Decision on External Bank Audit

RS Official Gazette, No 63/2025 Pursuant to Article 52, paragraph 3 and Article 56, paragraph 3 of the Law on Banks (RS Official Gazette, Nos 107/2005, 91/2010, 14/2015 and 19/2025) and Article 15, paragraph 1 of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 – CC decision, 44/2018 and 19/2025), the Executive Board of the National Bank of Serbia hereby issues the following D E C I S I O N ОN EXTERNAL BANK AUDIT I. INTRODUCTORY PROVISION

1. This Decision prescribes a set of criteria based on which the National Bank of Serbia shall draw up and publish a list of external auditors eligible to perform audit of financial statements of banks (hereinafter: List), and the minimum scope and contents of the external auditor’s report on the audited financial statements. II. CRITERIA FOR DRAWING UP AND PUBLISHING THE LIST OF EXTERNAL AUDITORS
2. In order to perform the audit of bank financial statements, the external auditor must meet the following criteria:

1. it complies with the conditions prescribed for an audit firm by the law on auditing;
2. it employs at least six certified auditors licensed to perform audit of financial statements, at least three of whom have a minimum three-year track record in auditing financial statements of banks;
3. it employs at least 20 people in its organisational unit in charge of audit;
4. the audit firm, its legal representative and persons referred to in item
5. hereof possess good business reputation. When assessing whether the audit firm, its legal representative and persons referred to in paragraph 1, item 2) hereof possess good business reputation, the National Bank of Serbia shall take into account in particular whether measures have been imposed against them in the quality control of the work of audit firms, in accordance with the law on auditing (including fines due to the established irregularities in work) or other measures in accordance with the regulations which may negatively impact their business reputation, given the type and severity of those measures.

2 The National Bank of Serbia shall evaluate the business reputation of the audit firm considering the entirety of its operations in its core business activity. The National Bank of Serbia shall assess business reputation of the audit firm’s legal representative, as well as of persons referred to in paragraph 1, item 2) hereof, considering their overall business experience and engagement, in particular whether they possess personal, moral and professional integrity and have a successful track record and reputation in their areas of work. The audit firm, the firm’s legal representative and/or a person referred to in paragraph 1, item 2) hereof shall be deemed not to have good business reputation if they have been convicted by final judgment, in the Republic of Serbia or in a foreign country, of a criminal offence or other punishable offence which makes them unfit for performing the audit of bank financial statements. 3. To become included in the List, the audit firm shall submit to the National Bank of Serbia a written request together with the supporting documents to prove compliance with the criteria set out in Section 2, paragraph 1 hereof. The documents referred to in paragraph 1 hereof shall be in Serbian and if they are originally in a foreign language, a translation into Serbian certified by a court-appointed translator shall be submitted together with the original or certified copy of the document. If the documents referred to in paragraph 1 hereof are neither in Serbian nor in English and it is not possible to obtain their translation into Serbian, the translation into English and translation from English to Serbian, certified by a court-appointed translator, shall be submitted. The National Bank of Serbia shall decide on the request from paragraph 1 hereof within 30 days from the date of receipt of the valid request. In the procedure of deciding about the request from paragraph 1 hereof, the audit firm shall present, upon the National Bank of Serbia’s request, the methodology of audit of bank financial statements it shall apply in its operations. 4. The National Bank of Serbia shall publish the drawn-up List on its website. The List shall contain the following data:

3

1. external auditor’s ordinal number;
2. external auditor’s business name and head office;
3. date and number of the National Bank of Serbia’s decision on the fulfilment of the criteria for inclusion in the List;
4. note including the data relevant for the auditing of bank financial statements, such as the data on suspension from Section 7 hereof. The National Bank of Serbia shall update the published List, and/or draw up and publish a new List, immediately upon adopting a decision whereby it established that the external auditor has met the criteria referred to in Section 2, paragraph 1 hereof or upon adopting a decision on removal of an external auditor from the List. Within the List, special records shall be kept about the external auditors which have been removed from the List, during five years after the adoption of the decision on removal from the List.

5. In case of any change in circumstances affecting the compliance with the criteria set out in Section 2, paragraph 1 of this Decision after the List is published – the external auditor shall promptly notify the National Bank of Serbia thereof. A listed external auditor shall submit to the National Bank of Serbia once a year and no later than 15 July of the current year the documents proving the fulfilment of the criteria from Section 2, paragraph 1 hereof as at 30 June of that year. Along with the documents from paragraph 2 hereof, the legal representative of the external auditor shall submit to the National Bank of Serbia a certified statement, given under material and criminal liability, proving the fulfilment of the requirements from Sections 2 and 8 hereof as at 30 June of the current year.
6. The National Bank of Serbia shall adopt a decision on the removal of an external auditor from the List in the following cases:

1. the external auditor ceased to comply with the criteria from Section 2, paragraph 1 hereof;
2. the external auditor and/or legal representative of the audit firm did not comply with Section 5 hereof;
3. the external auditor submitted false or incomplete data or documents within the meaning of Sections 2 or 5 hereof;
4. the external auditor acted contrary to Sections 8 or 9 hereof;

4 5) the external auditor failed to comply with Article 58, paragraph 1 of the Law on Banks (hereinafter: Law) and/or in the case referred to in Article 62 of the Law. In the case of removal from the List, the external auditor may not submit the request from Section 3, paragraph 1 hereof within five years from adoption of the decision on removal from the List. 7. If there are grounds to suspect that an external auditor failed to act in compliance with Article 58, paragraph 1 of the Law, the National Bank of Serbia may issue a decision on the suspension of such external auditor from the List until it finds out whether the auditor complied with that paragraph, but for no longer than 90 days. When it establishes that the external auditor acted in compliance with Article 58, paragraph 1 of the Law, and/or when the timeframe from paragraph 1 hereof expires, the National Bank of Serbia shall end the external auditor’s suspension from the List. Until the timeframe from paragraph 1 hereof expires, and/or until the National Bank of Serbia determines whether the external auditor complied with Article 58, paragraph 1 of the Law or not, the external auditor suspended from the List may complete the audit of financial statements of a bank initiated prior to the date of receiving the suspension decision, but may not take on new audit engagements. III. SPECIAL OBLIGATIONS OF AN EXTERNAL AUDITOR 8. A listed external auditor may not, in the course of the same year, engage in auditing of financial statements of a bank and provide it with consultancy services (e.g. bookkeeping and accounting, value appraisal, internal audit, IT, legal matters, business finance, advice or assistance, and/or other services), nor conduct an audit of financial statements for the year during which such services were provided. Furthermore, the listed external auditor may not conduct an audit of a bank’s financial statements for any year in which one of its employees was temporarily employed by that bank, including during the time the audit is being conducted. 9. The external auditor shall submit to the National Bank of Serbia, no later than 31 October of the current year, the plan of audit activities regarding individual audit of bank financial statements for that year, containing, as a minimum, areas of the bank’s business operations which will be subject to audit, description of the content of the planned audit by areas and envisaged duration of the audit.

5 At the request of the National Bank of Serbia, the external auditor shall submit the methodology of auditing bank financial statements it applies, as well as other information related to the conduct of audit. At the request of the National Bank of Serbia, the external auditor shall hold meetings with the National Bank of Serbia regarding the auditing of bank financial statements – prior to the commencement, in the course of and after the completion of the audit. Representatives of the bank whose financial statements were subject to audit may attend the meetings referred to in paragraph 3 hereof or be informed about their content by the external auditor. IV. MINIMUM SCOPE AND CONTENTS OF EXTERNAL AUDITOR’S REPORT ON THE AUDITED BANK FINANCIAL STATEMENTS 10. An external auditor’s report on the performed audit of annual bank financial statements (hereinafter: audit report) shall be compiled in compliance with the law on auditing and this Decision. The audit report shall include in particular:

1. external auditor’s opinion;
2. audited financial statements;
3. opinion on whether the performance report complies with financial statements for the same business year, along with the considered performance report;
4. letter on financial statements presentation;
5. analyses for the needs of the National Bank of Serbia. The external auditor’s opinion referred to in paragraph 2, item 1) hereof shall mean the opinion on whether the audited financial statements of a bank are compiled in accordance with the International Financial Reporting Standards within the meaning of the law on accounting and the National Bank of Serbia’s regulations, and whether they give a true and objective view, in all material respects, of the bank’s financial position, business performance and cash flows. Financial statements referred to in paragraph 2, item 2) hereof shall be enclosed in a summary form, which means that the forms of such statements comply with the decision on forms and content of items in the financial statement forms to be completed by banks, but they do not contain items with the value equal to zero, columns relating to financial statements mapping or

6 ADP codes. Notes to financial statements shall be submitted in full. Each individual summary financial statement form shall be signed by the management of the bank. A letter on financial statement presentation, signed by responsible bank officers, confirms that financial statements give a true and objective presentation of the bank’s financial position, business performance, cash flows and changes in equity for the relevant year and are in compliance with law. Analyses for the needs of the National Bank of Serbia shall contain: (А) Analysis of balance sheet, income statement and off-balance sheet assets, and (B) Business quality (solvency) analysis, also including potential adjustments made by the certified auditor and/or bank. А. Аnalysis of balance sheet, income statement and off-balance sheet assets 11. The analysis of balance sheet, income statement and off-balance sheet assets shall contain a brief comment by the external auditor on the bank’s balance sheet, income statement and off-balance sheet assets and their structure, and at least one separate review and an explanation of those balance and off-balance sheet positions that have changed significantly from the previous reporting period. B. Business quality (solvency) analysis 12. The analysis of a bank’s business quality (solvency) shall contain data pertaining to the following:

1. bank’s capital;
2. asset quality;
3. business performance indicators and risk exposure;
4. capital adequacy;
5. profitability;
6. human resources and organisational capacity;
7. information system.
8. Capital of a bank

13. Within data on a bank’s capital, it is necessary to:

1. comment on the bank’s capital before and after any adjustments made by the certified auditor or by the bank at the certified auditor’s suggestion;

7 2) draw up a list of the bank’s major shareholders, i.e. persons holding more than 5% of voting rights and state changes in the bank’s ownership structure in the course of the year; 3) analyse whether the shareholders are related in such a manner that they are thought to be acting as a single acquirer within the meaning of the provisions of the Law regulating ownership acquisition in a bank. 2) Asset quality 14. Within data on asset quality, it is necessary to:

1. show the structure of risk-weighted and non-risk weighted assets after adjustments, analyse risk-weighted assets and show value adjustment as an indirect write-off of investments in respect of balance sheet assets, and/or reserves for losses on off-balance sheet assets;
2. analyse the credit portfolio (loans, interests, assumed and potential obligations), materially significant debtors and their financial positions, loans approved to persons related to the bank within the meaning of the Law, as well as their financial position;
3. show interest-bearing and non-interest-bearing assets after adjustments and analyse their relationship, present the structure and level of receivables from other banks and comment on their collectability;
4. analyse transactions performed in the name and for the account of legal and natural persons, and if any risk-weighted investments are entered on the accounts of such persons, reclassify them to appropriate accounts;
5. state the amount of payments under guarantees issued, if any, and state whether the bank continues to provide guarantees to clients on whose behalf it has already made payments;
6. specify the average time period needed for the collection of payments made under guarantees.
7. Business performance indicators and risk exposure

15. Within data on business performance indicators and risk exposure, it is necessary to:

1. specify if, how many times and during which time period in the course of a year, the bank failed to comply with the prescribed capital adequacy ratio, exposure ratio (to a single person or a group of persons considered related persons within the meaning of the Law, as well as to the person related to the bank), investment ratio, liquidity ratio, and foreign exchange risk ratio, calculated in line with the National Bank of Serbia’s regulations;
2. state whether the bank has adopted procedures that ensure adequate internal controls and consistent application of the risk management strategy and policies, the procedures for risk identification and measurement,

8 i.e. the procedures for risk assessment and management of materially significant risks, as well as procedures for regular reporting on risk management issues to the bank’s bodies and the National Bank of Serbia; 3) provide a comment on the activities undertaken by the bank with a view to maintaining the prescribed values of ratios, particularly for the ratios violated in the course of the year, or the ratios that came close to the minimum and/or maximum prescribed values. 4) Capital adequacy 16. Within data on capital adequacy it is necessary to state the following:

1. if the bank has managed to maintain an adequate level of capital during the year – proportionate to the scope and type of its business activities and exposure;
2. if the National Bank of Serbia has set higher-than-prescribed capital adequacy ratios for the bank in view of the type and level of such bank’s risk exposure and business activities so as to ensure its safe and sound operations and the fulfilment of obligations to creditors;
3. if the bank applies appropriate procedures for monitoring and estimating the necessary level of capital considering the risks it is exposed or is likely to be exposed to in its future business operations.
4. Profitability

17. Within data on profitability, it is necessary to:

1. comment on the spread between the lending and deposit rates, analyse interest by the type of investment and appropriate source of funding, with special emphasis on the share of loans, and show the relation between: – profit (loss) and assets, – profit (loss) and total balance sheet capital, – interest income and assets, – interest expenses and liabilities, – net income/expenses in respect of impairment of financial assets and credit risk-weighted off-balance sheet items and assets;
2. analyse the interest-bearing and/or non-interest bearing assets and activities undertaken by the bank with a view to increasing the level of collectability and show the ratio of net interest income to interest-bearing assets;
3. comment on the structure of loss, and/or the amount of uncovered loss (causes and the year of incurrence, reasons for lack of coverage, as well as activities taken to eliminate the root causes of the loss incurred); interest income from impaired investments; interest expenses on deposits and loans taken; the manner of profit distribution.

9 6) Human resources and organisational capacity 18. Within data on human resources and organisational capacity, it is necessary to:

1. present the structure of the bank’s personnel, specifying the total number of employees: management, experts and auxiliary staff; members of the managing board (name and surname, and name of the legal entity which employs them) and of the executive board;
2. specify total gross and net remuneration to the president and members of the managing board, as well as total gross and net remuneration and earnings for the president and members of the executive board – earned in the bank;
3. show the bank’s organisational scheme with all organisational parts (branches, business units and representative offices in the country and abroad) and their seat.
4. Information system

19. Within data on the information system, it is necessary to:

1. describe the organisation and management of the information system and other technologies, its adequacy, reliability and compatibility with operations performed by the bank;
2. state whether the bank has adopted appropriate internal general acts that establish the framework for information system security management and assess the degree of physical protection of the bank’s data and information system.

20. The management letter shall contain, inter alia, all external auditor’s findings and recommendations regarding the effectiveness of internal audit, compliance control, the established risk management system and the system of internal controls of the bank. V. SPECIAL BANK OBLIGATIONS RELATED TO EXTERNAL AUDIT
21. A bank shall submit to the National Bank of Serbia adopted individual financial statements, along with the audit report, accompanied by the management letter, for the previous business year – within 120 days after the end of that year.

10 One copy of the audit report shall also be submitted to the committee for monitoring bank’s operations (audit committee). The bank shall submit consolidated annual financial statements along with the external auditor’s report to the National Bank of Serbia, for the previous business year, by no later than 150 days from the end of that year. The consolidated annual financial statements referred to in paragraph 3 hereof shall mean consolidated annual financial statements compiled in accordance with the law on accounting. External auditor’s report on the performed audit of annual consolidated financial statements of the bank shall be compiled in accordance with the law on auditing and shall contain the external auditor’s opinion and the consolidated financial statements that were audited. 22. No later than 15 days from the submission of audit report to the National Bank of Serbia, the bank shall publish:

1. complete external auditor’s report on its website and shall keep it on the website until the publication of the auditor’s report for the next business year. Within the meaning of this Decision, a complete external auditor’s report shall mean the audit report containing all the elements referred to in Section 10, paragraph 2, items 1) and 2) hereof;
2. external auditor’s summary report in at least one daily newspapers circulated in the territory of the Republic of Serbia. An external auditor’s summary report shall mean the audit report containing the elements referred to in Section 10, paragraph 2, items 1) and 2) hereof, excluding notes to the financial statements.

23. If the National Bank of Serbia refuses to accept the external auditor’s report, in accordance with Article 62 of the Law, the bank shall replace such report on its website with a report on a newly conducted audit prepared by another external auditor. If an error is detected in the published reports and data, the bank or the external auditor shall immediately inform the National Bank of Serbia thereof and the bank shall publish corrected reports and data without delay. VI. TRANSITIONAL PROVISION AND FINAL PROVISIONS
24. The List of External Auditors drawn up and published pursuant to the Decision on External Bank Audit (RS Official Gazette, Nos 41/2007, 59/2008, 67/2012 and 18/2015) shall continue to apply after the entry into force of this Decision and the listed external auditors shall submit for the first time to the

11 National Bank of Serbia the documents and statement from Section 5, paragraphs 2 and 3 hereof by 15 July 2026 and the plan from Section 9, paragraph 1 hereof by 31 October 2025. 25. This Decision shall supersede the Decision on External Bank Audit (RS Official Gazette, Nos 41/2007, 59/2008, 67/2012 and 18/2015). 26. This Decision shall be published in the RS Official Gazette and enter into force on 1 October 2025. NBS EB No 47 Chairperson 10 July 2025 of the NBS Executive Board B e l g r a d e G o v e r n o r of the National Bank of Serbia Dr Jorgovanka Tabaković, sign.