the PD by grade, loss given default (“LGD”), credit quality correlation among obligors, and other parameter values are estimated using the historical data of obligors and facilities stored in a database to calculate the credit risk. Then, based on these parameters, SMBC runs a simulation of simultaneous default using the Monte Carlo Simulation to calculate SMBC’s maximum loss exposure to the estimated amount of the maximum losses that may be incurred. Based on these quantitative results, SMBC allocates risk capital. Risk quantification is also executed for purposes such as to determine the portfolio’s risk concentration or to simulate economic movements (stress tests), and the results are used for making optimal decisions across the whole range of business operations, including formulating business plans and providing a standard against which individual credit applications are assessed. Credit Assessment At SMBC, the credit assessment of corporate loans involves a variety of financial analyses, including cash flows, to predict an enterprise’s capability of loan repayment and its growth prospects. These quantitative measures, when combined with qualitative analyses of industrial trends, the enterprise’s research and development capabilities, the competitiveness of its products or services, and its management caliber, result in a comprehensive credit assessment. The loan application is analyzed in terms of the intended utilization of the funds and the repayment schedule. In the assessment of housing loans for individuals, SMBC employs a credit 159 Table of Contents assessment model based on credit data amassed and analyzed by SMBC over many years, taking into account various relevant factors including proportion of the repayment to revenue, proportion of down payment to the value and past due information. Credit Monitoring At SMBC, in addition to analyzing loans at the application stage, the Credit Monitoring System is utilized to reassess obligor grades, and review credit policies for each obligor so that problems can be detected at an early stage, and quick and effective action can be taken. The system includes annual monitoring that is carried out each time the financial results of the obligor enterprise are obtained, as well as ad-hoc monitoring that is performed each time credit conditions change. Credit Portfolio Management Risk-Taking Within the Scope of Capital To keep the credit risk exposure to a permissible level relative to capital, the Corporate Risk Management Department of the SMBC Group sets a credit risk capital limit for internal control purposes. The Corporate Risk Management Department conducts monthly monitoring to make sure that these limits are being followed. Controlling Concentration Risk As our equity capital may be materially impaired in the event that the credit concentration risk becomes apparent, the Credit & Investment Planning Department of the SMBC Group therefore takes measures to manage concentration risks, such as introducing large exposure limits and conducting intensive loan reviews for obligors with large exposures, with an increased focus on industrial sectors with an excessive concentration of credit risk. Further, to manage country risk, SMBC’s Strategic Planning Department of the Global Banking Unit has credit limit guidelines based on each country’s creditworthiness. Toward Active Portfolio Management The Credit & Investment Planning Department makes use of financial instruments to proactively and flexibly manage SMBC’s portfolio to stabilize credit risk. Market Risk and Liquidity Risk Market risk is the possibility that fluctuations in interest rates, foreign exchange rates, equity prices or other market prices will change the market value of financial products, leading to a loss. The purpose of market risk management is to keep the market risk exposure to a permissible level relative to capital. Liquidity risk is defined as the uncertainty around our ability to meet our debt obligations without incurring unacceptably large losses. An example of such risk is the possible inability to meet our current and future cash flow/collateral needs, both expected and unexpected. In such cases, we may be required to raise funds at less than favorable rates or be unable to raise sufficient funds for settlement. The purpose of liquidity risk management is to ensure that we are in a position to address our liquidity obligations through monitoring the liquidity gap between assets and liabilities, and by maintaining highly liquid supplementary funding resources. On the basis of the SMBC Group-wide basic policies for risk management, we have a quantitative management process to control market and liquidity risks on an SMBC Group-wide basis. We at least annually review and identify which companies primarily carry the market and liquidity risks within us. We set permissible level limits of risk for each identified company in consideration of those companies’ business plans. We ensure that each identified company establishes a risk management system that is appropriate to the risks it faces, and has built-in transparent risk management processes which clearly separate front, middle and back office operations, and establishes a control system of mutual checks and balances. 160 Table of Contents Framework for Market and Liquidity Risk Management The board of directors authorizes important matters related to the management of market and liquidity risks, such as the basic policies and risk appetite, which are decided by the Management Committee. The Corporate Risk Management Department and the Risk Management Information Department, which are independent from the business units that directly handle market transactions, manage market and liquidity risks in an integrated manner. The Corporate Risk Management Department and the Risk Management Information Department not only monitor the current risk situations but also report regularly to the Management Committee and the board of directors. Additionally, the Asset Liability Management (“ALM”) Committee, which is generally held on a monthly basis, or the ALM Management Committee, which is generally held four times a year, meets to examine reports on the state of market and liquidity risk management and to discuss our ALM operation policies. Under our internal audit system, internal audits are also periodically performed to verify that the risk management framework is functioning properly. Market Risk Management Methods Market Risk Management Process We manage market risk capital derived from trading activities and non-trading activities, including equity holding investments and other transactions in the RAF by taking into account our shareholders’ equity and other principal indicators of our financial position. We also establish an upper limit on value at risk (“VaR”) and losses as Risk Appetite Measures. Our market risk can be divided into various factors: interest rates, foreign exchange rates, equity prices and option risks. We manage each of these risks by employing the VaR method as well as supplemental indicators suitable for managing each risk, such as the basis point value (“BPV”). VaR is the largest predicted loss that is possible given a fixed confidence interval. For example, our VaR indicates the largest loss that is possible for a holding period of one day and a confidence interval of 99.0%. BPV is the amount of change in assessed value as a result of a one-basis-point (0.01%) movement in interest rates. Market Risk Measurement Techniques—Value at Risk The principal SMBC Group companies’ internal VaR model makes use of historical data to prepare scenarios for market fluctuations and, by conducting simulations of gains and losses on a net position basis, the model estimates the potential losses that may occur. The VaR calculation method we employ for both trading and non-trading activities is based mainly on the following: • the historical simulation method; • a one-sided confidence interval of 99.0%; • a one-day holding period (a one-year holding period for the equity holding investment portfolio); and • an observation period of four years (ten years for the equity holding investment portfolio). This method is reviewed periodically and refined, if necessary. The relationship between the VaR calculated by the model and the hypothetical profit and loss data is back-tested periodically. There were no significant excess losses that would raise doubts on the validity of the model in the back-testing results, including from the trading accounts. The back-testing results are reviewed by management, which also monitors the ongoing suitability of the VaR model. 161 Table of Contents For products and positions where the historical simulation method is not applied, risk amounts are measured using reasonable and conservative methods and are also added to the risk amounts calculated using the historical simulation method. During the fiscal year ended March 31, 2026, the calculation methodology was improved in order to better reflect our group’s risk profile. Trading Activities Most of our trading activity is undertaken to accommodate the needs of commercial banking customers for interest rate and foreign exchange transactions. However, some interest rate and foreign exchange rate positions are taken using derivatives and other on-balance sheet instruments with the objective of earning a profit from favorable movements in market rates. The overall objective of managing market risk is to avoid unexpected losses due to changes in market prices. Non-Trading Activities The market risk for non-trading activity arises principally from the interest rate risk of our ALM operations, or banking, including loans, debt investment securities, deposits, and long- and short-term borrowings, and from the equity risk of our equity holding investments. ALM operations are regularly reviewed and discussed by the ALM Committee so as not to be heavily exposed to market fluctuations. Equity holding investment is a portfolio that consists principally of publicly traded Japanese equities. This portfolio, like that of other financial institutions in Japan, has historically included shares of our customers. VaR Summary for the Fiscal Years Ended March 31, 2026 and 2025 The following tables show our VaR by risk category and these figures are prepared based on the internal reporting provided to management. Our material market risk exposure categories consist of interest rate risk, foreign exchange risk, equities and commodities risk and others. The section headed “VaR for Trading Activity” shows our VaR for instruments entered into for trading purposes and the VaR model for the trading book includes principal consolidated subsidiaries. The section headed “VaR for Non-Trading Activity” shows our VaR for instruments entered into for purposes other than trading purposes. “Equity Holding Investment” in the “VaR for Non-Trading Activity” section is a portfolio that consists principally of publicly traded Japanese equities. This portfolio, like that of other financial institutions in Japan, has historically included shares of our customers. (a) VaR for Trading Activity Interest rate risk Foreign exchange risk Equities and commodities risk Others Total(1) (2) (In billions) For the fiscal year ended March 31, 2026: SMBC Consolidated Maximum ¥ 12.3 ¥ 8.5 ¥ 2.5 ¥ 2.4 ¥ 7.7 Minimum 5.4 4.2 0.2 0.8 4.3 Daily average 9.5 6.5 0.6 1.4 5.7 At March 31, 2026 10.0 7.3 0.3 1.4 4.7 SMFG Consolidated Maximum ¥ 13.5 ¥ 9.5 ¥ 6.1 ¥ 2.4 ¥ 12.2 Minimum 6.5 5.2 1.1 0.8 7.6 Daily average 10.8 7.5 1.9 1.4 9.0 At March 31, 2026 11.3 8.2 1.3 1.4 7.9 162 Table of Contents Interest rate risk Foreign exchange risk Equities and commodities risk Others Total(1) (In billions) For the fiscal year ended March 31, 2025: SMBC Consolidated Maximum ¥ 7.2 ¥ 6.7 ¥ 2.4 ¥ 21.5 ¥ 26.9 Minimum 4.4 3.2 0.1 12.4 17.8 Daily average 6.0 5.1 0.7 17.0 22.6 At March 31, 2025 5.7 5.4 0.2 19.1 23.9 SMFG Consolidated Maximum ¥ 24.1 ¥ 8.4 ¥ 22.3 ¥ 21.5 ¥ 61.8 Minimum 17.8 4.5 2.9 12.4 38.4 Daily average 19.5 6.5 5.7 17.0 42.1 At March 31, 2025 18.3 7.1 3.0 19.1 40.8 (1) Total for “Maximum,” “Minimum,” and “Daily average” represent the maximum, minimum and daily average of the total of the trading book. (2) As a result of an improvement of the methodology, the reported VaR figures are not directly comparable with those of prior periods. (b) VaR for Non-Trading Activity (i) Banking Interest rate risk Foreign exchange risk Equities and commodities risk Others Total(1) (2) (In billions) For the fiscal year ended March 31, 2026: SMBC Consolidated Maximum ¥ 104.7 ¥ 4.1 ¥ 34.6 ¥ 0.0 ¥ 124.6 Minimum 61.6 0.0 19.0 0.0 59.1 Daily average 87.1 0.2 25.8 0.0 93.0 At March 31, 2026 81.3 0.1 24.3 0.0 87.7 SMFG Consolidated Maximum ¥ 106.1 ¥ 4.1 ¥ 34.6 ¥ 0.0 ¥ 126.1 Minimum 62.7 0.0 19.0 0.0 60.2 Daily average 88.4 0.2 25.8 0.0 94.3 At March 31, 2026 82.9 0.1 24.3 0.0 89.3 Interest rate risk Foreign exchange risk Equities and commodities risk Others Total(1) (In billions) For the fiscal year ended March 31, 2025: SMBC Consolidated Maximum ¥ 80.6 ¥ 0.2 ¥ 35.6 ¥ 0.0 ¥ 94.7 Minimum 56.4 0.0 12.6 0.0 58.2 Daily average 66.9 0.0 28.0 0.0 73.7 At March 31, 2025 61.3 0.1 32.6 0.0 62.5 SMFG Consolidated Maximum ¥ 82.1 ¥ 0.2 ¥ 35.6 ¥ 0.0 ¥ 96.3 Minimum 57.6 0.0 12.6 0.0 59.5 Daily average 68.2 0.0 28.0 0.0 75.0 At March 31, 2025 62.5 0.1 32.6 0.0 63.6 (1) Total for “Maximum,” “Minimum,” and “Daily average” represent the maximum, minimum and daily average of the total of the banking book. 163 Table of Contents (2) As a result of an improvement of the methodology, the reported VaR figures are not directly comparable with those of prior periods. (ii) Equity Holding Investment Equities risk (In billions) For the fiscal year ended March 31, 2026: SMBC Consolidated Maximum ¥ 1,272.5 Minimum 832.8 Daily average 1,105.8 At March 31, 2026 1,012.6 SMFG Consolidated Maximum ¥ 1,621.0 Minimum 1,147.9 Daily average 1,455.4 At March 31, 2026 1,337.5 Equities risk (In billions) For the fiscal year ended March 31, 2025: SMBC Consolidated Maximum ¥ 1,258.2 Minimum 937.3 Daily average 1,134.5 At March 31, 2025 960.3 SMFG Consolidated Maximum ¥ 1,576.8 Minimum 1,233.7 Daily average 1,456.7 At March 31, 2025 1,323.4 Stress Tests The market occasionally undergoes extreme fluctuations that exceed projections. Therefore, to manage market risk, it is important to run simulations of situations that may occur only once in many years, or so-called stress tests. To prepare for unexpected market swings, we perform stress tests on a monthly basis based on various scenarios. The limitations of the VaR methodology include the following: • The use of historical data as a proxy for estimating future events may underestimate the probability of extreme market movements. Past market movement is not necessarily a good indicator of future events; • The use of a holding period assumes that all positions can be liquidated or hedged in that period of time. This assumption does not fully capture the market risk arising during periods of illiquidity, when liquidation or hedging in that period of time may not be possible; • The use of a confidence level neither takes account of, nor makes any statement about, any losses that might occur beyond this level of confidence; and • VaR does not capture all of the complex effects of the risk factors on the value of positions and portfolios and could underestimate potential losses. 164 Table of Contents Additional Information for Certain Risks (a) Interest Rate Risk To supplement the above limitations of VaR methodologies, the SMBC Group adopts various indices to measure and monitor the sensitivity of interest rates, including delta, gamma and vega risks. The SMBC Group considers BPV as one of the most significant indices to manage interest rate risk. BPV is the amount of change in the value to the banking and trading book as a result of a one-basis-point (0.01%) movement in interest rates. The principal SMBC Group companies use BPV to monitor interest rate risk, not only on a net basis, but also by term to prevent the concentration of interest rate risk in a specific period. In addition, as previously addressed, the SMBC Group enhances the risk management methods of VaR and BPV by using them in combination with back-testing and stress tests. Interest rate risk substantially changes depending on the method used for recognizing the expected maturity dates of demand deposits that can be withdrawn at any time or the method used for estimating the timing of cancellation prior to maturity of time deposits and consumer housing loans. At SMBC, the maturity of demand deposits that are expected to be left with SMBC for a prolonged period is regarded to be, at the longest ten years, and the cancellation prior to maturity of time deposits and consumer housing loans is estimated based on historical data. Based on the standards for interest rate risk in the banking book issued by the BCBS in April 2016, the FSA revised the related regulatory guidelines pertaining to monitoring of interest rate risks in the banking book in December 2017. The revised disclosure requirements with respect to the changes in economic value of equity (“ΔEVE”) and changes in net interest income (“ΔNII”) in the banking book as a result of interest rate shocks have been applied from March 31, 2018. The tables below present ΔEVE and ΔNII of SMBC and SMFG on a consolidated basis at March 31, 2026 and 2025, respectively. ΔEVE is defined as a decline in economic value as a result of an interest rate shock. It is calculated by multiplying the interest rate sensitivity (excluding credit spread) and interest rate change. The FSA implements a “materiality test” to identify banks taking excessive interest rate risks. Under the materiality test, the FSA monitors the ratio of ΔEVE to Tier 1 capital based on a set of prescribed interest rate shock scenarios. The threshold applied by the FSA is 15% and the ratios for SMBC on a consolidated basis at March 31, 2026 and 2025 were 5.0% and 3.0%, respectively, and those for SMFG on a consolidated basis at March 31, 2026 and 2025 were 4.6% and 2.9%, respectively. ΔNII is defined as a decline in interest income over a rolling 12-month period as a result of an interest rate shock. It is calculated assuming a constant balance sheet over a forward-looking rolling 12-month period. At March 31, 2026 At March 31, 2025 ΔEVE ΔNII ΔEVE ΔNII (In billions) SMBC Consolidated Parallel shock up ¥ 680.6 ¥ (295.8 ) ¥ 378.3 ¥ (251.5 ) Parallel shock down 9.1 370.9 107.4 378.6 Steepener shock 188.0 — 19.2 — Flattener shock 165.8 — 281.4 — Short rate shock up 406.2 — 342.4 — Short rate shock down 13.8 — 11.5 — Maximum 680.6 370.9 378.3 378.6 At March 31, 2026 At March 31, 2025 (In billions) Tier 1 Capital ¥ 13,497.5 ¥ 12,410.7 165 Table of Contents At March 31, 2026 At March 31, 2025 ΔEVE ΔNII ΔEVE ΔNII (In billions) SMFG Consolidated Parallel shock up ¥ 680.6 ¥ (295.8 ) ¥ 378.3 ¥ (251.5 ) Parallel shock down 9.1 370.9 107.4 378.6 Steepener shock 188.0 — 19.2 — Flattener shock 165.8 — 281.4 — Short rate shock up 406.2 — 342.4 — Short rate shock down 13.8 — 11.5 — Maximum 680.6 370.9 378.3 378.6 At March 31, 2026 At March 31, 2025 (In billions) Tier 1 Capital ¥ 14,655.9 ¥ 13,258.8 Note: ΔEVE and ΔNII are calculated by currency and the results are aggregated across the various currencies. For ΔNII, only Japanese yen and U.S. dollars are included in the calculation. These are the material currencies where interest rate sensitive assets and liabilities are more than 5% of total assets and liabilities. (b) Foreign Exchange Risk The principal SMBC Group companies set risk limits for each currency to manage the concentration of the foreign currency position. The foreign exchange risk is immaterial as shown above in VaR by risk category. (c) Equity Holding Investment Risk We establish limits on allowable risk for equity holding investments, and monitor the observance of those limits to keep equity price fluctuation risk within acceptable parameters. We have been reducing our equity holding investments, and the balance is within a permitted level, which is less than 100% of our consolidated Tier 1 Capital. See “Item 4.B. Business Overview—Regulations in Japan—Regulations for Stabilizing the Financial System—Restriction on Aggregate Shareholdings by a Bank.” 166 Table of Contents Liquidity Risk Management Methods We regard liquidity risk as one of the major risks. Our liquidity risk management is based on a framework consisting of setting Risk Appetite Measures and establishing contingency plans. The Risk Appetite Measures are measures for selecting the types and levels of risk that we are willing to take on or tolerate. As the level of liquidity risk is evaluated based on cash flow and balance sheet conditions, Risk Appetite Measures have been set for both of these areas. These measures include the Liquidity Coverage Ratio, a liquidity regulation, as well as a measure of the periods for which it will be possible to maintain funding levels even under stress due to deposit outflows or other factors, and the ratio which shows how much the stable funding covers the funding for loans and other assets, etc. The tolerated levels of risk are set based on account funding status, cash management planning, economic environments and other factors, and measures are monitored on a daily or monthly basis in order to limit reliance on short-term funding and appropriately manage liquidity. As a framework to complement the Risk Appetite Measures, upper limits are set in place on both an SMBC Group company basis and individual branch bases with regard to funding gaps, which are defined as a maturity mismatch between the source of funds and use of funds. Furthermore, contingency plans are established in preparation for emergency situations. These plans contain information on chains of command and lines of reporting as well as detailed action plans depending on the existing situation (i.e., normal, concerned, or crisis). Meanwhile, SMBC carries out quantitative management of alert indications based on early warning indicators established to assist the bank in promptly and systematically detecting liquidity risks. Operational Risk Operational risk is the possibility of losses arising from inadequate or failed internal processes, people and systems or from external events. Specifically, it covers processing risk, system risk, legal risk, human resources risk, tangible asset risk, third party risk and data risk. We have established regulations on operational risk management to set out the basic rules to be followed across the SMBC Group. Under this framework, we are working to enhance operational risk management across the SMBC Group by establishing an effective framework for identifying, assessing, controlling, and monitoring significant risk factors. In addition, from an operational resilience perspective, we are strengthening arrangements for contingency and business continuity plans. Processing risk is the risk of losses arising from the failure of directors and employees to perform administrative duties in accordance with administrative rules and procedures, or from accidents or misconduct. We have clarified the divisions responsible for the oversight functions for processing risk management, and we are working to raise the level of sophistication of our management of processing risk across the whole SMBC Group by establishing systems for managing the processing risks faced by SMBC Group companies, ensuring in-office inspection, minimizing losses in the event of processing risk materialization by drafting exhaustive contingency plans, and carrying out thorough quantification of the risk under management as basic principles. System risk is the risk arising from nonconformity to the business strategy, inappropriate technologies applied, changes to the development plan and delay in development when building an information system, and the risk of loss incurred due to the breakdown including those caused by cyber attack (unauthorized alteration, destruction, duplication and leakage of the information). We have set the following as basic principles: recognizing information systems as an essential part of management strategy taking into account advances in IT, minimizing system risk by drafting regulations and specific management standards, (including a security policy) and establishing contingency plans to minimize losses if a system risk materializes. 167 Table of Contents Conduct Risk Conduct risk is the risk that customer protection, market soundness, fair competition, the public interest, and the SMBC Group’s stakeholders will be adversely affected by actions that violate laws, regulations, or social norms. SMBC Group’s fundamental stance is that its business is not to negatively affect customers, market integrity, effective competition, public interests, and stakeholders. Efforts are being made to improve group-wide conduct risk management. Focuses of these efforts include preemptively identifying phenomena with the potential to cause significant deterioration in the trust of the SMBC Group and preventing the materialization of serious management risks by being keenly responsive to environmental changes. Reputational Risk Reputational risk is the risk of not meeting the expectations for high ethics, integrity, etc. by the stakeholders (that is, customers, shareholders, market, society, environment, employees, etc.) due to the business of the SMBC Group and the behavior of employees and other related parties, as well as of leading to impairment of the corporate value and decline in trust. We have prepared reputational risk management regulations to define the basic rules to be observed across the SMBC Group. Under these regulations, we are working to clarify our operating system of reputational risk, systems, methods and rules of reputational risk management and realize a highly efficient reputational risk management. Model Risk Model risk is the risk of potential adverse consequences or financial loss resulting from misinformed decision making based on inaccurate model outputs or using the model inappropriately. The SMBC Group has established a system for managing model risk based on the group-wide basic policies for risk management. The SMBC Group is working to improve model risk management across the SMBC Group by adhering to basic principles such as performing management based on a risk-based approach, evaluating model risk and carrying out quantitative management. Environmental and Social Risk Environmental and social risk is the risk that environmental and social factors become risk drivers and transmit through various pathways to each risk category such as credit risk and operational risk, ultimately resulting in losses to the SMBC Group. This risk includes climate-related risk, nature-related risk and human rights risk. We have developed environmental and social risk management policies to define the basic rules to be complied across the SMBC Group. Under these regulations, we identify the locations of environmental and social risk to be managed, and then to conduct management in an appropriate manner according to the characteristics of environmental and social risk.