Infcurion, Inc.

As the Group's core business is cashless payment services provided via the internet, it is constantly exposed to diverse cyber threats such as unauthorized access, malware, DDoS attacks, and supply chain attacks. Attack methods continue to become more sophisticated and elaborate, and in the event of an incident, service suspension, reporting obligations under the Act on the Protection of Personal Information, administrative sanctions, claims for damages, and brand damage may occur. As countermeasures, the Group is promoting reference to the FISC Security Standards, vulnerability diagnosis by external specialist firms, and the establishment of a multi-layered defense system (preventive, detective, and corrective controls).

The Group's business depends on cloud service infrastructure, and there is a risk that large-scale system failures or service interruptions may occur due to sudden increases in access, natural disasters, or unexpected failures on the part of cloud providers. Service suspension would directly affect customers and merchants, and could have a material impact on the business and results of operations. As countermeasures, the Group is working to strengthen system monitoring and operations, anticipate sudden transaction surges in advance, and design architecture that avoids excessive dependence on cloud services.

The cashless payment and financial DX-related markets are subject to extremely rapid technological innovation and shifting customer needs, making continuous adaptation essential for the Group. If the Group fails to identify and respond to changes in a timely manner, or if the costs of system investment and personnel expenses required for such responses become substantial, this may affect its business results. The Group strives to maintain its responsiveness by building a framework to grasp the latest technology trends and by securing and training excellent personnel.

The Group conducts business under various regulatory regimes, including registration as an electronic payment agency service provider, notification as a telecommunications carrier, and registration as a third-party prepaid payment instrument issuer. If registration is revoked due to future legal amendments, guidance from relevant authorities, or amendments to self-regulatory rules, this could seriously impede business continuity. The Group currently recognizes no facts constituting disqualifying grounds or violations of self-regulatory rules, but ongoing monitoring of the changing regulatory environment is necessary.

The Group's Embedded Finance business is at an early stage in Japan, and as the market rapidly expands, new competitors are expected to enter going forward. If competitors' competitiveness improves or new entrants erode the Group's service advantages, this may affect its business and results of operations. The Group strives to maintain its competitive advantage through the early introduction of services leveraging its knowledge and know-how in the payments and finance fields, as well as strategic initiatives with alliance and capital partners.

Securing, developing, and retaining excellent personnel is essential for business expansion; however, if the Group is unable to secure sufficient necessary personnel or if key personnel leave the organization, this could make appropriate staff allocation difficult and constrain business expansion. In particular, in growth businesses such as the Payment Platform Business, delays in securing personnel are directly linked to performance risk. The Group strives to secure and retain personnel through measures such as active recruitment activities, study sessions, and enhanced employee benefits.

The Group continuously invests in software design and development to expand its business scale, and if the results of each business fall significantly short of the business plan and asset value is judged to have declined significantly, it will be necessary to record an impairment loss. Recording an impairment loss would have a direct impact on the Group's business results and financial position. The Group strives for early identification of risk through growth and profitability management by business and product.

The Payment Platform Business currently records an operating loss at the segment level, and if delays occur in customer acquisition activities or in securing personnel, the loss may continue or expand, affecting the Group's business results and financial position. On the other hand, volume-based recurring revenue linked to payment processing amounts is driving business growth, and the Group achieved profitability at each stage of consolidated results in FY2025 (ended March 2025). The Group is working to reduce performance risk through growth and profitability management by business and product, as well as capital-efficient cash allocation.

The Group holds a large amount of personal and confidential information, and if important information is leaked due to human error by officers or employees, internal misconduct, external attacks, or security incidents at outsourcing partners, this could result in a loss of social trust and give rise to reporting obligations, administrative sanctions, and liability for damages under the Act on the Protection of Personal Information. The Group also recognizes new challenges such as the risk of information leakage and intellectual property infringement arising from the use of generative AI. The Group addresses these risks through strict enforcement of internal regulations, regular internal training, strengthened management of outsourcing partners, and the formulation and dissemination of rules for the use of generative AI.

SMFG is an equity-method affiliate that indirectly holds 28.9% of the total number of issued shares (as of the end of March 2026), and in FY2026 (ending March 2026), transactions with the SMFG Group amounted to ¥1,736 million. If the relationship with the SMFG Group deteriorates, this could affect the Group's business and results of operations due to a decrease in related transactions and other factors. Under the capital and business alliance agreement, the parties have agreed to maintain management autonomy and independence, and the Group has established an independent decision-making structure led by management centered on independent and dedicated officers.