Rakuten Bank, Ltd.

Approximately 60% of the Bank's new account openings are through Rakuten Group channels, and Marble Bridge-linked accounts account for approximately 50% of deposit balances, indicating an extremely high degree of dependency on the Rakuten ecosystem. If the Bank ceases to be a subsidiary or affiliate, etc. of Rakuten Group, Inc., termination of the brand license agreement, and changes to or termination of account linkage with Rakuten Securities and the Rakuten Points program may occur, which is expected to result in a significant decline in customer acquisition capability and a decrease in revenue. The Bank aims to expand account opening applications acquired through channels outside the Rakuten Group, but the current dependency structure remains a material risk factor for business continuity.

If administrative sanctions, scandals, or a loss of confidence in products or services occur at Rakuten Group companies, this could adversely affect the brand of the Rakuten Group as a whole, potentially resulting in customer attrition and reduced revenue for the Bank. Even for events not attributable to the Bank itself, damage to the Group brand directly affects the Bank's business results and financial condition. The Bank has established a governance framework, including verification of transaction appropriateness by the Special Monitoring Committee, but it is difficult to completely insulate itself from Group brand risk.

Since the Bank's operations are fundamentally based on non-face-to-face transactions conducted over the internet, if a system failure occurs due to hardware or software defects or errors by officers or employees, this could result in claims for damages from customers due to service disruption, administrative sanctions from regulatory authorities, and damage to social credibility. The Bank has implemented measures such as redundant communication networks, system redundancy, and multiple data center locations, but responding to a failure larger than anticipated may be difficult. This is a risk event that management recognizes as a top risk of particular importance.

External attacks from criminal or terrorist organizations, computer viruses, phishing emails, and the like could result in unauthorized intrusion into the Bank Group's systems, loss or theft of important data, and service disruptions. If such events materialize, they could damage social credibility, cause customer attrition, result in claims for damages, and lead to administrative sanctions from regulatory authorities, which would have a material impact on business results and financial condition. The Bank has strengthened its monitoring framework and implemented technical and physical countermeasures, but complete defense against rapidly evolving and increasingly sophisticated cyberattacks is difficult, and this is recognized as a top risk.

Given the Bank's characteristic of being based primarily on non-face-to-face transactions, if the Bank falls behind in responding to rapidly evolving and increasingly sophisticated financial crime methods, this could result in damage to social credibility due to reputational deterioration and increased costs associated with implementing additional measures. In addition, if anti-money laundering measures and sanctions violation countermeasures do not function effectively, or if it is determined that they fail to meet the level required by regulatory authorities, administrative sanctions, penalties, and a decline in customer trust may result. The Bank has established stricter identity verification at account opening and a monitoring framework for account usage, but continuous strengthening of its response is required to keep pace with the evolution of criminal methods.

The Bank is subject to various financial laws and regulations, supervisory guidelines, and self-regulatory rules, including the Banking Act, the Financial Instruments and Exchange Act, and the Trust Business Act, and may be subject to administrative sanctions, business suspension, or license revocation due to legal violations or differences in legal interpretation. In addition, if financial laws and regulations or supervisory guidelines are revised or new regulations are introduced, this could affect the Bank's business, business results, and financial condition. While the Bank is not aware of any such applicable facts at this time, it is continually required to respond to changes in the regulatory environment.

A rise in interest rates due to changes in domestic and overseas monetary policy could result in valuation losses or losses on sale of securities held, as well as increased credit-related expenses associated with rising lending rates. Additionally, as the return to a world with positive interest rates progresses, competition for deposits with other financial institutions is intensifying, and if it becomes necessary to raise deposit interest rates in light of the competitive environment, funding costs will increase. The Bank optimizes its asset and liability composition through ALM operations, but there are limits to its ability to respond to rapid interest rate fluctuations.

In addition to intensifying competition among financial institutions in the internet banking sector, entry into banking and the provision of financial services by companies from other industries is expanding, increasing the risk of a decline in the competitiveness of the Bank's services. If the Rakuten ecosystem or Rakuten Points lose competitiveness amid competition with other corporate groups, the Bank's services could also lose competitiveness in tandem. The Bank is promoting the strengthening of synergies with the Rakuten ecosystem and the provision of services that match customer needs, but if changes in the competitive environment exceed expectations, this could affect business results and financial condition.

The Bank Group holds Securitized Assets (Purchased Monetary Claims) backed by credit card receivables of Rakuten Card Co., Ltd. and telecommunications service receivables of Rakuten Mobile, Inc., among others, with the total balance of trust beneficiary interests reaching ¥2,707,357 million at the end of FY2026 (ending March 2026). If the Bank ceases to be a subsidiary or affiliate, etc. of Rakuten Group, Inc., opportunities to securitize monetary claims of Group companies would decrease, requiring diversification of investment methods. If a deterioration in the business performance of Rakuten Group companies leads to a decline in the performance of the underlying assets, this could affect business results and financial condition through increased credit-related expenses, among other factors.

As a banking business, the Bank Group holds customer information including a large volume of personal information, and if an information leak occurs, this could damage social credibility, cause customer attrition, result in claims for damages, and lead to administrative sanctions from regulatory authorities. The Bank has implemented measures such as establishing safety management measures based on the Personal Information Protection Act and setting safety management clauses in contracts with outsourcing partners, but complete prevention is difficult due to the increasing sophistication of cyberattacks and internal misconduct, among other factors. Depending on the scale and nature of an information leak, it could have a material impact on the Bank Group's business results.