Risk Management Initiatives

The purpose of Seven Bank’s risk management is to ensure healthy and effi cient management as aiming at an improvement in corporate value by appropriately managing various kinds of risks related to management.

Every fiscal year, the Board of Directors establishes the “Basic Policy on Risk Control,” which specifies the overall risk management policy, specific risk management policies and the organization and system for risk management. In accordance with this policy, the Executive Committee establishes detailed rules and regulations related to risk management and confirms the companywide risk status every quarter. The Bank’s risk management structure includes the Risk Management Division, which is responsible for supervising overall risk management activities, specific risk management divisions and the Internal Audit Division to perform internal audits. We have also established the Risk Management Committee and the Security Committee, chaired by the officer in charge of the Risk Management Division, and the Asset-Liability Management (ALM) Committee, chaired by the officer in charge of the Planning Division, as advisory bodies to the Executive Committee concerning risk management. The Group companies also establish risk management system aligned with the Bank’s policy and confirm their risk status, including their specific risks.

The Bank observes its basic policies relating to overall risk management, which are governed by the Basic Policy on Risk Control and Overall Risk Management Rules, established under the policy. We gain an overall grasp of our risks including climate change by assessing each of the Bank’s risk categories and manage them by comparing them with our equity.
We are also striving for enhanced risk management through priority items for risk management set by the Board of Directors (information security risk, system risk, financial crime countermeasures, market risk and liquidity risk) based on our policy for establishing the risk management structure. Our policy for establishing the risk management structure is based on the ideas of a risk-based approach, principles-based approach, strengthening of risk ownership, and group-based approach.

7BK-CSIRT (Computer Security Incident response Team), a dedicated team for cyber security management of the Seven Bank Group, is in charge of the Bankwide management of cyber security risks and is composed of members from multiple divisions. The team responds to a wide range of attacks on the Bank’s services and systems, including cyber attacks, skimming, fake cards, fraudulent access, and information leakage.
7BK-CSIRT conducts training and drills to be able to immediately respond in case of cyber incidents, by taking actions such as information coordination and external response. The initiatives of the team include cooperation with industry organizations and promotion of activities in the security community.
7BK-CSIRT also engages in Security by Design in which security methodology is incorporated as an essential factor at the planning stage of new services, considering increasingly sophisticated cyber attacks and proactive promotion of new technologies. This enables the Seven Bank to provide safe and secure services. Not only 7BK-CSIRT members but also our employees in charge of planning and designing services who are involved Security by Design deepen their knowledge through seminars about preventative measures against fraudulent use of services and other learning opportunities.
Believing the balanced combination of human resources, mechanism, and technology is necessary to maintain security, the Bank is working on each of them.

To fulfill our social responsibility as a bank, Seven Bank has defined the following four operations as top priorities for continuity in the event of a disaster, large-scale accident, or other crisis: the ATM services; the fund settlement operations serving banks and ATM partners; withdrawals from the Bank’s accounts and money transfer operations; and other operations of which interruption would have a significant impact on our management. Each division has also created a Business Continuity Plan (BCP) to enable continuity of these essential operations in the event of an accident, disaster, or other crisis. In addition, in order to verify the effectiveness of the business continuity management system and the business continuity plan, company-wide initial response drills assuming a major disaster, and drills assuming damage to data centers and other facilities are regularly conducted by departments in charge.