Enterprise risk management

Enterprise risk management

At present, the Company has a comprehensive risk management plan aligned with the Enterprise Risk Management (ERM) approach, based on the COSO-ERM framework. The objective is to foster accountability across the organization and ensure consistent direction throughout all functions, while strengthening the Company’s ability to compete sustainably and respond effectively to rapidly changing external conditions.

Embedding risk management as part of the organizational culture through internal communication and various meetings not only raises awareness among executives, employees, and relevant stakeholders, but also encourages everyone in the organization to participate in identifying and assessing risks, evaluating potential impacts, monitoring progress, and regularly reviewing operations in a systematic, continuous, and standardized manner.

Operating Framework

  1. Prepare risk reports aligned with a comprehensive management process.
  2. Organize workshops to encourage participation from all relevant parties and establish appropriate working teams.
  3. Manage risks through scenario simulations at an appropriate frequency.
  4. Review risk management to ensure alignment with the Company’s vision and organizational goals.
  5. Monitor and evaluate implementation to ensure alignment with the plan.
  6. Report implementation results at all levels at least twice a year.
  7. Integrate risk criteria into the development and improvement of products and services.
  8. Review the risk management manual and policies at least once a year.

Risk management structure

The Company has established a risk management structure that is aligned with internationally recognized standards, with clearly defined roles and responsibilities for the Risk Management Committee and other relevant committees. At present, risk management matters are reported to the Risk Management Committee under a dual reporting structure at least twice a year.

In addition, the Company has established an Internal Audit function, which performs its duties independently, while management has established a Compliance function to oversee compliance with rules, regulations, and laws. This further strengthens the Company’s risk management. The Company applies a risk management approach that supports effective oversight and enables the Company to achieve its strategic plans. Accordingly, the role of the Board of Directors is to view corporate governance, risk management, and compliance as an integrated framework (Governance, Risk and Compliance: GRC), thereby driving the organization toward value-based sustainability and enhancing operational and execution efficiency.

Structure and Roles and Responsibilities

The board of directors

  • Approve the Risk Management Policy and risk appetite.
  • Oversee and monitor risk management to ensure effective and continuous implementation.

The Risk Management Committee

  • Review risk management reports to ensure that risks remain within acceptable levels.

The Audit Committee

  • Conduct independent reviews to ensure that risk management implementation is effective.

Secretary of the Risk Management Committee

  • Propose policies and strategic plans, and identify key risks.
  • Coordinate with the committees or relevant parties.
  • Report risk management matters to the Risk Management Committee at least twice a year.

The Executives and employees

  • Manage and report risks identified in daily operations to supervisors.

Working Group

  • Propose policies and strategic plans to the Managing Director.
  • Develop approved risk management policies and guidelines into implementation within the responsible functions.
  • Promote an appropriate risk management and internal control culture within the responsible functions.

The Internal Audit Department

  • Conduct reviews to ensure that internal controls are appropriately implemented at least once a year.
  • Develop risk-based audit plans.
  • Coordinate with working teams to exchange information on risks that may affect the Company.

Risk Management Culture

  1. Executives and employees at all levels must integrate risk management into their work practices, decision-making, and daily operations.
  2. Identify, assess, and manage risks that may affect the Company’s objectives and strategies within the acceptable risk level.
  3. Regularly monitor, evaluate, and review the effectiveness of risk management.
  4. Participate in the development and continuous improvement of the risk management system to enhance its effectiveness.
  5. Promote risk knowledge, awareness, and communication across the organization.

Risk Management Process

The risk management process begins with the identification of potential risk issues, followed by risk assessment based on the level of impact and frequency. The next step is risk response, which comprises 4 approaches: acceptance, transfer, reduction, and avoidance. Control activities are then established to reduce risks to an acceptable level. The process also includes communication to ensure that personnel within the organization understand and apply risk management practices in their operations. The final step is monitoring and evaluation to ensure effective risk management and to support the continuous improvement of the risk management plan for greater appropriateness and effectiveness.

1. Event Identification and Analysis

This is the process of understanding the root causes of risks and identifying events or processes that may affect the achievement of the Company’s objectives. Risk consideration covers both internal and external factors, as well as all dimensions of the Company’s operations, to ensure comprehensive risk identification that remains aligned with the changing business context.

2. Risk Identification and Analysis

2.1 Likelihood Level refers to the probability that an event may occur, or how likely the event is to occur, considering the following:

2.2 Impact Level refers to the severity of the impact from a potential event, considering the degree of severity as follows:

The risk assessment score is calculated by multiplying the likelihood level by the impact level. Risk levels are classified into 4 levels to support effective risk management.

3. Risk Response

4. Control Activities

Risk control activities are established to manage risks appropriately in line with the potential level of risk.

Bar chart showing the relationship between risks and control activities. Increasing risk control activities can help reduce risks to an acceptable level.

5. Information and Communication

Information systems and communication are important tools that support effective risk management. Management can use them to communicate policies and monitor performance. An effective information system should include the following:

  1. Control of user access rights based on responsibilities and types of work.
  2. A data backup system to prevent disruptions from system failures or force majeure events.
  3. An interconnected system across departments to enable efficient shared data management.
  4. A backup operating unit equipped with necessary tools and systems for immediate operation in emergency situations.
  5. An asset management system that is user-friendly and convenient for operations.

6. Monitoring and Review

The Risk Management Committee arranges meetings to monitor risk management performance at least twice a year in order to assess and improve policies in alignment with the Company’s internal and external environment, address key risks and reduce them to acceptable levels, and review risk issues annually to ensure alignment with current circumstances..

Risk management performance

To foster risk management as part of the organizational culture, the Company reviews risk issues through discussions with the working team and the Risk Management Committee to ensure alignment with current circumstances. The Company also promotes risk management ownership within each function, from risk identification to monitoring and evaluation. Risk management performance is communicated to employees to raise awareness of the importance of enterprise risk management, enhance understanding of risk management practices, and ensure correct and consistent compliance with the Company’s Risk Management Manual.

In 2025, the Risk Management Committee held 4 meetings to monitor performance and discuss risk-related matters. The key agenda items of the meetings can be summarized as follows:

  • Consider and acknowledge progress in controlling and addressing risk issues.
  • Consider and approve the Risk Management Manual (revised version).
  • Consider and approve the Risk Management Committee Charter.
  • Consider and approve the revised risk prioritization.

Risk Level Assessment Diagram

  1. Shortage of personnel
  2. Fraud and corruption
  3. Competition and new market entrant
  4. Increase in domestic interest rates
  5. Funding from financial institutions
  6. Financial liquidity
  7. Cost-effectiveness of branch sales operations
  8. Increase in non-performing loans
  9. Natural disasters
  10. Regulations imposed by external authorities
  11. Cyber threats and data theft
  12. Increase in domestic goods prices
  13. Occupational health and safety
  14. Borrowers’ debt repayment capacity
  15. Inefficient service delivery
  16. Carbon tax (emerging risk)
  17. Inability to achieve the organization’s greenhouse gas reduction targets (emerging risk)

Summary Table of Risk Management Performance in 2025

Risk issues Impacts Level of impacts    level of chance Risk management plan Performance
KRI Target Result

1. Personnel Shortage

Shortage of sufficient personnel to support the Company’s growth.

5

1

Create incentives and promote a good working environment for employees.

Ratio of employee separations to new hires.

Ratio Not exceeding 1

0.54

2. Corruption

Corporate image and investor confidence in the Company.

4

5

Provide training to develop employee integrity and ethics.

Number of fraud and corruption incidents (cases)

0 cases

0 cases

3. Competition and New Market Entrants

Operating results not meeting targets.

4

5

Develop a strategic plan to maintain leadership in the business.

Largest market share in the loan portfolio.

No. 1

No. 1

4. Increase in Domestic Interest Rates

Higher financing costs.

5

3

Secure alternative backup funding sources and adjust lending interest rates upward.

Average annual interest rate (%)

Not exceeding 4.7

4.53

5. Funding from Financial Institutions

Credit facilities are suspended and new credit facilities are not approved.

5

3

Regularly assess and monitor financial ratios.

Debt-to-Equity Ratio (D/E Ratio) (times)

Less than 4

3.48

6. Financial Liquidity

Slowdown in loan disbursement and branch expansion.

5

1

Prepare an appropriate funding plan.

Ratio of cash inflows to cash outflows

Greater than 1

1.84

7. Cost-Effectiveness of Branch Expansion

Lack of cost-effectiveness in opening branches affecting operating performance.

4

5

Review and adjust business plans to suit each area.

Loan receivables per branch (Baht million/branch)

Not less than 19

21.13

8. Increase in Non-Performing Loans (NPL)

Decrease in net profit.

4

5

Slow down loan disbursement to high-risk customer groups and sell non-performing loans to other companies.

Percentage of non-performing loans to total loan disbursement (%)

Not exceeding 2.8

2.53

9. Natural Disasters

Operational disruption.

3

1

Prepare a budget to respond to potential impacts.

Number of incidents of signage damage caused by storms and floods

Not exceeding 280 cases/year

359

10. Regulations Imposed by External Authorities

Legal non-compliance and loss of investor confidence.

5

1

Continuously monitor and review the rules and regulations of the regulatory authorities overseeing the Company.

Compliance rate with regulatory requirements (%)

100

100

11. Cyber Threats and Data Theft

Violation of the Personal Data Protection Act and loss of the Company’s credibility.

5

1

Adopt modern technology within the organization.

Number of cyberattack incidents (cases)

0%

0%

12. Increase in Domestic Goods Prices

Increase in the Company’s operating costs.

4

1

Set expense ceilings and arrange alternative suppliers.

Ratio of average unit price to reference unit price (%)

Increase of not more than 4

Decrease of 1.37

13. Employee Occupational Health and Safety

Operational disruption due to employee absences.

2

3

Promote safety-related activities and provide safety equipment, such as helmets.

Number of accidents during working hours (cases)

0

74

14. Debenture Repayment Capacity

Corporate image and investor confidence in the Company.

3

1

Regularly assess the Company’s debenture repayment capacity.

Number of debenture default events (times/year)

0

0

15. Inefficient Service Delivery

Inability to retain the customer base

1

5

Provide training and guidance on proper customer service methods.

Customer satisfaction (%)

Greater than 80

93.78

16. Carbon Tax (Emerging Risk)

Increase in operating costs

2

1

Reduce greenhouse gas emissions from the Company’s operations.

Expenses arising from carbon tax (Baht)

0

0

17. Inability to Achieve the Organization’s Greenhouse Gas Reduction Targets (Emerging Risk)

Loss of investor confidence and credibility.

2

2

Closely monitor the Company’s performance and initiate projects to reduce greenhouse gas emissions.

Greenhouse gas emissions (tons of carbon dioxide per year)

Increase of not more than 10% from the previous year

Decrease of 11.07%

Risk Analysis

1. Personnel Shortage

With the goal of expanding branches to provide nationwide coverage, recruiting sufficient branch personnel to support business growth may affect operations. In addition, the microfinance business has faced increasing competition, making employee recruitment more challenging. The Company also faces challenges in retaining and motivating experienced and skilled employees to remain with the organization.

The Company has therefore planned workforce recruitment to adequately support business growth, established employee capability development plans, created career opportunities and work incentives, promoted career advancement and job security for employees, and provided appropriate remuneration and welfare. These efforts are supported through skills development programs and employee learning initiatives, together with effective performance evaluation criteria. The Company has set a key indicator requiring the ratio of employee separations to new hires to be no more than 1 time. In 2025, the ratio was 0.54, which remained within the acceptable threshold.

2. Corruption and Corporate Governance

Good corporate governance is a key mechanism that reflects management effectiveness and builds confidence among stakeholders. The Company adheres to ethical principles, transparency, and integrity in conducting its business. Recognizing potential fraud and corruption risks, the Company has established systematic preventive measures through its Anti-Corruption Policy, Gift Acceptance Policy, and Whistleblowing Policy, together with whistleblowing channels and comprehensive information disclosure to all stakeholder groups.

The Company continuously reviews root causes and establishes preventive measures against fraud and corruption through an effective internal control system and risk assessments across all operational processes. It also enforces strict disciplinary measures and promotes a corporate culture of ethics and integrity through regular employee training. In addition, the Company is a member of the Thai Private Sector Collective Action Against Corruption (CAC) and encourages business partners to join the network to enhance transparency across the value chain. In 2025, no cases of fraud or corruption were identified within the organization.

3. Competition and New Market Entrants

Intensifying competition in the retail lending business driven by new market entrants requires the Company to accelerate the development of its products, interest rates, and service quality to enhance customer satisfaction and loyalty. The Company also continuously reviews its strategies and operating plans to adapt to changes in the industry and maintain competitiveness.

The Company aims to expand its customer base by increasing branch coverage across all areas to promote inclusive access to financial services (Financial Inclusion). It also regularly monitors customer satisfaction results and uses the findings to improve service delivery. In 2025, the Company maintained its position as the leading provider in the microfinance lending business and continued its commitment to becoming an international microfinance service provider.

4. Increase in Domestic Interest Rates

An increase in domestic interest rates may raise the Company’s financing costs. However, the Company charges loan interest rates below the legal ceiling, providing flexibility to adjust rates in line with future costs. The Company also diversifies its funding sources through debenture issuances and borrowings from both domestic and international sources to mitigate the impact of interest rate volatility.

In 2025, the Company signed agreements to receive funding support under credit facilities totaling more than USD 270 million with 3 global financial institutions, namely Bank of China (BOC), the Asian Development Bank (ADB), and Sumitomo Mitsui Banking Corporation (SMBC).

5. Funding from Financial Institutions

Funding is a key factor in supporting the expansion of the Company’s lending business. Excessive reliance on any single financial institution, as well as changes in lending policies within the industry, may affect the Company’s access to funding sources and liquidity. The Company therefore diversifies its funding sources both domestically and internationally to reduce financing costs and manage liquidity risk through various financial instruments, such as debenture issuances, bills of exchange, and loans from financial institutions. This enables the Company to maintain an appropriate financial structure and support stable business growth, while continuously reviewing its funding plan.

6. Financial Liquidity

Financial liquidity management is a key factor in supporting debt repayment capacity and maintaining confidence among investors and creditors. If the Company is unable to convert assets into cash or secure sufficient funding sources, this may lead to long-term financial challenges. The Company therefore prepares a liquidity management plan to ensure sufficient cash flow under both normal and crisis conditions through cash flow forecasting, monitoring of liquidity ratios, and appropriate funding planning. In 2025, the Company’s cash inflow to cash outflow ratio was 1.84, which met the prescribed criteria.

7. Cost-Effectiveness of Branch Expansion

Branch expansion is a key driver of the Company’s growth. However, opening new branches may pose risks relating to investment cost-effectiveness and may affect operating performance and investor confidence. The Company therefore has established a thorough branch opening analysis and planning process, taking into account area potential, population density, target customer groups, performance of nearby branches, and key financial indicators such as Payback Period and Return on Investment (ROI), in accordance with the prescribed criteria. The Company also continuously adjusts its customer acquisition strategies to enhance branch operating efficiency.

The Company has set a target for loan receivables per branch of not less than Baht 19 million. In 2025, loan receivables per branch stood at Baht 21.13 million per branch, with a continuing upward trend.

8. Increase in Non-Performing Loans

If borrowers are unable to make repayments as scheduled, the Company may lose its primary source of interest income and may incur partial or full loss of principal, which could affect profitability and business growth. To reduce the likelihood of non-performing loans, the Company regularly monitors debt management performance and applies the MTC Model, a key tool that enhances the systematic management of debt. The Company also sells such debts to asset management companies specializing in non-performing assets in order to transfer the risk associated with uncollectible debts. As a result, in 2025, the non-performing loan ratio was 2.53%, below the target of 2.8%.

9. Natural Disasters

The increasing frequency of storms and floods may damage the Company’s assets, particularly branch signage and advertising signs, resulting in repair or replacement costs and potentially affecting the Company’s image and the continuity of branch operations. In 2025, the Company communicated with branches to monitor and regularly inspect the stability and strength of signage, particularly during the rainy season and periods of storms, and reviewed its risk management approach.

10. Regulations Imposed by External Authorities

As a regulated credit service provider, the Company is required to comply with the rules and regulations of various regulatory authorities. Any non-compliance or incomplete compliance may affect the Company’s reputation and credibility, result in fines, and potentially lead to license revocation, which could have a significant adverse impact on future operations. The Company therefore continuously reviews and monitors laws and regulations issued by external authorities and adjusts its business operations accordingly. It also provides training and knowledge assessments for all employees at least once a year. In addition, the Company has established a legal compliance function responsible for reporting performance results to the Board of Directors and management at least twice a year. In 2025, the Company had no legal disputes.

11. Cyber Threats and Data Theft

Rapid technological development has made cyber threats increasingly complex and may affect the security of customer data, business continuity, and stakeholder confidence. The Company has therefore developed a secure and efficient information technology infrastructure, established strict cybersecurity policies and measures, continuously enhanced employee knowledge, and engaged external parties to review its systems annually to ensure that data management complies with prescribed standards. In 2025, the Company recorded no information security incidents or personal data breaches, in line with its target.

12. Increase in Domestic Goods Prices

The increase in goods prices affects the Company’s operating expenses. The Company therefore places importance on and manages this risk to control operating costs within an acceptable level. This includes preparing an annual budget, surveying product prices, and planning responses to price increases through a bulk buying strategy to maintain quality and keep expenses at an appropriate level. The Company also arranges alternative suppliers in cases where product prices are higher than expected. The average unit price, compared with the acceptable reference price, must not increase by more than 4%. In 2025, the Company was able to reduce the average product price by 1.37%, which was below the target threshold and helped strengthen the Company’s cost advantage in operations.

13. Occupational Health and Safety

Hazards arising from force majeure events may result in loss of life, harm to the safety of personnel and property, and operational disruptions. The Company therefore places importance on employee well-being by establishing policies on occupational health, safety, and the working environment, and by promoting occupational health and safety awareness through various internal communication channels. These efforts aim to minimize the rate of work-related accidents. In 2025, there were 74 accident cases.

14. Debenture Repayment Capacity

As the Company continuously raises funds through debenture issuances to support working capital for business operations, business expansion, and the repayment of debentures or bills of exchange, any inability to repay debenture obligations on time may adversely affect the Company’s image and investor confidence. The Company therefore regularly monitors and assesses its debenture repayment capacity, with the requirement that no default events occur. It also considers the interest rates of new debenture issuances to ensure they remain at an appropriate level. Over the past 3 years, including 2025, the Company had no record of default on debenture repayments. As a result, the Company was assigned a National Long-Term Rating of A-(tha) with a Stable Outlook by Fitch Ratings.

15. Inefficient Service Delivery

Customers are one of the Company’s key stakeholders. Inefficient service delivery may affect the business across multiple dimensions, not only by limiting the Company’s ability to retain its existing customer base, but also by reducing opportunities to expand into new customer segments. The ability to create customer satisfaction is essential for enabling the Company to move forward and grow sustainably in a highly competitive market. The Company provides training and guidance to employees to enhance service quality under the principle of “close service, like a trusted family member.” The Company also uses customer suggestions and complaints to improve its operations, resolves issues and responds to complaints comprehensively, and incorporates service performance into branch KPI assessments. The Company has set a customer satisfaction target of not less than 80%. In 2025, the Company achieved a satisfaction assessment result of 93.78%, exceeding the target. Nevertheless, the Company remains committed to continuously enhancing its service standards to an international level in order to create the highest level of customer satisfaction.

16. Carbon Tax (Emerging Risk)

Many countries have begun imposing carbon taxes, and Thailand is another country where such measures may become unavoidable. The Excise Department is preparing to introduce carbon tax measures. If enforced, this may increase the Company’s operating costs and expenses. The Company therefore needs to prepare response plans by raising awareness among employees at all levels on resource use through various communication channels. In addition, the Company collects resource consumption data on a monthly basis to monitor and analyze resource use and develop appropriate measures. The Company has set a target to limit the increase in its carbon footprint to no more than 10% from the previous year. In 2025, the Company’s carbon footprint decreased by 11.07%.

17. Inability to Achieve the Organization’s Greenhouse Gas Reduction Targets (Emerging Risk)

Greenhouse gas emissions reduction targets are a key global agenda and an important factor considered by investors in investment decision-making. Organizations that are unable to achieve such targets may be affected in terms of stakeholder confidence and sustainability assessments. The Company therefore places importance on closely monitoring greenhouse gas management performance, with clear targets and systematic action plans. In 2025, the Company implemented the following measures:

  • Enhancing climate change-related operations in alignment with the Task Force on Climate-related Financial Disclosures (TCFD), together with establishing targets and strategies to reduce carbon footprint in the short, medium, and long term.
  • Expanding the solar power project, with a long-term target to install solar power systems across all branches nationwide.
  • Continuing the electricity consumption management measures for office operations to raise awareness and reduce electricity consumption at branches.