O-Bank Co Ltd

**Article 6 Governance Structure and Three Lines of Defense**

1. According to the Bank's \"Risk Management Policy\", the Board of Directors is the highest authority for risk management of the Bank, responsible for monitoring the Bank's climate risk exposure and disclosure, and is responsible for ultimate management. The risk management mechanism, risk appetite, strategy, and business plan approved by the board of directors shall take climate risk into consideration, including identifying and evaluating climate-related risks and opportunities, recognizing the possible impact of climate risk on the Bank's finances, and taking relevant international The goals of the agreement and the time frame required by the national policy are taken into consideration.

2. The Sustainability Committee under the Board of Directors is responsible for reviewing climate change development strategies, supervising annual plans and the achievement of various goals.

3. The ESG Development Working Committee under the chairman is the coordinating and promoting unit of the Bank's climate risk management and assists the Bank in introducing climate risk management.

4. In order to implement climate risk management, the Risk Management Committee is responsible for reviewing climate risk-related issues, supervising and reviewing the climate risk management mechanism, so as to improve the Bank's climate risk management system.

5. The Risk Management Division shall establish a climate risk management system and monitoring indicators to ensure the effectiveness of implementation and the resilience of the bank to face different climate scenarios, and allocate sufficient manpower to effectively implement the management process.

6. According to the three lines of defense structure of the bank's internal control, each should be responsible for climate risk management.

(1) The first line of defense is to identify and assess climate risks when handling related businesses, especially customers and asset positions in industries with high climate risks.

(2) The risk management unit of the second line of defense should effectively monitor the implementation of climate risk management by the first line of defense; the legal compliance unit should ensure that all units operate in compliance with laws and regulations.

(3) The third line of defense should evaluate the effectiveness of climate risk monitoring conducted by the first and second lines of defense, and provide suggestions for improvement in a timely manner.

7. Risk management units should report climate risk-related information to the board of directors and the risk management committee at least annually, so that the board of directors and senior management can take it into consideration when formulating strategic planning and monitoring business. In the process of monitoring climate risks, if major abnormalities or special circumstances are found, corresponding measures should be taken immediately in accordance with internal regulations and reported to the board of directors.

Article 6 Management of progress through engagement (1) O-Bank's Treasury Department and Financial Business Division are responsible for engaging with investees and corporate borrowers, respectively. Early each year they submit to O-Bank's ESG Development Working Committee annual plans for engagement targets, engagement topics (including the types of topics set out above in Article 4) and quantitative engagement goals, and the two aforementioned departments report at end of each year to the ESG Development Working Committee on engagement results. In addition, engagement-related documentation shall be retained for future reference (the retention period shall be five years) to facilitate management and tracking of ongoing progress (e.g. plans for post-engagement action, and tracking of goal achievement) and to review engagement results, to provide a basis for adjustments to ongoing engagements and business dealings. (2) If an engagement target's post-engagement corrective actions fail to meet engagement goals, O-Bank shall continue to dialogue with the engagement target's management team, emphasize O-Bank's position regarding engagement content, and actively demand improvement. If the engagement target is still unable to meet expectations, measures to be taken by O-Bank may include, without limitation: reduction or elimination of its investment position; and implementation of the financing management and control measures set out in the \"Guidelines for Promoting Sustainability of Corporate Loans.\"

I chair the Corporate Social Responsibility Committee that we formed in 2015. O-Bank's President serves as the committee's vice chairperson, and the rest of the committee's membership is composed of the chiefs of O-Bank's related units. Since the founding of this committee, we have begun to fulfill our corporate social responsibilities in a more systematic manner, steadily advancing commitments in the six dimensions of corporate governance, employee care, customer relationships, environmental protection, social engagement, and green finance. In recent years, in response to the issue of climate change and the issue of net zero, we have even more actively incorporated a sustainability-oriented mindset into the running of our business. For example, we have signed on to the Equator Principles, carried out our first green bond issue, become a TCFD Supporter, incorporated ESG risk factors into the investment decision-making process and the review process for financing decisions, joined the Partnership for Carbon Accounting Financials (PCAF), and carried out carbon emission inventories for our investment and financing portfolios, thus moving steadily toward the achievement of green finance, in hopes of using the power of finance to spur sustainable development in all different industries. [...] To fulfill our corporate social responsibility, O-Bank in January 2015 established the "Corporate Social Responsibility Committee." Responsible for setting CSR-related systems and policies, and for implementing plans, the committee holds regular meetings to track the execution of each project, and each year it is responsible for reporting to the Board of Directors on each unit's annual CSR plans and targets. O-Bank's Corporate Social Responsibility Committee reviews major topics and publishes a sustainability report each year to update readers on our recent achievements. Once the report has been approved by the Corporate Social Responsibility Committee and published, it is reported to the Board of Directors in order to facilitate communication with all stakeholders so that the latter can better understand O-Bank's CSR activities. [...] To ensure effective implementation of sustainability measures, O-Bank's President, all members of senior management, and all units each year set corporate social responsibility key performance indicators (CSR KPIs) which, after discussion by the Corporate Social Responsibility Committee, are submitted to the Board of Directors for approval. The President's CSR KPIs include indicators for the ratio of the company's reliance on renewable energy, green procurement ratio, promotion of climate-related strategies and measures, and achievement of ESG-related portfolio targets. The CSR KPIs for members of senior management include success in increasing the share of financing provided to environmentally- and socially-friendly enterprises, success in decreasing the share of financing provided to firms in carbon-intensive industries, success in increasing share of holdings of assets with excellent ESG performance, completion of climate scenario analyses and stress tests, success in decreasing operating CO2 emissions, and success in increasing the coverage of portfolio carbon emission inventories. The idea is to take a top-to-bottom approach in promoting CSR measures in order to achieve sustainable business practices. [...] In addition to setting CSR KPIs each year, O-Bank also incorporates CSR KPIs into employees' performance reviews. CSR KPIs account for 5~10% of the total score in each person's performance review, and a performance review score will affect an employee's performance bonus. The purpose of this measure is to strengthen the linkage between sustainability performance and employee compensation. CSR KPIs are also factored into performance evaluations for the O-Bank President and all members of senior management. Performance scores in such areas as CSR, legal compliance, internal control, risk control (including corporate governance and ethical management), and other non-financial indicators account for no less than 30% of a person's total performance evaluation score, and performance evaluation results are linked to short-term variable bonuses in order to encourage the O-Bank President and members of senior management to achieve CSR goals."
"The Risk Management Committee deliberates upon climate-related issues. This Committee is chaired by the Bank's Chairperson, and its members include two directors (directors Kenneth C.M. Lo and Chih-Ming Chien), the Bank's President, and the heads of the Bank's various divisions. The Committee reports once each year to the Board of Directors on measures it has taken to manage climate-related risks. [...] O-Bank each year compiles and analyzes statistics on the carbon levy expenses of investee companies and financing recipients, and periodically reports the results of its analyses to the Risk Management Committee in order to observe and monitor the carbon emissions of investee companies and financing recipients, and to appropriately avoid or control the sectors that are exposed to high transition risks.

## Article 3: Management Mechanism

The Bank should carefully evaluate any trade associations and non-profit organizations it participates in and sponsors. Evaluations should include, but are not limited to: the purpose of the association or organization, its advocacy principles, and its actual operations, to determine if they align with the Bank's corporate social responsibility principles and are consistent with the Bank's policies. O-Bank will not sponsor associations or organizations that deny climate change. When making donations, the value of the donation shall be approved according to the Bank's \"External Donation Review Procedures\" prior to proceeding with the donation.

Lobbying or advocacy activities that the Bank intends to participate in, as well as trade associations the Bank intends to join, must be evaluated according to the governance framework and management processes below. This is to ensure that the principles of the lobbying or advocacy activities and the industry associations the Bank joins align with the Bank's values and that their climate change policies are aligned with the Paris Agreement.

Lobbying or Advocacy Activities: The Bank commits not to engage in lobbying activities that against climate regulations aimed at mitigating climate change. For sustainability-related lobbying or advocacy activities, the Bank's Corporate Sustainability and Communications Division will, based on the nature of the activities, convene the Bank's highest supervisory officers relevant to the lobbying or advocacy topics to review the impact of these topics on the company, the environment, and society. The activities will then be submitted for approval by the CEO and the Chairperson.

Trade Associations: Each relevant organizations will evaluate the need to join related trade associations based on business needs, and this decision must be approved by the highest supervisory officer of the organization. The Bank's representatives participating in trade associations must continuously monitor and review whether the association's stance on climate change issues is aligned with the Paris Agreement.

When the climate change policy stance of lobbying or advocacy activities and trade associations is inconsistent with the Bank's public commitment to the Paris Agreement, the Bank will engage through its appointed representatives. This is to ensure that the trade associations or non-profit organizations the Bank participates in genuinely adhere to the climate policies and goals of the Paris Agreement.

## Article 4: Information Disclosure

The Bank's Sustainability Report will regularly disclose information on the Bank's participation in policy lobbying or advocacy activities and related activities as a member of trade associations, including the organizations involved, the content of the activities, the stance on climate change, and the value of donations.

**Article 6 Governance Structure and Three Lines of Defense**

1. According to the Bank's \"Risk Management Policy\", the Board of Directors is the highest authority for risk management of the Bank, responsible for monitoring the Bank's climate risk exposure and disclosure, and is responsible for ultimate management. The risk management mechanism, risk appetite, strategy, and business plan approved by the board of directors shall take climate risk into consideration, including identifying and evaluating climate-related risks and opportunities, recognizing the possible impact of climate risk on the Bank's finances, and taking relevant international The goals of the agreement and the time frame required by the national policy are taken into consideration.

2. The Sustainability Committee under the Board of Directors is responsible for reviewing climate change development strategies, supervising annual plans and the achievement of various goals.

3. The ESG Development Working Committee under the chairman is the coordinating and promoting unit of the Bank's climate risk management and assists the Bank in introducing climate risk management.

4. In order to implement climate risk management, the Risk Management Committee is responsible for reviewing climate risk-related issues, supervising and reviewing the climate risk management mechanism, so as to improve the Bank's climate risk management system.

5. The Risk Management Division shall establish a climate risk management system and monitoring indicators to ensure the effectiveness of implementation and the resilience of the bank to face different climate scenarios, and allocate sufficient manpower to effectively implement the management process.

6. According to the three lines of defense structure of the bank's internal control, each should be responsible for climate risk management.

(1) The first line of defense is to identify and assess climate risks when handling related businesses, especially customers and asset positions in industries with high climate risks.

(2) The risk management unit of the second line of defense should effectively monitor the implementation of climate risk management by the first line of defense; the legal compliance unit should ensure that all units operate in compliance with laws and regulations.

(3) The third line of defense should evaluate the effectiveness of climate risk monitoring conducted by the first and second lines of defense, and provide suggestions for improvement in a timely manner.

7. Risk management units should report climate risk-related information to the board of directors and the risk management committee at least annually, so that the board of directors and senior management can take it into consideration when formulating strategic planning and monitoring business. In the process of monitoring climate risks, if major abnormalities or special circumstances are found, corresponding measures should be taken immediately in accordance with internal regulations and reported to the board of directors.