To improve the abilities and performance of the group's employees in AML/CFT, categories of AML/CFT education and training courses organized by FFHC, First Bank, First Securities, First Securities Investment Trust, and AMC in 2024 are as follows:

First Bank began implementing the centralized suspicious transaction report (STR) project to effectively monitor suspicious transactions and implement reporting operations. The alerts produced in the SAR module of the AML system are now directed to the dedicated unit of the head office for investigation, identification, confirmation, and reporting to enhance investigations, improve the quality of reports, and ensure that there are no omissions.

The bank subsidiary conducts a customer due diligence (CDD) procedure (as shown in the chart below) that has a similar effect to general CDD. Special and sufficient measures must be in place to mitigate risks and in principle, individual accounts must submit identification documents for the verification of identity, address, and to contact customers by phone or mail when necessary. In principle, non-individual accounts must submit business registration documents, operating permits, change of registration or similar documents, company policy, list of directors and shareholders, and evidence for the identity of substantial beneficiaries. Relevant specifications are set out in the "Group-wide AML/CFT Plan" and "Anti-Money Laundering and Countering Terrorism Financing Guidelines". Regulations on non-face-to-face account opening and transactions are explained below: This service is limited to natural persons and sole proprietorship companies, but application is not limited to original customers of the bank. Online account opening requires ID authentication beforehand. Authentication methods vary between different types of customers, as described below:

In addition to strengthening its ID authentication mechanism, the subsidiary bank also adopts appropriate measures to conduct customer due diligence, such as confirming the customer's purpose and nature of opening a new account, proof of actual business operations, the main source of funds, and the anticipated number of transactions and amount. The Bank should also understand the scope of economic activities involved, in addition to conducting name verification and risk assessment operations. The Bank also regularly identifies if information pertaining to the ID of the customer and his real beneficiary is complete every year, in order to ensure authenticity and accuracy for information updates.

In addition to using the 53 suspicious transaction representations in the "Annex: Red Flags for Transactions Suspected to Involve Money Laundering or Terrorism Financing" published by the Bankers Association to monitor criminal behavior, the Group's subsidiary bank also compiles statistics from cases provided in letters from external inspection agencies to identify the crime risks that it faces. It has also adopted corresponding mitigating measures. The top 3 threats associated with money laundering and terrorism financing that the Bank identified in 2024 were fraud, tax crimes and narcotics, which were approximately consistent with the STR crime patterns that it declared.

Artificial intelligence and machine learning (AI/ML) technology is at the heart - and an important part - of regulatory technology, and the subsidiary bank has utilized or adopted the following technologies and control measures, in order to lower regulatory cost while enhancing regulatory performance:

As financial fraud incidents are quite rampant recently, the subsidiary bank has joined the Criminal Investigation Police Office's "Eagle Eye Anti-Fraud Alliance" to prevent customers from sustaining property losses. The Bank has developed an AI-enabled early-warning mode for account warning, enhanced monitoring and control over transactions, and signed a "Letter of Intent for Cooperation in the Anti-Fraud Project" with the Criminal Investigation Police Office on March 25, 2025, in order to jointly counter financial fraud. The Bank also plans to introduce the "associated network and dynamic money flow" analytical tool, and establish a "Bank-wide Joint Defense Mechanism", as part of its efforts to stay on top of all accounts with suspicious money flow while improving the successful rate of fraud interception. For over-the-counter operations, the Bank has formulated the "Gentle Reminders & Questions for Over-the-Counter Operations" and "Notices for Business Units to Protect Account Holders from Fraud & Be Mindful of Large Sums of Over-the-Counter Cash Withdrawals". With respect to customers who are making a withdrawal/remittance, applying for designated account transfer, elderly customers making a withdrawal exceeding a certain amount, or those who have manifested early warning signs or suspicious signs of fraud, the Bank would reach out to them with gentle reminders and questions. We would also notify the local prescient in a timely fashion for on-site investigation or police escort. Furthermore, the Bank has enhanced its employee education training to reach out to customers over the counter, as we properly utilize case studies provided by the National Police Agency as well as media reports of the latest fraud schemes, in order to boost interception effectiveness. In 2024, our performance in countering financial fraud continued to grow, as the number of cases and the amount were up by 3% and 34.3% respectively from 2023.

Apart from enhancing employee education training and raising their regulatory compliance awareness, subsidiary companies, including First Securities, FSITC and First Life Insurance, have also disseminated anti-financial fraud information and financial knowledge to our customers and the public via their official websites, social media platforms, apps, and digital channels.