Anti-money Laundering and Combating the Financing of Terrorism

AML/CFT Organizational Structure and Managing System

AML/CFT Management Program and Enhancement

Policies and Procedures

E.SUN FHC and its subsidiaries have established AML/CFT policies and procedures with regard to aspects such as due diligence, name screenings (watch list filtering), transaction monitoring, employee management, and record keeping. The key achievements in 2025 as follows:
E.SUN FHC	Completed periodic review of AML/CFT regulations and implemented group-wide information-sharing mechanism Held AML/CFT business exchange meetings with subsidiaries Continuously supervised the execution of AML/CFT in subsidiaries and monitored key indicators on the risk dashboard
E.SUN Bank	In response to trends in the virtual asset market and to align with international standards, the bank revised its "Anti-Money Laundering and Counter-Terrorism Financing Policy" and "Customer Identification and Due Diligence Operation Guidelines,"etc., and adjusted its customer relations policies for virtual asset service providers to strengthen the resilience of emerging risk management The bank revised its "Explanation of Customer Money Laundering and Terrorism Financing Risk Assessment Methodology," reshaping its customer money laundering risk scoring model and adding multiple risk factors to create a more flexible scoring factor framework The "Guidelines on Monitoring of Accounts and Transactions" and "Instructions for Account and Transaction Monitoring Operations " have been revised to clarify the obligations of overseas outlets and optimize case handling procedures in order to improve the overall effectiveness of transaction monitoring management
E.SUN Securities	To meet the needs of periodical review, the "Anti-Money Laundering and Counter-Terrorism Financing Control Mechanism" has been revised Revise the required cooperation items for anti-money laundering operations in brokerage firms, and periodical review operating procedures and related forms. The operating units shall be responsible for conducting the periodical review, promotion, and training
E.SUN Asset Management	To establish an internal control and risk management mechanism consistent with E.SUN Financial Holding and its subsidiaries, regulations such as the "Money Laundering and Terrorism Financing Risk Appetite Policy," "Key Points for Information Sharing to Prevent Money Laundering and Combat Terrorism Financing," and "Suspected Money Laundering Monitoring and Reporting Procedures" have been formulated or revised

Customer Due Diligence

E.SUN's due diligence procedures are as follows:

E.SUN continuously develops its IT systems, optimizes operational processes, and integrates customer information to improve CDD/EDD operations. Subsidiary E.SUN Bank has launched its self-developed CDD/EDD system, "Customer Due Diligence Platform (CAML)". CAML provides one-stop service for various CDD scenarios, covering onboarding stage, ongoing stage and trigger events, with a view to increase the mastery of customers' identification. The platform allows employees to access up-to-date customer information as well as retained documents, and provides online submission services for natural person customers during CDD, and CAML is planned to gradually extending to our overseas affiliates. Subsidiary E.SUN Securities has also launched its self-developed "Periodical Review Platform" to complete account review operations and access up-to-date customer information and retained documents.

Senior Management Approval and Sign Off

When assessing customer risk, various factors such as background, industry, socioeconomic activity characteristics, region, organization type, and structure of non-natural person customers must be considered. For customers identified as high risk or possessing specific high-risk factors, enhanced due diligence will be executed, including verification on the source of funds and wealth. The aforementioned customer transactions can only be undertaken with the approval of senior management. Moreover, transactions involving extremely high-risk jurisdictions such as Iran and DPRK are prohibited.

Non-Face-to-Face Due Diligence

For due diligence measures of customers from "non-face-to-face" channels, E.SUN has applied confirmation procedures equivalent to those for face-to-face customers and adopted adequate measures to mitigate risk. E.SUN Bank and E.SUN Securities provide specific, clear instructions for applying for digital bank accounts and online securities accounts on their official websites, including the required documents, application qualifications, and inquiry instructions on approval progress and supplementary document. Furthermore, both subsidiaries continually encourage customers to use online banking, mobile banking, or the "Personal Basic Information Update Platform (eKYC)" for online basic data updates to encourage customers in completing periodical reviews using a more convenient online channel.

Watch List Filtering

E.SUN improves its watch list filtering operations through the continuous development of IT systems. E.SUN Bank has launched its self-developed "Name Screening System (SAML)". SAML enhances the update frequency of important sanction lists by directly connecting to relevant official websites and prevents duplicate case reviews. The parameter setting and adopted watch lists are also continuously checked to ensure accuracy and efficiency. E.SUN Securities and E.SUN Asset Management strengthens its efficiency and effectiveness of watch list filtering by utilizing the AML/CFT query system established by the Taiwan Depository & Clearing Corporation with the aid of Dow Jones Risk & Compliance database.

Combating the Financing of Terrorism and Countering Proliferation Financing

For establishing business relationship or providing new services, E.SUN conducts real-time checks on customer names and those of their associates, as well as daily batch screening and name list updates. When conducting specific transactions, the related parties, such as remitters and beneficiaries, are also checked. The lists adopted by E.SUN include, but are not limited to, the Taiwan Ministry of Justice (MOJ) Sanctions List, the United Nations Security Council (UNSC) Comprehensive Sanctions List, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) Specially Designated Nationals List (SDN-List), and lists published by the local regulatory authorities of overseas branches. In response to the recent international sanctions against Russia, subsidiary E.SUN Bank has announced relevant information on the official website, reminding customers to be cautious of whether their counter parties and goods are involved with sanctions regimes in order to ensure the transactions are clear of sanctions.

PEP / RCA (Politically Exposed Person / Relative and Close Associate)

To verify whether customers and the corresponding ultimate beneficial owner belong to PEP/RCA, identifications are conducted via IT systems with name list databases during specific events, including the establishment of business relationships, the addition of new relationships, regular reviews, and trigger event reviews. If confirmed as PEP/RCA, enhanced due diligence and strengthened transaction monitoring will be conducted. Verification on source of funds and wealth along with senior management approval are also required before proceeding. Moreover, high-risk PEP/RCA customers must undergo annual reviews, and related transactions will be subject to enhanced monitoring. Each subsidiary also monitors changes in the number of PEP/RCA customers every quarter to effectively manage related risks.

Suspicious Transaction Reporting (STR)

In terms of suspicious transaction monitoring, E.SUN refers to typologies published by regulatory authorities, and conducts transaction monitoring for all transactions through system assistance and manual processes, covering customers, employees, and financial institutions involved with E.SUN. Alerts generated by the system are investigated by dedicated personnel to verify the reasonableness of customer occupation/industry, source of funds, purposes of transactions, and whether transaction activities are consistent with past patterns, while also retaining investigation records. Suspicious transactions discovered by branch staffs and relevant information are reported to dedicated units via internal reporting mechanism, and further investigations will be conducted by dedicated personnel.
If deemed suspicious, the transactions will be reported to the Financial Intelligence Center (FIU). The entire reporting processes are conducted through a dedicated computer with all portable devices blocked. All personnel in dedicated units are obliged to confidentiality agreements with a view to ensure reporting information cannot be leaked to unrelated third parties. The subsidiary, E.SUN Bank, launched a new version of its Transaction Monitoring and Reporting (TMR) system in 2024, which has been online by the first quarter of 2026. This allows for continuous improvement of the suspicious transaction monitoring and reporting mechanism, thereby effectively responding to rapidly evolving money laundering means.

Technology Application

In order to enhance operational efficiency and reduce the risk of manual error, E.SUN has self-developed Robotic Process Automation (RPA) programs to handle highly repetitive, routine tasks through automation or semi-automation. Machine learning models and platforms are also applied in practical scenarios, including adverse media collection, watch list filtering, and abnormal transaction detection, combined with business logic or manual operations to improve case review efficiency. In addition, subsidiary E.SUN Bank is also trying to gradually use AI and data technologies to assist in the identification and monitoring of suspicious transactions.

Record Keeping

E.SUN maintains records and files related to the implementation of AML/CFT, as well as records and vouchers of customer transactions, for at least five years after the end of customer business relationships or temporary transactions. This is done to facilitate future inspections and inquiries, and to provide evidence of efforts in AML/CFT.

Annual Independent Assessment

Item	Description
Overall Assessment	Internal Control System Statement and Independent Assurance Report	Each subsidiary issues a statement on the internal control system for AML/CFT, jointly signed by the chairman, general manager, chief auditor, and the dedicated AML/CTF supervisor. The statement is filed on the website of supervisory authorities and on the company's official website. In 2025, subsidiary E.SUN Bank continues to commission PricewaterhouseCoopers (PwC) to conduct auditing of the AML/CFT internal control system, and the assurance report is issued with opinion of fair presentation in material aspects.
	Institutional Risk Assessment (IRA)	In 2025, E.SUN continues to improve its risk assessment methodology by strengthening the analysis of quantitative data and control effectiveness. In response to recent trend of crimes and financial regulatory requirements, new control points are added for the evaluation of control effectiveness. The methodology enables a holistic understanding to the money laundering and terrorist financing risk faced by E.SUN. The results are reported to the board of directors and filed with the supervisory authorities. Additionally, the "Risk Appetite Declaration for Money Laundering and Financing of Terrorism" clarifies the acceptable minimum control measures and maximum residual risk levels for the institution's AML/CTF risk assessment, further enhancing the overall risk assessment framework.
Various control mechanism effectiveness verification	Transaction Monitoring	To ensure the appropriateness of the transaction monitoring system, the dedicated unit assesses the consistency, accuracy, and rationality of transaction monitoring data under the guidance of external consultant's methodology. Through analyzing the statistical distribution of customer transaction data, the reasonableness of threshold settings is examined to evaluate whether the transaction detection logic is effective and meets the needs of E.SUN.
	Watch List Filtering	E.SUN continues to engage with independent third-party, the Society for Worldwide Interbank Financial Telecommunication (SWIFT), to verify the effectiveness of its watch list filtering system. The major testing aspects include previse matching and fuzzy matching, with a view to evaluate the system performance in customer and transaction scanning, ensuring that the requirements on system effectiveness are met.

Education and Training

To enhance employees' AML/CFT awareness and cultivate a compliance culture, E.SUN plans appropriate hours and content for annual education and training programs for all levels of employees (including new hires), specialized units, anti-money laundering and counter-terrorism financing supervisors, senior management, and frontline staff, based on their job functions. In 2025, E.SUN held a series of courses highly aligned with the practical operations of its business units, covering topics such as fraud, emerging financial crimes, and current events like the Iranian sanctions, and invited personnel from the National Police Agency, the Bureau of Legal Investigation, and the National Taxation Bureau to share their practical experience. Furthermore, E.SUN has joined the Association of Certified Anti-Money Laundering Specialists (ACAMS) as a corporate member, adopting its online courses and global forward-looking news database to enrich its domestic and international education and training materials. For overseas outlets, headquarters also proactively compiles case-handling experience and provides explanations and guidance through conferences. In terms of professional certification, E.SUN continues to promote its employees to obtain domestic and international anti-money laundering professional certifications, including international professional certifications in different fields issued by ACAMS, in order to encourage employees to enhance their professional and international perspectives.

Disclosure of AML/CFT Related Information

E.SUN FHC discloses its AML/CFT policies, risk appetite, and AML questionnaires (Wolfsberg CBDDQ Questionnaire) on its official website, while subsidiary E.SUN Bank, E.SUN Securities, and E.SUN Asset Management also disclose internal control statements for AML/CFT on their official websites to enhance transparency.