Responsible for governing and overseeing information security and cybersecurity management to be appropriate for the Bank’s business operations.

Responsible for overseeing and monitoring information technology risks including risks from cyber threats.

Responsible for ensuring that our Information Technology Division works effectively and in alignment with business operations.

Responsible for supporting the Chief Information Security Officer (CISO) who is responsible for the following:

• Defining, developing and regularly reviewing the structure, policies, standards and procedures for information security and cybersecurity. 
• Assessing and monitoring the status of security control through vulnerability and threat management, as well as investigating any unusual incidents in the Bank’s security. 
• Fostering a risk culture regarding information security and cybersecurity in the organization.

• Organization Structure for Information Security and Cybersecurity
  The Bank shall follow the three lines of defense structure for information security and cybersecurity management by defining clear and definite responsibility across the Bank without overlapping accountability. All staff and executives have to be strictly accountable for their determined responsibilities to ensure efficiency and effectiveness of information security and cybersecurity management.

• Information Security and Cybersecurity Risk Management
  The Bank assigns a direct responsible person from each unit to coordinate and facilitate the identification and assessment of potential information security and cybersecurity events within their units as well as the assessment of existing internal controls to future determine effective risk control procedure or risk mitigation plans.

• Information Technology Asset Management
  The Bank shall define how any and all of its information assets should be handled, including the appropriate protection responsibilities for assets by identifying, inventorying, classifying, and developing rules for acceptable use. Assets shall also include any data, knowledge, or information that has value to the Bank, whether created by the Bank or not.

• Access Control
  The Bank shall determine the appropriate rules on need to know basis for access control, access rights, and access restrictions for assets that are commensurate to the sensitivity of the asset and exposure to information security risk.

• Cryptography
  The Bank shall ensure the security and protection of communication channels and the storage and transmission of assets through proper and effective cryptographic methods.

• Physical and Environmental Security
  The Bank shall implement physical and environmental security guidelines in order to prevent unauthorized physical access; damage and interference to information facilities; loss, damage, theft, or compromise of physical assets; and interruption to the Bank’s operations.

• Operations Security
  The Bank shall ensure the security and operation of information processing facilities; protection of assets from all applicable information security and cybersecurity threats.

• Communications Security
  The Bank shall ensure the protection of information in network services and the security of information when transmitted and transferred within and outside of the Bank.

• Mobile Devices and Remote Access Security
  The Bank shall secure and protect the use of mobile devices and remote access to the Bank’s information systems in order to prevent the compromise of the Bank’s information systems and assets.

• Information Security and Cybersecurity in Third Party Relationships
  The Bank shall manage third party relationships (e.g. external service provider, vendor, etc.) to ensure information security and cybersecurity when contracting and receiving services.

• System Acquisition, Development, and Maintenance
  The Bank shall constantly monitor and review the information security and cybersecurity vulnerabilities and capabilities of systems and applications in order to assess and reduce security risks associated with the ownership, use, and development of such systems and applications.

• Information Security and Cybersecurity Incident Management
  The Bank shall ensure that there is a consistent and effective approach in response to information security and cybersecurity related incidents. This includes the communication of security incidents and or weaknesses, as well as appropriate post-incident handling.

• Information Security and Cybersecurity Aspects of Business Continuity Management
  The Bank shall ensure that information security and cybersecurity continuity is a part of BCM in order to protect critical business processes and ensure continuity or timely resumption of information security and cybersecurity systems in adverse situations such as disasters, failures, or crises.

• Information Security and Cybersecurity Training and Awareness
  The Bank shall establish information security and cybersecurity training and awareness programs to ensure the knowledge, skills, and awareness of all employees in the protection against information security and cybersecurity threats on regular basis.

• Human Resource Security
  The Bank shall define, communicate, and enforce responsibilities and requirements towards the Bank’s assets for all those employed by the Bank.

• Compliance and Information Security and Cybersecurity Review
  The Bank shall avoid breaches of legal, statutory, and contractual obligations related to information security and cybersecurity requirements. The Bank shall abide by any applicable legislation and regulation when using any information or information system in its operations.

• Emerging Information Security and Cybersecurity Threats and Trends
  The Bank is aware of developing information security and cybersecurity trends due to the rapid evolution of technology and corresponding technological threats. The Bank shall monitor vulnerabilities and threats that may arise due to changes in the technological landscape and the way technology is used within the Bank. The bank shall ensure that emerging technology deployment shall be efficiently managed with additional specific guideline on top of normal practices in order to drive the proactive awareness and support the banking industry.

Artificial intelligence (AI) technology is currently being widely adopted across both business operations and in daily life. The Bank has leveraged AI to support its business activities, including threat detection, product recommendation (cross-selling), and chatbot implementation for customer services. Recognizing the potential risks associated with the use of AI, the Bank has established a comprehensive risk management framework based on the principles of responsible AI adoption that takes into consideration the impacts related to ethics, social and personal data security. The Bank has also established an Information Security and Cybersecurity Policy which specifies a comprehensive governance framework for the adoption and control of AI to ensure its appropriate and responsible use. The policy also embeds security-by-design principles into AI-enabled systems, including data encryption, access controls, and regular vulnerability assessments. The Bank also engages in proactive communication with employees and customers to promote awareness and understanding of responsible AI use.

We place the highest priority on the protection of personal data to prevent data subjects from being harmed by the misuse or unlawful exploitation of personal information. We have established principles and operational guidelines for personal data security that are fully aligned with the Personal Data Protection Act (PDPA) and other relevant regulations. The Bank has assigned responsible personnel for reviewing and monitoring data. Requirements have also been set up on the granting of access rights, and the sorting and classification of data in order to establish different corresponding personal data security measures that are consistent with the degree of risk and potential impacts from a breach of personal data privacy. We have identified personal data risk as one of the Bank’s key risks and have assigned the Data Protection Office and Data Protection Officer (DPO) to participate in the risk management process, from risk identification to risk management and risk controls.

Personal Data Protection Governance

To ensure transparent and effective governance of personal data protection in compliance with the Bank’s internal practices and relevant laws and regulations, the Bank has clearly defined the roles and responsibilities of the Board of Directors, senior executives, and relevant departments in personal data protection. The Bank undertakes risk control according to the Three Lines of Defense principle and ensures that the audit of personal data protection is conducted by the Audit and Control Division working independently of the units that collect, use and disclose personal data. In addition, the Bank has established a Data Protection Office under the Compliance Unit and appointed a DPO to be in charge of personal data.

Personal Data Protection Policy and Standards

We have established the Personal Data Protection Policy and Standards in compliance with the Personal Data Protection Act B.E. 2562 (PDPA) and other applicable regulatory requirements. The policy applies across the Bank’s business groups, business partners and external service providers. The policy is reviewed on an annual basis to ensure it remains current and effective. In addition, the Bank has developed operating manuals for personal data protection for all relevant units to ensure that employees have a good understanding of the processes and puts them into practice accordingly. All employees must acknowledge and conform to the Personal Data Protection Policy. Any violation or non-compliance may result in disciplinary action and could also give rise to criminal liability or other legal penalties under applicable laws. We disseminate our Privacy Notice through multiple channels, including the website, branches, and digital banking channels, to inform data subjects of details regarding personal data protection and their rights. Data subjects may seek further information and exercise their rights at any branch or through other service channels of the Bank, or by contacting the Bank’s Data Protection Officer or the Data Protection Office for assistance.

We have established a consent form that specifies details and objectives regarding the collection, use and disclosure of the personal data of a data subject so that the data subject can consider this before giving consent, prior to or during data processing (such consent is the data subject’s choice and will not in any way be a requirement for using the Bank’s services). Additionally, we also monitor the data used for secondary purposes as allowed by relevant laws and with consent, such as marketing activities and data analytics to develop products and services. As of the reporting period, 88 percent of the Bank’s customers have provided consent for the use of their personal data for secondary purposes.

Personal Data Breach Response

We have established clear guidelines and procedures, and designated responsible persons for responding to personal data breach incidents. A personal data breach reporting form has been established for completion by the unit detecting the incident and for reporting to the responsible supervisor in charge for further submission to the DPO.

Data subjects may submit complaints regarding personal data breach incidents through the Bank’s established complaint handling channels or by contacting the Data Protection Officer (DPO) or the Data Protection Office. Upon receipt of a complaint, we conduct a transparent and impartial investigation to ascertain the facts. If the investigation confirms the breach, we will take action against the wrongdoer according to the established disciplinary processes and guidelines, make proper remedies to the affected parties, and implement corrective measures to prevent recurrence. In 2025 we received a total of 22 complaints related to personal data protection breaches, comprising 12 complaints submitted through the Bank’s complaint handling channels and 10 complaints submitted through regulatory authorities. Of these, 15 cases have been fully investigated and resolved with none of the cases causing significant impacts on data subjects.

We believe that fostering a culture of information technology security, cybersecurity and personal data protection in the organization requires every employee to have the right knowledge and understanding of the subject. Therefore, we have taken the following measures or requirements to enhance knowledge and understanding:

• Requiring members of the Board of Directors to participate in training programs related to information technology security and cybersecurity management, organized by the Bank or relevant regulatory authorities.
• Communicating the Bank’s Information Security and Cybersecurity Policy, as well as related information security and cybersecurity manuals through internal communication channels, and developing engaging learning materials in the form of animations to enhance accessibility and understanding.
• Implementing mandatory training programs for executives and employees to enhance awareness of cyber threat prevention and personal data protection. These include Personal Data Protection training, Phishing Email Awareness training, and Information Security and Cybersecurity training.
• Requiring employees in relevant units to attend Personal Data Protection training specific to their roles.
• Organizing a PDPA Awareness Campaign to promote understanding of proper compliance with the Personal Data Protection Act B.E. 2562 (PDPA), delivered through a range of knowledge-sharing materials such as articles, newsletters, infographics and videos, with dedicated channels provided for employees to submit inquiries to the Data Protection Officer (DPO).
• Organizing expert sessions on the topic of the Personal Data Protection Act (PDPA) to enhance employees’ understanding of the Bank’s roles and responsibilities as a data controller; best practices for managing personal data throughout its lifecycle; and guidelines for engaging with companies or their directors in a manner that ensures compliance with the PDPA and prevents any potential violations.
• Sharing knowledge about the ESG Journey 2025 and strengthening operational excellence in PDPA to enhance awareness of the latest personal data protection regulations and guidelines issued by the Office of the Personal Data Protection Commission (PDPC).
• Developing and disseminating security tips and security news throughout the year via the Bank’s internal communication channels.
• Organizing cybersecurity talk sessions by inviting internal and external experts to share knowledge on cybersecurity topics, such as Cyber Threat Awareness to Build Organizational Resilience; Security First! Fundamental Security Principles for Vendors and Application Developers; The Quantum (Computing) Mania; and Surviving in Digital Future.
• Organizing the Cybersecurity Hero Season 2 program, building on the success of Season 1, with the objective of encouraging behavioral change among employees to recognize the importance of cybersecurity awareness and how to deal with cyber threats. Activities included reporting phishing emails and cyber threats impersonating the Bank in order to collect points to redeem prizes.
• Organizing Bangkok Bank Cybersecurity Day 2025 under the theme Unlocking the Future of Cybersecurity with AI which aimed at enhancing knowledge of AI technology trends, the safe and responsible adoption of AI in alignment with the Bank’s cybersecurity framework, and emerging AI-related cyber threats. The event featured knowledge-sharing by experts in AI and cybersecurity from both inside and outside the Bank, as well as interactive booths provided by leading technology companies.