HKBN Ltd. — Governance Information 2025

Oct 31, 2025

HKBN Ltd.
香港寬頻有限公司
(Incorporated in the Cayman Islands with limited liability)
(the “Company”)

TERMS OF REFERENCE OF THE RISK COMMITTEE

Definitions

1. For the purposes of these terms of reference (the “Terms”):

“Articles” means the articles of association of the Company (as amended from time to time);

“Audit Committee” means the audit committee of the Company;

“Board” means the board of directors of the Company;

“Company” means HKBN Ltd.;

“Company Secretary” means the company secretary of the Company;

“Directors” means the members of the Board;

“ERM” means the enterprise risk management;

“Group” means the Company and its subsidiaries;

“Listing Rules” mean the Rules Governing the Listing of Securities on the Stock Exchange (as amended from time to time);

“Management” means any persons discharging an executive management role within the Group;

“Nomination Committee” means the nomination committee of the Company;

“Remuneration Committee” means the remuneration committee of the Company;

“Risk Committee” means the risk committee established by resolution of the Board in accordance with these Terms;

“Shareholders” means the shareholders of the Company from time to time; and

“Stock Exchange” means The Stock Exchange of Hong Kong Limited.

• 1 -

---

Purpose

1. The Risk Committee is to assist the Board in: (a) assessing and making recommendations on the risk appetite, profile and tolerance of the Group; and (b) the oversight of matters concerning the Group’s ERM framework, policies and systems (other than financial policies, systems and controls within the remit of the Audit Committee), bringing any issues to the attention of the Board.

Establishment

1. The Risk Committee was established by resolution of the Board on 22 January 2025.

Membership

1. The members of the Risk Committee shall be appointed by the Board from among the Directors and shall consist of not less than three members, a majority of whom shall be independent non-executive Directors. A quorum shall be two members of whom at least one shall be an independent non-executive Director.

2. Appointments to the Risk Committee shall be for a period of up to three years, which may be extended by the Board provided that a majority of the Risk Committee members remain independent non-executive Directors.

3. The chairman of the Risk Committee shall be appointed by the Board and shall be any one Director.

Attendance at meetings

1. With the agreement of the chairman of the Risk Committee, other Directors, external advisors and others persons may be invited to attend all or part of any meetings.

Frequency and procedure of meetings

1. Meetings of the Risk Committee shall be held not less than twice a year.

2. An agenda and other relevant documents should be sent in full to all members in a timely manner at least three days before the intended date of a meeting of the Risk Committee (or such other period as may be agreed by its members).

3. Meetings of the Risk Committee may follow the same procedures as those for meetings of the Board under the relevant provisions in the Articles.

4. Management is obliged to supply the Risk Committee with adequate information in a timely manner to enable it to make informed decisions. The information supplied must be complete and reliable. Where any member requires more detailed and complete information from Management, that member should make any additional necessary enquiries. The Risk Committee and each member shall have separate and independent access to Management.

5. 2 -

---

Annual general meetings

1. The chairman of the Risk Committee (or in his/her absence, his/her duly appointed delegate) shall attend the Company’s annual general meetings and be prepared to respond to any Shareholders’ questions on the Risk Committee’s activities.

Authority

1. The Risk Committee is authorised by the Board to perform any activity within these Terms. It is authorised to seek any information it requires from any employee of the Group and all employees are directed to co-operate with any request made by the Risk Committee.

2. The Risk Committee is authorised by the Board to obtain, at the Company’s expense, external independent professional advice and to secure the attendance of outsiders with relevant experience and expertise if it considers necessary. The Risk Committee shall be provided with sufficient resources to perform its duties. The Risk Committee shall be responsible for establishing the selection criteria, selecting, appointing and setting the terms of reference for any external party who advises the Risk Committee.

Duties

1. The duties of the Risk Committee shall include:

Risk appetite, tolerance and ERM framework and policies

(a) reviewing the Group’s overall risk appetite and tolerance and making recommendations to the Board;

(b) reviewing the Group’s ERM framework and related policies and making recommendations on any material changes to the policies to the Board;

(c) reviewing and assessing the effectiveness of the Group’s risk control and mitigation tools, approach and methodology, including but not limited to the Group’s ERM framework, internal audit function relating to risk management, business continuity and contingency plans;

Risk assessment and monitoring

(d) reviewing and approving the Group’s top risks annually, including but not limited to strategic, market, financial, business environment, law and regulatory compliance, climate, technology and operational, advising the Board on the likelihood and impact of principal risks and their management and mitigation;

(e) reviewing reports from internal audit that pertain to the objectives and responsibilities of the Risk Committee, and considering other internal audit matters as referred by the Audit Committee;

(f) reviewing material findings regarding the Group or any of its principal operating entities from regulators relating to risk management or assessment, and reviewing steps taken or proposed by Management to address the findings;

• 3 -

---

• 4 -

Risk management function

(g) monitoring and reviewing annually the effectiveness of the Group’s risk management function to ensure that it has adequate resources, budget, access to information and staff with appropriate qualifications, experience and training to enable it to perform its role effectively;

(h) ensuring the risk management function has adequate independence and appropriate standing within the Group, and the head of audit and risk has direct access to the Risk Committee and the chairman of the Board;

(i) discussing with the head of audit and risk any significant findings and recommendations arising from work undertaken, and reviewing and monitoring Management’s responsiveness to such findings and recommendations;

(j) being consulted on decisions regarding the appointment or removal of the head of audit and risk and his/her remuneration and evaluating his/her performance annually, working and liaising as necessary with the Nomination Committee and the Remuneration Committee;

(k) meeting with the head of audit and risk on a regular basis without Management being present, to discuss the remit of the risk management function and any issues arising from risk reviews and work undertaken;

Internal controls

(l) reviewing the Group’s risk management, internal control and compliance evaluation report to monitor the effectiveness of controls across key risk types;

Other responsibilities

(m) giving due consideration to all relevant laws, rules regulations and guidance applicable to the Group; and

(n) being provided with appropriate and timely training, both in the form of an induction programme for new members and on an ongoing basis for all members of the Risk Committee.

Reporting procedures

1. Full minutes of the Risk Committee’s meetings shall be kept by a duly appointed secretary of the meeting (who should normally be the Company Secretary or a duly appointed representative). The minutes shall be made available for inspection on reasonable notice by any Director. Minutes of meetings of the Risk Committee shall record in sufficient detail the matters considered by the Risk Committee and decisions reached, including any concerns raised by members or dissenting views expressed. Draft and final versions of minutes of such meetings should be sent to all members of the Risk Committee for their comments and records within a reasonable time after such meetings.

---

1. Without prejudice to the generality of the duties of the Risk Committee set out in these Terms, the Risk Committee shall report back to the Board and keep the Board fully informed of its decisions and recommendations, unless there are legal or regulatory restrictions on its ability to do so.

2. The Risk Committee should evaluate its own performance, these Terms and its membership annually to ensure it is performing its duties effectively and recommend to the Board any changes it considers necessary.

Terms available

1. The Risk Committee shall make these Terms available on request and by inclusion on the websites of the Company and the Stock Exchange to explain its role and the authority delegated to it by the Board.

Hong Kong, 31 October 2025