Reporting Requirements in Terms of Regulation 46

CONFIDENTIAL P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za Ref.: 15/8/1/3 D2/2024 To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act 94 of 1990 Reporting requirements in terms of regulation 46 of the Regulations relating to Banks Executive summary Regulation 46 of the Regulations relating to Banks (Regulations) imposes specified reporting duties on the auditors of banks, controlling companies and branches of foreign institutions. The purpose of this Directive is to specify detailed references to the regulatory returns that have to be audited, reviewed or concluded upon under a limited assurance framework in part fulfilment of the auditors’ respective reporting requirements in relation to regulation 46 of the Regulations. This Directive incorporates the changes brought about as a result of the amendments to the requirements relating to securitisation exposures and the revised form BA 500 gazetted on 30 September 2022 (Government Gazette No. 46996), with an effective date of 1 October 2022. This Directive replaces Directive 5 of 2023 dated 20 July 2023.

1. Introduction 1.1 Regulation 46(1) of the Regulations requires the auditor of a bank to report annually, within 120 days of the financial year end, on the bank’s financial position and the results of its operations, as reflected in the regulatory returns specified in regulation 46(6) of the Regulations. 1.2 In addition to reporting on the quantitative aspects, the auditor is also required to report on qualitative aspects of the bank and its operations, including, but not limited to the bank’s system of internal controls. 1.3 Regulation 46(6) of the Regulations further requires that the auditor’s reports contemplated in the same regulation be rendered in accordance with the wording and practices agreed from time to time between the Prudential Authority (PA), the South African Institute of Chartered Accountants and the Independent Regulatory Board for Auditors (IRBA).

2 1.4 The Committee for Auditing Standards of the IRBA is mandated with the review and approval of the illustrative regulatory reports referred to in regulation 46(6) of the Regulations, in line with required due process. The latest approved versions of these illustrative regulatory reports are published on the website of the IRBA1 for use by auditors in fulfilment of the reporting requirements stipulated in regulation 46 of the Regulations. 1.5 In respect of regulatory reports pertaining to South African operations, the illustrative regulatory reports referenced above comprise Parts A to I, with Parts A to E addressing the reports required in terms of regulation 46(6) of the Regulations and structured in accordance with the type of audit, review or limited assurance engagement conducted, including the associated levels of assurance. These are: • Part A – Audit report on the year-end BA returns; • Part B – Review report on the year-end BA returns; • Part C – Limited assurance report on risk returns at year-end; • Part D – Limited assurance report on risk returns at year-end derived from internal models; and • Part E – Limited assurance report on BA 325 daily market risk returns. 1.6 In respect of regulatory reports pertaining to foreign operations, the illustrative regulatory reports referenced above comprise Parts A to H, with Parts A to D addressing the reports required in terms of regulation 46(6) of the Regulations and structured in accordance with the type of audit, review or limited assurance engagement conducted, including the associated levels of assurance. These are: • Part A – Audit report on the year-end BA 610 return; • Part B – Review report on the year-end BA 610 return; • Part C – Limited assurance report on risk lines of the BA 610 return at year￾end; and • Part D – Limited assurance report on risk lines of the BA 610 return at year￾end derived from internal models. 2. Directive 2.1 Based on the aforesaid and in accordance with the provisions of section 6(6) of the Banks Act, 1990 auditors of banks are hereby directed as follows: 2.1.1 To perform an audit, review or limited assurance engagement on the respective regulatory returns specified in regulation 46(6) of the Regulations, in accordance with the detailed audit matrix provided in Annexure 1 for reports submitted to the PA in relation to engagements for financial years ended on or after 30 September 2023 for the purposes of reporting in terms of Parts A to E or Parts A to D of the illustrative regulatory reports in relation to South African and foreign operations respectively. 2.1.2 The reports submitted to the PA, in relation to the above, shall be rendered in accordance with the illustrative regulatory reports published by the IRBA from time to time. 1 https://www.irba.co.za/industry-specific-guides-and-regulatory-reports-pages/reports-to-the-prudential￾authority-and-the-exchange-control-department

3 2.1.3 Parts A to E and Parts A to D of the respective reports submitted to the PA shall make reference to this Directive insofar as the detail of audit, review or limited assurance work performed is concerned. 3. Acknowledgement of receipt 3.1 Kindly ensure that a copy of this directive is made available to your institution’s external auditors. In addition, the attached acknowledgement of receipt, duly completed and signed by both the Chief Executive Officer of the institution and the said auditors, should be returned to the PA at the earliest convenience of the signatories. Fundi Tshazibana Chief Executive Officer Date: Encl.: 1 The previous directive issued was Directive 1/2024, dated 5 March 2024.