SMFG Capital Ratio Information (A) Deriving and Scoring Scenarios a. Deriving Scenarios In order to grasp all potential risks of a business/product, we first identify “business processes & /products” stipulated in the  “Common Procedures of Operations.” Then, we derive all possible scenarios for the generation of a loss event of prescribed  magnitude by breaking down the operation process of each “business processes & /products” into “processing types.” We evaluate each individual scenario on an operation process basis. Classification of Business, Products and Processing Type  (Example) (Example) Product Operation process (a) Explanation to customer (b) Request for preparation of application form (c) Presentation of conditions to customer,  conclusion of contract (d) Conclusion of the deal with Treasury Marketing  Department  (e) Entry of contract implementation form (f) Exchange of forward contract Explanation Receipt and check  Agreements and contracts Internal transfer System entries Issuance, notification and reporting Business Exchange forward contract Conclusion of exchange forward contract b. Scenario Assessment In order to assess scenarios, it is necessary to quantify loss frequency and amount for each scenario. At SMBC, in order to quantify  loss frequency for each scenario, we execute risk control assessments on each scenario. In risk assessment, in order to measure the easiness of loss occurrence in each operation process before taking into account the  risk management (control) situation, we set standards for various assessment items — transaction volume, volatility of transaction  volume, time limits and so on — and the operation process is scored on how well the standards are met. Risk Scoring  (Examples) Control Assessment  (Examples) 1 0 2 1 0 0 0 Perspective Easiness of  making an error (a) Transaction  volume (b) Volatility of transaction volumes (c) Time  limits (d) Complexity of process (e) Complexity of products (f)  Deal with outside party (g) Booking of business products Largeness of annual processing volume Degree of concentration of processing on specific dates Shortness of deadlines and degree of urgency Degree of processing complexity, processing volume per task Product complexity Easiness of an error leading to a clerical accident Risk Items What to Assess Score Easiness of error in transferring actual items/funds to customer/other bank leading to  loss accident Easiness of error in handling of, or in notifying actions to be taken on, products with  market risk leading to loss event (a) Explanation (b) Attribute  confirmation (c) Receipt and check (d) Issuance, notification and reporting (e) Internal  transfer (f)  Application, decision and authorization (g) Agreements and contracts (h) Preparation of vouchers, etc. and making entries (i) System  entries (j)  Management during contract period (k) Safekeeping, depositing and withdrawal Processing type 1 0 1 0 0 Design of procedures Authority and verification System situation (a)  Establishment of manuals and procedures (b)  Details of manuals and procedures (c)  Processing authority and pre-process check (d) Post-process  check (e) System  processing Whether rules/ procedures/etc. have been documented or updated Assess processing authority, pre-process check Degree of system processing Perspective Risk Items What to Assess Score Whether there are rules for accurate processing execution without omissions and whether  they are effective (excluding those included in below three risk items) Assess post-process check and accident detection measures  (assess only preventive measures) Control assessment is executed from the perspective of preventive control and detection & recovery control. We set standards  for various items — establishment of manuals and procedures, processing authority and pre-process check, post-process check,  and so on — and the operation process is scored on how well the standards are met.  SMFG  2011 202