Tf Yim

Role: Chief Risk Officer & MIC for Risk Management (Interim MIC for Compliance Aug to Nov 2026) - Established and chaired of the Risk Management Committee and the Token Admission Review Committee. - Developed comprehensive risk management policies, guidelines and control framework for the firm. - Led the risk management department in creating and implementing the risk control framework across the company’s Virtual Asset Trading Platform (VATP) business to ensure effective risk identification, assessment, monitoring and mitigation. - Secured SFC Virtual Asset Trading Platform (VATP) licenses. - Member of the core management team responsible for presenting and engaging with the SFC during on-site inspections and demonstrations across eight key areas: Custody/Wallet Infrastructure, Cybersecurity, Anti-Money Laundering (AML), Know Your Customer (KYC), Market Surveillance, Trade Operations, Insurance, and Financial Requirements. - Leading DFX Global business expansion in Bermuda under the Bermuda Monetary Authority (BMA), including completing introductory call and submitting F license application in February 2026 for spot and perpetual futures derivative exchange. - Driving expansion in Dubai under the Virtual Assets Regulatory Authority (VARA), including obtaining approval to incorporate and preparing license application submission in March 2026 for exchange services, lending, and borrowing. - To serve as CEO for both Bermuda and Dubai exchanges, overseeing operations, regulatory compliance, and strategic growth initiatives. - Transitioned from Group CRO role to focus on executive leadership and international market development.

- Owner of all risk management policies for the Group and Chair of the Risk Management Committee. - Developed and managed a comprehensive risk management framework in respect to credit risk, market risk, liquidity risk, operational risk, technology risk and enterprise risk to ensure proper processes for risk identification, assessment, monitoring and mitigation are in place to ensure proper implementation of all risk management policies and guidelines. - Ensure risk management complies with SFC’s and MAS's regulatory obligations whilst taking practical approach to risk-based challenges and offer appropriate solutions. - Developed regular reports to senior management and provide advice to all departments from a risk and control perspective. - Designated Manager-In-Charge (MIC) of Risk Management in respect of Type 1 (Dealing in securities), Type 4 (Advising on securities) and type 9 (Asset Management) Licenses issued by Securities and Futures Commission in Hong Kong (SFC) - Helped secure an Approval-In-Principle (“AIP”) from the Securities and Futures Commission (SFC) to operate a virtual asset trading platform under a license for Type 1 (dealing in securities) and Type 7 (providing automated trading services). - Helped secure an uplift of Type 9 license by the SFC to manage a portfolio of 100% virtual assets. - Helped secure Singapore MAS approval for the CMS license to operate as a licensed fund management company (LFMC).

- Member of Hong Kong and Shanghai’s Local Enterprise Risk Committee and Regional Technology Risk Management Committee - Designed and developed the Shanghai’s Risk Control Self-Assessment (RCSA) and control testing framework in line with Hong Kong and global practice - Coordinated Hong Kong and Shanghai’s RCSA workshops with business and relevant stakeholders to identify key risks and assign monitoring scripts for periodic self-assessments - Monitored the design and operating effectiveness of 1st line of Defense Controls to ensure independence in monitoring and challenging of the processes/controls in order to ensure discipline and consistency with risk standards, policy and appetite. - Ensured the ORM procedures are set up to implement and monitor the adherence to the ORM risk policies of the bank and other related procedures and guidelines. - Reporting, investigating and escalating Operational Risk Incidents/Issues as well as tracking its related action plans - Liaise with Global and Local Information Security Officer and Head of Technology on information security controls - Developed and promoted a risk-conscious culture, promoting transparent communication and reliable, integrated risk reporting/information. Ensured pro-active interaction and communication between the ORM and other control functions (e.g. Credit Risk, Market Risk, Compliance and Legal) - Conducted Operational Risk Awareness trainings to all staff in Hong Kong and worked with Human Resources to incorporate operational risk as part of the on-boarding training programme

- Regional coverage across Greater China North Asia (GCNA) including China, Taiwan, Korea, Japan and Hong Kong. - Created and continually enhanced a robust Operational Risk governance framework to deal with the evolving business landscape across GCNA and its respective outsourcing hubs in Malaysia and India. - Managed Operational risk and controls whilst promoting a culture of proactive risk management, issue self identification and risk awareness by creating a number of GCNA Risk Dashboards, Operational risk initiatives and Regional Risk Forums - Support the development of effective surveillance and monitoring parameters such as Key Control Indicators (KCIs) and Control Self Testing (CSTs). - Review and analyze the key operational risks and control related data trends and root causes. Ensure timely reporting and escalation of risk events or significant incidents, and work with the process and business owners to develop action plans to remediate and mitigate risks. - Initiate, drive and enhance functions in Financial Market Operations across GCNA through various inspections and observations as well as onsite visits to Malaysia and China to identify common risks/gaps and develop practical solutions across all GCNA to ensure alignment to both local and regional policy requirements and standards. - Perform risk assessment of new business initiatives including new product or process development such as Bond Connect and the partial restarting of the Equity Business. - Ensure all changes in policies, procedures, projects and regulations are updated and embedded within the Operations structure.

- Risk Assessment: Identify and assess the risk rating of current and potential process as well as identifying control failures and gaps. Make suggestions on how to mitigate the risks and perform analysis of recently implemented mitigating controls to ensure it has been fully and consistently implemented. - Challenge the status quo: Challenge the risk and control framework to further enhance the control environment - Incident Review and Analysis: Escalate timely to senior management and investigate the incident in terms of the background, timeline, root causes and financial/customer/regulatory impact in order to come up with common risk themes and issues before making recommendations on corrective actions such as preventive and detective controls. - Key Risk Indicators (KRIs) and Analysis : Work with the Operations teams and other regional/functional Operations groups to identify key risk indicators, to set thresholds for escalations, to highlight areas of exceptions/concerns whilst working with line managers on remediation efforts. Risk and Control Self-Assessment (RCSA): Work with line managers in ensuring the RCSA risk and control templates reflect the current risk environment and vet through RCSA issues raised to ensure effective remediation - New Product Process/Migrations: Provide guidance and advice from a risk and control perspective to ensure risks arising from new products and/or business, migrations, etc. are properly addressed and approved - Coordinate to ensure timely and accurate responses to queries from Audit and regulators as well as mitigation actions development with the aim of no repeated issues and no high risk issues. - Project Management: Managed a portfolio of risk mitigating projects with the objective to minimize risk and streamlining processes. Plan effectively on the project scope with consideration of delivery constraints whilst maximizing benefits and mitigating risk.

Audited Functions included but not limited to: Risk Model Governance – (Regional Lead within a Global Audit) Market Risk Management Governance – (Regional Lead within a Global Audit) New Business Group/New Product Approval – (Regional Lead within a Regional audit) Risk Control and Self-Assessment (RCSA) – (Regional Lead within a Regional Audit)

- Monitored the risk profile of transactions and strategies undertaken by the CIO businesses (i.e. FX and Fixed Income products). Ad hoc analysis and reporting with daily due diligence, calculating utilization of potential transactions and determining impact to limits. - Monitored various risk measures used to determine the market risk profile of the portfolio, specifically Value at Risk (VAR), asset/liability management and non-statistical qualitative risk assessments. - Participated with colleagues globally in establishing guidelines, standards and best practices for CIO risk management. - Participated in risk related matters, including completing risk analysis of CIO's existing and new transactions regarding impact on VaR and Stress limits, policies, and methodologies.

- Analyzed trading strategies and developing detailed knowledge of trading positions within the Equities business (i.e. Delta1, Prime Services and Structure Equities Transactions). - Provided regular summaries of market risk exposures, P&L and pipeline deals. - Created, produced and validated daily risk and limit exposure reports as well as constant interactions with other risk departments, head traders and senior management to ensure all the risk exposures within the Equities businesses are properly managed in accordance with the internal and external policies/mandates/limits. - Back tested, stress tested, and approved a number of Structure Equity Transaction deals

- Constructed performance analysis (qualitative and quantitative) as well as gathering and reviewing Hedge Fund documents (i.e. Due Diligence Questionnaire and Prospectus) - Compilation, on an ad hoc basis, of standard due diligence and analysis, including review of public records, reference checks, legal/compliance checks and news sources.