Page 82 - BAM ONE REPORT 2564 (ENGLISH VERSION)

80 Part 1
Business Operation and Performance

Risk of the insurance taken out by the Company not fully covering the risk of loss to the Company
The Company generally takes out three types of insurance against risks: (a) directors and officers liability insurance,
(b) all risks insurance for its office buildings, including third party liability insurance, and (c) fire insurance for constructions
located on the collateral underlying NPLs and NPAs. Although the Company believes that the said insurance could
cover any potential damage and plans to continue such insurance coverage, it is likely that the said insurance may not
adequately cover the damage and loss that may arise in the future (e.g. damage to the collateral underlying NPLs or
NPAs that is not caused by fire). If the insurance does not cover such damage and loss, there could be a significant
adverse impact on the Company’s financial position and performance. However, if the Company chooses to expand
the insurance coverage, it will have to pay the premium at a higher rate. Besides, it may not be able to acquire insurance
policy that provides the coverage and economic benefits as desired or may even be unable to acquire any insurance
policy at all.

Risk from accident or intrusion into the Company’s properties
The Company may encounter various situations in relation to the properties in its possession such as in the case
where an injury from accident occurs on the Company’s property or nearby area or there is an intruder illegally utilizing
its property, which mostly occurs before a transfer of such property to the Company. Its property inspection and
prevention measures may not efficiently protect against all potential accidents, intrusion, hostile possession or illegal
use of its properties. As such, it is likely that the Company may face claims for damages from those injured in any such
accident, or those who have illegally used its properties may cause damages for which the Company is made jointly
liable, or the intruders may occupy or use its properties in a wrongful manner. Then, the Company may have to take
some actions and relatively incur a great amount of expenses in order to restore its possessory rights over those
properties or may even fail to acquire the possession of those properties, thereby likely resulting in a decline in value
of such properties. Previously, the Company encountered a situation where it was unable to enter the properties
transferred or acquired from collateral enforcement because there were intruders on the properties, which led to a
delay in recognition of revenue from value of such properties and may accordingly have a negative impact on its
financial position and performance.

Risk from access to or use of information that may tarnish the Company’s reputation and adversely affect
its business
Since the Company has to process abundance of customer data in its business operation, it is therefore prone
to risk concerned with the access to and management of such information, including:
(a) The protection of data compiled and stored in the Company’s IT system, as well as the protection against
the intrusion of the IT system by outsiders or against the error or offence committed by the Company’s
employees;
(b) The importance given to data privacy, disclosure and protection; and
(c) The compliance with laws governing the use and disclosure of personal information.

Thailand begins to attach greater importance to laws and regulations on cyber security and personal information
protection, as evident from the promulgation of the Personal Data Protection Act B.E. 2562, which was published in
the Government Gazette on May 27, 2019 and is the first information protection legislation in Thailand. After this Act