· Establish a comprehensive risk management system that incorporates ESG and climate change factors, and systematically manages all types of risks in accordance with the three lines of defense for risk management.
· Clarify that the Board of Directors, as the highest decision-making body for risk management of the Company, is responsible for reviewing the Company's risk management policies such as risk appetite, risk tolerance, etc., and overseeing the effective operation of the risk management system.
· Clarify that the Internal Audit Department is responsible for coordinating the work of the three lines of defense and reporting material risk issues to the Board of Directors.
· Regularly conduct comprehensive risk assessments to systematically analyze the various risks faced by the Company, such as strategic risk, financial risk, operational risk, ESG and climate risk, and gain insights into the potential opportunities brought by climate change.
· Regularly conduct risk management training, promote risk management knowledge, and enhance the risk management awareness and capability of all staff.

· Pay close attention to the latest changes in national laws, regulations and policies, continuously improve the compliance management system, optimize the compliance management process, and integrate compliance management into the whole process of the Company's operation and decision-making.
· Attach great importance to anti-corruption and integrity work, and establish a comprehensive anti-fraud mechanism, including risk assessment, reporting and investigation, accountability and punishment, to secure business ethics.
· Regularly conduct compliance publicity and education activities to ensure that all staff participate in compliance training.

· Strictly comply with relevant laws such as the Cybersecurity Law of the People's Republic of China to ensure the security of customer information. Actively promote the information security management system to ensure the normal operation of customer business throughout the year.
· Establish a comprehensive data privacy and protection and cybersecurity management process to safeguard the security of the information system.
· Conduct special training for employees responsible for operation and maintenance, and conduct regular security assessments for all employees to continuously improve their awareness of data security and behavioral norms.