Risk Management

Based on the recognition of the importance of risk management, top management is actively involved in the risk management process, and systems are in place for verifying and monitoring the effectiveness and appropriateness of this process. Specifically, the group-wide basic policies for risk management and the risk appetites are determined by the Management Committee and authorized by the Board of Directors. After that, the status of risk management based on these policies and risk appetites is reported to the Board of Directors by the Group CRO.

SMBC Group has introduced a Risk Appetite Framework for controlling group-wide risks that clarifies the types and levels of risk that we are willing to take on or are prepared to tolerate in order to grow profits. It is one of two pillars of our business management alongside business strategies. In formulating business strategies and related matters, particularly significant management risks are identified as “top risks,” and stress tests are conducted.

Furthermore, in preparation for natural disasters, cyberattacks, etc., we strive to build a resilient and agile risk management framework, including strengthening operational resilience—the ability to ensure business continuity and prompt recovery of critical operations.

See the Appendix for more information on top risks.

As a basis for ensuring all employees carry out their duties appropriately from the perspectives of compliance and risk, SMBC Group has established the “Behavioral Guideline on Compliance and Risk,” based on the Five Values.

To achieve sustainable improvement in corporate value, it is essential that each one of employees makes decisions with risk ownership and acts accordingly. We strive to foster a sound risk culture by conducting internal surveys to monitor employees’ compliance awareness and risk sensitivity, as well as by communicating messages from top management to employees and providing internal training.