Notice No. 08/2024 on Operating Rules and Prudential Requirements for Microfinance Financial Institutions

PUBLISHED IN THE OFFICIAL GAZETTE, SERIES I, NO. 242, OF DECEMBER 20, 2024 NOTICE NO. 08/2024 SUBJECT: THE FINANCIAL SYSTEM − Operating Rules and Prudential Requirements Applicable to Microfinance Financial Institutions In light of the dynamic operations of the Angolan Financial System, the adoption of internationally recognised best practices, and the continuous emergence of novel institutions and, by extension, new financial products and services, there is an imperative to foster microfinance initiatives within the country. The primary objective of this initiative is to facilitate the expansion of microfinance activities. The objective is to stimulate new operators and promote financial and social inclusion, thereby generating new economic activity, jobs and income for Angolan families. This is in line with the objectives defined in the National Development Programme, sustainable economic development, diversification and inclusive growth. Following the publication of Presidential Decree no. 165/24 on 18 July, which approves the Regulation of Microfinance Financial Institutions and grants the National Bank of Angola the authority to oversee the operations of these non￾banking financial institutions, it is essential to define the operating rules and prudential requirements applicable to Microfinance Financial Institutions, whose nature is to provide financial services, among others, small and medium-sized operations, namely credit operations and small deposit-taking, commensurate with their risks, business model, nature and level of complexity. In accordance with Article 4 of the Regulations on Microfinance Financial Institutions, as approved by Presidential Decree 165/24 of 18 July, and in conjunction with Article 9(3) and Article 166 of Law 14/ 21 of 19 May, the Law

CONTINUATION OF NOTICE No. 08/2024 Page 2 of 26 on the General Regime of Financial Institutions, as well as Article 31(1)(d) and Article 98(1)(f) of Law 14/21 of 19 May. º 14/21, of 19 May, Law on the General Regime of Financial Institutions, as well as Article 31(1)(d) and (f) and Article 98(1), both of Law 24/21, of 18 October, Law of the National Bank of Angola. I HEREBY DETERMINE: CHAPTER I GENERAL PROVISIONS Article 1 (Object and Scope) This Notice establishes the operational rules applicable to Microfinance Financial Institutions, solvency ratios and the composition of regulatory own funds, classification and provisions of operations, accounting and reporting. CHAPTER II ACTIVITIES AND SHARE CAPITAL Article 2 (Deposit Taking and Credit Granting) In accordance with Article 5(2) of the Microfinance Financial Institutions Regulations, as approved by Presidential Decree 165/24 of 18 July, Microfinance Financial Institutions are permitted to accept deposits and grant credit, subject to the following limits: a) Deposit-taking up to a maximum of Kz 10 000 000.00 (ten million Kwanzas) per individual client, with the respective balance not exceeding this amount. exceeding the same amount; b) Deposit-taking up to a maximum of Kz 20,000,000.00 (twenty million Kwanzas) per corporate client, with the respective balance not exceeding the same amount;

CONTINUATION OF NOTICE No. 08/2024 Page 3 of 26 c) Financial investments in securities and term deposits, the residual maturity of which must not exceed one (1) year; d) Granting of credit up to a maximum of Kz 10,000,000.00 (ten million Kwanzas) per individual client; e) Granting of credit up to a maximum of Kz 20 000 000.00 (twenty million Kwanzas) per corporate client. Article 3 (Share Capital) Microfinance Financial Institutions shall be incorporated and remain in operation with the minimum regulatory share capital, defined in specific regulations. CHAPTER III CAPITAL REQUIREMENTS Article 4 (Own Funds) The Own Funds of Microfinance Financial Institutions, established under the terms of this Notice, include Tier 1 and Tier 2 own funds. Article 5 (Tier 1 Capital)

1. Level 1 own funds must be used to cover risks or losses incurred by the company. They must be distinguished by their quality, permanence, degree of subordination, capacity and timeliness to absorb losses. In addition, where applicable, the possibility of deferring or cancelling their remuneration must be taken into account.
2. Tier 1 own funds are made up of positive and negative elements.

CONTINUATION OF NOTICE No. 08/2024 Page 4 of 26 3. For the purposes of the previous paragraph, the following shall be considered positive own funds: a) Paid-up share capital; b) Legal, statutory and other reserves formed by undistributed profits; c) The positive net result for the previous financial year; d) The positive net result carried forward from previous financial years; and; e) The provisional positive result for the current financial year. 4. For the purposes of paragraph 2 of this Article, the following shall be regarded as negative elements of own funds; a) Intangible assets b) Negative net profit carried over from previous financial years; c) The negative net result for the last financial year; d) The negative result of the current financial year; and e) Own shares. Article 6 (Tier 2 Capital) Complementary own funds are the amounts corresponding to: a) Funds; b) Reserves arising from the revaluation of fixed assets; c) Other positive revaluation reserves; d) Subordinated loans with a term of more than five years, the terms of which are approved by Banco Nacional de Angola, and which may be considered up to 50 per cent of Tier 1 own funds; and; e) Hybrid capital and debt instruments, the terms of which are approved by National Bank of Angola.

CONTINUATION OF NOTICE No. 08/2024 Page 5 of 26 Article 7 (Calculation of the Regulatory Solvency Ratio)

1. The Regulatory Solvency Ratio (RSR) is the ratio between the Regulatory Own Funds (ROF) and the amounts exposed to the risks inherent in the operations carried out.
2. For calculation purposes, the values at risk are segregated according to exposure, according to the following formula: ROF = (Regulatory Own Funds /(VAPRC+VEAPRO) *100)
3. The formula set out in the previous paragraph is made up of the elements described below: i. RSR = Regulatory Solvency Ratio; ii. Regulatory Own Funds (ROF) = Own Funds (Level 1) + Own Funds (Level 2); iii. VAPWCR– Value of assets weighted by credit risk, including off-balance sheet items; and, iv. EVAWOR – Equivalent value in assets weighted by operational risk. Article 8 (Eligibility of Tier 2 Capital) Tier 2 Own Funds may correspond to a maximum of 100 per cent of the value of Tier 1 Own Funds, net of the deductions provided for in Article 6(4) and which meet the other conditions set out in this Notice.

CONTINUATION OF NOTICE No. 08/2024 Page 6 of 26 Article 9 (Compatibility with the Risk Level of the Assets) Microfinance Financial Institutions, regardless of the minimum capital and regulatory own funds, must keep the value of their own funds compatible with the degree of risk of the structure of their assets, to be established in specific regulations. Article 10 (Regulatory Solvency Bonds)

1. Microfinance Financial Institutions must: a) Maintain own funds at the minimum values established in this Notice; and b) Maintain at all times an appropriate ratio between the amount of its own funds and the amount of its assets and off-balance-sheet items weighted according to the risks involved, in particular credit risk and operational risk.
2. Microfinance Financial Institutions shall maintain a level of capital commensurate with the nature and scale of their operations and the inherent risks, and shall maintain a Regulatory Solvency Ratio (RSR) of not less than 12 per cent (twelve per cent). Article 11 (Credit Risk)
3. Microfinance institutions shall calculate the own funds requirement to cover credit risk, as set out in specific rules, taking into account all activities, excluding the trading book and assets deducted directly from own funds, for the following risk classes: a) Public entities; b) Organisations;

CONTINUATION OF NOTICE No. 08/2024 Page 7 of 26 c) Financial institutions; d) Companies; e) Retail portfolio; f) Positions secured by real estate; g) Overdue items; h) Covered bonds or public sector bonds; and, i) Other elements. 2. National Bank of Angola shall define in specific regulations the structure and minimum content of the reports and other information that must be submitted under this article. Article 12 (Operational Risk)

1. Microfinance Financial Institutions shall calculate the own funds requirement to cover the operational risk of their activities in accordance with the basic indicator, standard or alternative standard methods set out in specific regulations on the own funds requirement to cover operational risk.
2. Microfinance institutions shall apply the provisions of this Article on a consolidated and individual basis, as appropriate: a) The calculation of the regulatory capital requirement to cover operational risk shall be made on a consolidated basis, according to the method used by the institution, and on an individual basis, provided that the requirements applicable to all entities in the financial group are met; b) the combined use of different methods for calculating the regulatory capital requirement to cover operational risk on a consolidated basis may be used only in exceptional cases, with the approval of the National Bank of Angola, namely in the case of the acquisition of new

CONTINUATION OF NOTICE No. 08/2024 Page 8 of 26 financial institutions or business lines, where a transitional period may be required for the application of the approved method; and, c) The combined use referred to in the previous paragraph is subject to the institution's commitment to use only one method in accordance with the action plan approved by the National Bank of Angola. 3. The National Bank of Angola shall establish in specific regulations the structure and minimum content of the reports and other information to be submitted in accordance with this Article. CHAPTER IV OTHER PRUDENTIAL REQUIREMENTS Article 13 (Prudential Limits on Major Risks and Holdings in Non-Financial Companies)

1. Microfinance Financial Institutions shall establish operational procedures linked to sound, effective and complete internal control policies and processes to identify all situations of risk concentration and to monitor the limits referred to in this Article.
2. Microfinance Financial Institutions shall consider the direct risk or the risk of the guarantors of operations, provided that they apply consistent and uniform methodologies.
3. The National Bank of Angola shall define, in specific regulations, the information obligations in terms of structure, specifying the main risks and the exposures subject to and exempted from the limits, as well as the nature of the mitigants.

CONTINUATION OF NOTICE No. 08/2024 Page 9 of 26 Article 14 (Liquidity risk)

1. Microfinance institutions must comply with regulatory limits on liquidity and observation ratio, as defined in specific regulations.
2. Microfinance Financial Institutions shall apply the provisions of this Article on a consolidated and individual basis, as appropriate.
3. The parent undertaking of a financial group shall apply the provisions of this Article on a consolidated basis to the activities of the financial group of which it is a part, in order to ensure consistency and convergence of approaches to liquidity risk.
4. The National Bank of Angola shall define, in specific regulations, the quantitative analysis requirements, as well as the structure and content of the reports relating to the liquidity ratio and the observation ratio. Article 15 (Interest Rate Risk in the Portfolio of Microfinance Financial Institutions)
5. For the purpose of calculating the interest rate risk of the portfolio, Microfinance Institutions shall consider an instantaneous positive or negative shock of 2% (two per cent) in the interest rate resulting in a parallel movement of the yield curve of the same magnitude, estimating the impact on the present value of cash flows and on the interest margin.
6. The National Bank of Angola shall define in specific regulations the analysis and reporting requirements associated with the impact of a standardised interest rate shock on the economic value of future cash flows associated with the portfolio and the interest margin.

CONTINUATION OF NOTICE No. 08/2024 Page 10 of 26 Article 16 (Leverage Ratio)

1. The National Bank of Angola defines the requirements for the calculation of the leverage ratio in specific regulations.
2. For the purposes of the preceding paragraph, institutions shall comply with the minimum leverage ratio requirement of 3% (three per cent) by dividing the measure of an institution's Tier 1 capital by the measure of that institution's total exposure, in accordance with the methodology established in specific regulations.
3. Microfinance financial institutions shall calculate the leverage ratio on the reporting date and shall at all times comply with the minimum requirement established in the previous paragraph.

CONTINUATION OF NOTICE No. 08/2024 Page 11 of 26 Article 17 (Interest Rates)

1. Interest rates between Microfinance Financial Institutions and their clients are freely negotiated.
2. Subject to the provisions of the previous paragraph, interest rates that constitute usury shall not be practised. Article 18 (Credit Classification and Provisioning) The rules for the classification of loans granted are applicable to microfinance financial institutions, and the corresponding provisions must be established according to the level of risk assumed, under the conditions to be defined in specific regulations. Article 19 (Changes to the Basis for Calculating Prudential Ratios and Limits) The National Bank of Angola may decide to adjust the amounts used to calculate the limits set out in this Notice whenever the conditions of compliance with the principles of prudence so warrant. Article 20 (Reserves)
3. Microfinance Institutions must have a legal reserve to cover possible losses.
4. Without prejudice to the provisions of the previous paragraph, the National Bank of Angola may determine the constitution of compulsory reserves and other liabilities that it may determine.

CONTINUATION OF NOTICE No. 08/2024 Page 12 of 26 CHAPTER V SUPERVISION Article 21 (Supervision) Microfinance financial institutions are subject to prudential and behavioural supervision in accordance with the provisions of Law No. 14/21 of 19 May, the Law on the General Regime of Financial Institutions and its related regulations. Article 22 (Property acquisition) Microfinance Financial Institutions are prohibited from acquiring real estate for consideration, with the exception of real estate necessary for their own premises or those of their groupings. In the event that the acquisition is for the purpose of repaying their own loans, the real estate must be sold within one year. Article 23 (Corporate Governance and Internal Control) The corporate governance model applicable to Microfinance Financial Institutions is established in specific regulations. CHAPTER VI RISK GOVERNANCE Article 24 (Risk Governance)

1. The Management Body must have an overview of the Institution's overall risk profile, considering credit, liquidity and operational risks, classifying them as material or immaterial.

CONTINUATION OF NOTICE No. 08/2024 Page 13 of 26 2. Without prejudice to the provisions of the previous paragraph, Microfinance Financial Institutions must consider the concentration of risks, including inter￾and intra-risk concentration. 3. The National Bank of Angola shall define in specific regulations the risk management functions, policies and processes for the identification, assessment, monitoring, control and provision of information for the management of the respective risks. Article 25 (Ability to Take Risks)

1. Microfinance Financial Institutions are required to formalise their risk-taking capacity in accordance with prudent and consistent assumptions.
2. For the purposes of the previous paragraph, Microfinance Financial Institutions must consider at least the following factors: a) Financial capacity; b) Management capacity; c) Competitive dynamics of the market in which they operate. d) Operational flexibility; and e) Internal control systems.
3. The Management Body of Microfinance Financial Institutions shall be responsible for establishing the methods to be used in determining the institution's risk-bearing capacity and for documenting the assumptions made therein in a clear and objective manner. This shall ensure that their adequacy is verified at least annually and whenever relevant changes occur in the factors referred to in the previous paragraph.
4. Microfinance Financial Institutions must ensure that the risks assumed are covered by the limits formally defined and approved in their risk management policy.

CONTINUATION OF NOTICE No. 08/2024 Page 14 of 26 Article 26 (Risk Appetite)

1. Microfinance Financial Institutions must adequately consider risk appetite in their risk management strategies, policies and risk management strategies, policies and processes, which should be aligned with the institution's risk￾taking capacity and overall strategy.
2. The Board of Directors is responsible for defining the institution's risk appetite, considering its strategy and long-term objectives, as well as its adaptation to changes in business, macroeconomic and market conditions.
3. Whenever the Board of Directors approves an increase in the risk of a particular activity, it must counterbalance this by reducing the risk of another activity, so that the institution remains within the risk appetite initially defined.
4. When determining risk appetite, Microfinance Financial Institutions should consider the following measures: a) Quantitative, which can be translated into risk limits that can be aggregated and disaggregated to allow the measurement of the risk profile against the appetite and capacity to assume risk, and b) Qualitative, to measure risks that cannot be quantified, namely the reputational consequences of ineffective management of conduct risk. Article 27 (Strategy)
5. It is the responsibility of the Board of Directors to define a viable risk strategy. This strategy must be capable of withstanding economic cycles and consistent with the risk-taking capacity and risk appetite of the company.

CONTINUATION OF NOTICE No. 08/2024 Page 15 of 26 2. The risk strategy and its level of detail must be appropriate to the nature of the activity, size, complexity and consider the risk content of each business in which it operates, always ensuring consistency with the business strategy. 3. When formulating the strategy, institutions should consider their legal structure, key business lines, the breadth and diversity of the markets, products and jurisdictions in which they operate or plan to operate,, macroeconomic conditions and common market practices, as well as domestic and foreign legal requirements and their respective updates. 4. The strategy defined by the Management Body must consider the level of sophistication of the institution's information and communication systems, as well as its risk management systems and processes. 5. The risk strategy should contain the objectives for risk management with regard to the material activities and significant risks of the institutions, including a definition and formalisation of the institution's risk appetite, based on credible assumptions and reliable and current information. 6. Without prejudice to the delegation of powers to employees with management responsibilities, the Management Body must ensure that the strategy is implemented and monitored. 7. The Management Body must establish a system of limits across the institution in order to ensure compliance with the strategy and the ability to take risks. 8. The limits system must include sub-limits and alerts adapted to the business unit or entity and the types of risks, for exposures to counterparties or groups of counterparties linked to each other, sectors or industries, as well as exposures to specific products, currencies, localisations or markets. 9. The Management Body must ensure that risk acceptance policies and processes are developed that are consistent with the risk management strategy and risk appetite.

CONTINUATION OF NOTICE No. 08/2024 Page 16 of 26 10. In reviews of the risk strategy, risk appetite, risk management policies and limits system, the results of stress tests should be considered. 11. When defining their strategy, institutions must determine the relationship between the risk and return of their investments, considering the cost of capital and the respective own funds available to cover it, regulatory requirements and those resulting from the assessment of the institution itself, as well as its liquidity situation. 12. The Management Body must periodically review the institution's financial results, at least quarterly, and on the basis of this analysis, determine any changes to the risk strategy. 13. The Management Body and employees with management responsibility must ensure that the risk strategy is properly documented and reviewed at least annually to reflect changes in risk appetite, risk profile, risk-taking capacity and macroeconomic and market conditions. 14. The Management Body and employees with management responsibilities must ensure that the contents of the risk strategy, as well as any changes arising from its revisions, are communicated internally to the areas directly related to the respective contents, in order to guarantee consistency in the overall operation of the institution. Article 28 (Concentration of Risk)

1. Microfinance Financial Institutions (MFI) must give due consideration to risk concentration in their risk management strategies, policies and processes. They should clearly define the responsibilities of relevant employees and develop processes for identifying, evaluating, monitoring, controlling and reporting on risk concentration, taking into account both inter- and intra-risk concentration.

CONTINUATION OF NOTICE No. 08/2024 Page 17 of 26 2. Employees with management responsibilities must periodically assess and review the influence of risk concentration on the institution's business strategy and, similarly, the influence of business strategy on risk concentration itself. 3. Institutions should define what constitutes a material concentration, which should be aligned with their risk-bearing capacity and risk appetite and should also determine the level of risk concentration resulting from the different risk positions accepted, taking into account their strategy, size and geographical location. 4. The risk concentration assessment must enable the impact of risk concentrations on the institution's profitability, solvency and liquidity position to be quantified, as well as ensuring compliance with regulatory requirements. 5. The assessment mentioned in the previous paragraph must be reviewed regularly and reflect changes in the external environment, as well as changes in the institution's risk profile and consider its strategy. 6. Institutions must carry out risk concentration assessments in proportion to the nature, size and complexity of the operations in which they are involved. 7. The concentration risk mitigation techniques used by institutions should be appropriate, feasible and understood by employees with relevant functions. 8. Institutions should ensure that their risk concentration mitigation measures do not rely exclusively on certain instruments, which may result in another type of concentration. They should also consider the nature and quality of the mitigation instruments. 9. Institutions should consider their mitigation techniques in the overall exposure to risk concentration. 10. When assessing mitigation techniques, institutions should analyse the quality of their risk management, internal systems and controls, as well as their

CONTINUATION OF NOTICE No. 08/2024 Page 18 of 26 ability to make effective management decisions in order to adjust risk concentration levels. Article 29 (Segregation of Duties Requirements and Duties of Collaborators with a Relevant Risk Management Function)

1. Microfinance Financial Institutions must consider the following areas in their organisational and operational structures: a) The person that initiates operations relating to credit/trading activity (front office/trading desk); b) The person responsible for monitoring and reporting risks (middle office); and c) The person responsible for settling and accounting for trading operations (back office).
2. The areas described in the previous paragraph shall be independent of each other, from the lowest levels of the hierarchy to the level of the Board of Directors.
3. Microfinance Financial Institutions must formalise and document the objectives, policies and processes for individual risk management in accordance with the provisions of this Notice and the respective concentration, namely: a) Strategies and processes, bearing in mind risk appetite, risk-taking capacity and the business environment; b) Structure and organisation of the relevant risk management function; c) Scope and nature of reporting and risk assessment systems; and, d) Policies for hedging or mitigating risk and strategies and processes for monitoring their ongoing adequacy and effectiveness.

CONTINUATION OF NOTICE No. 08/2024 Page 19 of 26 4. Microfinance Financial Institutions must ensure that whenever exceptions to the limit system occur, they must be properly documented and communicated to the relevant employees and authorised by the employees with management responsibilities and, where necessary, by the Board of Directors. 5. Microfinance Financial Institutions should establish procedures to monitor exceptions to the limit system, including an appropriate escalation procedure and corrective actions by employees with management responsibilities. 6. Employees with managerial responsibilities must ensure effective coordination and communication between the employees responsible for managing the various risks. 7. The Governing Body must ensure that employees have adequate training and experience in relation to the tasks they perform, and must provide training for employees so that they keep up with developments in internationally accepted practices. Article 30 (Outsourcing Services)

1. The Governing Body must define adequate and comprehensive procedures regarding the outsourcing of services.
2. Institutions should establish a comprehensive outsourcing risk management policy to consider outsourced activities and the relationship with the service provider.
3. The outsourcing risk management policy should include contingency plans that should cover recovery plans and periodic testing of security systems and exit strategies.

CONTINUATION OF NOTICE No. 08/2024 Page 20 of 26 4. Institutions must ensure that outsourcing does not affect their ability to fulfil their obligations to customers, nor is it an impediment to effective supervision by the National Bank of Angola 5. The segregation of duties established in this Notice must be observed at the level of service providers. 6. Employees with relevant functions must ensure effective coordination and communication between the employees responsible for managing the various risks and those responsible for acquiring external services, including subcontracting agreements. 7. Institutions should establish a process for evaluating and selecting service providers. 8. Outsourcing relationships shall be guided by contracts that describe the relevant aspects of the relationship, including the rights, duties and expectations of the parties involved, ownership and confidentiality, as well as the rights to terminate the contract and expectations of the parties involved, the ownership and confidentiality of the data, as well as the rights to terminate the contract. 9. The National Bank of Angola may determine that certain services may not be outsourced. Article 31 (Information and Communication Systems)

1. It is vital that the institutions define and implement effective and reliable information and communication systems covering all their activities.
2. The level of sophistication of these systems should be commensurate with the nature, size and complexity of the institution's business activities.
3. Information and communication systems must ensure that all activities are articulated in such a way as to enable effective management of the institution's risks and their concentration.

CONTINUATION OF NOTICE No. 08/2024 Page 21 of 26 4. Institutions should ensure that their information and communication systems, including those containing and utilising data, are secure, subject to independent oversight and supported by appropriate contingency procedures. 5. Information and communication systems should be developed to facilitate internal and external reporting processes. 6. Segregation of duties must be ensured whenever the processing of the institutions' activities makes use of information and communication systems, through appropriate procedures and controls to prevent misuse. 7. When data is entered into information and communication systems, it is essential to ensure that the individual responsible enters operations using their own identification, and that the date of the entry and the reference number of the operation are entered automatically and cannot be changed. 8. The information and communication systems must enable employees with management responsibilities to swiftly and accurately access the level of risk assumed by the institution. This will allow them to verify that their performance is in line with that established in the risk strategy. Article 32 (Internal Audit) Institutions are required to carry out internal audits of their governance processes for all relevant risk categories on a regular basis. These categories include credit, liquidity and operational risks, as well as strategy and reputation. The purpose of these audits is to verify: a) Whether activities are in accordance with the respective established policies; b) That operations are carried out in accordance with the guidelines established by the Governing Body;

CONTINUATION OF NOTICE No. 08/2024 Page 22 of 26 c) Whether there are opportunities for improvement in the risk governance process. Article 33 (New Product, Service or Market Business)

1. Institutions are required to formulate plans for the development of new products or services, the modification of existing products or services, or the entry into new markets. These plans must fulfil the following requirements: a) An in-depth analysis of the risk underlying these business, and a description, from a risk management perspective, of the main consequences inherent in their adoption. b) A detailed description of the proposed products or services and their strategy, ensuring their compatibility with existing products or services; c) Identification of the resources needed to establish sound and effective risk management of the proposed products or services. d) Analysing the reasonableness of the proposed products or services in relation to the financial situation, the institution's capital levels and liquidity situation; and e) Determining the procedures to be used in identifying, assessing, monitoring, controlling and reporting on the risks of the proposed products or services.
2. Institutions are required to ensure that their risk management control infrastructures are appropriate and that they monitor the evolution of new products, services, markets, processes and systems. This involves identifying possible concentrations of risk that exceed the established limits and that result from the introduction of new products, services or markets.

CONTINUATION OF NOTICE No. 08/2024 Page 23 of 26 3. For the purposes of approving the plans referred to in paragraph 1 of this Article, institutions shall have documented policies, including all aspects to be considered, namely the definition of new products and services, new markets and significant changes to products and services to be used within the institution and internal functions involved in the decision-making process. 4. Approval policies should describe the most important issues to be considered before a decision is made and include: a) The verification of compliance with regulations; b) Pricing models; c) The impact on the risk profile bearing in mind the risk appetite and the capacity to assume risk; d) Capital adequacy and profitability; e) The impact on net worth, if applicable; f) The existence of adequate resources; and, g) The internal tools and expertise needed to understand and monitor the associated risks. 5. The development of new products and services or entry into new markets is conditional on the availability of adequate and available resources to understand and manage the associated risks. 6. Prior to undertaking risk positions on new products, services or markets, the Governing Body must analyse and approve the plan developed, in coordination with the area responsible for monitoring the activities in question. The approval process may be delegated, provided there are explicit formalised guidelines and the Governing Body is informed of decisions in a timely manner. 7. The risk management function must be involved in the approval process mentioned in paragraph 3 of this article, in order to carry out a complete and objective assessment of the risks inherent in new products, services or

CONTINUATION OF NOTICE No. 08/2024 Page 24 of 26 markets. This assessment must be carried out under various scenarios that condition the institution in the effective management of any new risk. 8. The risk management function must have a clear vision of the implementation of new products and services in the different lines of business and the power to require that changes to existing products and services be subject to the formal approval process. 9. In instances where there are uncertainties regarding the framework for activities related to new products, services or markets, the decision should be made in collaboration by the front office and an independent area. 10. The units involved in the operationalisation of new business must participate in the approval process whenever activities involving new risks or adding to existing risks are undertaken. 11. Before taking decisions on embarking on new ventures in products, services or markets, it is advisable to undertake a preliminary testing phase. This phase should be conducted within a manageable scope, encompassing test trading that does not involve significant risk positions, among other considerations. 12. Units involved in the negotiation of new products, services or markets and internal audit should participate in the test phase, within the scope of their responsibilities. 13. Negotiation of new products, services or markets should only begin after: a) Successful completion of the test phase; b) Definition and operationalisation of appropriate processes for risk identification, assessment, monitoring, control and reporting.

CONTINUATION OF NOTICE No. 08/2024 Page 25 of 26 Article 34 (Accounting) Microfinance financial institutions must record their operations in the accounts in accordance with the Chart of Accounts for Non-Banking Financial Institutions. Article 35 (External Audit) The external audit of Microfinance Financial Institutions is subject to the provisions of Notice no. 12/23, of 04 December, on External Auditing. Article 36 (Computer Application)

1. Microfinance Financial Institutions are required to implement a comprehensive information and communication system. This system must guarantee the processing of information in a complete, reliable, timely, consistent and comprehensible manner. The aim of this system is to obtain a comprehensive view of the fulfilment of the strategy, the risk profile, the financial situation and the behaviour of the markets. This view is based on duly parameterised processes for the collection, processing and dissemination of said information.
2. Within the scope of their operations, Microfinance Financial Institutions must implement mechanisms to prevent and combat money laundering, terrorist financing and the proliferation of weapons of mass destruction, under the terms of the legislation in force.

CONTINUATION OF NOTICE No. 08/2024 Page 26 of 26 CHAPTER VI FINAL PROVISIONS Article 37 (Sanctions) Failure to comply with the provisions of this Notice constitutes a contravention provided for and punishable under the terms of Law no. 14/21, of 19 May, the Law on the General Regime of Financial Institutions. Article 38 (Doubts and omissions) Doubts or omissions arising from the interpretation and application of this Notice shall be settled by the National Bank of Angola. Article 39 (Entry into Force) This Notice shall enter into force on the date of its publication. BE IT PUBLISHED Luanda, 16 th December 2024. THE GOVERNOR MANUEL ANTÓNIO TIAGO DIAS