Guidance Note on the Scope of Application of SAMA’s Basel Framework December 2022

Guidance Note on the Scope of Version Issuance Date Page Number Application of SAMA’s Basel Framework 1 December 2022 1 of 5 Guidance Note on the Scope of Application of SAMA’s Basel Framework Introduction The Basel Framework comprises the minimum risk-based capital including the relevant capital buffers, leverage, liquidity and large exposure standards, the supervisory review process under Pillar 2 and public disclosures under Pillar 3, and designed to be applied on internationally active banks. The Basel framework is applied on a consolidated basis at the holding company level and at every tier within a banking group, depending on the group structure to ensure that it captures the risk of the whole banking group, taking into account risks arising from individual entities in the group. Implementation of Basel Framework in Saudi Arabia Since the implementation of Basel II - SAMA’s Detailed Guidance Document Circular No.BCS290 dated June 2006, all local banks1 were required to apply the SAMA’s Basel requirements on a standalone and consolidated basis. The scope of application include, applying the framework to any holding company that is the parent entity within a banking group to ensure that it captures the risks of the banking group as a whole. As such, SAMA applies the framework to all local banks on a consolidated level and at every tier within the bank group, depending on the group structure to ensure that it captures the risk of the whole group, taking into account risks arising from individual entities in the group. The scope remains unchanged since the issuance of Basel II –Detailed Guidance Document relating to Pillar 1 issued by SAMA in 2006 in addition, the prudential returns requirements are also aligned to the scope of application implemented by SAMA. Objective The objectives of this Guidance Note is to clarify SAMA’s policy on the scope of application of the SAMA’s Basel Framework and the corresponding reporting requirements in view of banks’ enquiries on the revised Framework

1 Local Banks who are engaged predominantly in banking business including licensed subsidiaries of banks located outside the kingdom, operating in Saudi Arabia.

Guidance Note on the Scope of Version Issuance Date Page Number Application of SAMA’s Basel Framework 1 December 2022 2 of 5 issued by SAMA in 2021 and 2022 as well as setting out SAMA’s expectations on banks’ group-wide risk oversight and monitoring practices. Banks should refer to the relevant policies on the specific requirements of the SAMA’s Basel Framework. Definition For the purpose of this Guidance Note only: The Framework: Refers to SAMA Basel Framework which includes the minimum risk-based capital and the relevant capital buffers, leverage, liquidity and large exposure standards, the supervisory review process under Pillar 2 and public disclosures under Pillar 3. Standalone (Solo) level: Refers to the local bank entity excluding it subsidiaries. For the avoidance of doubt, standalone level includes domestic and foreign branches and representative offices. Consolidated level: Refers to the local bank entity and all consolidated financial subsidiaries2 where the bank have a majority ownership or – controlled. Majority Ownership or –Controlled: Refers to ownership structure where one entity holds 50% or more of the equity of another entity or meet the control definition in the IFRS standards. Financial subsidiary: Refers to a subsidiary engaged in predominantly financial activities 3 including, but not limited to, investment firms, finance companies, payment companies and special purpose vehicles (SPVs) established to undertake financial-related activities.

2 Financial subsidiary does not include insurance company. 3 Financial activities include financial leasing, issuing credit cards, portfolio management, investment advisory, custodial and safekeeping services and other similar activities that are ancillary to the business of banking.

Guidance Note on the Scope of Version Issuance Date Page Number Application of SAMA’s Basel Framework 1 December 2022 3 of 5 Application of the Framework on Banking Groups in Saudi Arabia and Reporting Requirements Scope of application

1. Local banks must comply with SAMA’s Basel Framework (the Framework) at both standalone and consolidated level4 .
2. For purposes of the Framework, the consolidation will include all subsidiaries undertaking financial or banking activities, which the bank have a majority ownership5or –control, except insurance entities.
3. Where consolidation of a subsidiary is not feasible6 , banks are required to seek SAMA’s approval to exclude the subsidiary from the scope of application and reporting requirements. The application should include proper justifications and risk management controls to ensure group risks are managed effectively.
4. Subject to SAMA discretion, the framework may apply to the bank subsidiaries at every tier or level within the banking group on a consolidated and/or on standalone basis, as applicable. In this regard, SAMA will, among others, take into consideration the type of subsidiary7 , quantitative and qualitative factors such as size of assets and liabilities, nature of business activities and inter-connectedness within the group. Pillar 2
5. For Pillar 2 purposes, SAMA applies its supervisory review process under Pillar 2 on a consolidated basis. This means SAMA’s supervisory assessment of banks’ risk management frameworks, capital and liquidity planning and adequacy will consider the nature and significance of

4 For avoidance of doubt, the Framework does not apply to branches of a bank licensed in another jurisdiction operating in Saudi Arabia (“foreign bank branches”). Foreign bank branches are to comply with their home regulator’s prudential requirements. 5 The minority interests (capital held by third parties) that arise can only be recognized in consolidated capital only if they meet the applicable definition of capital in SAMA's Final Guidance Document Concerning Implementation of Capital Reforms. Any minority interest in excess of the subsidiaries’ minimum regulatory capital requirements is not recognized. 6 For example subsidiaries acquired through debt previously contracted and held on a temporary basis, or subject to different laws and regulation that conflict with SAMA regulatory requirements. 7 The application will be restricted to financial subsidiaries that can follows SAMA regulatory requirements

Guidance Note on the Scope of Version Issuance Date Page Number Application of SAMA’s Basel Framework 1 December 2022 4 of 5 business activities and associated risks of the subsidiaries, which are consolidated and not consolidated and their impact to the local bank and the overall banking group. This is consistent with SAMA’s consolidated supervision objective to ensure that risks within a banking group are adequately captured. In this regard, SAMA may also apply its supervisory discretion in extending the scope of application of other relevant prudential requirements, if warranted. 6. The bank’s Internal Capital Adequacy Assessment Plan (ICAAP) and its Internal Liquidity Adequacy Assessment Plan (ILAAP) should capture risks arising from consolidated subsidiaries in accordance to SAMA’s ICAAP and ILAAP requirements. Pillar 3 7. For purposes of Pillar 3 Disclosure requirements, banks shall follow the Pillar 3 disclosure requirements, where disclosures shall be at the consolidated level only, unless otherwise specified by SAMA. 8. Banks are required to disclose that the insurance entity (within the group, if any) is not included in the scope of application as part of its Pillar 3 disclosures. Reporting Requirements 9. Banks are required to report to SAMA two sets of prudential returns, the first set being the prudential returns at standalone level and the second set being the prudential returns at the consolidated level. For this purpose, banks shall use the relevant templates for the reporting of these prudential returns to SAMA. 10. Where reporting on standalone (e.g. reporting of risk-weighted assets, minimum regulatory capital and liquidity requirements at the bank entity level) is not feasible, banks are required to seek SAMA’s supervisory approval on a yearly basis for exemption from reporting on standalone basis. The application for exemption should include proper justifications and risk management controls to ensure risks are managed effectively. 11. Each consolidated subsidiary is not required to report its prudential returns to SAMA on a standalone basis. However, SAMA would expect the bank to have full risk oversight of its group’s subsidiary activities and

Guidance Note on the Scope of Version Issuance Date Page Number Application of SAMA’s Basel Framework 1 December 2022 5 of 5 be adequately informed of capital and liquidity adequacy of the overall group, including its major subsidiaries. 12. SAMA expect banks to have access to information on the activities and risk exposures of all their subsidiaries and attribute these risk exposures to the consolidated subsidiaries at all times. Banks are required to have internal systems to support the group-wide risk monitoring and reporting and to provide the information, as and when, required by SAMA.

Saudi Central Bank (SAMA) Minimum Capital Requirements for Credit Risk December 2022

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 2 of 349 Contents

1. Introduction 7
2. Scope of Application 8
3. Implementation Timeline 8
4. SAMA Reporting Requirements: 8
5. Overview of risk-weighted assets approaches for credit risk 8
6. Due diligence requirements 10
7. Standardized Approach: Individual Exposures 11 Exposures to sovereigns 11 Exposures to Public Sector Entities (PSEs) 12 Exposures to multilateral development banks (MDBs) 12 Exposures to banks 15 Exposures to covered bonds 20 Exposures to securities firms and other financial institutions 23 Exposures to corporates 23 Subordinated debt, equity and other capital instruments 28 Retail exposure class 32 Real estate exposure class 34 Risk weight multiplier to certain exposures with currency mismatch 45 Off-balance sheet items 46 Exposures that give rise to counterparty credit risk 48 Credit derivatives 48 Defaulted exposures 49
8. Standardized approach: the use of external rating 52 Recognition of external ratings by SAMA 52 Implementation considerations 55
9. Standardized Approach: Credit Risk Mitigation 61 Overview of credit risk mitigation techniques 64 Collateralized transactions 66 On-balance sheet netting 82 Guarantees and credit derivatives 83
10. IRB Approach: overview and asset class definitions 91 Categorization of exposures 92 Definition of corporate exposures 92 Definition of sovereign exposures 96 Definition of bank exposures 96 Definition of retail exposures 97

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 3 of 349 Definition of equity exposures 99 Definition of eligible purchased receivables 100 Foundation and advanced approaches 102 Corporate, sovereign and bank exposures 103 Retail exposures 104 Equity exposures 104 Eligible purchased receivables 105 Adoption of the IRB approach for asset classes 105 11. IRB Approach: Risk Weight Functions 108 Explanation of the risk-weight functions 108 Risk-weighted assets for exposures that are in default 109 Risk-weighted assets for corporate, sovereign and bank exposures thatare not in default 109 12. IRB Approach: Risk components 115 Risk components for corporate, sovereign and bank exposures 115 13. IRB Approach: Supervisory slotting approach for specialized lending 138 Risk weights for specialized lending (PF, OF, CF and IPRE) 138 Risk weights for specialized lending (HVCRE) 139 Expected loss for specialized lending (SL) exposures subject to thesupervisory slotting criteria 140 Supervisory slotting criteria for specialized lending 142 14. IRB Approach: RWA for purchased receivables 168 Risk-weighted assets for default risk 168 Risk-weighted assets for dilution risk 171 Treatment of purchase price discounts for receivables 172 Recognition of credit risk mitigants 173 15. IRB Approach: Treatment of expected losses and provisions 174 Calculation of expected losses 174 Calculation of provisions 175 Treatment of EL and provisions 176 16. IRB Approach: Minimum requirements to use IRB approach 177 Section 1: composition of minimum requirements 178 Section 2: compliance with minimum requirements 179 Section 3: rating system design 180 Section 5: corporate governance and oversight 193 Section 6: use of internal ratings 196 Section 7: risk quantification 197 Section 8: validation of internal estimates 219 Section 9: supervisory LGD and EAD estimates 220 Section 10: requirements for recognition of leasing 227

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 4 of 349 Section 11: disclosure requirements 228 Transition 229 Phase-in for standardized approach treatment of equity exposures 229 Phase-in for the removal of the internal ratings-based approach for equity exposures 229 18. Securitization: general provisions 230 Scope and definitions of transactions covered under the securitizationframework 230 Definitions and general terminology 231 Operational requirements for the recognition of risk transference 238 Due diligence requirements 242 Calculation of capital requirements and risk-weighted assets 244 Caps for securitization exposures 247 Treatment of credit risk mitigation for securitization exposures 249 Simple, transparent and comparable securitizations: scope of andconditions for alternative treatment 253 Simple, transparent and comparable term securitizations: criteria forregulatory capital purposes 254 Criterion A1: Nature of assets 254 Criterion A2: Asset performance history 256 Criterion A3: Payment status 257 Criterion A4: Consistency of underwriting 258 Criterion A5: Asset selection and transfer 259 Criterion A6: Initial and ongoing data 261 Criterion B7: Redemption cash flows 262 Criterion B8: Currency and interest rate asset and liability mismatches 262 Criterion B9: Payment priorities and observability 263 Criterion B10: Voting and enforcement rights 265 Criterion B11: Documentation disclosure and legal review 265 Criterion B12: Alignment of interest 266 Criterion C13: Fiduciary and contractual responsibilities 266 Criterion C14: Transparency to investors 267 Criterion D15: Credit risk of underlying exposures 268 Criterion D16: Granularity of the pool 268 Simple, transparent and comparable short-term securitizations: criteriafor regulatory capital purposes 269 Criterion A1: Nature of assets (conduit level) 270 Criterion A1: Nature of assets (transaction level) 271 Additional guidance for Criterion A1 271 Criterion A2: Asset performance history (conduit level) 273 Criterion A2: Asset performance history (transaction level) 273 Additional requirement for Criterion A2 274 Criterion A3: Asset performance history (conduit level) 274

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 5 of 349 Criterion A3: Asset performance history (transaction level) 275 Additional requirement for Criterion A3 275 Criterion A4: Consistency of underwriting (conduit level) 276 Criterion A4: Consistency of underwriting (transaction level) 276 Additional requirement for Criterion A4 277 Criterion A5: Asset selection and transfer (conduit level) 277 Criterion A5: Asset selection and transfer (transaction level) 278 Additional requirement for Criterion A5 280 Criterion A6: Initial and ongoing data (conduit level) 280 Criterion A6: Initial and ongoing data (transaction level) 281 Additional requirement for Criterion A6 281 Criterion B7: Full support (conduit level only) 282 Additional requirement for Criterion B7 282 Criterion B8: Redemption cash flow (transaction level only) 283 Additional requirement for Criterion B8 284 Criterion B9: Currency and interest rate asset and liability mismatches(conduit level) 284 Criterion B9: Currency and interest rate asset and liability mismatches(transaction level) 284 Additional requirement for Criterion B9 285 Criterion B10: Payment priorities and observability (conduit level) 285 Criterion B10: Payment priorities and observability (transaction level) 285 Criterion B11: Voting and enforcement rights (conduit level) 287 Criterion B11: Voting and enforcement rights (transaction level) 287 Criterion B12: Documentation, disclosure and legal review (conduitlevel only) 287 Additional requirement for Criterion B12 288 Criterion B13: Alignment of interest (conduit level only) 288 Criterion B14: Cap on maturity transformation (conduit level only) 289 Criterion C15: Financial institution (conduit level only) 289 Criterion C16: Fiduciary and contractual responsibilities (conduit level) 289 Criterion C16: Fiduciary and contractual responsibilities (transaction level) 290 Additional requirement for Criterion C16 291 Criterion C17: Transparency to investors (conduit level) 291 Criterion C17: Transparency to investors (transaction level) 292 Criterion D18: Credit risk of underlying exposures (transaction level only) 292 Criterion D19: Granularity of the pool (conduit level only) 293 19. Securitization: standardized approach 294 Standardized approach (SEC-SA) 294 Resecuritisation exposures 297 Alternative capital treatment for term STC securitizations and short- term STC securitizations meeting the STC criteria for capital purposes 298

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 6 of 349 20. Securitization: External- ratings-based approach (SEC- ERBA) 299 External-ratings-based approach (SEC-ERBA) 299 Operational requirements for use of external credit assessments 301 Operational requirements for inferred ratings 303 Alternative capital treatment for term STC securitizations and short- term STC securitizations meeting the STC criteria for capital purposes 304 21. Securitization: Internal assessment approach (SEC- IAA) 306 Internal assessment approach (SEC-IAA) 306 22. Securitization: Internal- ratings-based approach 311 Internal ratings-based approach (SEC-IRBA) 311 Definition of KIRB 311 Definition of attachment point (A), detachment point (D) andsupervisory parameter (p) 315 Calculation of risk weight 319 Alternative capital treatment for term securitizations and short-termsecuritizations meeting the STC criteria for capital purposes 321 23. Securitizations of non- performing loans 323 Securitization of non-performing loans 323 24. Equity investments in funds 325 The look-through approach 325 The mandate-based approach 326 The fall-back approach 328 Treatment of funds that invest in other funds 328 Partial use of an approach 328 Leverage adjustment 329 Application of the LTA and MBA to banks using the IRB approach 329 25. Capital treatment of unsettled transactions and failed trades 332 Overarching principles 332 Scope of requirements 333 Capital requirements for DvP transactions 333 Capital requirements for non-DvP transactions (free deliveries) 334 26. Illustrative risk weights calculated under the internal ratings-based (IRB) approach to credit risk. 336 27. Illustrative examples for recognition of dilution risk when applying the Securitization Internal Ratings-Based Approach (SEC-IRBA) to securitization exposures. 337 28. Equity investments in funds: illustrative example of the calculation of risk-weighted assets (RWA) under the look-through approach (LTA) 344 29. Equity investments in funds: illustrative example of the calculation of RWA under the mandate￾based approach (MBA). 346 30. Equity investments in funds: illustrative examples of the leverage adjustment. 347

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 7 of 349 Minimum Capital Requirements for Credit Risk

1. Introduction 1.1 The Basel Committee on Banking Supervision issued the Basel III: Finalizing post-crisis reforms in December 2017, which includes among others, the revised framework for Credit Risk aimed to enhance the robustness and risk sensitivity of the standardized approaches, balances simplicity of the framework and, comparability in the calculation of risk weighted assets (RWAs) for credit risk using different available approaches. 1.2 This revised framework in risk-weighted assets for credit risk is issued by SAMA in exercise of the authority vested in SAMA under the Charter issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. 1.3 This revised framework on risk-weighted assets for credit risk will supersede the following existing requirements related to the calculation of RWAs for credit risk: − Circular No. BCS 242, Date: 11 April 2007 (Mapping of Credit Assessment Ratings Provided by Eligible External Credit Assessment Institution to Determine Risk Weighted Exposures). − Circular No. 351000121270, Date: 17 July 2014 (Basel III - Internal Rating Based Approaches for Credit Risk). − Circular No. 391000047997, Date: 14 January 2018 (Reducing RWA for mortgages to 50%). − Circular No. 410589780000, Date: 1 June 2020 (Reducing RWA for MSMEs).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 8 of 349 2. Scope of Application 1.4 This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 1.5 This framework is not applicable to foreign banks’ branches operating in the Kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators. 3. Implementation Timeline This framework will be effective on 01 January 2023. 4. SAMA Reporting Requirements: SAMA expects all banks to report their credit RWAs and capital charge using SAMA’s Q17 reporting template within 30 days after the end of each quarter. 5. Overview of risk-weighted assets approaches for credit risk 5.1 Banks can choose between two broad methodologies for calculating their risk￾based capital requirements for credit risk. The first is the standardized approach, which is set out in chapters 6 to 9: i. The standardized approach assigns standardized risk weights to exposures as described in chapter 7. Risk weighted assets are calculated as the product of the standardized risk weights and the exposure amount. Exposures should be risk-weighted net of specific provisions (including partial write-offs). ii. To determine the risk weights in the standardized approach for certain exposure classes, banks may, as a starting point, use assessments by external credit assessment institutions (ECAIs) that are recognized as

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 9 of 349 eligible for capital purposes by SAMA. The requirements covering the use of external ratings are set out in chapter 8. 1 iii. The credit risk mitigation techniques that are permitted to be recognized under the standardized approach are set out in chapter 9. 5.2 The second risk-weighted assets approach is the internal ratings-based (IRB) approach, which allows banks to use their internal rating systems for credit risk. The IRB approach is set out in chapters 10 to 16. Banks must seek SAMA’s regulatory approval before they can use the IRB Approach for calculation of capital requirements for credit risk, subject to the Bank meeting all minimum requirements for the use of IRB Approach, supervisory review and validation exercise as may be carried out by SAMA. 5.3 This policy document also covers the treatment in banking book of the following exposures:

1. Securitization exposures (chapters 18 to 23);
2. Equity investments in funds (chapter 24); and
3. Exposures arising from unsettled transactions and failed trades (chapter 25).

1 The notations in chapters 7 to 9 follow the methodology used by one institution, Standard and Poor’s (S&P). The use of S&P credit ratings is an example only; those of some other external credit assessment institutions could equally well be used. The ratings used throughout this document, therefore, do not express any preferences or determinations on external assessment institutions.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 10 of 349 6. Due diligence requirements 6.1 Banks must perform due diligence to ensure that they have an adequate understanding, at origination and thereafter on a regular basis (at least annually), of the risk profile and characteristics of their counterparties. In cases where ratings are used, due diligence is necessary to assess the risk of the exposure for risk management purposes and whether the risk weight applied is appropriate and prudent. The sophistication of the due diligence should be appropriate to the size and complexity of banks’ activities. Banks must take reasonable and adequate steps to assess the operating and financial performance levels and trends through internal credit analysis and/or other analytics outsourced to a third party, as appropriate for each counterparty. Banks must be able to access information about their counterparties on a regular basis to complete due diligence analyses. 6.2 For exposures to entities belonging to consolidated groups, due diligence should, to the extent possible, be performed at the solo entity level to which there is a credit exposure. In evaluating the repayment capacity of the solo entity, banks are expected to take into account the support of the group and the potential for it to be adversely impacted by problems in the group. 6.3 Banks should have in place effective internal policies, processes, systems and controls to ensure that the appropriate risk weights are assigned to counterparties. Banks must be able to demonstrate to SAMA that their due diligence analyses are appropriate.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 11 of 349 7. Standardized Approach: Individual Exposures Exposures to sovereigns 7.1 Exposures to sovereigns and their central banks will be risk-weighted based on the external rating of the sovereign as follows: Risk weight table for sovereigns and central banks Table 1 External rating AAA to AA– A+ to A– BBB+ to BBB– BB+ to B– Below B– Unrated Risk weight 0% 20% 50% 100% 150% 100% 7.2 A 0% risk weight can be applied to banks’ exposures to Saudi sovereign (or SAMA) of incorporation denominated in Saudi Riyal and funded2 in Saudi Riyal (SAR).3 Exposures to Saudi sovereign of incorporation denominated in foreign currencies should be treated according to the Saudi sovereign external rating. 7.3 Sovereign exposures to the member countries of Gulf Cooperation Council (GCC) will also be risk-weighted based on the external rating of the respective country as per Table 1. 7.4 Exposuresto the Bank for International Settlements, the International Monetary Fund, the European Central Bank, the European Union, the European Stability Mechanism and the European Financial Stability Facility may receive a 0% risk weight.

2 This is to say that the bank would also have corresponding liabilities denominated in the domestic currency. 3 This lower risk weight may be extended to the risk-weighting of collateral and guarantees under the CRM framework (chapter 9)

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 12 of 349 Exposures to Public Sector Entities (PSEs) 7.5 For the purposes of RWA treatment, domestic PSEs in general include government authorities, administrative and/or statutory bodies responsible to the government, which may be owned, controlled, and/or mostly funded by the government and not involved in any commercial undertakings. 7.6 Exposures to domestic PSEs will be risk-weighted based on the external rating of the Saudi sovereign external rating Risk weight table for PSEs Based on external rating of sovereign Table 2 External rating of the sovereign AAA to AA– A+ to A– BBB+ to BBB– BB+ to B– Below B– Unrated Risk weight 20% 50% 100% 100% 150% 100% 7.7 Foreign PSEs, including PSEs in GCC countries, shall be assigned a risk weight based on the external rating of the PSE respective country’s sovereign rating. Exposures to multilateral development banks (MDBs) 7.8 For the purposes of calculating capital requirements, a Multilateral Development Bank (MDB) is an institution created by a group of countries that provides financing and professional advice for economic and social development projects. MDBs have large sovereign memberships and may include both developed and /or developing countries. Each MDB has its own independent legal and operational status, but with a similar mandate and a considerable number of joint owners. 7.9 A 0% risk weight will be applied to exposures to specified MDBs that are recognized by the Basel Committee for Banking Supervision (BCBS) for fulfilling the following eligibility criteria:

1. very high-quality long-term issuer ratings, i.e. a majority of an MDB’s

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 13 of 349 externalratings must be AAA; 4 2. either the shareholder structure comprises a significant proportion of sovereigns with long-term issuer external ratings of AA– or better, or the majority of the MDB’s fund-raising is in the form of paid-in equity/capital and there is little or no leverage; 3. strong shareholder support demonstrated by the amount of paid-in capital contributed by the shareholders; the amount of further capital the MDBs have the right to call, if required, to repay their liabilities; and continued capital contributions and new pledges from sovereign shareholders; 4. adequate level of capital and liquidity (a case-by-case approach is necessaryin order to assess whether each MDB’s capital and liquidity are adequate); and, 5. strict statutory lending requirements and conservative financial policies, which would include among other conditions a structured approval process,internal creditworthiness and risk concentration limits (per country, sector, and individual exposure and credit category), large exposures approval by the board or a committee of the board, fixed repayment schedules, effective monitoring of use of proceeds, status review process, and rigorous assessment of risk and provisioning to loan loss reserve. 7.10 The specified MDBs eligible for a 0% risk weight are as follows. This list is subject to review by SAMA from time to time.

1. The World Bank Group comprising the International Bank for Reconstruction and Development;
2. The International Finance Corporation;
3. The Multilateral Investment Guarantee Agency and the International Development Association;
4. The Asian Development Bank;
5. The African Development Bank;
6. The European Bank for Reconstruction and Development;

4 MDBs that request to be added to the list of MDBs eligible for a 0% risk weight must comply with the AAA rating criterion at the time of the application to the BCBS. Once included in the list of eligible MDBs, the rating may be downgraded, but in no case lower than AA–. Otherwise, exposures to such MDBs will be subject to the treatment set out in paragraph 7.11

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 14 of 349 7. The Inter-American Development Bank; 8. The European Investment Bank, 9. The European Investment Fund; 10. The Caribbean Development Bank, 11. The Islamic Development Bank 12. The Nordic Investment Bank; 13. The Council of Europe Development Bank; 14. The International Finance Facility for Immunization; and 15. The Asian Infrastructure Investment Bank.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 15 of 349 7.11 For exposures to all other MDBs, banks will assign to their MDB exposures the corresponding “base” risk weights determined by the external ratings according to Table 3. Risk weight table for MDB exposures Table 3 External rating of counterparty AAA to AA– A+ to A– BBB+ to BBB– BB+ to B– Below B– Unrated “Base” risk weight 20% 30% 50% 100% 150% 50% Exposures to banks 7.12 For the purposes of calculating capital requirements, a bank exposure is defined as a claim (including loans and senior debt instruments, unless considered as subordinated debt for the purposes of paragraph 7.52) on any financial institution that is licensed to take deposits from the public and is subject to appropriate prudential standards and level of supervision5. The treatment associated with subordinated bank debt and equities is addressed in paragraphs 7.46 to 7.52. Risk weight determination 7.13 Bank exposures will be risk-weighted based on the following hierarchy:

1. External Credit Risk Assessment Approach (ECRA): This approach applies to all rated exposures to banks. Banks will apply chapter 8 to determine which rating can be used and for which exposures.
2. Standardized Credit Risk Assessment Approach (SCRA): This approach is applicable to all exposures to banks that are unrated.

5 For internationally active banks, appropriate prudential standards (e.g. capital and liquidity requirements) and level of supervision should be in accordance with the Basel framework.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 16 of 349 External Credit Risk Assessment Approach (ECRA) 7.14 Banks will assign to their rated bank exposures6 the corresponding “base” risk weights determined by the external ratings according to Table 4. Such ratings must not incorporate assumptions of implicit government support7 , unless the rating refers to a public bank owned by its government. Banks may continue to use external ratings, which incorporate assumptions of implicit government support for up to a period of five years, from the date of effective implementation of this framework, when assigning the “base” risk weights in Table 4 to their bank exposures. Risk weight table for bank exposures External Credit Risk Assessment Approach (ECRA) Table 4 External rating of counterparty AAA to AA– A+ to A– BBB+ to BBB– BB+ to B– Below B– “Base” risk weight 20% 30% 50% 100% 150% Risk weight for short-term exposures 20% 20% 20% 50% 150% 7.15 Exposures to banks with an original maturity of three months or less, as well as exposures to banks that arise from the movement of goods across national borders with an original maturity of six months or less8 can be assigned a risk

6 An exposure is rated from the perspective of a bank if the exposure is rated by a recognized “eligible credit assessment institution” (ECAI) which has been nominated by the bank (i.e. the bank has informed SAMA of its intention to use the ratings of such ECAI for regulatory purposes in a consistent manner paragraph 8.8 In other words, if an external rating exists but the credit rating agency is not a recognized ECAI by SAMA, or the rating has been issued by an ECAI which has not been nominated by the bank, the exposure would be considered as being unrated from the perspective of the bank 7 Implicit government support refers to the notion that the government would act to prevent bank creditors from incurring losses in the event of a bank default or bank distress. 8 This may include on-balance sheet exposures such as loans and off- balance sheet exposures such as self￾liquidating trade-related contingent items.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 17 of 349 weight that correspond to the risk weights for short term exposures in Table 4. 7.16 Banks must perform due diligence to ensure that the external ratings appropriately and conservatively reflect the creditworthiness of the bank counterparties. If the due diligence analysis reflects higher risk characteristics than that implied by the external rating bucket of the exposure (i.e. AAA to AA– ; A+ to A– etc.), the bank must assign a risk weight at least one bucket higher than the “base” risk weight determined by the external rating. Due diligence analysis must never result in the application of a lower risk weight than that determined by the external rating. Standardized Credit Risk Assessment Approach (SCRA) 7.17 Banks will apply the SCRA to all their unrated bank exposures. The SCRA requires banks to classify bank exposures into one of three risk-weight buckets (i.e. Grades A, B and C) and assign the corresponding risk weights in Table 5. Under the SCRA, exposures to banks without an external credit rating may receive a risk weight of 30%, provided that the counterparty bank has a Common Equity Tier 1 ratio which meets or exceeds 14% and a Tier 1 leverage ratio which meets or exceeds 5%. The counterparty bank must also satisfy all the requirements for Grade A classification. For the purposes of SCRA only, “published minimum regulatory requirements” in paragraphs 7.18 to 7.26 excludes liquidity standards. Risk weight table for bank exposures Standardized Credit Risk Assessment Approach (SCRA) Table 5 Credit risk assessment ofcounterparty Grade A Grade B Grade C “Base” risk weight 40% 75% 150% Risk weight for short￾termexposures 20% 50% 150% SCRA: Grade A 7.18 Grade A refers to exposures to banks, where the counterparty bank has adequate capacity to meet their financial commitments (including repayments of principal and interest) in a timely manner, for the projected life of the assets or exposures

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 18 of 349 and irrespective of the economic cycles and business conditions. 7.19 A counterparty bank classified into Grade A must meet or exceed the published minimum regulatory requirements and buffers established by its national supervisor as implemented in the jurisdiction where it is incorporated, except for bank-specific minimum regulatory requirements or buffers that may be imposed through supervisory actions (e.g. via the Supervisory Review Process) and not made public. If such minimum regulatory requirements and buffers (other than bank-specific minimum requirements or buffers) are not publicly disclosed or otherwise made available by the counterparty bank, then the counterparty bank must be assessed as Grade B or lower. 7.20 If as part of its due diligence, a bank assesses that a counterparty bank does not meet the definition of Grade A in paragraphs 7.18 and 7.19, exposures to the counterparty bank must be classified as Grade B or Grade C. SCRA: Grade B 7.21 Grade B refers to exposures to banks, where the counterparty bank is subject to substantial credit risk, such as repayment capacities that are dependent on stable or favorable economic or business conditions. 7.22 A counterparty bank classified into Grade B must meet or exceed the published minimum regulatory requirements (excluding buffers) established by its national supervisor as implemented in the jurisdiction where it is incorporated, except for bank-specific minimum regulatory requirements that may be imposed through supervisory actions (e.g. via the Supervisory Review Process) and not made public. If such minimum regulatory requirements are not publicly disclosed or otherwise made available by the counterparty bank then the counterparty bank must be assessed as Grade C.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 19 of 349 7.23 Banks will classify all exposures that do not meet the requirements outlined in paragraphs 7.18 and 7.19 into Grade B, unless the exposure falls within Grade C under paragraphs 7.24 to 7.26. SCRA: Grade C 7.24 Grade C refers to higher credit risk exposures to banks, where the counterparty bank has material default risks and limited margins of safety. For these counterparties, adverse business, financial, or economic conditions are very likely to lead, or have led, to an inability to meet their financial commitments. 7.25 At a minimum, if any of the following triggers is breached, a bank must classify the exposure into Grade C:

1. The counterparty bank does not meet the criteria for being classified as Grade B with respect to its published minimum regulatory requirements, asset out in paragraphs 7.21 and 7.22 or
2. Where audited financial statements are required, the external auditor has issued an adverse audit opinion or has expressed substantial doubt about the counterparty bank’s ability to continue as a going concern in its financial statements or audited reports within the previous 12 months. 7.26 Even if the triggers set out in paragraph 7.25 are not breached, a bank may assess that the counterparty bank meets the definition in paragraph 7.24. In that case, the exposure to such counterparty bank must be classified into Grade C. 7.27 Exposures to banks with an original maturity of three months or less, as well as exposures to banks that arise from the movement of goods across national borders with an original maturity of six months or less,9 can be assigned a risk weight that correspond to the risk weights for short term exposures in Table 5.

9 This may include on-balance sheet exposuressuch asloans and off-balance sheet exposures such as self￾liquidating trade-related contingent items.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 20 of 349 7.28 To reflect transfer and convertibility risk under the SCRA, a risk-weight floor based on the risk weight applicable to exposures to the sovereign of the country where the bank counterparty is incorporated will be applied to the risk weight assigned to bank exposures. The sovereign floor applies when: i. The exposure is not in the local currency of the jurisdiction of incorporation of the debtor bank; and ii. For a borrowing booked in a branch of the debtor bank in a foreign jurisdiction, when the exposure is not in the local currency of the jurisdiction in which the branch operates. The sovereign floor will not apply to short-term (i.e. with a maturity below one year) self-liquidating, trade-related contingent items that arise from the movement of goods. Exposures to covered bonds 7.29 Covered bonds are bonds issued by a bank or mortgage institution that are subject by law to special public supervision designed to protect bond holders. Proceeds deriving from the issue of these bonds must be invested in conformity with the law in assets which, during the whole period of the validity of the bonds,are capable of covering claims attached to the bonds and which, in the event of the failure of the issuer, would be used on a priority basis for the reimbursementof the principal and payment of the accrued interest. Eligible assets 7.30 In order to be eligible for the risk weights set out in paragraph 7.34 the underlying assets (the cover pool) of covered bonds as defined in paragraph 7.29 shall meet the requirements set out in paragraph 7.33 and shall include any of the following:

1. claims on, or guaranteed by, sovereigns, their central banks, public sector entities or multilateral development banks;
2. claims secured by residential real estate that meet the criteria set out in paragraph 7.63 and with a loan-to-value ratio of 80% or lower;
3. claims secured by commercial real estate that meets the criteria set out in

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 21 of 349 paragraph 7.63 and with a loan-to-value ratio of 60% or lower; or 4. Claims on, or guaranteed by banks that qualify for a 30% or lower risk weight. However, such assets cannot exceed 15% of covered bond issuances. 7.31 The nominal value of the pool of assets assigned to the covered bond instrument (s) by its issuer should exceed its nominal outstanding value by at least 10%. The value of the pool of assets for this purpose does not need to be that required by the legislative framework. However, if the legislative framework does not stipulate a requirement of at least 10%, the issuing bank needs to publicly disclose on a regular basis that their cover pool meets the 10% requirement in practice. In addition to the primary assets listed in this paragraph, additional collateral may include substitution assets (cash or short term liquid and secure assets held in substitution of the primary assets to top up the cover pool for management purposes) and derivatives entered into for the purposes of hedging the risks arising in the covered bond program. 7.32 The conditions set out in paragraphs 7.30 and 7.31 must be satisfied at the inception of the covered bond and throughout its remaining maturity. Disclosure requirements 7.33 Exposures in the form of covered bonds are eligible for the treatment set out in paragraph 7.34, provided that the bank investing in the covered bonds can demonstrate to SAMA that:

1. It receives portfolio information at least on: (a) the value of the cover pool and outstanding covered bonds; (b) the geographical distribution and type of cover assets, loan size, interestrate and currency risks; (c) the maturity structure of cover assets and covered bonds; and (d) the percentage of loans more than 90 days past due; and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 22 of 349 2. The issuer makes the information referred to in point (1) available to the bank at least semi-annually. 7.34 Covered bonds that meet the criteria set out in paragraphs 7.30 to 7.33 shall be risk-weighted based on the issue-specific rating or the issuer’s risk weight according to the rules outlined in chapter 8. For covered bonds with issue￾specific ratings10 , the risk weight shall be determined according to Table 6. For unrated covered bonds, the risk weight would be inferred from the issuer’s ECRA or SCRA risk weight according to Table 7. Risk weight table for rated covered bond exposures Table 6 Issue-specific rating of the covered bond AAA to AA– A+ to A– BBB+ to BBB– BB+ to B– Below B– “Base” risk weight 10% 20% 20% 50% 100% Risk weight table for unrated covered bond exposures Table 7 Risk weight of the issuing bank 20% 30% 40% 50% 75% 100% 150% “Base” risk weight 10% 15% 20% 25% 35% 50% 100%

10 An exposure is rated from the perspective of a bank if the exposure is rated by a recognized ECAI which has been nominated by the bank (i.e. the bank has informed its supervisor of its intention to use the ratings of such ECAI for regulatory purposes in a consistent manner (see paragraph 8.8). In other words, if an external rating exists but the credit rating agency is not a recognized ECAI by SAMA, or the rating has been issued by an ECAI, which has not been nominated by the bank, the exposure would be considered as being unrated from the perspective of the bank.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 23 of 349 7.35 Banks must perform due diligence to ensure that the external ratings appropriately and conservatively reflect the creditworthiness of the covered bond and the issuing bank. If the due diligence analysis reflects higher risk characteristics than that implied by the external rating bucket of the exposure (i.e. AAA to AA–; A+ to A– etc.), the bank must assign a risk weight at least one buckethigher than the “base” risk weight determined by the external rating. Due diligence analysis must never result in the application of a lower risk weight than that determined by the external rating. Exposures to securities firms and other financial institutions 7.36 Exposures to all securities firms and financial institutions will be treated as exposures to corporates. Exposures to corporates 7.37 Exposures to corporates include exposures (loans, bonds, receivables, etc.) to incorporated entities, associations, partnerships, proprietorships, trusts, funds and other entities with similar characteristics, except those, which qualify for one of the other exposure classes. The treatment associated with subordinated debt and equities of these counterparties is addressed in paragraphs 7.46 to 7.54. The corporate exposure class includes exposures to insurance companies and other financial corporates that do not meet the definitions of exposures to banks, or securities firms and other financial institutions, as determined in paragraphs 7.12 and 7.36 respectively. The corporate exposure class does not include exposures to individuals. The corporate exposure class differentiates between the following subcategories:

1. General corporate exposures;
2. Specialized lending exposures, as defined in paragraph 7.41

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 24 of 349 General corporate exposures 7.38 For corporate exposures, banks will assign “base” risk weights according to Table 8. Banks must perform due diligence to ensure that the external ratings appropriately and conservatively reflect the creditworthiness of the counterparties. Banks which have assigned risk weights to their rated bank exposures based on paragraph 7.14 must assign risk weights for all their corporate exposures according to Table 8. If the due diligence analysis reflects higher risk characteristics than that implied by the external rating bucket of the exposure (i.e. AAA to AA–; A+ to A– etc.), the bank must assign a risk weight at least one bucket higher than the “base” risk weight determined by the external rating. Due diligence analysis must never result in the application of a lower risk weight than that determined by the external rating. 7.39 Where banks have overseas operations, unrated corporate exposures of banks incorporated in jurisdictions that allow the use of external ratings for regulatory purposes will receive a 100% risk weight, with the exception of unrated exposures to corporate micro, small or medium-sized entities (MSMEs), as described in paragraph 7.40. Risk weight table for corporate exposures Table 8 External rating ofcounterparty AAA to AA– A+ to A– BBB+ to BBB– BB+ to BB– Below BB– Unrated “Base” risk weight 20% 50% 75% 100% 150% 100%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 25 of 349 7.40 The definitions of MSMEs shall continue to apply as per SAMA Circular No. 381000064902, Date: 15 March 2017 or any subsequent circulars, corporate MSMEs for the purpose of capital requirements are defined as corporate exposures where the reported annual revenues for the consolidated group of which the corporate MSME counterparty is a part is less than or equal to SAR 200 million for the most recent financial year. For unrated exposures to corporate MSMEs, an 85% risk weight will be applied. Exposures to MSMEs that meet the criteria in paragraphs 7.57 will be treated as regulatory retail MSME exposures and risk weighted at 75%. Specialized lending 7.41 A corporate exposure will be treated as a specialized lending exposure if such lending possesses some or all of the following characteristics, either in legal formor economic substance:

1. The exposure is not related to real estate and is within the definitions of object finance, project finance or commodities finance under paragraph 7.42. If the activity is related to real estate, the treatment would be determined inaccordance with paragraphs 7.61 to 7.83;
2. The exposure is typically to an entity (often a special purpose vehicle (SPV))that was created specifically to finance and/or operate physical assets;
3. The borrowing entity has few or no other material assets or activities, and therefore little or no independent capacity to repay the obligation, apart from the income that it receives from the asset(s) being financed. The primary source of repayment of the obligation is the income generated bythe asset(s), rather than the independent capacity of the borrowing entity;and
4. The terms of the obligation give the lender a substantial degree of control over the asset(s) and the income that it generates.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 26 of 349 7.42 Exposures described in paragraph 7.41 will be classified in one of the following three subcategories of specialized lending:

1. Project finance Refers to the method of funding in which the lender looks primarily to the revenues generated by a single project, both as the source of repayment and as security for the loan. This type of financing is usually for large, complex and expensive installations such as power plants, chemical processing plants, mines, transportation infrastructure, environment, media, and telecoms. Project finance may take the form of financing the construction of a new capital installation, or refinancing of an existing installation, with or without improvements.
2. Object finance Refers to the method of funding the acquisition of equipment (e.g. ships, aircraft, satellites, railcars, and fleets) where the repayment of the loan is dependent on the cash flows generated by the specific assets that have been financed and pledged or assigned to the lender.
3. Commodities finance Refers to short-term lending to finance reserves, inventories, or receivables of exchange-traded commodities (e.g. crude oil, metals, or crops), where the loan will be repaid from the proceeds of the saleof the commodity and the borrower has no independent capacity to repay the loan. 7.43 Banks will assign to their specialized lending exposures the risk weights determined by the issue-specific external ratings, if these are available, according to Table 8. Issuer ratings must not be used (i.e. paragraph 8.13 does not apply in the case of specialized lending exposures).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 27 of 349 7.44 For specialized lending exposures for which an issue-specific external rating is not available, and for all specialized lending exposures of banks incorporated in jurisdictions that do not allow the use of external ratings for regulatory purposes, the following risk weights will apply:

1. Object and commodities finance exposures will be risk-weighted at 100%;
2. Project finance exposures will be risk-weighted at 130% during the pre￾operational phase and 100% during the operational phase. Project finance exposures in the operational phase, which are deemed to be high quality, as described in paragraph 7.45, will be risk weighted at 80%. For this purpose, operational phase is defined as the phase in which the entity that was specifically created to finance the project has (a) a positive net cash flow that is sufficient to cover any remaining contractual obligation, and (b) Declining long-term debt. 7.45 A high quality project finance exposure refers to an exposure to a project finance entity that is able to meet its financial commitments in a timely manner and its ability to do so is assessed to be robust against adverse changes in the economic cycle and business conditions. The following conditions must also be met:
3. The project finance entity is restricted from acting to the detriment of the creditors (e.g. by not being able to issue additional debt without the consentof existing creditors);
4. The project finance entity hassufficient reserve funds or other financial arrangements to cover the contingency funding and working capital requirements of the project;
5. The revenues are availability-based11 or subject to a rate-of-return

11 Availability-based revenues mean that once construction is completed, the project finance entity is entitled to payments from its contractual counterparties (e.g. the government), as long as contract conditions are fulfilled. Availability payments are sized to cover operating and maintenance costs, debt service costs and equity returns as the project finance entity operates the project. Availability payments are not subject to swings in demand, such as traffic levels, and are adjusted typically only for lack of performance or lack of availability of the asset to the public

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 28 of 349 regulationor take-or-pay contract; 4. The project finance entity’s revenue depends on one main counterparty andthis main counterparty shall be a central government, PSE or a corporate entity with a risk weight of 80% or lower; 5. The contractual provisions governing the exposure to the project finance entity provide for a high degree of protection for creditors in case of a default of the project finance entity; 6. The main counterparty or other counterparties which similarly comply with the eligibility criteria for the main counterparty will protect the creditors from the losses resulting from a termination of the project; 7. All assets and contracts necessary to operate the project have been pledged to the creditors to the extent permitted by applicable law; and 8. Creditors may assume control of the project finance entity in case of its default. Subordinated debt, equity and other capital instruments 7.46 The treatment described in paragraphs 7.50 to 7.52. applies to subordinated debt, equity and other regulatory capital instruments issued by either corporates or banks, provided that such instruments are not deducted from regulatory capital or risk-weighted at 250% according to the Regulatory Capital Under Basel III Framework (Article 4.4 – Section A of SAMA Circular No. 341000015689, Date: 19 December 2012), or risk weighted at 1250% according to paragraph 7.54. It also excludes equity investments in funds treated under chapter 24. 7.47 Equity exposures are defined on the basis of the economic substance of the instrument. They include both direct and indirect ownership interests,12 whether voting or non-voting, in the assets and income of a commercial enterprise or of afinancial institution that is not consolidated or deducted. An instrument is

12 Indirect equity interests include holdings of derivative instruments tied to equity interests, and holdings in corporations, partnerships, limited liability companies or other types of enterprises that issue ownership interests and are engaged principally in the business of investing in equity instruments.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 29 of 349 considered to be an equity exposure if it meets all of the following requirements:

1. It is irredeemable in the sense that the return of invested funds can be achieved only by the sale of the investment or sale of the rights to the investment or by the liquidation of the issuer;
2. It does not embody an obligation on the part of the issuer; and
3. It conveys a residual claim on the assets or income of the issuer. 7.48 In addition to instruments classified as equity as a result of paragraph 7.47, the following instruments must be categorized as an equity exposure:
4. An instrument with the same structure as those permitted as Tier 1 capital for banking organizations.
5. An instrument that embodies an obligation on the part of the issuer and meets any of the following conditions: (a) The issuer may defer indefinitely the settlement of the obligation; (b) The obligation requires (or permits at the issuer’s discretion) settlementby issuance of a fixed number of the issuer’s equity shares; (c) The obligation requires (or permits at the issuer’s discretion) settlementby issuance of a variable number of the issuer’s equity shares and (ceteris paribus) any change in the value of the obligation is attributable to, comparable to, and in the same direction as, the change in the valueof a fixed number of the issuer’s equity shares13; or,

13 For certain obligations that require or permit settlement by issuance of a variable number of the issuer’s equity shares, the change in the monetary value of the obligation is equal to the change in the fair value of a fixed number of equity shares multiplied by a specified factor. Those obligations meet the conditions of item (c) if both the factor and the referenced number of shares are fixed. For example, an issuer may be required to settle an obligation by issuing shares with a value equal to three times the appreciation in the fair value of 1,000 equity shares. That obligation is considered to be the same as an obligation that requires settlement by issuance of shares equal to the appreciation in the fair value of 3,000 equity shares.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 30 of 349 (d) The holder has the option to require that the obligation be settled in equity shares, unless either (i) in the case of a traded instrument, SAMA is content that the bank has demonstrated that the instrument trades more like the debt of the issuer than like its equity, or (ii) in the case of non-traded instruments, SAMA is content that the bank has demonstrated that the instrument should be treated as a debt position. In cases (i) and (ii), the bank may decompose the risks forregulatory purposes, with the approval of SAMA. 7.49 Debt obligations and other securities, partnerships, derivatives or other vehicles structured with the intent of conveying the economic substance of equity ownership are considered an equity holding14 . This includes liabilities from which the return is linked to that of equities15. Conversely, equity investments that are structured with the intent of conveying the economic substance of debt holdings or securitization exposures would not be considered an equity holding. 16 7.50 Banks will assign a risk weight of 400% to speculative unlisted equity exposures described in paragraph 7.51 and a risk weight of 250% to all other equity holdings. 7.51 Speculative unlisted equity exposures are defined as equity investments in unlisted companies that are invested for short-term resale purposes or are considered venture capital or similar investments, which are subject to price volatility and are acquired in anticipation of significant future capital gains17 .

14 Equities that are recorded as a loan but arise from a debt/equity swap made as part of the orderly realization or restructuring of the debt are included in the definition of equity holdings. However, these instruments may not attract a lower capital charge than would apply if the holdings remained in the debt portfolio. 15 SAMA may decide not to require that such liabilities be included where they are directly hedged by an equity holding, such that the net position does not involve material risk. 16 SAMA may consider to re-characterize debt holdings as equites for regulatory purposes and to otherwise ensure the proper treatment of holdings under the supervisory review process. 17 For example, investments in unlisted equities of corporate clients with which the bank has or intends to establish a long-term business relationship and debt-equity swaps for corporate restructuring purposes would be excluded.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 31 of 349 7.52 Banks will assign a risk weight of 150% to subordinated debt and capital instruments other than equities. 7.53 Notwithstanding the risk weights specified in paragraphs 7.50 to 7.52, the risk weight for investments in significant minority- or majority-owned and – controlledcommercial entities depends upon the application of two materiality thresholds:

1. For individual investments, 15% of the bank’s capital; and
2. For the aggregate of such investments, 60% of the bank’s capital. 7.54 Investments in significant minority- or majority-owned and –controlled commercial entities below the materiality thresholds in paragraph 7.52 must be risk- weighted as specified in paragraphs 7.47 to 7.52. Investments in excess of the materiality thresholds must be risk-weighted at 1250%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 32 of 349 Retail exposure class 7.55 The retail exposure class excludes exposures within the real estate exposure class.The retail exposure class includes the following types of exposures:

1. Exposures to an individual person or persons; and
2. Exposures to MSMEs (as defined in paragraph 7.40) that meet the “regulatory retail” criteria set out in paragraph 7.57 below. Exposures to MSMEs that do not meet these criteria will be treated as corporate MSMEs exposures under paragraph 7.40. 7.56 Exposures within the retail exposure class will be treated according to paragraphs 7.57 to 7.59 below. For the purpose of determining risk weighted assets, the retail exposure class consists of the follow three sets of exposures:
3. “Regulatory retail” exposures that do not arise from exposures to “transactors” (as defined in paragraph 7.58).
4. “Regulatory retail” exposures to “transactors”.
5. “Other retail” exposures. 7.57 “Regulatory retail” exposures are defined as retail exposures that meet all of the criteria listed below:
6. Product criterion: The exposure takes the form of any of the following: revolving credits and lines of credit (including credit cards, charge cards and overdrafts), personal term loans and leases (e.g. instalment loans, auto loans and leases, student and educational loans, personal finance) and small business facilities and commitments. Mortgage loans, derivatives and other securities (such as bonds and equities), whether listed or not, are specifically excluded from this category.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 33 of 349 2. Low value of individual exposures: The maximum aggregated exposure to one counterparty cannot exceed an absolute threshold of SAR 4.46 million. 3. Granularity criterion: No aggregated exposure to one counterparty18 can exceed 0.2%19 of the overall regulatory retail portfolio. Defaulted retail exposures are to be excluded from the overall regulatory retail portfolio when assessing the granularity criterion. 7.58 “Transactors” are obligors in relation to facilities such as credit cards and charge cards where the balance has been repaid in full at each scheduled repayment date for the previous 12 months. Obligors in relation to overdraft facilities would also be considered as transactors if there has been no drawdown over the previous 12 months. 7.59 “Other retail” exposures are defined as exposures to an individual person or persons that do not meet all of the regulatory retail criteria in paragraph 7.57. 7.60 The risk weights that apply to exposures in the retail asset class are as follows:

1. Regulatory retail exposures that do not arise from exposures to transactors(as defined in paragraph 7.58) will be risk weighted at 75%.
2. Regulatory retail exposures that arise from exposures to transactors (as defined in paragraph 7.58) will be risk weighted at 45%.
3. Other retail exposures will be risk weighted at 100%.

18 Aggregated exposure means gross amount (i.e. not taking any credit risk mitigation into account) of all forms of retail exposures, excluding residential real estate exposures. In case of off-balance sheet claims, the gross amount would be calculated after applying credit conversion factors. In addition, “to one counterparty” means one or several entities that may be considered as a single beneficiary (e.g. in the case of a small business that is affiliated to another small business, the limit would apply to the bank’s aggregated exposure on both businesses). 19 To apply the 0.2% threshold of the granularity criterion, banks must: first, identify the full set of exposures in the retail exposure class (as defined in paragraph 7.55); second, identify the subset of exposure that meet product criterion and do not exceed the threshold for the value of aggregated exposures to one counterparty (as defined in paragraph 7.57); and third, exclude any exposures that have a value greater than 0.2% of the subset before exclusions

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 34 of 349 Real estate exposure class 7.61 Real estate is immovable property that is land, including agricultural land and forest, or anything treated as attached to land, in particular buildings, in contrast to being treated as movable/personal property. The real estate exposure asset class consists of:

1. Exposures secured by real estate that are classified as “regulatory real estate”exposures.
2. Exposures secured by real estate that are classified as “other real estate” exposures.
3. Exposures that are classified as “land acquisition, development and construction” (ADC) exposures. 7.62 “Regulatory real estate” exposures consist of:
4. “Regulatory residential real estate” exposures that are not “materially dependent on cash flows generated by the property”.
5. “Regulatory residential real estate” exposures that are “materially dependent on cash flows generated by the property”.
6. “Regulatory commercial real estate” exposures that are not “materially dependent on cash flows generated by the property”.
7. “Regulatory commercial real estate” exposures that are “materially dependent on cash flows generated by the property”.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 35 of 349 Regulatory real estate exposures 7.63 For an exposure secured by real estate to be classified as a “regulatory real estate” exposure, the loan must meet the following requirements:

1. Finished property: The exposure must be secured by a fully completed immovable property. This requirement does not apply to forest, desert and agricultural land. This criteria can be met by loans to individuals that are secured by residential property under construction or land upon which residential property would be constructed, provided that: (i) the property is a one-to-four family residential housing unit that will be the primary residence of the borrower and the lending to the individual is not, in effect, indirectly financing land acquisition, development and construction exposures described in paragraph 7.82; or (ii) sovereign or PSEs involved have the legal powers and ability to ensurethat the property under construction will be finished.
2. Legal enforceability: Any claim on the property taken must be legally enforceable in all relevant jurisdictions. The collateral agreement and the legal process underpinning it must be such that they provide for the bank to realize the value of the property within a reasonable time frame.
3. Claims over the property: The loan is a claim over the property where the lender bank holds a first lien over the property, or a single bank holds the first lien and any sequentially lower ranking lien(s) (i.e. there is no intermediate lien from another bank) over the same property. However, where junior liens 20provide the holder with a claim for collateral that is legally enforceable and constitute an effective credit risk mitigant, junior liens

20 Please refer to Art24, the ‘Registered Real Estate Mortgage’s Law issued via Royal Decree No. M/49 dated 03/07/2012.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 36 of 349 held by a different bank than the one holding the senior lien mayalso be recognized.21 In order to meet the above requirements, the national frameworks governing liens should ensure the following: (i) each bank holding a lien on a property can initiate the sale of the property independently from other entities holding a lien on the property; and (ii) where the sale of the property is not carried out by means of a public auction, entities holding a senior lien take reasonable steps to obtain a fair market value or the best price that may be obtained in the circumstances when exercising any power of sale on their own (i.e. it is not possible for the entity holding the senior lien to sell the property on its own at a discounted value in detriment of the junior lien). 4. Ability of the borrower to repay: The borrower must meet the requirementsset according to paragraph 7.65. 5. Prudent value of property: The property must be valued according to the criteria in paragraphs 7.66 to 7.68 for determining the value in the loan-to-value ratio (LTV). Moreover, the value of the property must not depend materially on the performance of the borrower. 6. Required documentation: All the information required at loan origination and for monitoring purposes must be properly documented, including information on the ability of the borrower to repay and on the valuation of the property. 7.64 SAMA may require banks to increase the risk weights in the corresponding risk weight tables as appropriate if they are determined to be too low for real estate exposures based on default experience and other factors such as market price

21 Likewise, this would apply to junior liens held by the same bank that holds the senior lien in case there is an intermediate lien from another bank (i.e. the senior and junior liens held by the bank are not in sequential ranking order

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 37 of 349 stability. Banks will be informed accordingly. 7.65 Banks should put in place underwriting policies with respect to the granting of mortgage loans that include the assessment of the ability of the borrower to repay. Underwriting policies must define a metric(s)(such as the loan’s debt service coverage ratio) and specify its (their) corresponding relevant level(s) to conduct such assessment22 . Underwriting policies must also be appropriate when the repayment of the mortgage loan depends materially on the cash flows generated by the property, including relevant metrics (such as an occupancy rate of the property). 7.66 The LTV is the amount of the loan divided by the value of the property. When calculating the LTV, the loan amount will be reduced as the loan amortizes. The value of the property will be maintained at the value measured at origination, with the following exceptions:

1. SAMA may require banks to revise the property value downward. If the value has been adjusted downwards, a subsequent upwards adjustment can be made but not to a higher value than the value at origination.
2. The value must be adjusted if an extraordinary, idiosyncratic event occursresulting in a permanent reduction of the property value.
3. Modifications made to the property that unequivocally increase its valuecould also be considered in the LTV. 7.67 The LTV must be prudently calculated in accordance with the following requirements:
4. Amount of the loan: Includes the outstanding loan amount and any undrawn committed amount of the mortgage loan23. The loan amount must be calculated gross of any provisions and other risk mitigants, except for pledged

22 Metrics and levels for measuring the ability to repay should mirror the Financial Stability Board (FSB) Principles for sound residential mortgage underwriting practices (April 2012). 23 If a bank grants different loans secured by the same property and they are sequential in ranking order (i.e. there is no intermediate lien from another bank), the different loans should be considered as a single exposure for risk-weighting purposes, and the amount of the loans should be added to calculate the LTV

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 38 of 349 deposits accounts with the lending bank that meet all requirementsfor on-balance sheet netting and have been unconditionally and irrevocably pledged for the sole purposes of redemption of the mortgage loan. 24 2. Value of the property: The valuation must be appraised independently25 using prudently conservative valuation criteria. To ensure that the value of the property is appraised in a prudently conservative manner, the valuation must exclude expectations on price increases and must be adjusted to take into account the potential for the current market price to be significantly above the value that would be sustainable over the life of the loan. 26 7.68 A guarantee or financial collateral may be recognized as a credit risk mitigant in relation to exposures secured by real estate if it qualifies as eligible collateral under the credit risk mitigation framework (chapter 9). This may include mortgage insurance 27if it meets the operational requirements of the credit risk mitigation framework for a guarantee. Banks may recognize these risk mitigants in calculating the exposure amount; however, the LTV bucket and risk weight to be applied to the exposure amount must be determined before the application of the appropriate credit risk mitigation technique.

24 The loan amount of the junior liens must include all other loans secured with liens of equal or higher ranking than the bank’s lien securing the loan for purposes of defining the LTV bucket and risk weight for the junior lien. If there is insufficient information for ascertaining the ranking of the other liens, the bank should assume that these liens rank pari passu with the junior lien held by the bank. This treatment does not apply to exposures that are risk weighted according to the loan splitting approach (paragraphs 7.75 and 7.78), where the junior lien would be taken into account in the calculation of the value of the property. The bank will first determine the “base” risk weight based on Tables 9, 10, 11 or 12 as applicable and adjust the “base” risk weight by a multiplier of 1.25, for application to the loan amount of the junior lien. If the “base” risk weight corresponds to the lowest LTV bucket, the multiplier will not be applied. The resulting risk weight of multiplying the “base” risk weight by 1.25 will be capped at the risk weight applied to the exposure when the requirements in paragraph 7.63 are not met. 25 The valuation must be done independently from the bank’s mortgage acquisition, loan processing and loan decision process. 26 In the case where the mortgage loan is financing the purchase of the property, the value of the property for LTV purposes will not be higher than the effective purchase price. 27 A bank’s use of mortgage insurance should mirror the FSB Principles for sound residential mortgage underwriting (April 2012).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 39 of 349 Definition of “regulatory residential real estate” exposures 7.69 A “regulatory residential real estate” exposure is a regulatory real estate exposurethat is secured by a property that has the nature of a dwelling and satisfies all applicable laws and regulations enabling the property to be occupied for housing purposes (i.e. residential property). 28 Definition of “regulatory commercial real estate” exposures 7.70 A “regulatory commercial real estate” exposure isregulatory real estate exposure that is not a regulatory residential real estate exposure. Definition of exposures that are “materially dependent on cash flows generated bythe property” 7.71 Regulatory real estate exposures (both residential and commercial) are classified as exposures that are “materially dependent on cash flows generated by the property” when the prospects for servicing the loan materially depend on the cash flows generated by the property securing the loan rather than on the underlying capacity of the borrower to service the debt from other sources. The primary source of these cash flows would generally be lease or rental payments, or the sale of the property. The distinguishing characteristic of these exposures compared to other regulatory real estate exposures is that both the servicing of the loan and the prospects for recovery in the event of default depend materially on the cash flows generated by the property securing the exposure. 7.72 It is expected that the material dependence condition, set out in paragraph 7.71 above,would predominantly apply to loans to corporates, MSMEs or SPVs, but is not restricted to those borrower types. As an example, a loan may be considered materially dependent if more than 50% of the income from the borrower used in the bank's assessment of its ability to service the loan is from cash flows generated by the residential property.

28 For residential property under construction described in paragraph 7.63(1), this means there should be an expectation that the property will satisfy all applicable laws and regulations enabling the property to be occupied for housing purposes.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 40 of 349 7.73 As exceptions to the definition contained in paragraph 7.71 above, the following typesof regulatory real estate exposures are not classified as exposures that are materially dependent on cash flows generated by the property:

1. An exposure secured by a property that is the borrower’s primary residence;
2. An exposure secured by an income-producing residential housing unit, to anindividual who has mortgaged less than two properties or housing units;
3. An exposure secured by residential real estate property to associations orcooperatives of individualsthat are regulated under national law and existwith the only purpose of granting its members the use of a primary residence in the property securing the loans; and
4. An exposure secured by residential real estate property to public housing companies and not-for-profit associations regulated under national law thatexist to serve social purposes and to offer tenants long-term housing. Risk weights for regulatory residential real estate exposures that are not materially dependent on cash flows generated by the property 7.74 For regulatory residential real estate exposures that are not materially dependent on cash flow generated by the property, the risk weight to be assigned to the total exposure amount will be determined based on the exposure’s LTV ratio in Table 9 below. The use of the risk weights in Table 9 is referred to as the “whole loan” approach. Whole loan approach risk weights for regulatory residential real estate exposures that are not materially dependent on cash flows generated by the property Table9 Risk weight LTV ≤ 50% 50% < LTV ≤60% 60% < LTV ≤ 80% 80% < LTV ≤ 90% 90% < LTV ≤ 100% LTV

100% 20% 25% 30% 40% 50% 70%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 41 of 349 7.75 As an alternative to the whole loan approach for regulatory residential real estate exposures that are not materially dependent on cash flows generated by the property, banks may apply the “loan splitting” approach. Under the loan splitting approach, the risk weight of 20% is applied to the part of the exposure up to 55% of the property value and the risk weight of the counterparty (as prescribed in paragraph Error! Reference source not found.) is applied to the residual exposure29 . Where there are liens on the property that are not held by the bank, the treatment is as follows:

1. Where a bank holds the junior lien and there are senior liens not held by the bank, to determine the part of the bank’s exposure that is eligible for the 20% risk weight, the amount of 55% of the property value should be reduced by the amount of the senior liens not held by the bank. For example, for a loan of SAR 70,000 to an individual secured on a property valued at SAR 100,000, where there is also a senior ranking lien of SAR 10,000 held by another institution, the bank will apply a risk weight of 20% to SAR 45,000 (=max (SAR 55,000 – SAR 10,000, 0)) of the exposure and, according to paragraph Error! Reference source not found. a risk weight of 75% to the residual exposure of SAR 25,000. (this does not take into account the other loan taken by the borrower from the senior lien holder).
2. Where liens not held by the bank rank pari passu with the bank’s lien, to determine the part of the bank’s exposure that is eligible for the 20% risk weight, the amount of 55% of the property value, reduced by the amount of more senior liens not held by the bank (if any), should be reduced by the product of: (i) 55% of the property value, reduced by the amount of any senior liens (if any, both held by the bank and held by other institutions); and (ii) The amount of liens not held by the bank that rank pari passu with

29 For example, for a loan of SAR 70,000 to an individual secured on a property valued at SAR 100,000, the bank will apply a risk weight of 20% to SAR 55,000 of the exposure and, according to paragraph 7.82(1), a risk weight of 75% to the residual exposure of SAR 15,000. This gives total risk weighted assets for the exposure of SAR 22,250 = (0.20 * SAR 55,000) + (0.75 * SAR 15,000).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 42 of 349 the bank’s lien divided by the sum of all pari passu liens. For example, for a loan of SAR 70,000 to an individual secured on a property valued at SAR 100,000, where there is also a pari passu ranking lien of SAR 10,000 held by another institution, the bank will apply a risk weight of 20% to SAR 48,125 (=SAR 55,000 – SAR 55,000 * SAR 10,000/SAR 80,000) of the exposure and, according to CRE20.89(1), a risk weight of 75% to the residual exposure of SAR 21,875. If both the loan and the bank’s lien is only SAR 30,000 and there is additionally a more senior lien of SAR 10,000 not held by the bank, the property value remaining available is SAR 33,750 (= (SAR 55,000 – SAR 10,000) - ((SAR 55,000 – SAR 10,000) * SAR 10,000/(SAR 10,000+ SAR 30,000)), and the bank will apply a risk weight of 20% to SAR 30,000. Risk weights for regulatory residential real estate exposures that are materially dependent on cash flows generated by the property 7.76 For regulatory residential real estate exposures that are materially dependent on cash flows generated by the property, the risk weight to be assigned to the total exposure amount will be determined based on the exposure’s LTV ratio in Table10 below. Risk weights for regulatory residential real estate exposures that are materially dependent on cash flows generated by the property Table 10 Risk weight LTV ≤50% 50% < LTV ≤ 60% 60% < LTV ≤ 80% 80% < LTV ≤ 90% 90% < LTV ≤ 100% LTV > 100% 30% 35% 45% 60% 75% 105%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 43 of 349 Risk weights for regulatory commercial real estate exposures that are notmaterially dependent on cash flows generated by the property 7.77 For regulatory commercial real estate exposures that are not materially dependent on cash flow generated by the property, the risk weight to be assigned to the total exposure amount will be determined based on the exposure’s LTV in Table 11 below (which sets out a whole loan approach). The risk weight of the counterparty for the purposes of Table 11 below and 7.78 below is prescribed in paragraph Error! Reference source not found.. Whole loan approach risk weights for regulatory commercial real estate exposures that are not materially dependent on cash flows generated by theproperty Table 11 Risk weight LTV ≤ 60% LTV > 60% Min (60%, RW of counterparty) RW of counterparty 7.78 Banks may apply the “loan splitting” approach, as an alternative to the whole loan approach, for regulatory commercial real estate exposures that are not materially dependent on cash flows generated by the property. Under the loan splitting approach, the risk weight of 60% or the risk weight of the counterparty, whichever is lower, is applied to the part of the exposure up to 55% of the property value30, and the risk weight of the counterparty is applied to the residual exposure.

30 Where there are liens on the property that are not held by the bank, the part of the exposure up to 55% of the property value should be reduced by the amount of the senior liens not held by the bank and by a pro-rata percentage of any liens pari passu with the bank’s lien but not held by the bank. See paragraph 7.75 for examples of how this methodology applies in the case of residential retail exposures.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 44 of 349 Risk weights for regulatory commercial real estate exposures that are materially dependent on cash flows generated by the property 7.79 For regulatory commercial real estate exposures that are materially dependent on cash flows generated by the property, the risk weight to be assigned to the total exposure amount will be determined based on the exposure’s LTV in Table 12 below. Whole loan approach risk weights for regulatory commercial real estate exposures that are materially dependent on cash flows generated by the property Table12 Risk weight LTV ≤ 60% 60% < LTV ≤ 80% LTV > 80% 70% 90% 110% Definition of “other real estate” exposures and applicable risk weights 7.80 An “other real estate” exposure is an exposure within the real estate asset class that is not a regulatory real estate exposure (as defined in paragraph 7.63 above) and is not a land ADC exposure (as defined in paragraph 7.82 below). 7.81 Other real estate exposures are risk weighted as follows:

1. The risk weight of the counterparty is used for other real estate exposures that are not materially dependent on the cash flows generated by the property. For exposures to individuals the risk weight applied will be 75%. For exposures to SMEs, the risk weight applied will be 85%. For exposures to other counterparties, the risk weight applied is the risk weight that would be assigned to an unsecured exposure to that counterparty.
2. The risk weight of 150% is used for other real estate exposures that are materially dependent on the cash flows generated by the property.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 45 of 349 Definition of land acquisition, development and construction exposures andapplicable risk weights 7.82 Land ADC exposures31 refers to loans to companies or SPVs financing any of the land acquisition for development and construction purposes, or development and construction of any residential or commercial property. ADC exposures will be risk-weighted at 150%, unless they meet the criteria in paragraph 7.83. 7.83 ADC exposures to residential real estate may be risk weighted at 100%, provided that the following criteria are met:

1. prudential underwriting standards meet the requirements in paragraph 7.63 (i.e. the requirements that are used to classify regulatory real estate exposures) where applicable;
2. Pre-sale or pre-lease contracts amount to a significant portion of total contracts or substantial equity at risk. Pre-sale or pre-lease contracts must be legally binding written contracts and the purchaser/renter must have made a substantial cash deposit which is subject to forfeiture if the contract is terminated. Equity at risk should be determined as an appropriate amountof borrower-contributed equity to the real estate’s appraised as-completed value. Risk weight multiplier to certain exposures with currency mismatch 7.84 For unhedged retail and residential real estate exposures to individuals where thelending currency differs from the currency of the borrower’s source of income, banks will apply a 1.5 times multiplier to the applicable risk weight according to paragraphs 7.55 to 7.60 and 7.74 to 7.76, subject to a maximum risk weight of 150%. 7.85 For the purposes of paragraph 7.84, an unhedged exposure refers to an exposure to a borrower that has no natural or financial hedge against the foreign exchange risk resulting from the currency mismatch between the currency of the borrower’s income and the currency of the loan. A natural hedge exists where the borrower,in its normal operating procedures, receives foreign currency income that matches the currency of a given loan (e.g. remittances, rental

31 ADC exposures do not include the acquisition of forest or desert or agricultural land, where there is no planning consent or intention to apply for planning consent.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 46 of 349 incomes, salaries). Afinancial hedge generally includes a legal contract with a financial institution (e.g. forward contract). For the purposes of application of the multiplier, only these natural or financial hedges are considered sufficient where they cover at least 90% of the loan instalment, regardless of the number of hedges. Off-balance sheet items 7.86 Off-balance sheet items will be converted into credit exposure equivalents through the use of credit conversion factors (CCF). In the case of commitments, the committed but undrawn amount of the exposure would be multiplied by the CCF. For these purposes, commitment means any contractual arrangement that has been offered by the bank and accepted by the client to extend credit, purchase assets or issue credit substitutes.32 It includes any such arrangement that can be unconditionally cancelled by the bank at any time without prior notice to the obligor. It also includes any such arrangement that can be cancelled by the bank if the obligor fails to meet conditions set out in the facility documentation, including conditionsthat must be met by the obligor prior to any initial or subsequent drawdown under the arrangement. Counterparty risk weightings for over-the-counter (OTC) derivative transactions will not be subject to any specific ceiling. 7.87 A 100% CCF will be applied to the following items:

1. Direct credit substitutes, e.g. general guarantees of indebtedness (includingstandby letters of credit serving as financial guarantees for loans and securities) and acceptances (including endorsements with the character ofacceptances).

32 Certain arrangements might be exempted from the definition of commitments provided that the following conditions are met: (i) the bank receives no fees or commissions to establish or maintain the arrangements; (ii) the client is required to apply to the bank for the initial and each subsequent drawdown; (iii) the bank has full authority, regardless of the fulfilment by the client of the conditions set out in the facility documentation, over the execution of each drawdown; and (iv) the bank’s decision on the execution of each drawdown is only made after assessing the creditworthiness of the client immediately prior to drawdown. Exempted arrangements that meet the above criteria are limited to certain arrangements for corporates and MSMEs, where counterparties are closely monitored on an ongoing basis.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 47 of 349 2. Sale and repurchase agreements and asset sales with recourse33 where thecredit risk remains with the bank. 3. The lending of banks’ securities or the posting of securities as collateral by banks, including instances where these arise out of repo-style transactions (i.e. repurchase/reverse repurchase and securities lending/securities borrowing transactions). The risk-weighting treatment for counterparty creditrisk must be applied in addition to the credit risk charge on the securities or posted collateral, where the credit risk of the securities lent or posted as collateral remains with the bank. This paragraph does not apply to posted collateral related to derivative transactions that is treated in accordance with the counterparty credit risk standards. 4. Forward asset purchases, forward forward deposits and partly paid shares and securities,34 which represent commitments with certain drawdown. 5. Off-balance sheet itemsthat are creditsubstitutes not explicitly included inany other category. 7.88 A 50% CCF will be applied to note issuance facilities and revolving underwriting facilities regardless of the maturity of the underlying facility. 7.89 A 50% CCF will be applied to certain transaction-related contingent items (e.g. performance bonds, bid bonds, warranties and standby letters of credit related to particular transactions). 7.90 A 40% CCF will be applied to commitments, regardless of the maturity of the underlying facility, unless they qualify for a lower CCF. 7.91 A 20% CCF will be applied to both the issuing and confirming banks of short￾term self-liquidating trade letters of credit arising from the movement of goods (e.g. documentary credits collateralized by the underlying shipment). Short term inthis context means with a maturity below one year.

33 These items are to be weighted according to the type of asset and not according to the type of counterparty with whom the transaction has been entered into. 34 These items are to be weighted according to the type of asset and not according to the type of counterparty with whom the transaction has been entered into.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 48 of 349 7.92 A 10% CCF will be applied to commitments that are unconditionally cancellable at any time by the bank without prior notice, or that effectively provide for automatic cancellation due to deterioration in a borrower’s creditworthiness. SAMA may require applying higher CCF to certain commitments as appropriate based on various factors, which may constrain banks’ ability to cancel the commitment in practice. 7.93 Where there is an undertaking to provide a commitment on an off-balance sheet item, banks are to apply the lower of the two applicable CCFs35 . Exposures that give rise to counterparty credit risk 7.94 For exposures that give rise to counterparty credit risk according to paragraph 5.3 in The Counterparty Credit Risk (CCR) Framework (i.e. OTC derivatives, exchange-traded derivatives, long settlement transactions and securities financing transactions), the exposure amount to be used in the determination of RWA is to be calculated under the rules set out in chapters 3 to 8 in The Counterparty Credit Risk (CCR) Framework. Credit derivatives 7.95 A bank providing credit protection through a first-to-default orsecond-to-default credit derivative is subject to capital requirements on such instruments. For first￾to-default credit derivatives, the risk weights of the assets included in the basket must be aggregated up to a maximum of 1250% and multiplied by the nominal amount of the protection provided by the credit derivative to obtain the risk￾weighted asset amount. For second-to-default credit derivatives, the treatment is similar; however, in aggregating the risk weights, the asset with the lowest risk￾weighted amount can be excluded from the calculation. This treatment applies respectively for nth-to-default credit derivatives, for which the n-1 assets with thelowest risk-weighted amounts can be excluded from the calculation.

35 For example, if a bank has a commitment to open short-term self- liquidating trade letters of credit arising from the movement of goods, a 20% CCF will be applied (instead of a 40% CCF); and if a bank has an unconditionally cancellable commitment described in paragraph 7.92 to issue direct credit substitutes, a 10% CCF will be applied (instead of a 100% CCF).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 49 of 349 Defaulted exposures 7.96 For risk-weighting purposes under the standardized approach, a defaulted exposure is defined as one that is past due for more than 90 days, or is an exposure to a defaulted borrower. A defaulted borrower is a borrower in respect of whom any of the following events have occurred:

1. Any material credit obligation that is past due for more than 90 days. Overdrafts will be considered as being past due once the customer has breached an advised limit or been advised of a limit smaller than current outstanding;
2. Any material credit obligation is on non-accrued status (e.g. the lending bankno longer recognizes accrued interest as income or, if recognized, makes anequivalent amount of provisions);
3. A write-off or account-specific provision is made as a result of a significantperceived decline in credit quality subsequent to the bank taking on any credit exposure to the borrower;
4. Any credit obligation is sold at a material credit-related economic loss;
5. A distressed restructuring of any credit obligation (i.e. a restructuring that may result in a diminished financial obligation caused by the material forgiveness, or postponement, of principal, interest or (where relevant) fees)is agreed by the bank;
6. The borrower’s bankruptcy or a similar order in respect of any of the borrower’s credit obligations to the banking group has been filed;
7. The borrower has sought or has been placed in bankruptcy or similar protection where this would avoid or delay repayment of any of the creditobligations to the banking group; or
8. Any other situation where the bank considers that the borrower is unlikely topay its credit obligations in full without recourse by the bank to actions suchas realizing security.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 50 of 349 7.97 For retail exposures, the definition of default can be applied at the level of a particular credit obligation, rather than at the level of the borrower. As such, default by a borrower on one obligation does not require a bank to treat all other obligations to the banking group as defaulted. 7.98 With the exception of residential real estate exposures treated under paragraph 7.99,the unsecured or unguaranteed portion of a defaulted exposure shall be risk- weighted net of specific provisions and partial write-offs as follows:

1. 150% risk weight when specific provisions are less than 20% of the outstanding amount of the loan; and
2. 100% risk weight when specific provisions are equal or greater than 20% and less than 50% of the outstanding amount of the loan.
3. 50% risk weight when specific provisions are equal to or greater than 50% of the outstanding amount of the loan. 7.99 Defaulted residential real estate exposures where repayments do not materially depend on cash flows generated by the property securing the loan shall be risk￾weighted net of specific provisions and partial write-offs at 100%. Guarantees or financial collateral which are eligible according to the credit risk mitigation framework might be taken into account in the calculation of the exposure in accordance with paragraph 7.68. 7.100 For the purpose of defining the secured or guaranteed portion of the defaulted exposure, eligible collateral and guarantees will be the same as for credit risk. Other assets 7.101 Article 4.4 – Section A of SAMA Guidance Document Concerning the Implementation of Basel III (Circular No. 341000015689, Date: 19 December

2012. • specifies a deduction treatment for the following exposures: significant investments in the common shares of unconsolidated financial institutions, mortgage servicing rights, and deferred tax assets that arise from temporary differences. The exposures are deducted in the calculation of Common Equity Tier1 if they exceed the thresholds set out in that article. A 250% risk weight applies to the amount of the three “threshold deduction” items listed in the article that are not deducted by the article.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 51 of 349 7.102 The standard risk weight for all other assets will be 100%, with the exception of the following exposures:

1. A 0% risk weight will apply to: (a) Cash owned and held at the bank or in transit; and (b) Gold bullion held at the bank or held in another bank on an allocated basis, to the extent the gold bullion assets are backed by gold bullion liabilities.
2. A 20% risk weight will apply to cash items in the process of collection.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 52 of 349 8. Standardized approach: the use of external rating Recognition of external ratings by SAMA 8.1 The following ECAIs qualify as Eligible ECAI’s in Saudi Arabia, (1) Standard & Poor's (S&P); (2) Moody's; and (3) Fitch. The recognition process 8.2 Only credit assessments from credit rating agencies recognized as external credit assessment institutions (ECAIs) will be allowed. SAMA will determine on a continuous basis whether an ECAI meets the criteria listed in 8.3 and recognition will only be provided in respect of ECAI ratings for types of exposure where all criteria and conditions are met. SAMA will also take into account the criteria and conditions provided in the International Organization of Securities Commissions' Code of Conduct Fundamentals for Credit Rating Agencies when determining ECAI eligibility. Eligibility criteria 8.3 An ECAI must satisfy each of the following eight criteria. (1) Objectivity: The methodology for assigning external ratings must be rigorous, systematic, and subject to some form of validation based on historical experience. Moreover, external ratings must be subject to ongoingreview and responsive to changes in financial condition. Before being recognized by SAMA, a rating methodology for each market segment, including rigorous back testing, must have been established for at least one year and preferably three years. (2) Independence: An ECAI should be independent and should not be subject to political or

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 53 of 349 economic pressures that may influence the rating. In particular, an ECAI should not delay or refrain from taking a rating action based on its potential effect (economic, political or otherwise). The rating process should be as free as possible from any constraints that could arise in situations where the composition of the board of directors or the shareholder structureof the credit rating agency may be seen as creating a conflict of interest. Furthermore, an ECAI should separate operationally, legally and, if practicable, physically its rating business from other businesses and analysts. (3) International access/transparency: The individual ratings, the key elements underlining the ratings assessments and whether the issuer participated in the rating process should be publicly available on a non-selective basis, unless they are private ratings, which should be at least available to both domestic and foreign institutions with legitimate interest and on equivalentterms. In addition, the ECAI’s general procedures, methodologies and assumptions for arriving at ratings should be publicly available. (4) Disclosure: An ECAI should disclose the following information: its code of conduct; the general nature of its compensation arrangements with assessedentities; any conflict of interest, the ECAI's compensation arrangements, its rating assessment methodologies, including the definition of default, the time horizon, and the meaning of each rating; the actual default rates experienced in each assessment category; and the transitions of the ratings, e.g. the likelihood of AA ratings becoming A over time. A rating should be disclosed as soon as practicably possible after issuance. When disclosing a rating, the information should be provided in plain language, indicating the nature and limitation of credit ratings and the risk of unduly relying on themto make investments.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 54 of 349 (5) Resources: An ECAI should have sufficient resources to carry out high-quality credit assessments. These resources should allow for substantial ongoing contact with senior and operational levels within the entities assessed in order to add value to the credit assessments. In particular, ECAIs should assign analysts with appropriate knowledge and experience to assess the creditworthiness of the type of entity or obligation being rated. Such assessments should be based on methodologies combining qualitative and quantitative approaches. (6) Credibility: To some extent, credibility is derived from the criteria above. In addition, the reliance on an ECAI’s external ratings by independent parties (investors, insurers, trading partners) is evidence of the credibility of the ratings of an ECAI. The credibility of an ECAI is also underpinned by the existence of internal procedures to prevent the misuse of confidential information. In order to be eligible for recognition, an ECAI does not have toassess firms in more than one country. (7) Cooperation with SAMA: ECAIs should notify SAMA of significant changes to methodologies and provide access to external ratings and other relevant data in order to support initial and continued determination of eligibility. 8.4 Regarding the disclosure of conflicts of interest referenced in paragraph 8.3(4) above,at a minimum, the following situations and their influence on the ECAI’s credit rating methodologies or credit rating actions shall be disclosed: (1) The ECAI is being paid to issue a credit rating by the rated entity or by theobligor, originator, underwriter, or arranger of the rated obligation; (2) The ECAI is being paid by subscribers with a financial interest that could beaffected by a credit rating action of the ECAI; (3) The ECAI is being paid by rated entities, obligors, originators, underwriters,arrangers, or subscribers for services other than issuing credit ratings or providing access to the ECAI’s credit ratings;

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 55 of 349 (4) The ECAI is providing a preliminary indication or similar indication of credit quality to an entity, obligor, originator, underwriter, or arranger prior to being hired to determine the final credit rating for the entity, obligor, originator, underwriter, or arranger; and (5) The ECAI has a direct or indirect ownership interest in a rated entity or obligor, or a rated entity or obligor has a direct or indirect ownership interestin the ECAI. 8.5 Regarding the disclosure of an ECAI's compensation arrangements referenced in (4) above: (1) An ECAI should disclose the general nature of its compensation arrangements with rated entities, obligors, lead underwriters, or arrangers. (2) When the ECAI receives from a rated entity, obligor, originator, lead underwriter, or arranger compensation unrelated to its credit rating services,the ECAI should disclose such unrelated compensation as a percentage of total annual compensation received from such rated entity, obligor, lead underwriter, or arranger in the relevant credit rating report or elsewhere, as appropriate. (3) An ECAI should disclose in the relevant credit rating report or elsewhere, as appropriate, if it receives 10% or more of its annual revenue from a single client (e.g. a rated entity, obligor, originator, lead underwriter, arranger, orsubscriber, or any of their affiliates). Implementation considerations The mapping of Credit Assessments by ECAIs 8.6 SAMA will be assigning eligible ECAIs’ ratings to the risk weights available under the standardized risk weighting framework, i.e. deciding which rating categories correspond to which risk weights. 8.7 Banks can use the following mapping of ECAIs’ ratings. This mapping will be subject to review by SAMA as appropriate and banks will be informed accordingly.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 56 of 349 SAMA S&P Moody's Fitch 1 AAA Aaa AAA AA+ Aa1 AA+ AA Aa2 AA AA- Aa3 AA￾2 A+ A1 A+ A A2 A A- A3 A￾3 BBB+ Baa1 BBB+ BBB Baa2 BBB BBB- Baa3 BBB￾4 BB+ Ba1 BB+ BB Ba2 BB BB- Ba3 BB￾B+ B1 B+ B B2 B B- B3 B￾5 CCC+ Caa1 CCC+ CCC Caa2 CCC CCC- Caa3 CCC￾CC Ca CC D D 6 Unrated

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 57 of 349 8.8 Banks must use the chosen ECAIs and their ratings consistently for all types of exposure where they have been recognized by SAMA as an eligible ECAI, for both risk-weighting and risk management purposes. Banks are not allowed to “cherry-pick” the ratings provided by different ECAIs and to arbitrarily change the use of ECAIs. 8.9 Banks must use the global rating scale provided by the ECAIs consistently for all types of exposures, the use of national rating scales is subject to mapping to the global rating. Multiple external ratings 8.10 If there is only one rating by an ECAI chosen by a bank for a particular exposure, that rating should be used to determine the risk weight of the exposure. 8.11 If there are two ratings by ECAIs chosen by a bank that map into different risk weights, the higher risk weight will be applied. 8.12 If there are three or more ratings with different risk weights, the two ratings that correspond to the lowest risk weights should be referred to. If these give rise to the same risk weight, that risk weight should be applied. If different, the higher risk weight should be applied. Determination of whether an exposure is rated: Issue-specific and issuer ratings 8.13 Where a bank investsin a particular issue that has an issue-specific rating, the risk weight of the exposure will be based on this rating. Where the bank’s exposure isnot an investment in a specific rated issue, the following general principles apply. (1) In circumstances where the borrower has a specific rating for an issued debt – but the bank’s exposure is not an investment in this particular debt – a high-quality credit rating (one which maps into a risk weight lower than thatwhich applies to an unrated exposure) on that specific debt may only be applied to the bank’s unrated exposure if this exposure ranks in all respects pari passu or senior to the exposure with a rating. If not, the external rating cannot be used and the unassessed exposure will receive

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 58 of 349 the risk weight forunrated exposures. (2) In circumstances where the borrower has an issuer rating, this rating typically applies to senior unsecured exposures to that issuer. Consequently, only senior exposures to that issuer will benefit from a high-quality issuer rating. Other unassessed exposures of a highly rated issuer will be treated as unrated. If either the issuer or a single issue has a low-quality rating (mapping into a risk weight equal to or higher than that which applies to unrated exposures), an unassessed exposure to the same counterparty that ranks pari passu or is subordinated to either the senior unsecured issuer rating or the exposure with a low-quality rating will be assigned the same risk weight as is applicable to the low-quality rating. (3) In circumstances where the issuer has a specific high-quality rating (one which maps into a lower risk weight) that only applies to a limited class ofliabilities (such as a deposit rating or a counterparty risk rating), this may only be used in respect of exposures that fall within that class. 8.14 Whether the bank intends to rely on an issuer- or an issue-specific rating, the rating must take into account and reflect the entire amount of credit risk exposure the bank has with regard to all payments owed to it. For example, if abank is owed both principal and interest, the rating must fully take into accountand reflect the credit risk associated with repayment of both principal and interest. 8.15 In order to avoid any double-counting of credit enhancement factors, no supervisory recognition of credit risk mitigation techniques will be taken into account if the credit enhancement is already reflected in the issue specific rating (see paragraph 9.5). Domestic currency and foreign currency ratings 8.16 Where exposures are risk-weighted based on the rating of an equivalent exposure to that borrower, the general rule is that foreign currency ratings would be used for exposures in foreign currency. Domestic currency ratings, if separate,would

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 59 of 349 only be used to risk-weight exposures denominated in the domestic currency36 . Short-term/long-term ratings 8.17 For risk-weighting purposes, short-term ratings are deemed to be issue-specific. They can only be used to derive risk weights for exposures arising from the rated facility. They cannot be generalized to other short-term exposures, except under the conditions in paragraph 8.19. In no event can a short-term rating be used to support a risk weight for an unrated long-term exposure. Short-term ratings may only be used for short-term exposures against banks and corporates. Table 13 37 38 below provides a framework for banks’ exposures to specific short-term facilities,such as a particular issuance of commercial paper: Risk weight table for specific short-term ratings Table 13 External rating A-1/P-1 A-2/P-2 A-3/P-3 Others Risk weight 20% 50% 100% 150% 8.18 If a short-term rated facility attracts a 50% risk-weight, unrated short-term exposures cannot attract a risk weight lower than 100%. If an issuer has a short￾term facility with an external rating that warrants a risk weight of 150%, all unrated exposures, whether long-term or short-term, should also receive a 150% risk weight, unless the bank uses recognized credit risk mitigation techniques for

36 However, when an exposure arises through a bank’s participation in a loan that has been extended, or has been guaranteed against convertibility and transfer risk, by certain multilateral development banks (MDBs), its convertibility and transfer risk can be considered by SAMA to be effectively mitigated. To qualify, MDBs must have preferred creditor status recognized in the market and be included in the first footnote in paragraph 7.9. In such cases, for risk- weighting purposes, the borrower’s domestic currency rating may be used instead of its foreign currency rating. In the case of a guarantee against convertibility and transfer risk, the local currency rating can be used only for the portion that has been guaranteed. The portion of the loan not benefiting from such a guarantee will be risk-weighted based on the foreign currency rating. 37 The notations follow the methodology used by S&P and by Moody’s Investors Service. The A-1 rating of S&P includes both A-1+ and A-1–. 38 The “others” category includes all non-prime and B or C ratings.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 60 of 349 such exposures. 8.19 In cases where short-term ratings are available, the following interaction with the general preferential treatment for short-term exposures to banks as described in paragraph 7.15 will apply: (1) The general preferential treatment for short-term exposures applies to all exposuresto banks of up to three months original maturity when there is nospecific short-term exposure rating. (2) When there is a short-term rating and such a rating maps into a risk weightthat is more favorable (i.e. lower) or identical to that derived from the general preferential treatment, the short-term rating should be used for thespecific exposure only. Other short-term exposures would benefit from the general preferential treatment. (3) When a specific short-term rating for a short term exposure to a bank maps into a less favorable (higher) risk weight, the general short-term preferential treatment for interbank exposures cannot be used. All unrated short-term exposures should receive the same risk weighting as that implied by the specific short-term rating. 8.20 When a short-term rating is to be used, the institution making the assessment needs to meet all of the eligibility criteria for recognizing ECAIs, as described in paragraph 8.3, in terms of its short-term ratings. Level of application of the rating 8.21 External ratings for one entity within a corporate group cannot be used to risk￾weight other entities within the same group. Use of unsolicited ratings 8.22 As a general rule, banks should use solicited ratings from eligible ECAIs. Banks are not permitted to use unsolicited ratings.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 61 of 349 9. Standardized Approach: Credit Risk Mitigation 9.1 Banks use a number of techniques to mitigate the credit risks to which they are exposed. For example, exposures may be collateralized by first-priority claims, in whole or in part with cash or securities, a loan exposure may be guaranteed by a third party, or a bank may buy a credit derivative to offset various forms of credit risk. Additionally banks may agree to net loans owed to them against deposits from the same counterparty39 . 9.2 The framework set out in this chapter is applicable to banking book exposures that are risk-weighted under the standardized approach. General requirements 9.3 No transaction in which credit risk mitigation (CRM) techniques are used shall receive a higher capital requirement than an otherwise identical transaction where such techniques are not used. 9.4 The requirements of chapter 19 in Pillar 3 Disclosure Requirements Framework must be fulfilled for banks to obtain capital relief in respect of any CRM techniques. 9.5 The effects of CRM must not be double-counted. Therefore, no additional supervisory recognition of CRM for regulatory capital purposes will be granted onexposures for which the risk weight already reflects that CRM. Consistent with paragraph 8.14, principal-only ratings will also not be allowed within the CRM framework. 9.6 While the use of CRM techniques reduces or transfers credit risk, it may simultaneously increase other risks (i.e. residual risks). Residual risks include legal, operational, liquidity and market risks. Therefore, banks must employ robust procedures and processes to control these risks, including strategy; consideration of the underlying credit; valuation; policies and procedures;

39 In this section, “counterparty” is used to denote a party to whom a bank has an on- or off-balance sheet credit exposure. That exposure may, for example, take the form of a loan of cash or securities (where the counterparty would traditionally be called the borrower), of securities posted as collateral, of a commitment or of exposure under an over-the-counter (OTC) derivatives contract.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 62 of 349 systems; control of roll-off risks; and management of concentration risk arising from the bank’s useof CRM techniques and its interaction with the bank’s overall credit risk profile. Where these risks are not adequately controlled, SAMA may impose additional capital charges or take other supervisory actions in the supervisory review process. 9.7 In order for CRM techniques to provide protection, the credit quality of the counterparty must not have a material positive correlation with the employed CRM technique or with the resulting residual risks (as defined in paragraph 9.6). For example, securities issued by the counterparty (or by any counterparty￾relatedentity) provide little protection as collateral and are thus ineligible. 9.8 In the case where a bank has multiple CRM techniques covering a single exposure(e.g. a bank has both collateral and a guarantee partially covering an exposure), the bank must subdivide the exposure into portions covered by each type of CRM technique (e.g. portion covered by collateral, portion covered by guarantee) and the risk-weighted assets of each portion must be calculated separately. Whencredit protection provided by a single protection provider has differing maturities, they must be subdivided into separate protection as well. Legal requirements 9.9 In order for banks to obtain capital relief for any use of CRM techniques, all documentation used in collateralized transactions, on-balance sheet netting agreements, guarantees and credit derivatives must be binding on all parties and legally enforceable in all relevant jurisdictions. Banks must have conducted sufficient legal review to verify this and have a well-founded legal basis to reach this conclusion, and undertake such further review as necessary to ensure continuing enforceability. General treatment of maturity mismatches 9.10 For the purposes of calculating risk-weighted assets, a maturity mismatch occurs when the residual maturity of a credit protection arrangement (e.g. hedge) is less than that of the underlying exposure.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 63 of 349 9.11 In the case of financial collateral, maturity mismatches are not allowed under the simple approach (see paragraph 9.33). 9.12 Under the other approaches, when there is a maturity mismatch the credit protection arrangement may only be recognized if the original maturity of the arrangement is greater than or equal to one year, and its residual maturity is greater than or equal to three months. In such cases, credit risk mitigation may be partially recognized as detailed below in paragraph 9.13. 9.13 When there is a maturity mismatch with recognized credit risk mitigants, the following adjustment applies, where: (1) Pa = value of the credit protection adjusted for maturity mismatch (2) P = credit protection amount (e.g. collateral amount, guarantee amount)adjusted for any haircuts (3) t = min {T, residual maturity of the credit protection arrangement expressedin years} (4) T = min {five years, residual maturity of the exposure expressed in years} 9.14 The maturity of the underlying exposure and the maturity of the hedge must both be defined conservatively. The effective maturity of the underlying must be gauged as the longest possible remaining time before the counterparty is scheduled to fulfil its obligation, taking into account any applicable grace period. For the hedge, (embedded) options that may reduce the term of the hedge must be taken into account so that the shortest possible effective maturity is used. For example: where, in the case of a credit derivative, the protection seller has a call option, the maturity is the first call date. Likewise, if the protection buyer owns the call option and has a strong incentive to call the transaction at the first call date, for example because of a step-up in cost from this date on, the effective maturity is the remaining time to the first call date.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 64 of 349 Currency mismatches 9.15 Currency mismatches are allowed under all approaches. Under the simple approach there is no specific treatment for currency mismatches, given that a minimum risk weight of 20% (floor) is generally applied. Under the comprehensive approach and in case of guarantees and credit derivatives, a specific adjustment for currency mismatches is prescribed in paragraph 9.51 and 9.81 to 0, respectively. Overview of credit risk mitigation techniques Collateralized transactions 9.16 A collateralized transaction is one in which: (1) banks have a credit exposure or a potential credit exposure; and (2) that credit exposure or potential credit exposure is hedged in whole or in part by collateral posted by a counterparty or by a third party on behalf of the counterparty. 9.17 Where banks take eligible financial collateral, they may reduce their regulatory capital requirements through the application of CRM techniques40 . 9.18 Banks may opt for either: (1) The simple approach, which replaces the risk weight of the counterparty withthe risk weight of the collateral for the collateralized portion of the exposure(generally subject to a 20% floor); or (2) The comprehensive approach, which allows a more precise offset of collateral against exposures, by effectively reducing the exposure amount bya volatility-adjusted value ascribed to the collateral.

40 Alternatively, banks with appropriate supervisory approval may instead use the internal models method in the Counterparty Credit Risk (CCR) Framework to determine the exposure amount, taking into account collateral.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 65 of 349 9.19 Detailed operational requirements for both the simple approach and comprehensive approach are given in paragraph 9.32 to 9.64. Banks may operate under either, but not both, approaches in the banking book. 9.20 For collateralized OTC transactions, exchange traded derivatives and long settlement transactions, banks may use the standardized approach for counterparty credit risk (chapter 6) or the internal models method (chapter 7) in The Counterparty Credit Risk (CCR) Framework to calculate the exposure amount, in accordance with paragraphs 9.65 to 9.66. On-balance sheet netting 9.21 Where banks have legally enforceable netting arrangements for loans and deposits that meet the conditions in 9.67 and 9.68 they may calculatecapital requirements on the basis of net credit exposures as set out in that paragraph. Guarantees and credit derivatives 9.22 Where guarantees or credit derivatives fulfil the minimum operational conditions set out in paragraphs 9.69 to 9.71, banks may take account of the credit protection offered by such credit risk mitigation techniques in calculating capital requirements. 9.23 A range of guarantors and protection providers are recognized and a substitution approach applies for capital requirement calculations. Only guarantees issued by or protection provided by entities with a lower risk weight than the counterparty lead to reduced capital charges for the guaranteed exposure, since the protected portion of the counterparty exposure is assigned the risk weight of the guarantor or protection provider, whereas the uncovered portion retains the risk weight of the underlying counterparty. 9.24 Detailed conditions and operational requirements for guarantees and credit derivatives are given in paragraphs 9.69 to 9.83.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 66 of 349 Collateralized transactions General requirements 9.25 Before capital relief is granted in respect of any form of collateral, the standards set out below in paragraphs 9.269.31 must be met, irrespective of whether the simple or the comprehensive approach is used. Banks that lend securities or post collateral must calculate capital requirements for both of the following: (i) the credit risk or market risk of the securities, if this remains with the bank; and (ii) the counterparty credit risk arising from the risk that the borrower of the securities may default. 9.26 The legal mechanism by which collateral is pledged or transferred must ensure that the bank has the right to liquidate or take legal possession of it, in a timely manner, in the event of the default, insolvency or bankruptcy (or one or more otherwise-defined credit events set out in the transaction documentation) of the counterparty (and, where applicable, of the custodian holding the collateral). Additionally, banks must take all steps necessary to fulfil those requirements under the law applicable to the bank’s interest in the collateral for obtaining and maintaining an enforceable security interest, e.g. by registering it with a registrar,or for exercising a right to net or set off in relation to the title transfer of the collateral. 9.27 Banks must have clear and robust procedures for the timely liquidation of collateral to ensure that any legal conditions required for declaring the default of the counterparty and liquidating the collateral are observed, and that collateral can be liquidated promptly. 9.28 Banks must ensure that sufficient resources are devoted to the orderly operation of margin agreements with OTC derivative and securities-financing counterparties, as measured by the timeliness and accuracy of its outgoing margin calls and response time to incoming margin calls. Banks must have collateral risk management policies in place to control, monitor and report: (1) The risk to which margin agreements expose them (such as the volatility andliquidity of the securities exchanged as collateral); (2) The concentration risk to particular types of collateral;

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 67 of 349 (3) The reuse of collateral (both cash and non-cash) including the potential liquidity shortfalls resulting from the reuse of collateral received from counterparties; and (4) The surrender of rights on collateral posted to counterparties. 9.29 Where the collateral is held by a custodian, banks must take reasonable steps to ensure that the custodian segregates the collateral from its own assets. 9.30 A capital requirement must be applied on both sides of a transaction. For example, both repos and reverse repos will be subject to capital requirements. Likewise, both sides of a securities lending and borrowing transaction will be subject to explicit capital charges, as will the posting of securities in connection with derivatives exposures or with any other borrowing transaction. 9.31 Where a bank, acting as an agent, arranges a repo-style transaction (i.e. repurchase / reverse repurchase and securities lending/borrowing transactions) between a customer and a third party and provides a guarantee to the customer that the third party will perform on its obligations, then the risk to the bank is the same as if the bank had entered into the transaction as a principal. In such circumstances,a bank must calculate capital requirements as if it were itself the principal. The simple approach: general requirements 9.32 Under the simple approach, the risk weight of the counterparty is replaced by the risk weight of the collateral instrument collateralizing or partially collateralizing the exposure. 9.33 For collateral to be recognized in the simple approach, it must be pledged for at least the life of the exposure and it must be marked to market and revalued with a minimum frequency of six months. Those portions of exposures collateralized by the market value of recognized collateral receive the risk weight applicable to the collateral instrument. The risk weight on the collateralized portion is subject to a floor of 20% except under the conditions specified in paragraphs 9.36 to 9.39. The remainder of the exposure must be assigned the risk weight appropriate to the counterparty. Maturity mismatches are not allowed under the simple approach (see paragraphs 9.10 to 9.11).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 68 of 349 The simple approach: eligible financial collateral 9.34 The following collateral instruments are eligible for recognition in the simple approach: (1) Cash (as well as certificates of deposit or comparable instruments issued by the lending bank) on deposit with the bank that is incurring the counterparty exposure41 42 . (2) Gold. (3) Debt securities that meet the following conditions: (a) Debt securities rated43 by a recognized external credit assessment institution (ECAI) where these are either: (i) At least BB– when issued by sovereigns or public sector entities (PSEs) that are treated as sovereigns; or (ii) At least BBB– when issued by other entities (including banks and other prudentially regulated financial institutions); or (iii) At least A-3/P-3 for short-term debt instruments. (b) Debt securities not rated by a recognized ECAI where these are: (i) Issued by a bank; and (ii) Listed on a recognized exchange; and (iii) Classified as senior debt; and (iv) All rated issues of the same seniority by the issuing bank are rated at least BBB– or a-3/p-3 by a recognized ECAI; and (v) The bank holding the securities as collateral has no information to

41 Cash-funded credit-linked notes issued by the bank against exposures in the banking book that fulfil the criteria for credit derivatives are treated as cash-collateralized transactions. 42 When cash on deposit, certificates of deposit or comparable instruments issued by the lending bank are held as collateral at a third- party bank in a non-custodial arrangement, if they are openly pledged/assigned to the lending bank and if the pledge/assignment is unconditional and irrevocable, the exposure amount covered by the collateral (after any necessary haircuts for currency risk) receives the risk weight of the third-party bank. 43 When debt securities that do not have an issue specific rating are issued by a rated sovereign, banks may treat the sovereign issuer rating as the rating of the debt security.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 69 of 349 suggest that the issue justifies a rating below BBB– or A-3/P-3 (asapplicable); and (vi) SAMA is sufficiently confident that the market liquidity of the security is adequate. (4) Equities (including convertible bonds) that are included in a main index. (5) Undertakings for Collective Investments in Transferable Securities (UCITS)and mutual funds where: (a) a price for the units is publicly quoted daily; and (b) the UCITS/mutual fund is limited to investing in the instruments listed in this paragraph. 44 9.35 Resecuritizations as defined in the securitization chapters 18 to 23 are not eligible financial collateral. Simple approach: exemptions to the risk-weight floor 9.36 Repo-style transactions that fulfil all of the following conditions are exempted from the risk-weight floor under the simple approach: (1) Both the exposure and the collateral are cash or a sovereign security or PSEsecurity qualifying for a 0% risk weight under the standardized approach (chapter 0); (2) Both the exposure and the collateral are denominated in the same currency; (3) Either the transaction is overnight or both the exposure and the collateral aremarked to market daily and are subject to daily remargining; (4) Following a counterparty’s failure to remargin, the time that is required between the last mark-to-market before the failure to remargin and the liquidation of the collateral is considered to be no more than four

44 However, the use or potential use by a UCITS/mutual fund of derivative instruments solely to hedge investments listed in this paragraph and paragraph 9.45 shall not prevent units in that UCITS/mutual fund from being eligible financial collateral.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 70 of 349 businessdays; (5) The transaction is settled across a settlement system proven for that type oftransaction; (6) The documentation covering the agreement is standard market documentation for repo-style transactions in the securities concerned; (7) The transaction is governed by documentation specifying that if the counterparty fails to satisfy an obligation to deliver cash or securities or to deliver margin or otherwise defaults, then the transaction is immediately terminable; and (8) Upon any default event, regardless of whether the counterparty is insolventor bankrupt, the bank has the unfettered, legally enforceable right to immediately seize and liquidate the collateral for its benefit. 9.37 Transactions with core market participants; SAMA and Saudi sovereign only. 9.38 Repo transactions that fulfil the requirement in paragraph 9.36 receive a 10% risk weight, as an exemption to the risk weight floor described in paragraph 9.33. If the counterparty to the transaction is a core market participant, banks may apply a risk weight of 0% to the transaction. 9.39 The 20% floor for the risk weight on a collateralized transaction does not apply and a 0% risk weight may be applied to the collateralized portion of the exposure where the exposure and the collateral are denominated in the same currency, and either: (1) The collateral is cash on deposit as defined in paragraph 9.34(1); or (2) The collateral isin the form ofsovereign/PSE securities eligible for a 0% riskweight, and its market value has been discounted by 20%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 71 of 349 The comprehensive approach: general requirements 9.40 In the comprehensive approach, when taking collateral, banks must calculate their adjusted exposure to a counterparty in order to take account of the risk mitigating effect of that collateral. Banks must use the applicable supervisory haircuts to adjust both the amount of the exposure to the counterparty and the value of any collateral received in support of that counterparty to take account ofpossible future fluctuations in the value of either45 , as occasioned by market movements. Unless either side of the transaction is cash or a zero haircut is applied, the volatility-adjusted exposure amount is higher than the nominal exposure and the volatility-adjusted collateral value is lower than the nominal collateral value. 9.41 The size of the haircuts that banks must use depends on the prescribed holding period for the transaction. For the purposes of chapter 9, the holding period is the period of time over which exposure or collateral values are assumed to move before the bank can close out the transaction. The supervisory prescribed minimum holding period is used as the basis for the calculation of the standard supervisory haircuts. 9.42 The holding period, and thus the size of the individual haircuts depends on the type of instrument, type of transaction, residual maturity and the frequency of marking to market and remargining as provided in paragraphs 9.49 to 9.50. For example, repo-style transactions subject to daily marking-to-market and to daily remargining will receive a haircut based on a 5-business day holding period and secured lending transactions with daily mark-to-market and no remargining clauses will receive a haircut based on a 20-business day holding period. Haircuts must be scaled up using the square root of time formula depending on the actual frequency of remargining or marking to market. This formula is included in paragraph 9.58.

45 Exposure amounts may vary where, for example, securities are being lent.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 72 of 349 9.43 Additionally, where the exposure and collateral are held in different currencies, banks must apply an additional haircut to the volatility-adjusted collateral amount in accordance with paragraphs 9.51 and 9.81 to 0 to take account of possible future fluctuations in exchange rates. 9.44 The effect of master netting agreements covering securities financing transactions (SFTs) can be recognized for the calculation of capital requirements subject to the conditions and requirements in paragraphs 9.61 to 9.64 . Where SFTs are subject to a master netting agreement whether they are held in the banking book or trading book, a bank may choose not to recognize the netting effects in calculating capital. In that case, each transaction will be subject to a capital charge as if there were no master netting agreement. The comprehensive approach: eligible financial collateral 9.45 The following collateral instruments are eligible for recognition in the comprehensive approach: (1) All of the instruments listed in paragraph 9.34; (2) Equities and convertible bonds that are not included in a main index but which are listed on a recognized security exchange; (3) UCITS/mutual funds which include the instruments in point (2). The comprehensive approach: calculation of capital requirement 9.46 For a collateralized transaction, the exposure amount after risk mitigation is calculated using the formula that follows, where: (1) E* = the exposure value after risk mitigation (2) E = current value of the exposure (3) He = haircut appropriate to the exposure (4) C = the current value of the collateral received

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 73 of 349 (5) Hc = haircut appropriate to the collateral (6) Hfx = haircut appropriate for currency mismatch between the collateral andexposure 9.47 In the case of maturity mismatches, the value of the collateral received (collateral amount) must be adjusted in accordance with paragraphs 9.10 to 0. 9.48 The exposure amount after risk mitigation (E*) must be multiplied by the risk weight of the counterparty to obtain the risk-weighted asset amount for the collateralized transaction. 9.49 The following supervisory haircuts in table 14 below (assuming daily mark-to￾market, daily remargining and a 10 business day holding period), expressed as percentages, must be used to determine the haircuts appropriate to the collateral (Hc ) and to the exposure (He ): Supervisory haircuts for comprehensive approach Table 14 Issue rating for debt securities Residual maturity Sovereigns Other issuers Securitization exposures AAA to AA–/A-1 < 1 year 0.5 1 2

1 year, < 3years 2 3 8 3 years, < 5years 4 5 years, < 10years 4 6 16

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 74 of 349

10 years 12 A+ to BBB–/ A-2/A-3/P-3 and unrated bank securities 9.34(3)(b) < 1 year 1 2 4 1 year, < 3years 3 4 12 3 years, < 5years 6 5 years, < 10years 6 12 24 10 years 20 BB+ to BB– All 15 Not eligible Not eligible Main index equities (includingconvertible bonds) and gold 20 Other equities and convertiblebonds listed on a recognized exchange 30 UCITS/mutual funds Highest haircut applicable to any security in which the fund can invest, unless the bank can apply the look-through approach (LTA) for equity investments in funds, in which case the bank may use a weighted average of haircuts applicable to instruments held by the fund. Cash in the same currency 0

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 75 of 349 9.50 In paragraph 9.49 : (1) “Sovereigns” includes: PSEs that are treated as sovereigns by SAMA, as well as multilateral development banks receiving a 0% risk weight. (2) “Other issuers” includes: PSEsthat are not treated assovereigns by SAMA. (3) “Securitization exposures” refers to exposures that meet the definition set forth in the securitization framework. (4) “Cash in the same currency” refers to eligible cash collateral specified in paragraph 9.34(1). 9.51 The haircut for currency risk (Hfx) where exposure and collateral are denominatedin different currencies is 8% (also based on a 10-business day holding period anddaily mark-to-market). 9.52 For SFTs and secured lending transactions, a haircut adjustment may need to be applied in accordance with paragraphs 9.55 to 9.58. 9.53 For SFTs in which the bank lends, or posts as collateral, non-eligible instruments, the haircut to be applied on the exposure must be 30%. For transactions in whichthe bank borrows non-eligible instruments, credit risk mitigation may not be applied. 9.54 Where the collateral is a basket of assets, the haircut (H) on the basket must be calculated using the formula that follows, where: (1) ai is the weight of the asset (as measured by units of currency) in the basket (2) Hi the haircut applicable to that asset

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 76 of 349 The comprehensive approach: adjustment for different holding periods and non￾daily mark-to-market or remargining 9.55 For some transactions, depending on the nature and frequency of the revaluation and remargining provisions, different holding periods and thus different haircuts must be applied. The framework for collateral haircuts distinguishes between repo-style transactions (i.e. repo/reverse repos and securities lending/borrowing),” other capital markets-driven transactions” (i.e. OTC derivatives transactions and margin lending) and secured lending. In capital￾market-driven transactions and repo-style transactions, the documentation contains remargining clauses; in secured lending transactions, it generally does not. 9.56 The minimum holding period for various products is summarized in table 15 below: Minimum holding periods Table 15 Summary of minimum holding periods and remargining/revaluation periods Transaction type Minimum holding period Minimum remargining /revaluation period Repo-style transaction five business days daily remargining Other capital market transactions 10 business days daily remargining Secured lending 20 business days daily revaluation

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 77 of 349 9.57 Regarding the minimum holding periods set out in paragraph 9.56, if a netting set includes both repo-style and other capital market transactions, the minimum holding period of ten business days must be used. Furthermore, a higher minimum holding period must be used in the following cases: (1) For all netting sets where the number of trades exceeds 5,000 at any point during a quarter, a 20-business day minimum holding period for the following quarter must be used. (2) For netting sets containing one or more trades involving illiquid collateral, a minimum holding period of 20 business days must be used. "Illiquid collateral" must be determined in the context of stressed market conditions and will be characterized by the absence of continuously active markets where a counterparty would, within two or fewer days, obtain multiple price quotations that would not move the market or represent a price reflecting a market discount. Examples of situations where trades are deemed illiquid for this purpose include, but are not limited to, trades that are not marked daily and trades that are subject to specific accounting treatment for valuation purposes (e.g. repo-style transactions referencing securities whose fair value is determined by models with inputs that are not observed in the market). (3) If a bank has experienced more than two margin call disputes on a particular netting set over the previous two quarters that have lasted longer than the bank's estimate of the margin period of risk (as defined in The Counterparty Credit Risk (CCR) Framework), then for the subsequent two quarters the bank must use a minimum holding period that is twice the level that would apply excluding the application of this sub-paragraph.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 78 of 349 9.58 When the frequency of remargining or revaluation is longer than the minimum, the minimum haircut numbers must be scaled up depending on the actual number of business days between remargining or revaluation. The 10-business day haircuts provided in paragraphs 9.49 to 9.50 are the default haircuts and thesehaircuts must be scaled up or down using the formula below, where: (1) H = haircut (2) H10 = 10-business day haircut for instrument (3) TM = minimum holding period for the type of transaction. (4) NR = actual number of business days between remargining for capital market transactions or revaluation for secured transactions

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 79 of 349 The comprehensive approach: exemptions under the comprehensive approach for qualifying repo-style transactions involving core market participants 9.59 For repo-style transactions with core market participants as defined in paragraph 9.37 and that satisfy the conditions in paragraph 9.36, a haircut of zero can be applied. 9.60 Where, under the comprehensive approach, a foreign supervisor applies a specific carve-out to repo-style transactions in securities issued by its domestic government, banks are allowed to adopt the same approach to the same transactions. The comprehensive approach: treatment under the comprehensive approach of SFTs covered by master netting agreements 9.61 The effects of bilateral netting agreements covering SFTs may be recognized on acounterparty-by-counterparty basis if the agreements are legally enforceable in each relevant jurisdiction upon the occurrence of an event of default and regardless of whether the counterparty is insolvent or bankrupt. In addition, netting agreements must: (1) Provide the non-defaulting party the right to terminate and close out in a timely manner all transactions under the agreement upon an event of default, including in the event of insolvency or bankruptcy of the counterparty; (2) Provide for the netting of gains and losses on transactions (including the value of any collateral) terminated and closed out under itso that a single net amount is owed by one party to the other; (3) Allow for the prompt liquidation or set-off of collateral upon the event ofdefault; and (4) Be, together with the rights arising from the provisions required in (1) to (3) above, legally enforceable in each relevant jurisdiction upon the occurrenceof an event of default and regardless of the counterparty’s insolvency or bankruptcy.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 80 of 349 9.62 Netting across positionsin the banking and trading book may only be recognized when the netted transactions fulfil the following conditions: (1) All transactions are marked to market daily46;and (2) The collateral instruments used in the transactions are recognized as eligiblefinancial collateral in the banking book. 9.63 The formula in paragraph 9.64 will be used to calculate the counterparty credit risk capital requirements for SFTs with netting agreements. This formula includes the current exposure, an amount for systematic exposure of the securities based on the net exposure, an amount for the idiosyncratic exposure of the securities based on the gross exposure, and an amount for currency mismatch. All other rules regarding the calculation of haircuts under the comprehensive approach stated in paragraphs 9.40 to 9.60 equivalently apply for banks using bilateral netting agreements for SFTs. 9.64 Banks using standard supervisory haircuts for SFTs conducted under a master netting agreement must use the formula that follows to calculate their exposure amount, where: (1) E* is the exposure value of the netting set after risk mitigation (2) Ei is the current value of all cash and securities lent, sold with an agreementto repurchase or otherwise posted to the counterparty under the netting agreement (3) Cj is the current value of all cash and securities borrowed, purchased with anagreement to resell or otherwise held by the bank under the netting agreement (4) (5)

46 The holding period for the haircuts depends, as in other repo-style transactions, on the frequency of margining.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 81 of 349 (6) Es is the net current value of each security issuance under the netting set(always a positive value) (7) Hs is the haircut appropriate to Es as described in tables of paragraphs 9.49 to 9.50, as applicable (a) Hs has a positive sign if the security is lent, sold with an agreement to repurchased, or transacted in manner similar to either securities lendingor a repurchase agreement (b) Hs has a negative sign if the security is borrowed, purchased with an agreement to resell, or transacted in a manner similar to either a securities borrowing or reverse repurchase agreement (8) N is the number of security issues contained in the netting set (except that issuances where the value Es is less than one tenth of the value of the largestEs in the netting set are not included the count) (9) Efx is the absolute value of the net position in each currency fx different fromthe settlement currency (10) Hfx is the haircut appropriate for currency mismatch of currency fx

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 82 of 349 Collateralized OTC derivatives, exchange traded derivatives and long settlement transactions 9.65 Under the standardized approach for Counterparty Credit Risk Framework (SA￾CCR), the calculation of the counterparty credit risk charge for an individual contractwill be calculated using the following formula, where: (1) Alpha = 1.4 (2) RC = the replacement cost calculated according to paragraphs 6.5 to 6.22 in The Counterparty Credit Risk (CCR) Framework. (3) PFE = the amount for potential future exposure calculated according to paragraphs 6.23 to 6.76 in the CCR framework. 9.66 As an alternative to the SA-CCR for the calculation of the counterparty credit risk charge, banks may also use the internal models method as set out in chapter 7 of the Counterparty Credit Risk (CCR) Framework, subject to SAMA’s approval. On-balance sheet netting 9.67 A bank may use the net exposure of loans and deposits as the basis for its capital adequacy calculation in accordance with the formula in paragraph 9.46, when the bank: (1) Has a well-founded legal basis for concluding that the netting or offsetting agreement is enforceable in each relevant jurisdiction regardless of whetherthe counterparty is insolvent or bankrupt; (2) Is able at any time to determine those assets and liabilities with the samecounterparty that are subject to the netting agreement; (3) Monitors and controls its roll-off risks; and (4) Monitors and controls the relevant exposures on a net basis,

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 83 of 349 9.68 When calculating the net exposure described in the paragraph above, assets (loans) are treated as exposure and liabilities(deposits) as collateral. The haircuts are zero except when a currency mismatch exists. A 10-business day holding period applies when daily mark-to-market is conducted. For on-balance sheet netting, the requirements in paragraphs 9.49, 9.58 and 9.10 to 0 must be applied. Guarantees and credit derivatives Operational requirements for guarantees and credit derivatives 9.69 If conditions set below are met, banks can substitute the risk weight of the counterparty with the risk weight of the guarantor. 9.70 A guarantee (counter-guarantee) or credit derivative must satisfy the following requirements: (1) it represents a direct claim on the protection provider; (2) it is explicitly referenced to specific exposures or a pool of exposures, so thatthe extent of the cover is clearly defined and incontrovertible; (3) other than non-payment by a protection purchaser of money due in respectof the credit protection contract it is irrevocable; (4) there is no clause in the contract that would allow the protection provider unilaterally to cancel the credit cover, change the maturity agreed ex post, orthat would increase the effective cost of cover as a result of deteriorating credit quality in the hedged exposure; (5) it must be unconditional; there should be no clause in the protection contract outside the direct control of the bank that could prevent the protection provider from being obliged to pay out in a timely manner in theevent that the underlying counterparty fails to make the payment(s) due. 9.71 In the case of maturity mismatches, the amount of credit protection that is provided must be adjusted in accordance with paragraphs 9.10 to 0.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 84 of 349 Specific operational requirements for guarantees 9.72 In addition to the legal certainty requirements in paragraph 9.9, in order for a guarantee to be recognized, the following requirements must be satisfied: (1) On the qualifying default/non-payment of the counterparty, the bank may in a timely manner pursue the guarantor for any monies outstanding under the documentation governing the transaction. The guarantor may make one lump sum payment of all monies under such documentation to the bank, or the guarantor may assume the future payment obligations of the counterparty covered by the guarantee. The bank must have the right to receive any such payments from the guarantor without first having to take legal action in order to pursue the counterparty for payment. (2) The guarantee is an explicitly documented obligation assumed by the guarantor. (3) Except as noted in the following sentence, the guarantee covers all types of payments the underlying counterparty is expected to make under the documentation governing the transaction, for example notional amount, margin payments, etc. Where a guarantee covers payment of principal only,interests and other uncovered payments must be treated as an unsecured amount in accordance with the rules for proportional cover described in paragraph 9.79. Specific operational requirements for credit derivatives 9.73 In addition to the legal certainty requirements in paragraph 9.9, in order for a credit derivative contract to be recognized, the following requirements must be satisfied: (1) The credit events specified by the contracting parties must at a minimumcover: (a) failure to pay the amounts due under terms of the underlying obligationthat are in effect at the time of such failure (with a grace period that is closely in line with the grace period in the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 85 of 349 underlying obligation); (b) bankruptcy, insolvency or inability of the obligor to pay its debts, or its failure or admission in writing of its inability generally to pay its debts asthey become due, and analogous events; and (c) restructuring47 of the underlying obligation involving forgiveness or postponement of principal, interest or fees that results in a credit loss event (i.e. write-off, specific provision or other similar debit to the profitand loss account). (2) If the credit derivative covers obligations that do not include the underlying obligation, point (7) below governs whether the asset mismatch is permissible. (3) The credit derivative shall not terminate prior to expiration of any grace period required for a default on the underlying obligation to occur as a result of a failure to pay. In the case of a maturity mismatch, the provisionsof paragraphs 9.10 to 0 must be applied. (4) Credit derivatives allowing for cash settlement are recognized for capital purposes insofar as a robust valuation processisin place in order to estimateloss reliably. There must be a clearly specified period for obtaining post- credit-event valuations of the underlying obligation. If the reference obligation specified in the credit derivative for purposes of cash settlement isdifferent from the underlying obligation, section (7) below governs whether the asset mismatch is permissible.

47 When hedging corporate exposures, this particular credit event is not required to be specified provided that: (1) a 100% vote is needed to amend maturity, principal, coupon, currency or seniority status of the underlying corporate exposure; and (2) the legal domicile in which the corporate exposure is governed has a well-established bankruptcy code that allows for a company to reorganize/restructure and provides for an orderly settlement of creditor claims. If these conditions are not met, then the treatment in paragraph 9.74 may be eligible.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 86 of 349 (5) If the protection purchaser’s right/ability to transfer the underlying obligation to the protection provider isrequired forsettlement, the terms ofthe underlying obligation must provide that any required consent to such transfer may not be unreasonably withheld. (6) The identity of the parties responsible for determining whether a credit eventhas occurred must be clearly defined. This determination must not be the sole responsibility of the protection seller. The protection buyer must have the right/ability to inform the protection provider of the occurrence of a credit event. (7) A mismatch between the underlying obligation and the reference obligation under the credit derivative (i.e. the obligation used for purposes of determining cash settlement value or the deliverable obligation) is permissible if: (a) The reference obligation ranks pari passu with or is junior to the underlying obligation; and (b) The underlying obligation and reference obligation share the same obligor (i.e. The same legal entity) and legally enforceable cross-defaultor cross-acceleration clauses are in place. (8) A mismatch between the underlying obligation and the obligation used for purposes of determining whether a credit event has occurred is permissible if: (a) The latter obligation ranks pari passu with or is junior to the underlyingobligation; and (b) The underlying obligation and reference obligation share the same obligor (i.e. The same legal entity) and legally enforceable cross-defaultor cross-acceleration clauses are in place.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 87 of 349 9.74 When the restructuring of the underlying obligation is not covered by the credit derivative, but the other requirements in paragraph 9.73 are met, partial recognition of the credit derivative will be allowed. If the amount of the credit derivative is less than or equal to the amount of the underlying obligation, 60% of the amount of the hedge can be recognized as covered. If the amount of the credit derivative is larger than that of the underlying obligation, then the amount of eligible hedge is capped at 60% of the amount of the underlying obligation. Range of eligible guarantors (counter-guarantors)/protection providers and credit derivatives 9.75 Credit protection given by the following entities can be recognized when they have a lower risk weight than the counterparty: (1) Sovereign entities48 , PSEs, multilateral development banks (MDBs), banks, securities firms and other prudentially regulated financial institutions with alower risk weight than the counterparty49; (2) Other entities that are externally rated except when credit protection is provided to a securitization exposure. This would include credit protection provided by a parent, subsidiary and affiliate companies when they have a lower risk weight than the obligor; (3) When credit protection is provided to a securitization exposure, other entities that currently are externally rated BBB– or better and that were externally rated A– or better at the time the credit protection was provided. This would include credit protection provided by parent, subsidiary and affiliate companies when they have a lower risk weight than the obligor.

48 This includes the Bank for International Settlements, the International Monetary Fund, the European Central Bank, the European Union, the European Stability Mechanism and the European Financial Stability Facility, as well as MDBs eligible for a 0% risk weight as defined in paragraph 7.9. 49 A prudentially regulated financial institution is defined as: a legal entity supervised by a regulator that imposes prudential requirements consistent with international norms or a legal entity (parent company or subsidiary) included in a consolidated group where any substantial legal entity in the consolidated group is supervised by a regulator that imposes prudential requirements consistent with international norms. These include, but are not limited to, prudentially regulated insurance companies, broker/dealers, thrifts and futures commission merchants, and qualifying central counterparties as defined in chapter 8 of the Credit Counterparty Risk (CCR) framework.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 88 of 349 9.76 Only credit default swaps and total return swaps that provide credit protection equivalent to guarantees are eligible for recognition50 . The following exception applies: where a bank buys credit protection through a total return swap and records the net payments received on the swap as net income, but does not record offsetting deterioration in the value of the asset that is protected (eitherthrough reductions in fair value or by an addition to reserves), the credit protection will not be recognized. 9.77 First-to-default and all other nth-to-default credit derivatives (i.e. by which a bankobtains credit protection for a basket of reference names and where the first- ornth–to-default among the reference names triggers the credit protection and terminates the contract) are not eligible as a credit risk mitigation technique andtherefore cannot provide any regulatory capital relief. In transactions in which a bank provided credit protection through such instruments, it shall apply the treatment described in paragraph 7.94. Risk-weight treatment of transactions in which eligible credit protection is provided 9.78 The general risk-weight treatment for transactions in which eligible credit protection is provided is as follows: (1) The protected portion is assigned the risk weight of the protection provider.The uncovered portion of the exposure is assigned the risk weight of the underlying counterparty. (2) Materiality thresholds on payments below which the protection provider isexempt from payment in the event of loss are equivalent to retained first- loss positions. The portion of the exposure that is below a materiality threshold must be assigned a risk weight of 1250% by the bank purchasingthe credit protection.

50 Cash-funded credit-linked notes issued by the bank against exposures in the banking book that fulfil all minimum requirements for credit derivatives are treated as cash-collateralized transactions. However, in this case the limitations regarding the protection provider as set out in paragraph 9.75 do not apply.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 89 of 349 9.79 Where losses are shared pari passu on a pro rata basis between the bank and the guarantor, capital relief is afforded on a proportional basis, i.e. the protected portion of the exposure receives the treatment applicable to eligible guarantees /credit derivatives, with the remainder treated as unsecured. 9.80 Where the bank transfers a portion of the risk of an exposure in one or more tranches to a protection seller or sellers and retains some level of the risk of the loan, and the risk transferred and the risk retained are of differentseniority, banks may obtain credit protection for either the senior tranches (e.g. the second-loss portion) or the junior tranche (e.g. the first-loss portion). In this case the rules as set out in the securitization standard apply. Currency mismatches 9.81 Where the credit protection is denominated in a currency different from that in which the exposure is denominated – i.e. there is a currency mismatch – the amount of the exposure deemed to be protected must be reduced by the application of a haircut HFX, using the formula that follows, where: (1) G = nominal amount of the credit protection (2) HFX = haircut appropriate for currency mismatch between the credit protection and underlying obligation 9.82 The currency mismatch haircut for a 10-business day holding period (assuming daily marking to market) is 8%. This haircut must be scaled up using the square root of time formula, depending on the frequency of revaluation of the credit protection as described in paragraph 9.58.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 90 of 349 Sovereign guarantees and counter-guarantees 9.83 As specified in paragraph 7.2, a 0% risk weight may be applied to a bank’s exposures to Saudi sovereign (or SAMA) where the exposure is denominated in and funded in Saudi Riyal. This treatment can be extended to portions of exposures guaranteed by the sovereign (or central bank), where the guarantee is denominated in the domestic currency and the exposure is funded in that currency. An exposure may be covered by a guarantee that is indirectly counter￾guaranteed by a sovereign. Such an exposure may be treated as covered by a sovereign guarantee provided that: (1) the sovereign counter-guarantee covers all credit risk elements of the exposure; (2) both the original guarantee and the counter-guarantee meet all operational requirements for guarantees, except that the counter￾guarantee need not bedirect and explicit to the original exposure; and (3) SAMA is satisfied that the cover is robust and that no historical evidence suggests that the coverage of the counter-guarantee is less than effectively.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 91 of 349 10.IRB Approach: overview and asset class definitions 10.1 This chapter describes the internal ratings-based (IRB) approach for credit risk. Subject to certain minimum conditions and disclosure requirements, banks that have received SAMA’s approval to use the IRB approach may rely on their own internal estimates of risk components in determining the capital requirementfor a given exposure. The risk components include measures of the probability of default (PD), loss given default (LGD), the exposure at default (EAD), and effective maturity (M). In some cases, banks may be required to use a supervisory value as opposed to an internal estimate for one or more of the risk components. 10.2 The IRB approach is based on measures of unexpected losses (UL) and expected losses. The risk-weight functions, as outlined in chapter 11, produce capital requirements for the UL portion. Expected losses are treated separately, as outlined in chapter 15. 10.3 In this chapter, first the asset classes (e.g. corporate exposures and retail exposures) eligible for the IRB approach are defined. Second, there is a description of the risk components to be used by banks by asset class. Third, the requirements are outlined that relate to a bank’s adoption of the IRB approach at the asset class level and the related roll-out requirements. In cases where an IRB treatment is not specified, the risk weight for those other exposures is 100%, except when a 0% risk weight applies under the standardized approach, and the resulting risk-weighted assets are assumed to represent UL only. Moreover, banks must apply the risk weights referenced in paragraphs 7.53, 7.54 and 7.101 of the standardized approach to the exposures referenced in those paragraphs (that is, investments that are assessed against certain materiality thresholds).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 92 of 349 Categorization of exposures 10.4 Under the IRB approach, banks must categorize banking-book exposures into broad classes of assets with different underlying risk characteristics, subject to the definitions set out below. The classes of assets are (a) corporate, (b) sovereign, (c) bank, (d) retail, and (e) equity. Within the corporate asset class, five sub-classes of specialized lending are separately identified. Within the retail asset class, three sub-classes are separately identified. Within the corporate and retail asset classes, a distinct treatment for purchased receivables may also apply provided that certain conditions are met. For the equity asset class, the IRB approach is not permitted, as outlined further below. 10.5 The classification of exposures in this way is broadly consistent with established bank practice. However, some banks may use different definitions in their internal risk management and measurement systems. Banks are required to apply the appropriate treatment to each exposure for the purposes of deriving their minimum capital requirement. Banks must demonstrate to SAMA that their methodology for assigning exposuresto different classes is appropriate and consistent over time. Definition of corporate exposures 10.6 In general, a corporate exposure is defined as a debt obligation of a corporation, partnership, or proprietorship. Banks are permitted to distinguish separately exposures to micro, small or medium-sized entities (MSME), as defined in paragraph 11.8. 10.7 In addition to general corporates, within the corporate asset class five sub￾classes of specialized lending (SL) are identified. Such lending possesses all the following characteristics, in legal form or economic substance: (1) The exposure is typically to an entity (often a special purpose vehicle (SPV))that was created specifically to finance and/or operate physical assets,

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 93 of 349 (2) The borrowing entity has little or no other material assets or activities, andtherefore little or no independent capacity to repay the obligation, apart from the income that it receives from the asset(s) being financed; (3) The terms of the obligation give the lender a substantial degree of controlover the asset(s) and the income that it generates; and (4) As a result of the preceding factors, the primary source of repayment of theobligation is the income generated by the asset(s), rather than the independent capacity of a broader commercial enterprise. 10.8 The five sub-classes of SL are project finance (PF), object finance (OF), commodities finance (CF), income-producing real estate (IPRE) lending, and high-volatility commercial real estate (HVCRE) lending. Each of these sub￾classes is defined below. Project Finance 10.9 PF is a method of funding in which the lender looks primarily to the revenues generated by a single project, both as the source of repayment and as security for the exposure. This type of financing is usually for large, complex and expensive installations that might include, for example, power plants, chemical processing plants, mines, transportation infrastructure, environment, and telecommunications infrastructure. Project finance may take the form of financingof the construction of a new capital installation, or refinancing of an existing installation, with or without improvements. 10.10 In such transactions, the lender is usually paid solely or almost exclusively out of the money generated by the contracts for the facility’s output, such as the electricity sold by a power plant. The borrower is usually an SPV that is not permitted to perform any function other than developing, owning, and operating the installation. The consequence is that repayment depends primarily on the project’s cash flow and on the collateral value of the project’s assets. In contrast, if repayment of the exposure depends primarily on a well-established, diversified,credit-worthy, contractually obligated end user for repayment, it is considered a secured exposure to that end-user.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 94 of 349 Object Finance 10.11 OF refers to a method of funding the acquisition of physical assets (e.g. ships, aircraft, satellites, railcars, or fleets) where the repayment of the exposure is dependent on the cash flows generated by the specific assets that have been financed and pledged or assigned to the lender. A primary source of these cash flows might be rental or lease contracts with one or several third parties. In contrast, if the exposure is to a borrower whose financial condition and debt￾servicing capacity enables it to repay the debt without undue reliance on the specifically pledged assets, the exposure should be treated as a collateralized corporate exposure. Commodities Finance 10.12 CF refers to structured short-term lending to finance reserves, inventories, or receivables of exchange-traded commodities (e.g. crude oil, metals, or crops), where the exposure will be repaid from the proceeds of the sale of the commodity and the borrower has no independent capacity to repay the exposure. This is the case when the borrower has no other activities and no other material assets on its balance sheet. The structured nature of the financing is designed to compensate for the weak credit quality of the borrower. The exposure’s rating reflects its self-liquidating nature and the lender’s skill in structuring the transaction rather than the credit quality of the borrower. 10.13 Such lending can be distinguished from exposures financing the reserves, inventories, or receivables of other more diversified corporate borrowers. Banks are able to rate the credit quality of the latter type ofborrowers based on their broader ongoing operations. In such cases, the value ofthe commodity serves as a risk mitigant rather than as the primary source of repayment.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 95 of 349 Income-Producing Real Estate Lending 10.14 IPRE lending refers to a method of providing funding to real estate (such as, office buildings to let, retail space, multifamily residential buildings, industrial or warehouse space, or hotels) where the prospects for repayment and recovery on the exposure depend primarily on the cash flows generated by the asset. The primary source of these cash flows would generally be lease or rental payments or the sale of the asset. The borrower may be, but is not required to be, an SPV, an operating company focused on real estate construction or holdings, or an operating company with sources of revenue other than real estate. The distinguishing characteristic of IPRE versus other corporate exposures that are collateralized by real estate is the strong positive correlation between the prospects for repayment of the exposure and the prospects for recovery in the event of default, with both depending primarily on the cash flows generated by a property. High-Volatility Commercial Real Estate Lending 10.15 HVCRE lending is the financing of commercial real estate that exhibits higher loss rate volatility (i.e. higher asset correlation) compared to other types of SL. HVCRE includes: (1) Commercial real estate exposures secured by properties of types that are categorized by SAMA as sharing higher volatilities in portfolio default rates; (2) Loans financing any of the land acquisition, development and construction (ADC) phases for properties of those types in such jurisdictions; and (3) Loans financing ADC of any other properties where the source of repayment at origination of the exposure is either the future uncertain sale of the property or cash flows whose source of repayment is substantially uncertain (e.g. the property has not yet been leased to the occupancy rate prevailing in that geographic market for that type of commercial real estate), unless the borrower has substantial equity at risk. Commercial ADC loans exempted from treatment as HVCRE

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 96 of 349 loans on the basis of certainty of repayment or borrower equity are, however, ineligible for the additional reductions for SL exposures described in paragraph 13.4. Definition of sovereign exposures 10.16 This asset class covers all exposures to counterparties treated as sovereigns under the standardized approach. This includes sovereigns (and their central banks), certain public sector entities (PSEs) identified as sovereigns in the standardized approach, multilateral development banks (MDBs) that meet the criteria for a 0% risk weight and referred to in the first footnote in paragraph 7.9 , and the entities referred to in paragraph 7.4. Definition of bank exposures 10.17 This asset class covers exposures to banks as defined in paragraph 7.12 and those securities firms and other financial institutions set out in paragraph 7.36 that are treated as exposures to banks. Bank exposures also include covered bonds as defined in paragraph 7.29 as well as claims on all domestic PSEs that are not treated as exposures to sovereigns under the standardized approach, and MDBs that do not meet the criteria for a 0% risk weight under the standardized approach (i.e. MDBs that are not listed in paragraph 7.10). This asset class also includes exposures to the entities listed in this paragraph that are in the form of subordinated debt or regulatory capital instruments (which form their own asset class within the standardized approach), provided that such instruments: (i) do not fall within the scope of equity exposures as defined in paragraph 10.24; (ii) are not deducted from regulatory capital or risk-weighted at 250% according to Article 4.4 – Section A of SAMA Guidance Document Concerning the Implementation of Basel III (Circular No. 341000015689, Date: 19 December 2012); and (iii) are not risk weighted at 1250% according to paragraph 7.54.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 97 of 349 Definition of retail exposures 10.18 An exposure is categorized as a retail exposure if it meets all of the criteria set out in paragraph 10.19 (which relate to the nature of the borrower and value of individual exposures) and all of the criteria set out in paragraph 10.20 (which relate to the size of the pool of exposures). 10.19 The criteria related to the nature of the borrower and value of the individual exposures are as follows: (1) Exposures to individuals – such as revolving credits and lines of credit (e.g. credit cards, overdrafts, or retail facilities secured by financial instruments) aswell as personal term loans and leases (e.g. instalment loans, auto loans and leases, student and educational loans, personal finance, or other exposures with similar characteristics) – are generally eligible for retail treatment regardless of exposure size. (2) Where a loan is a residential mortgage (including first and subsequent liens,term loans and revolving home equity lines of credit) it is eligible for retail treatment regardless of exposure size so long as the credit is an exposure to an individual51 . (3) Where loans are extended to MSMEs and managed as retail exposures they are eligible for retail treatment provided the total exposure of the banking group to a MSME borrower (on a consolidated basis where applicable) is less than SAR 4.46 million. MSMEs loans extended through or guaranteed by an individual are subject to the same exposure threshold. 10.20 The criteria related to the size of the pool of exposures are as follows: (1) The exposure must be one of a large pool of exposures, which are managedby the bank on a pooled basis.

51 SAMA may exclude from the retail residential mortgage sub-asset class loans to individuals that have mortgaged no more than two properties or housing units, and treat such loans as corporate exposures.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 98 of 349 (2) Where a loan gives rise to a small business exposure below SAR 4 million, it may be treated as retail exposures if the bank treats such exposures in its internal risk management systems consistently over time and in the same manner as other retail exposures. This requires that such an exposure be originated in a similar manner to other retail exposures. Furthermore, it must not be managed individually in a way comparable to corporate exposures, but rather as part of a portfolio segment or pool of exposures with similar risk characteristics for purposes of risk assessment and quantification. However, this does not preclude retail exposures from being treated individually at some stages of the risk management process. The fact that an exposure is rated individually does not by itself deny the eligibility as a retail exposure. 10.21 Within the retail asset class category, banks are required to identify separately three sub-classes of exposures: (1) Residential mortgage loans, as defined above; (2) Qualifying revolving retail exposures, as defined in the following paragraph;and (3) All other retail exposures. Definition of qualifying revolving retail exposures 10.22 All of the following criteria must be satisfied for a sub-portfolio to be treated as aqualifying revolving retail exposure (QRRE). These criteria must be applied at a sub-portfolio level consistent with the bank’s segmentation of its retail activities generally. Segmentation at the national or country level (or below) should be thegeneral rule. (1) The exposures are revolving, unsecured, and uncommitted (both contractually and in practice). In this context, revolving exposures are definedas those where customers’ outstanding balances are permitted to fluctuate based on their decisions to borrow and repay, up to a limit established by the bank.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 99 of 349 (2) The exposures are to individuals. (3) The maximum exposure to a single individual in the sub-portfolio is SAR 400,000 or less. (4) Because the asset correlation assumptions for the QRRE risk-weight function are markedly below those for the other retail risk-weight function at low PD values, banks must demonstrate that the use of the QRRE risk-weight function is constrained to portfolios that have exhibited low volatility of lossrates, relative to their average level of loss rates, especially within the low PDbands. (5) Data on loss rates for the sub-portfolio must be retained in order to allow analysis of the volatility of loss rates. (6) The supervisor must concur that treatment as a qualifying revolving retailexposure is consistent with the underlying risk characteristics of the sub-portfolio. 10.23 The QRRE sub-class is split into exposures to transactors and revolvers. A QRRE transactor is an exposure to an obligor that meets the definition set out in paragraph 7.56. That is, the exposure is to an obligor in relation to a facility such as credit card or charge card where the balance has been repaid in full at each scheduled repayment date for the previous 12 months, or the exposure is in relation to an overdraft facility if there have been no drawdowns over the previous 12 months. All exposures that are not QRRE transactors are QRRE revolvers, including QRRE exposures with less than 12 months of repayment history. Definition of equity exposures 10.24 This asset class covers exposures to equities as defined in paragraphs 7.47 to 7.49.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 100 of 349 Definition of eligible purchased receivables 10.25 Eligible purchased receivables are divided into retail and corporate receivables asdefined below. Retail receivables 10.26 Purchased retail receivables, provided the purchasing bank complies with the IRB rules for retail exposures, are eligible for the top-down approach as permitted within the existing standards for retail exposures. The bank must also apply the minimum operational requirements as set in chapters 14 and 16. Corporate receivables 10.27 In general, for purchased corporate receivables, banks are expected to assess the default risk of individual obligors as specified in paragraphs 11.3 to 11.12 consistent with the treatment of other corporate exposures. However, the top￾down approach may be used, provided that the purchasing bank’s programme for corporate receivables complies with both the criteria for eligible receivables and the minimum operational requirements of this approach. The use of the top￾down purchased receivables treatment is limited to situations where it would be an undue burden on a bank to be subjected to the minimum requirements for the IRB approach to corporate exposures that would otherwise apply. Primarily, it is intended for receivables that are purchased for inclusion in asset-backed securitization structures, but banks may also use this approach, with the approval of SAMA, for appropriate on-balance sheet exposures that share the same features.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 101 of 349 10.28 SAMA may deny the use of the top-down approach for purchased corporate receivables depending on the bank’s compliance with minimum requirements. In particular, to be eligible for the proposed ‘top-down’ treatment, purchased corporate receivables must satisfy the following conditions: (1) The receivables are purchased from unrelated, third party sellers, and as such the bank has not originated the receivables either directly or indirectly. (2) The receivables must be generated on an arm’s-length basis between theseller and the obligor. (As such, intercompany accounts receivable and receivables subject to contra-accounts between firms that buy and sell toeach other are ineligible.52) (3) The purchasing bank has a claim on all proceeds from the pool of receivables or a pro-rata interest in the proceeds.53 (4) SAMA may establish concentration limits above which capital charges must be calculated using the minimum requirements for the bottom-up approach for corporate exposures. 10.29 The existence of full or partial recourse to the seller does not automatically disqualify a bank from adopting this top-down approach, as long as the cash flows from the purchased corporate receivables are the primary protection against default risk as determined by the rules in paragraphs 14.4 to 14.7 for purchased receivables and the bank meets the eligibility criteria and operational requirements.

52 Contra-accounts involve a customer buying from and selling to the same firm. The risk is that debts may be settled through payments in kind rather than cash. Invoices between the companies may be offset against each other instead of being paid. This practice can defeat a security interest when challenged in court. 53 Claims on tranches of the proceeds (first loss position, second loss position, etc.) would fall under the securitization treatment.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 102 of 349 Foundation and advanced approaches 10.30 For each of the asset classes covered under the IRB framework, there are three key elements: (1) Risk components: estimates of risk parameters provided by banks,some ofwhich are supervisory estimates. (2) Risk-weight functions: the means by which risk components are transformed into risk-weighted assets and therefore capital requirements. (3) Minimum requirements: the minimum standards that must be met in orderfor a bank to use the IRB approach for a given asset class. 10.31 For certain asset classes, there are two broad approaches: a foundation and an advanced approach. Under the foundation approach (F-IRB approach), as a general rule, banks provide their own estimatesof PD and rely on supervisory estimates for other risk components. Under the advanced approach (A-IRB approach), banks provide their own estimates of PD, LGD and EAD, and their own calculation of M, subject to meeting minimum standards. For both the foundation and advanced approaches, banks must alwaysuse the risk-weight functions provided in this Framework for the purpose of deriving capital requirements. The full suite of approaches is described below. 10.32 For exposures to equities, as defined in paragraph 10.24, the IRB approaches are not permitted (see paragraph 10.41). In addition, the A-IRB approach cannot be used for the following: (1) Exposures to general corporates (i.e. exposures to corporates that are notclassified as specialized lending) belonging to a group with total consolidated annual revenues greater than SAR 2,230m. (2) Exposures in the bank asset class in paragraph 10.17, and other securities firms and financial institutions (including insurance companies and any other financialinstitutions in the corporate asset class).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 103 of 349 10.33 In making the assessment for the revenue threshold in paragraph 10.32, the amounts must be as reported in the audited financial statements of the corporates or, for corporates that are part of consolidated groups, their consolidated groups (according to the accounting standard applicable to the ultimate parent of the consolidated group). The figures must be based on the average amounts calculated over the prior three years, or on the latest amounts updated every three years by the bank. Corporate, sovereign and bank exposures 10.34 Under the foundation approach, banks must provide their own estimates of PD associated with each of their borrower grades, but must use supervisory estimates for the other relevant risk components. The other risk components are LGD, EAD and M54 . 10.35 Under the advanced approach, banks must calculate the effective maturity (M)55 and provide their own estimates of PD, LGD and EAD. 10.36 There is an exception to this general rule for the five sub-classes of assets identified as SL. The SL categories: PF, OF, CF, IPRE and HVCRE 10.37 Banks that do not meet the requirements for the estimation of PD under the corporate foundation approach for their SL exposures are required to map their internal risk grades to five supervisory categories, each of which is associated with a specific risk weight. This approach is termed the ‘supervisory slotting criteria approach’.

54 As noted in paragraph 12.44 2012.44, SAMA may require banks using the foundation approach to calculate M using the definition provided in paragraphs 12.46 to 12.55. 55 At the discretion of SAMA, certain domestic exposures may be exempt from the calculation of M (see paragraph 12.44).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 104 of 349 10.38 Banks that meet the requirements for the estimation of PD are able to use the foundation approach to corporate exposures to derive risk weights for all classes of SL exposures except HVCRE. SAMA may consider allowing banks meeting these requirements for HVCRE exposures to use a foundation approach that is similar in all respects to the corporate approach, with the exception of a separate risk-weight function as described in paragraph 11.11. 10.39 Banks that meet the requirements for the estimation of PD, LGD and EAD are able to use the advanced approach to corporate exposures to derive risk weights for all classes of SL exposures except HVCRE. SAMA may consider allowing banks meeting these requirements for HVCRE exposure are able to use an advanced approach that is similar in all respects to the corporate approach, with the exception of a separate risk-weight function as described in paragraph 11.11. Retail exposures 10.40 For retail exposures, banks must provide their own estimates of PD, LGD and EAD. There is no foundation approach for this asset class. Equity exposures 10.41 All equity exposures are subject to the approach set out in paragraph 7.50 of the standardized approach for credit risk, with the exception of equity investments in funds that are subject to the requirements set out in chapter 24.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 105 of 349 Eligible purchased receivables 10.42 The treatment potentially straddles two asset classes. For eligible corporate receivables, both a foundation and advanced approach are available subject to certain operational requirements being met. As noted in paragraph 10.27, for corporate purchased receivables, banks are in general expected to assess the default risk of individual obligors. The bank may use the A-IRB treatment for purchased corporate receivables (paragraphs 14.6 to 14.7) only for exposures to individual corporate obligors that are eligible for the A-IRB approach according to paragraphs 10.32 and 10.33. Otherwise, the F-IRB treatment for purchased corporate receivables should be used. For eligible retail receivables, as with the retail asset class, only the A-IRB approach is available. Adoption of the IRB approach for asset classes 10.43 Once a bank adopts an IRB approach for part of its holdings within an asset class, it is expected to extend it across all holdings within that asset class. In this context, the relevant assets classes are as follows: (1) Sovereigns (2) Banks (3) Corporates (excluding specialized lending and purchased receivables) (4) Specialized lending (5) Corporate purchased receivables (6) QRRE (7) Retail residential mortgages (8) Other retail (excluding purchased receivables) (9) Retail purchased receivables.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 106 of 349 10.44 For many banks, it may not be practicable for various reasons to implement the IRB approach for an entire asset class across all business units at the same time. Furthermore, once on IRB, data limitations may mean that banks can meet the standards for the use of own estimates of LGD and EAD for some but not all of their exposures within an asset class at the same time (for example, exposures that are in the same asset class, but are in different business units). 10.45 As such, SAMA will consider allowing banks to adopt a phased rollout of the IRB approach across an asset class. The phased rollout includes: (i) adoption of IRB across the asset class within the same business unit; (ii) adoption of IRB for the asset class across business units in the same banking group; and (iii) move from the foundation approach to the advanced approach for certain risk components where use of the advanced approach is permitted. However, when a bank adopts an IRB approach for an asset class within a particular business unit, it must apply the IRB approach to all exposures within that asset class in that unit. 10.46 If a bank intends to adopt an IRB approach to an asset class, it must produce an implementation plan, specifying to what extent and when it intends to roll out the IRB approaches within the asset class and business units. The plan should be realistic, and must be agreed with the SAMA. It should be driven by the practicality and feasibility of moving to the more advanced approaches, and not motivated by a desire to adopt an approach that minimizes its capital charge. During the roll-out period, SAMA will ensure that no capital relief is granted for intra-group transactions which are designed to reduce a banking group’s aggregate capital charge by transferring credit risk among entities on the standardized approach, foundation and advanced IRB approaches. This includes, but is not limited to, asset sales or cross guarantees. 10.47 Some exposures that are immaterial in terms of size and perceived risk profile within their asset class may be exempt from the requirements in the previous twoparagraphs, subject to supervisory approval. Capital requirements for such operations will be determined according to the standardized approach, SAMA will determine whether a bank should hold more capital under the supervisory review process for such positions.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 107 of 349 10.48 Banks adopting an IRB approach for an asset class are expected to continue to employ an IRB approach for that asset class. A voluntary return to the standardized or foundation approach is permitted only in extraordinary circumstances,such as divestiture of a large fraction of the bank’s credit-related business in that asset class, and must be approved by SAMA 10.49 Given the data limitations associated with SL exposures, a bank may remain on the supervisory slotting criteria approach for one or more of the PF, OF, CF, IPRE or HVCRE sub-classes, and move to the foundation or advanced approach for the other sub-classes. However, a bank should not move to the advanced approach for the HVCRE sub-class without also doing so for material IPRE exposures at thesame time. 10.50 Irrespective of the materiality, exposures to central counterparties arising from over-the-counter derivatives, exchange traded derivatives transactions and securities financing transactions must be treated according to the dedicated treatment laid down in chapter 8 of The Counterparty Credit Risk (CCR) Framework.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 108 of 349 11.IRB Approach: Risk Weight Functions 11.1 This chapter presents the calculation of risk weighted assets under the internal ratings-based (IRB) approach for: (i) corporate, sovereign and bank exposures; and (ii) retail exposures. Risk weighted assets are designed to address unexpectedlosses from exposures. The method of calculating expected losses, and for determining the difference between that measure and provisions, is described in chapter 15. Explanation of the risk-weight functions 11.2 Regarding the risk-weight functions for deriving risk weighted assets set out in this chapter: (1) Probability of default (PD) and loss-given-default (LGD) are measured asdecimals (2) Exposure at default (EAD) is measured as currency (e.g. SAR), except where explicitly noted otherwise (3) ln denotes the natural logarithm (4) N(x) denotes the cumulative distribution function for a standard normal random variable (i.e. the probability that a normal random variable with meanzero and variance of one is less than or equal to x). The normal cumulative distribution function is, for example, available in Excel as the function NORMSDIST. (5) G(z) denotes the inverse cumulative distribution function for a standard normal random variable (i.e. the value of x such that N(x) = z). The inverse of the normal cumulative distribution function is, for example, available in Excelas the function NORMSINV.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 109 of 349 Risk-weighted assets for exposures that are in default 11.3 The capital requirement (K) for a defaulted exposure is equal to the greater of zero and the difference between its LGD (described in paragraph 16.82) and the bank’sbest estimate of expected loss (described in paragraph 16.85). The risk￾weighted assetamount for the defaulted exposure is the product of K, 12.5, and the EAD. Risk-weighted assets for corporate, sovereign and bank exposures thatare not in default Risk-weight functions for corporate, sovereign and bank exposures 11.4 The derivation of risk-weighted assets is dependent on estimates of the PD, LGD,EAD and, in some cases, effective maturity (M), for a given exposure. 11.5 For exposures not in default, the formula for calculating risk-weighted assets is as follows

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 110 of 349 11.6 Regarding the formula set out in paragraph 11.5 above, M is the effective maturity, calculated according to paragraphs 12.43 to 12.54, and the following term is used to refer to a specific part of the capital requirements formula: 11.7 A multiplier of 1.25 is applied to the correlation parameter of all exposures to financial institutions meeting the following criteria: (1) Regulated financial institutions whose total assets are greater than or equal to SAR 375 billion. The most recent audited financial statement of the parent company and consolidated subsidiaries must be used in order to determine asset size. For the purpose of this paragraph, a regulated financial institutionis defined as a parent and its subsidiaries where any substantial legal entity in the consolidated group is supervised by a regulator that imposes prudential requirements consistent with international norms. These include, but are not limited to, prudentially regulated Insurance Companies, Broker/Dealers, Banks, Thrifts and Futures Commission Merchants. (2) Unregulated financial institutions, regardless of size. Unregulated financial institutions are, for the purposes of this paragraph, legal entities whose main business includes: the management of financial assets, lending, factoring, leasing, provision of credit enhancements, securitization, investments, financial custody, central counterparty services, proprietary trading and other financial services activities identified by supervisors.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 111 of 349 Firm-size adjustment for micro, small or medium-sized entities (MSMEs) 11.8 Under the IRB approach for corporate credits, banks will be permitted to separately distinguish exposures to MSME borrowers (defined as corporate exposures where the reported revenues for the consolidated group of which the firm is a part is less than SAR 223 million) from those to large firms. A firm-size adjustment(i.e. 0.04 x (1 – (S – 5) / 45)) is made to the corporate risk weight formula for exposures to MSME borrowers. S is expressed as total annual revenues in millions of SAR with values of S falling in the range of equal to or less than SAR 223 million or greater than or equal to SAR 22.3 million. Reported revenue of less than SAR 20 million will be treated as if they were equivalent to SAR 20 million for the purposes of the firm-size adjustment for MSME borrowers. 11.9 SAMA may allow banks, as a failsafe, to substitute total assets of the consolidated group for total revenues in calculating the MSME threshold and the firm-size adjustment. However, total assets should be used only when total revenues are not a meaningful indicator of firm size. Risk weights for specialized lending 11.10 Regarding project finance, object finance, commodities finance and income￾producing real estate sub-asset classes of specialized lending (SL): (1) Banks that meet the requirements for the estimation of PD will be able to use the foundation IRB (F-IRB) approach for the corporate asset class to derive risk weightsfor SL sub-classes. Asspecified in paragraph 13.2, banks that donot meet the requirements for the estimation of PD will be required to use the supervisory slotting approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 112 of 349 (2) Banks that meet the requirements for the estimation of PD, LGD and EAD (where relevant) will be able to use the advanced IRB (A-IRB) approach forthe corporate asset class to derive risk weights for SL sub￾classes. 11.11 Regarding the high volatility commercial real estate (HVCRE) sub-asset class of specialized lending, banks that meet the requirements for the estimation of PD and whose supervisor has chosen to implement a foundation or advanced approach to HVCRE exposures will use the same formula for the derivation of risk weights that is used for other SL exposures, except that they will apply the following asset correlation formula: 11.12 Banks that do not meet the requirements for estimation of LGD or EAD for HVCRE exposures must use the supervisory parameters for LGD and EAD for corporate exposures, or use the supervisory slotting approach. Risk-weighted assets for retail exposures that are not in default 11.13 There are three separate risk-weight functions for retail exposures, as defined in paragraphs 11.14 to 11.16. Risk weights for retail exposures are based on separate assessments of PD and LGD as inputs to the risk-weight functions. None of the three retail risk-weight functions contain the full maturity adjustment componentthat is present in the risk-weight function for exposures to banks, sovereigns andcorporates.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 113 of 349 Retail residential mortgage exposures 11.14 For exposures defined in paragraph 10.18 that are not in default and are secured or partly secured56 by residential mortgages, risk weights will be assigned based on the following formula: Qualifying revolving retail exposures 11.15 For qualifying revolving retail exposures as defined in paragraphs 10.21 and 10.22 that are not in default, risk weights are defined based on the following formula:

56 This means that risk weights for residential mortgages also apply to theunsecured portion of such residential mortgages.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 114 of 349 Other retail exposures 11.16 For all other retail exposures that are not in default, risk weights are assigned based on the following function, which allows correlation to vary with PD:

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 115 of 349 12.IRB Approach: Risk components 12.1 This chapter presents the calculation of the risk components (PD, LGD, EAD, M) that are used in the formulas set out in chapter 11. In calculating these components, the legal certainty standards for recognizing credit risk mitigation under the standardized approach to credit risk (chapter 9) apply for both the foundation and advanced internal ratings-based (IRB) approaches. Risk components for corporate, sovereign and bank exposures 12.2 Paragraphs 12.2 to 12.56, sets out the calculation of the risk components for corporate, sovereign and bank exposures. In the case of an exposure that is guaranteed by a sovereign, the floors that apply to the risk components do not apply to that part of the exposure covered by the sovereign guarantee (i.e. any part of the exposure that is not covered by the guarantee is subject to the relevant floors). Probability of default (PD) 12.3 For corporate, sovereign and bank exposures, the PD is the one-year PD associated with the internal borrower grade to which that exposure is assigned. The PD of borrowers assigned to a default grade(s), consistent with the reference definition of default, is 100%. The minimum requirements for the derivation of the PD estimates associated with each internal borrower grade are outlined in paragraphs 16.76 to 16.78. 12.4 With the exception of exposures in the sovereign asset class, the PD for each exposure that is used as input into the risk weight formula and the calculation of expected loss must not be less than 0.05%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 116 of 349 Loss given default (LGD) 12.5 A bank must provide an estimate of the LGD for each corporate, sovereign and bank exposure. There are two approachesfor deriving this estimate: a foundation approach and an advanced approach. As noted in paragraph 10.32, the advanced approach is not permitted for exposures to certain entities. LGD under the foundation internal ratings-based (F-IRB) approach: treatment ofunsecured claims and non-recognized collateral 12.6 Under the foundation approach, senior claims on sovereigns, banks, securities firms and other financial institutions (including insurance companies and any financial institutions in the corporate asset class) that are not secured by recognized collateral will be assigned a 45% LGD. Senior claims on other corporates that are not secured by recognized collateral will be assigned a 40% LGD. 12.7 All subordinated claims on corporates, sovereigns and banks will be assigned a 75% LGD. A subordinated loan is a facility that is expressly subordinated to another facility. LGD under the F-IRB approach: collateral recognition 12.8 In addition to the eligible financial collateral recognized in the standardized approach, under the F-IRB approach some other forms of collateral, known as eligible IRB collateral, are also recognized. These include receivables, specified commercial and residential real estate, and other physical collateral, where they meet the minimum requirements set out in paragraphs 16.130 to 16.146. For eligible financial collateral, the requirements are identical to the operational standards as set out in the credit risk mitigation section of the standardized approach (see chapter 9).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 117 of 349 12.9 The simple approach to collateral presented in the standardized approach is not available to banks applying the IRB approach. 12.10 The LGD applicable to a collateralized transaction (LGD*) must be calculated as the exposure weighted average of the LGD applicable to the unsecured part of anexposure (LGDU) and the LGD applicable to the collateralized part of an exposure(LGDS ). Specifically, the formula that follows must be used, where: (1) E is the current value of the exposure (i.e. cash lent or securities lent or posted). In the case of securities lent or posted the exposure value has to beincreased by applying the appropriate haircuts (HE ) according to the comprehensive approach for financial collateral. (2) ES is the current value of the collateral received after the application of the haircut applicable for the type of collateral (Hc ) and for any currency mismatches between the exposure and the collateral, as specified in paragraphs 12.11 to 12.12. ES is capped at the value of E ∙ (1+HE ). (3) EU = E ∙ (1+HE ) - Es . The terms EU and ES are only used to calculate LGD*.Banks must continue to calculate EAD without taking into account the presence of any collateral, unless otherwise specified. (4) LGDU is the LGD applicable for an unsecured exposure, as set out in paragraphs 12.6 and 12.7. (5) LGDS is the LGD applicable to exposures secured by the type of collateralused in the transaction, as specified in paragraph 12.11.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 118 of 349 12.11 Table 16 below specifies the LGDS and haircuts applicable in the formula setout in paragraph 12.10: Table 16 Type of collateral LGDS Haircut Eligible financial collateral 0% As determined by the haircuts that apply in the comprehensive formula of the standardized approach for credit risk (paragraph 9.49). The haircuts have to be adjusted for different holding periods and non-daily remargining or revaluation according to paragraphs 9.55 to 9.58 of the standardized approach. Eligible receivables 20% 40% Eligible residential realestate / commercial real estate 20% 40% Other eligible physical collateral 25% 40% Ineligible collateral Not applicable 100%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 119 of 349 12.12 When eligible collateral is denominated in a different currency to that of the exposure, the haircut for currency risk is the same haircut that applies in the comprehensive approach (paragraph 9.51 of the standardized approach). 12.13 Banks that lend securities or post collateral must calculate capital requirements for both of the following: (i) the credit risk or market risk of the securities, if this remains with the bank; and (ii) the counterparty credit risk arising from the risk that the borrower of the securities may default. Paragraphs 12.37 to 12.43 set out the calculation the EAD arising from transactions that give rise to counterparty credit risk. For such transactions the LGD of the counterparty must be determined using the LGD specified for unsecured exposures, as set out in paragraphs 12.6 and 12.7.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 120 of 349 LGD under the F-IRB approach: methodology for the treatment of pools of collateral 12.14 In the case where a bank has obtained multiple types of collateral it may apply the formula set out in paragraph 12.10 sequentially for each individual type of collateral. In doing so, after each step of recognizing one individual type of collateral, the remaining value of the unsecured exposure (EU ) will be reduced by the adjusted value of the collateral (ES ) recognized in that step. In line with paragraph 12.10, the totalof ES across all collateral types is capped at the value of E ∙ (1+HE ). This results inthe formula that follows, where for each collateral type i: (1) LGDSi is the LGD applicable to that form of collateral (as specified in paragraph 0). (2) ESi is the current value of the collateral received after the application of thehaircut applicable for the type of collateral (Hc ) (as specified in paragraph 0). LGD under the advanced approach 12.15 Subject to certain additional minimum requirements specified below (and the conditions set out in paragraph 10.32), SAMA may permit banks to use their own internal estimates of LGD for corporate and sovereign exposures. LGD must be measured as the loss given default as a percentage of the EAD. Banks eligible forthe IRB approach that are unable to meet these additional minimum requirements must utilize the foundation LGD treatment described above.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 121 of 349 12.16 The LGD for each corporate exposure that is used as input into the risk weight formula and the calculation of expected loss must not be less than the parameter floors indicated in table 17 below (the floors do not apply to the LGD for exposures in the sovereign asset class): LGD parameter floors for corporate exposures Table 17 Unsecured Secured 25% Varying by collateral type: 0% financial 10% receivables 10% commercial or residential real estate15% other physical 12.17 The LGD floors for secured exposures in the table above apply when the exposureis fully secured (i.e. the value of collateral after the application of haircuts exceeds the value of the exposure). The LGD floor for a partially secured exposure is calculated as a weighted average of the unsecured LGD floor for the unsecured portion and the secured LGD floor for the secured portion. That is, the following formula should be used to determine the LGD floor, where: (1) LGDU floor and LGDS floor are the floor values for fully unsecured and fullysecured exposures respectively, as specified in the table in paragraph 12.10. (2) The other terms are defined as set out in paragraphs 12.10 and 0.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 122 of 349 12.18 In cases where a bank has met the conditions to use their own internal estimates of LGD for a pool of unsecured exposures, and takes collateral against one of these exposures, it may not be able to model the effects of the collateral (i.e. it may not have enough data to model the effect of the collateral on recoveries). In such cases, the bank is permitted to apply the formula set out in paragraphs 12.10 or 12.14, with the exception that the LGDU term would be the bank’s own internal estimate of the unsecured LGD. To adopt this treatment the collateral must be eligible under the F-IRB and the bank’s estimate of LGDU must not take account of any effects of collateral recoveries. 12.19 The minimum requirements for the derivation of LGD estimates are outlined in paragraphs 16.82 to 16.87. Treatment of certain repo-style transactions 12.20 Banks that want to recognize the effects of master netting agreements on repo￾style transactions for capital purposes must apply the methodology outlined in paragraph 12.38 for determining E* for use as the EAD in the calculation of counterpartycredit risk. For banks using the advanced approach, own LGD estimates would bepermitted for the unsecured equivalent amount (E*) used to calculate counterparty credit risk. In both cases banks, in addition to counterparty credit risk, must also calculate the capital requirements relating to any credit or market risk to which they remain exposed arising from the underlying securities in the master netting agreement. Treatment of guarantees and credit derivatives 12.21 There are two approaches for recognition of credit risk mitigation (CRM) in the form of guarantees and credit derivatives in the IRB approach: a foundation approach for banks using supervisory values of LGD, and an advanced approach for those banks using their own internal estimates of LGD.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 123 of 349 12.22 Under either approach, CRM in the form of guarantees and credit derivatives must not reflect the effect of double default (see paragraph 16.101). As such, to the extent that the CRM is recognized by the bank, the adjusted risk weight will not be less than that of a comparable direct exposure to the protection provider. Consistent with the standardized approach, banks may choose not to recognize credit protection if doing so would result in a higher capital requirement. Treatment of guarantees and credit derivatives: recognition under the foundation approach 12.23 For banks using the foundation approach for LGD, the approach to guarantees and credit derivatives closely follows the treatment under the standardized approach as specified in paragraphs 9.69 to 9.83. The range of eligible guarantors is the same as under the standardized approach except that companies that are internally rated may also be recognized under the foundation approach. To receive recognition, the requirements outlined in paragraphs 9.69 to 9.74 of the standardized approach must be met. 12.24 Eligible guarantees from eligible guarantors will be recognized as follows: (1) For the covered portion of the exposure, a risk weight is derived by taking: (a) The risk-weight function appropriate to the type of guarantor, and (b) The pd appropriate to the guarantor’s borrower grade. (2) The bank may replace the LGD of the underlying transaction with the LGD applicable to the guarantee taking into account seniority and any collateralization of a guaranteed commitment. For example, when a bank has a subordinated claim on the borrower but the guarantee represents a seniorclaim on the guarantor this may be reflected by using an LGD applicable for senior exposures (see paragraph 12.6) instead of an LGD applicable for subordinated exposures. (3) In case the bank applies the standardized approach to direct exposures

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 124 of 349 tothe guarantor it may only recognize the guarantee by applying the standardized approach to the covered portion of the exposure. 12.25 The uncovered portion of the exposure is assigned the risk weight associated with the underlying obligor. 12.26 Where partial coverage exists, or where there is a currency mismatch between the underlying obligation and the credit protection, it is necessary to split the exposure into a covered and an uncovered amount. The treatment in the foundation approach follows that outlined in paragraphs 9.79 to 9.80 of the standardized approach, and depends upon whether the cover is proportional or tranched. Treatment of guarantees and credit derivatives: recognition under the advanced approach 12.27 Banks using the advanced approach for estimating LGDs may reflect the risk￾mitigating effect of guarantees and credit derivativesthrough either adjusting PD or LGD estimates. Whether adjustments are done through PD or LGD, they must be done in a consistent manner for a given guarantee or credit derivative type. In doing so, banks must not include the effect of double default in such adjustments. Thus, the adjusted risk weight must not be less than that of a comparable direct exposure to the protection provider. In case the bank applies the standardized approach to direct exposures to the guarantor it may only recognize the guarantee by applying the standardized approach to the covered portion of the exposure. In case the bank applies the F-IRB approach to direct exposures to the guarantor it may only recognize the guarantee by determining the risk weight for the comparable direct exposure to the guarantor according to the F-IRB approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 125 of 349 12.28 A bank relying on own-estimates of LGD has the option to adopt the treatment outlined in paragraphs 12.23 to 12.26 above for banks under the F-IRB approach, or to make an adjustment to its LGD estimate of the exposure to reflect the presence of the guarantee or credit derivative. Under this option, there are no limits to the range of eligible guarantors although the set of minimum requirements provided in paragraphs 16.103 to 16.104 the type of guarantee must be satisfied. For credit derivatives, the requirements of paragraphs 16.109 to 16.110 must be satisfied57 . For exposures for which a bank has permission to use its own estimates of LGD, the bank may recognize the risk mitigating effects of first-to-default credit derivatives, but may not recognize the risk mitigating effects of second-to-default or more generally nth-to-default credit derivatives. Exposure at default (EAD) 12.29 The following sections apply to both on and off-balance sheet positions. All exposures are measured gross of specific provisions or partial write-offs. The EAD on drawn amounts should not be less than the sum of: (i) the amount by which a bank’s regulatory capital would be reduced if the exposure were written-off fully; and (ii) any specific provisions and partial write-offs. When the difference between the instrument’s EAD and the sum of (i) and (ii) is positive, this amount istermed a discount. The calculation of risk-weighted assets is independent of any discounts. Under the limited circumstances described in paragraph 15.4, discounts may be included in the measurement of total eligible provisions for purposes of the EL-provision calculation set out in chapter 15. Exposure measurement for on-balance sheet items 12.30 On-balance sheet netting of loans and deposits will be recognized subject to the same conditions as under paragraph 9.67 of the standardized approach. Where currency or maturity mismatched on-balance sheet netting exists, the treatment followsthe standardized approach, as set out in paragraphs 9.10 and 9.12 to 9.15

57 When credit derivatives do not cover the restructuring of the underlying obligation, the partial recognition set out in paragraph 9.74 of the standardized approach applies.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 126 of 349 Exposure measurement for off-balance sheet items (with the exception of derivatives) 12.31 For off-balance sheet items there are two approaches for the estimation of EAD: a foundation approach and an advanced approach. When only the drawn balances of revolving facilities have been securitized, banks must ensure that they continue to hold required capital against the undrawn balances associated with the securitized exposures. 12.32 In the foundation approach, EAD is calculated as the committed but undrawn amount multiplied by a credit conversion factor (CCF). In the advanced approach, EAD for undrawn commitments may be calculated as the committed but undrawn amount multiplied by a CCF or derived from direct estimates of total facility EAD. In both the foundation approach and advanced approaches, the definition of commitments is the same as in the standardized approach, as set out in paragraph 7.86. EAD under the foundation approach 12.33 The types of instruments and the CCFs applied to them under the F-IRB approach are the same as those in the standardized approach, as set out in paragraphs 7.86 to 7.93. 12.34 The amount to which the CCF is applied is the lower of the value of the unused committed credit line, and the value that reflects any possible constraining of the availability of the facility, such as the existence of a ceiling on the potential lending amount which is related to a borrower’s reported cash flow. If the facility is constrained in this way, the bank must have sufficient line monitoring and management procedures to support this contention. 12.35 Where a commitment is obtained on another off-balance sheet exposure, banks under the foundation approach are to apply the lower of the applicable CCFs.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 127 of 349 EAD under the advanced approach 12.36 Banks which meet the minimum requirements for use of their own estimates of EAD (see paragraphs 16.88 to 16.97) will be allowed for exposures for which A-IRB is permitted (see paragraph 10.31) to use their own internal estimates of EAD for undrawnrevolving commitments58 to extend credit, purchase assets or issue credit substitutes provided the exposure is not subject to a CCF of 100% in the foundation approach (see paragraph 12.33). Standardized approach CCFs must be used for all other off-balance sheet items (for example, undrawn non￾revolving commitments), and must be used where the minimum requirements for own estimates of EAD are not met. The EAD for each exposure that is not in the sovereign asset class that is used as input into the risk weight formula and the calculation of expected loss is subject to a floor that is the sum of: (i) the on balance sheet amount; and (ii) 50% of the off balance sheet exposure using the applicable CCF in the standardized approach. Exposures that give rise to counterparty credit risk 12.37 For exposures that give rise to counterparty credit risk according to The Counterparty Credit Risk (CCR) Framework (i.e.OTC derivatives, exchange￾traded derivatives, long settlement transactions and securities financing transactions (SFTs)), the EAD is to be calculated under the rules set in chapters 3 to 8 of the Counterparty Credit Risk (CCR) framework. 12.38 For SFTs, banks may recognize a reduction in the counterparty credit risk requirement arising from the effect of a master netting agreement providing that it satisfy the criteria set out in paragraphs 9.61 and 9.62 of the standardized approach. The bank must calculate E*, which is the exposure to be used for the counterparty credit risk requirement taking account of the risk mitigation of collateral received, using the formula set out in paragraph 9.64 of the standardized approach. In calculating risk-weighted assets and expected loss

58 A revolving loan facility is one that lets a borrower obtain a loan where the borrower has the flexibility to decide how often to withdraw from the loan and at what time intervals. A revolving facility allows the borrower to drawdown, repay and re-draw loans advanced to it. Facilities that allow prepayments and subsequent redraws of those prepayments are considered as revolving.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 128 of 349 (EL) amounts forthe counterparty credit risk arising from the set of transactions covered by the master netting agreement, E* must be used as the EAD of the counterparty. 12.39 As an alternative to the use of standard haircuts for the calculation of the counterparty credit risk requirement for SFTs set out in paragraph 12.38, banks may be permitted to use a value-at-risk (VaR) models approach to reflect price volatility of the exposures and the financial collateral. This approach can take into accountthe correlation effects between security positions. This approach applies to single SFTs and SFTs covered by netting agreements on a counterparty-by-counterpartybasis, both under the condition that the collateral is revalued on a daily basis. This holds for the underlying securities being different and unrelated to securitizations. The master netting agreement must satisfy the criteria set out in paragraphs 9.61 and 9.62 of the standardized approach. The VaR models approachis available to banks that have received supervisory recognition for an internal market risk model according to paragraph 10.2 in The Market Risk Framework. Banks which have not received market risk model recognition can separately apply for supervisory recognition to use their internal VaR models for the calculation of potential price volatility for SFTs, provided the model meets the requirements of paragraph 10.2 in The Market Risk Framework. Although the market risk standards have changed from a 99% VaR to a 97.5% expected shortfall, the VaR models approach to SFTs retains the use of a 99% VaR to calculate the counterparty credit risk for SFTs. The VaR model needs to capture risk sufficient to pass the back testing and profit and loss attribution tests of paragraph 10.4 in The Market Risk Framework. The default risk charge of paragraphs 13.18 to 13.39 in The Market Risk Framework is not required in the VaR model for SFTs. 12.40 The quantitative and qualitative criteria for recognition of internal market risk models for SFTs are in principle the same as in paragraphs 10.5 to 10.16 and 13.1 to 13.12 in The Market Risk Framework. The minimum liquidity horizon or the holding period for SFTs is 5 business days for margined repo-style transactions, rather than the 10 business days in paragraph 13.12 in The Market Risk Framework. For other transactions eligible for the VaR models approach, the 10 business day holding period will be retained. The minimum holding period should be adjusted upwards for market instruments where such a holding period would be inappropriate given the liquidity of the instrument concerned.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 129 of 349 12.41 The calculation of the exposure E* for banks using their internal model to calculate their counterparty credit risk requirement will be as follows, where banks will use the previous day's VaR number: 12.42 Subject to SAMA’s approval, instead of using the VaR approach, banks may also calculate an effective expected positive exposure for repo-style and other similar SFTs, in accordance with the internal models method set out in the counterparty credit risk standards. 12.43 As in the standardized approach, for transactions where the conditions in paragraph 9.36 are met, and in addition, the counterparty is a core market participant as specified in paragraph 9.37, banks can apply a zero H. A netting set that contains any transaction that does not meet the requirements in paragraph 9.36 of the standardized approach is not eligible for this treatment.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 130 of 349 Effective maturity (M) 12.44 Effective maturity (M) will be 2.5 years for exposures to which the bank applies the foundation approach, except for repo-style transactions where the effective maturity is 6 months (i.e. M=0.5). Banks using the foundation and advanced approaches are requiredto measure M for each facility using the definition provided below. 12.45 Banks using any element of the A-IRB approach are required to measure effective maturity for each facility as defined below. 12.46 Except as noted in paragraph 12.51, the effective maturity (M) is subject to a floor of oneyear and a cap of 5 years. 12.47 For an instrument subject to a determined cash flow schedule, effective maturity M is defined as follows, where CFt denotes the cash flows (principal, interest payments and fees) contractually payable by the borrower in period t: 12.48 If a bank is not in a position to calculate the effective maturity of the contracted payments as noted above, it is allowed to use a more conservative measure of M such asthat it equalsthe maximum remaining time (in years) that the borrower is permitted to take to fully discharge its contractual obligation (principal, interest, and fees) under the terms of loan agreement. Normally, this will correspond to the nominal maturity of the instrument. 12.49 For derivatives subject to a master netting agreement, the effective maturity is defined as the weighted average maturity of the transactions within the netting agreement. Further, the notional amount of each transaction should be used for weighting the maturity. 12.50 For revolving exposures, effective maturity must be determined using the maximum contractual termination date of the facility. Banks must not use the repayment date of the current drawing.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 131 of 349 12.51 The one-year floor, set out in paragraph 12.46 above, does not apply to certain short- term exposures, comprising fully or nearly-fully collateralized59 capital market- driven transactions (i.e. OTC derivatives transactions and margin lending) and repo- style transactions (i.e. repos/reverse repos and securities lending/borrowing) with an original maturity of less than one year, where the documentation contains daily remargining clauses. For all eligible transactions the documentation must require daily revaluation, and must include provisions that must allow for the prompt liquidation or setoff of the collateral in the event of default or failure to re-margin. The maturity of such transactions must be calculated as the greater of one-day, and the effective maturity (M, consistent with the definition above), except for transactions subject to a master netting agreement, where the floor is determined by the minimum holding period for the transaction type, as required by paragraph 12.54. 12.52 The one-year floor, set out in paragraph 12.46 above, also does not apply to the following exposures: (1) Short-term self-liquidating trade transactions. Import and export letters ofcredit and similar transactions should be accounted for at their actual remaining maturity. (2) Issued as well as confirmed letters of credit that are short term (i.e. have amaturity below one year) and self-liquidating. 12.53 In addition to the transactions considered in paragraph 12.51 above, other short￾term exposures with an original maturity of less than one year that are not part of a bank’s ongoing financing of an obligor may be eligible for exemption from the one-year floor. After a careful review of the particular circumstances, SAMA will define the types of short-term exposures that might be considered eligible for this treatment. The results of these reviews might, for example, include transactions such as: (1) Some capital market-driven transactions and repo-style transactions thatmight not fall within the scope of paragraph 12.51.

59 The intention is to include both parties of a transaction meeting these conditions where neither of the parties is systematically under- collateralized.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 132 of 349 (2) Some trade finance transactions that are not exempted by paragraph 12.52. (3) Some exposures arising from settling securities purchases and sales. This could also include overdrafts arising from failed securities settlements provided that such overdrafts do not continue more than a short, fixed number of business days. (4) Some exposures arising from cash settlements by wire transfer, including overdrafts arising from failed transfers provided that such overdrafts do notcontinue more than a short, fixed number of business days. (5) Some exposures to banks arising from foreign exchange settlements. (6) Some short-term loans and deposits. 12.54 For transactions falling within the scope of paragraph 12.51 subject to a master netting agreement, the effective maturity is defined as the weighted average maturity of the transactions. A floor equal to the minimum holding period for the transactiontype set out in paragraph 9.56 of the standardized approach will apply to the average. Where more than one transaction type is contained in the master netting agreement a floor equal to the highest holding period will apply to the average. Further, the notional amount of each transaction should be used for weighting maturity. 12.55 Where there is no explicit definition, the effective maturity (M) assigned to all exposures is set at 2.5 years unless otherwise specified in paragraph 12.44.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 133 of 349 Treatment of maturity mismatches 12.56 The treatment of maturity mismatches under IRB is identical to that in the standardized approach (see paragraphs 9.10 to 0). Risk components for retail exposures 12.57 Paragraphs 12.57 to 12.67 set out the calculation of the risk components for retail exposures. In the case of an exposure that is guaranteed bya sovereign, the floors that apply to the risk components do not apply to that part of the exposure covered by the sovereign guarantee (i.e. any part of the exposure that is not covered by the guarantee is subject to the relevant floors). Probability of default (PD) and loss given default (LGD) 12.58 For each identified pool of retail exposures, banks are expected to provide an estimate of the PD and LGD associated with the pool, subject to the minimum requirements as set out in chapter 16. Additionally, the PD for retail exposures is thegreater of: (i) the one-year PD associated with the internal borrower grade to which the pool of retail exposures is assigned; and (ii) 0.1% for qualifying revolving retail exposure (QRRE) revolvers (see paragraph 10.22 for the definition of QRRE revolvers) and 0.05% for all other exposures. The LGD for each exposure that is used as input into the risk weight formula and the calculation of expected loss must not be less than the parameter floors indicated in table 18 below:

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 134 of 349 LGD parameter floors for retail exposures Table 18 Type of exposure Unsecured Secured Mortgages Not applicable 5% QRRE (transactors and revolvers) 50% Not applicable Other retail 30% Varying by collateral type:  0% financial  10% receivables  10% commercial or residentialreal estate  15% other physical 12.59 Regarding the LGD parameter floors set out in the table above, the LGD floors forpartially secured exposures in the “other retail” category should be calculated according to the formula set out in paragraph 12.17. The LGD floor for residential mortgages is fixed at 5%, irrespective of the level of collateral provided by the property.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 135 of 349 Recognition of guarantees and credit derivatives 12.60 Banks may reflect the risk-reducing effects of guarantees and credit derivatives, either in support of an individual obligation or a pool of exposures, through an adjustment of either the PD or LGD estimate, subject to the minimum requirements in paragraphs 16.99 to 16.110. Whether adjustments are done throughPD or LGD, they must be done in a consistent manner for a given guarantee or credit derivative type. In case the bank applies the standardized approach to direct exposures to the guarantor it may only recognize the guarantee by applying the standardized approach risk weight to the covered portion of the exposure. 12.61 Consistent with the requirements outlined above for corporate and bank exposures, banks must not include the effect of double default in such adjustments. The adjusted risk weight must not be less than that of a comparable direct exposure to the protection provider. Consistent with the standardized approach, banks may choose not to recognize credit protection if doing so would result in a higher capital requirement.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 136 of 349 Exposure at default (EAD) 12.62 Both on- and off-balance sheet retail exposures are measured gross of specific provisions or partial write-offs. The EAD on drawn amounts should not be less than the sum of: (i) the amount by which a bank’s regulatory capital would be reduced if the exposure were written-off fully; and (ii) any specific provisions andpartial write-offs. When the difference between the instrument’s EAD and the sum of (i) and (ii) is positive, this amount is termed a discount. The calculation ofrisk-weighted assets is independent of any discounts. Under the limited circumstances described in paragraph 15.4, discounts may be included in the measurement of total eligible provisions for purposes of the EL-provision calculation set out in chapter 15. 12.63 On-balance sheet netting of loans and deposits of a bank to or from a retail customer will be permitted subject to the same conditions outlined in paragraphs 9.67 and 9.68 of the standardized approach. The definition of commitment is the same as in the standardized approach, as set out in paragraph 7.86. Banks must use their own estimates of EAD for undrawn revolving commitments to extend credit,purchase assets or issue credit substitutes provided the exposure is not subject toa CCF of 100% in the standardized approach (see paragraph 7.84) and the minimum requirements in paragraphs 16.88 to 16.98 are satisfied. Foundation approach CCFs must be used for all other off-balance sheet items (for example, undrawn non- revolving commitments), and must be used where the minimum requirements forown estimates of EAD are not met. 12.64 Regarding own estimates of EAD, the EAD for each exposure that is used as inputinto the risk weight formula and the calculation of expected loss is subject to a floor that is the sum of: (i) the on balance sheet amount; and (ii) 50% of the off balance sheet exposure using the applicable CCF in the standardized approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 137 of 349 12.65 For retail exposures with uncertain future drawdown such as credit cards, banks must take into account their history and/or expectation of additional drawings prior to default in their overall calibration of loss estimates. In particular, where abank does not reflect conversion factorsfor undrawn linesin its EAD estimates, itmust reflect in its LGD estimates the likelihood of additional drawings prior to default. Conversely, if the bank does not incorporate the possibility of additional drawings in its LGD estimates, it must do so in its EAD estimates. 12.66 When only the drawn balances of revolving retail facilities have been securitized,banks must ensure that they continue to hold required capital against the undrawn balances associated with the securitized exposures using the IRB approach to credit risk for commitments. 12.67 To the extent that foreign exchange and interest rate commitments exist within a bank’s retail portfolio for IRB purposes, banks are not permitted to provide their internal assessments of credit equivalent amounts. Instead, the rules for the standardized approach continue to apply.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 138 of 349 13.IRB Approach: Supervisory slotting approach for specialized lending 13.1 This chapter sets out the calculation of risk weighted assets and expected losses for specialized lending (SL) exposures subject to the supervisory slotting approach. The method for determining the difference between expected losses and provisions is set out in chapter 15. Risk weights for specialized lending (PF, OF, CF and IPRE) 13.2 For project finance (PF), object finance (OF), commodities finance (CF) and income producing real estate (IPRE) exposures, banks that do not meet the requirements for the estimation of probability of default (PD) under the corporate internal ratings-based (IRB) approach will be required to map their internal grades to five supervisory categories, each of which is associated with a specific risk weight. The slotting criteria on which this mapping must be based are provided in paragraph 13.13 for PF exposures, paragraph 13.15 for OF exposures, paragraph 013.6 for CF exposures and paragraph 13.14 for IPRE exposures. The risk weights for unexpected losses (UL) associated with each supervisory category are shown in table 19 below: Supervisory categories and unexpected loss (UL) risk weights for other SL exposures Table 19 Strong Good Satisfactory Weak Default 70% 90% 115% 250% 0%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 139 of 349 13.3 Although banks are expected to map their internal ratings to the supervisory categories for specialized lending using the slotting criteria, each supervisory category broadly corresponds to a range of external credit assessments as outlined in table 20 below. Table 20 Strong Good Satisfactory Weak Default BBB- or better BB+ or BB BB- or B+ B to C￾Not applicable 13.4 SAMA may allow banks to assign preferential risk weights of 50% to “strong” exposures, and 70% to “good” exposures, provided they have a remaining maturity of less than 2.5 years or SAMA determines that banks’ underwriting and other risk characteristics are substantially stronger than specified in the slotting criteria for the relevant supervisory risk category. Risk weights for specialized lending (HVCRE) 13.5 For high-volatility commercial real estate (HVCRE) exposures, banks that do not meet the requirements for estimation of PD, or did not obtain SAMA’s approval to implement the foundation or advanced approaches to HVCRE, must map their internal grades to five supervisory categories, each of which is associated with a specific risk weight. The slotting criteria on which this mapping must be based are the same as those for IPRE, as provided in paragraph 13.14. The risk weights associated with each supervisory category are shown in table 21 below:

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 140 of 349 Table 21 Supervisory categories and UL risk weights for high-volatility commercial real estate Strong Good Satisfactory Weak Default 95% 120% 140% 250% 0% 13.6 As indicated in paragraph 13.3, each supervisory category broadly corresponds to a range of external credit assessments. 13.7 SAMA may allow banks to assign preferential risk weights of 70% to “strong” exposures, and 95% to “good” exposures, provided they have a remaining maturity of less than 2.5 years or SAMA determines that banks’ underwriting and other risk characteristics are substantially stronger than specified in the slotting criteria for the relevant supervisory risk category. Expected loss for specialized lending (SL) exposures subject to thesupervisory slotting criteria 13.8 For SL exposures subject to the supervisory slotting criteria, the expected loss (EL) amount is determined by multiplying 8% by the risk-weighted assets produced from the appropriate risk weights, as specified below, multiplied by exposure at default.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 141 of 349 13.9 The risk weights for SL, other than HVCRE, are as shown in table 22 below: Table 22 Strong Good Satisfactory Weak Default 5% 10% 35% 100% 625% 13.10 Where, SAMA allow banks to assign preferential riskweights to non-HVCRE SL exposures falling into the “strong” and “good” supervisory categories as outlined in paragraph 13.4, the corresponding expected loss (EL) risk weight is 0% for “strong” exposures, and 5% for “good” exposures. 13.11 The risk weights for HVCRE are as shown in table 23 below: Table 23 Strong Good Satisfactory Weak Default 5% 5% 35% 100% 625% 13.12 Even where, SAMA allow banks to assign preferential risk weights to HVCRE exposures falling into the “strong” and “good” supervisory categories as outlined in paragraph 13.7, the corresponding EL risk weight will remain at5% for both “strong” and “good” exposures.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 142 of 349 Supervisory slotting criteria for specialized lending 13.13 Table 24 below sets out the supervisory rating grades for project finance exposures subject to the supervisory slotting approach. Table 24 Strong Good Satisfactory Weak Financial strength Market conditions Few competing suppliers or substantial and durable advantage in location, cost, or technology. Demand is strong and growing Few competing suppliers or better than average location, cost, or technology but this situation may not last. Demand is strong and stable Project has no advantage in location, cost, or technology. Demand is adequate and stable Project has worse than average location, cost, or technology. Demand is weak and declining Financial ratios (eg debt service coverage ratio (DSCR), loan life coverage ratio, project life coverage ratio, and debt-to-equity ratio) Strong financial ratios considering the level of project risk; very robust economic assumptions Strong to acceptable financial ratios considering the level of project risk; robust project economic assumptions Standard financial ratios considering the level of project risk Aggressive financial ratios considering the level of project risk

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 143 of 349 Stress analysis The project can meet its financial obligations under sustained, severely stressed economic or sectoral conditions The project can meet its financial obligations under normal stressed economic or sectoral conditions. The project is only likely to default under severe economic conditions The project is vulnerable to stresses that are not uncommon through an economic cycle, and may default in a normal downturn The project is likely to default unless conditions improve soon Financial structure Duration of the credit compared to the duration of the project Useful life of the project significantly exceeds tenor of the loan Useful life of the project exceeds tenor of the loan Useful life of the project exceeds tenor of the loan Useful life of the project may not exceed tenor of the loan Amortisation schedule Amortising debt Amortising debt Amortising debt repayments with limited bullet payment Bullet repayment or amortising debt repayments with high bullet repayment

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 144 of 349 Political and legal environment Political risk, including transfer risk, considering project type and mitigants Very low exposure; strong mitigation instruments, if needed Low exposure; satisfactory mitigation instruments, if needed Moderate exposure; fair mitigation instruments High exposure; no or weak mitigation instruments Force majeure risk (war, civil unrest, etc.), Low exposure Acceptable exposure Standard protection Significant risks, not fully mitigated Government support and project’s importance for the country over the long term Project of strategic importance for the country (preferably export￾oriented). Strong support from Government Project considered important for the country. Good level of support from Government Project may not be strategic but brings unquestionable benefits for the country. Support from Government may not be explicit Project not key to the country. No or weak support from Government Stability of legal and regulatory environment (risk of change in law) Favourable and stable regulatory environment over the long term Favourable and stable regulatory environment over the medium term Regulatory changes can be predicted with a fair level of certainty Current or future regulatory issues may affect the project Acquisition of all necessary supports and approvals for such relief from local content laws Strong Satisfactory Fair Weak

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 145 of 349 Enforceability of contracts, collateral and security Contracts, collateral and security are enforceable Contracts, collateral and security are enforceable Contracts, collateral and security are considered enforceable even if certain non-key issues may exist There are unresolved key issues in respect if actual enforcement of contracts, collateral and security Transaction characteristics Design and technology risk Fully proven technology and design Fully proven technology and design Proven technology and design — start-up issues are mitigated by a strong completion package Unproven technology and design; technology issues exist and/or complex design

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 146 of 349 Construction risk Permitting and siting All permits have been obtained Some permits are still outstanding but their receipt is considered very likely Some permits are still outstanding but the permitting process is well defined and they are considered routine Key permits still need to be obtained and are not considered routine. Significant conditions may be attached Type of construction contract Fixed-price date-certain turnkey construction engineering and procurement contract (EPC) Fixed-price date-certain turnkey construction EPC Fixed-price date-certain turnkey construction contract with one or several contractors No or partial fixed-price turnkey contract and/or interfacing issues with multiple contractors Completion guarantees Substantial liquidated damages supported by financial substance and/or strong completion guarantee from sponsors with excellent financial standing Significant liquidated damages supported by financial substance and/or completion guarantee from sponsors with good financial standing Adequate liquidated damages supported by financial substance and/or completion guarantee from sponsors with good financial standing Inadequate liquidated damages or not supported by financial substance or weak completion guarantees

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 147 of 349 Track record and financial strength of contractor in constructing similar projects. Strong Good Satisfactory Weak Operating risk Scope and nature of operations and maintenance (O & M) contracts Strong long￾term O&M contract, preferably with contractual performance incentives, and/or O&M reserve accounts Long-term O&M contract, and/or O&M reserve accounts Limited O&M contract or O&M reserve account No O&M contract: risk of high operational cost overruns beyond mitigants Operator’s expertise, track record, and financial strength Very strong, or committed technical assistance of the sponsors Strong Acceptable Limited/weak, or local operator dependent on local authorities Off-take risk (a) If there is a take-or-pay or fixed-price off-take contract: Excellent creditworthiness of off-taker; strong termination clauses; tenor of contract comfortably exceeds the Good creditworthiness of off-taker; strong termination clauses; tenor of contract exceeds the maturity of the debt Acceptable financial standing of off-taker; normal termination clauses; tenor of contract generally Weak off￾taker; weak termination clauses; tenor of contract does not exceed the maturity of the debt

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 148 of 349 maturity of the debt matches the maturity of the debt (b) If there is no take-or￾pay or fixed￾price off-take contract: Project produces essential services or a commodity sold widely on a world market; output can readily be absorbed at projected prices even at lower than historic market growth rates Project produces essential services or a commodity sold widely on a regional market that will absorb it at projected prices at historical growth rates Commodity is sold on a limited market that may absorb it only at lower than projected prices Project output is demanded by only one or a few buyers or is not generally sold on an organized market Supply risk Price, volume and transportation risk of feed￾stocks; supplier’s track record and financial strength Long-term supply contract with supplier of excellent financial standing Long-term supply contract with supplier of good financial standing Long-term supply contract with supplier of good financial standing — a degree of price risk may remain Short-term supply contract or long-term supply contract with financially weak supplier — a degree of price risk definitely remains Reserve risks (e.g. natural resource development) Independently audited, proven and developed reserves well in Independently audited, proven and developed reserves in Proven reserves can supply the project Project relies to some extent on potential and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 149 of 349 excess of requirements over lifetime of the project excess of requirements over lifetime of the project adequately through the maturity of the debt undeveloped reserves Strength of Sponsor Sponsor’s track record, financial strength, and country/sector experience Strong sponsor with excellent track record and high financial standing Good sponsor with satisfactory track record and good financial standing Adequate sponsor with adequate track record and good financial standing Weak sponsor with no or questionable track record and/or financial weaknesses Sponsor support, as evidenced by equity, ownership clause and incentive to inject additional cash if necessary Strong. Project is highly strategic for the sponsor (core business — long-term strategy) Good. Project is strategic for the sponsor (core business — long-term strategy) Acceptable. Project is considered important for the sponsor (core business) Limited. Project is not key to sponsor’s long-term strategy or core business

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 150 of 349 Security Package Assignment of contracts and accounts Fully comprehensive Comprehensive Acceptable Weak Pledge of assets, taking into account quality, value and liquidity of assets First perfected security interest in all project assets, contracts, permits and accounts necessary to run the project Perfected security interest in all project assets, contracts, permits and accounts necessary to run the project Acceptable security interest in all project assets, contracts, permits and accounts necessary to run the project Little security or collateral for lenders; weak negative pledge clause Lender’s control over cash flow (eg cash sweeps, independent escrow accounts) Strong Satisfactory Fair Weak Strength of the covenant package (mandatory prepayments, payment deferrals, payment cascade, dividend restrictions…) Covenant package is strong for this type of project Covenant package is satisfactory for this type of project Covenant package is fair for this type of project Covenant package is Insufficient for this type of project

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 151 of 349 Project may issue no additional debt Project may issue extremely limited additional debt Project may issue limited additional debt Project may issue unlimited additional debt 13.14 Table 25 below sets out the supervisory rating grades for income producing real estate exposures and high-volatility commercial real estate exposures subject to the supervisory slotting approach. Table 25 Strong Good Satisfactory Weak Financial strength Market conditions The supply and demand for the project’s type and location are currently in equilibrium. The number of competitive properties coming to market is equal or lower than forecasted demand The supply and demand for the project’s type and location are currently in equilibrium. The number of competitive properties coming to market is roughly equal to forecasted demand Market conditions are roughly in equilibrium. Competitive properties are coming on the market and others are in the planning stages. The project’s design and capabilities may not be state of the art compared to new projects Market conditions are weak. It is uncertain when conditions will improve and return to equilibrium. The project is losing tenants at lease expiration. New lease terms are less favourable compared to those expiring

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 152 of 349 Financial ratios and advance rate The property’s DSCR is considered strong (DSCR is not relevant for the construction phase) and its loan-to-value ratio (LTV) is considered low given its property type. Where a secondary market exists, the transaction is underwritten to market standards The DSCR (not relevant for development real estate) and LTV are satisfactory. Where a secondary market exists, the transaction is underwritten to market standards The property’s DSCR has deteriorated and its value has fallen, increasing its LTV The property’s DSCR has deteriorated significantly and its LTV is well above underwriting standards for new loans Stress analysis The property’s resources, contingencies and liability structure allow it to meet its financial obligations during a period of severe financial The property can meet its financial obligations under a sustained period of financial stress (eg interest rates, economic growth). The property is likely to default only under severe economic conditions During an economic downturn, the property would suffer a decline in revenue that would limit its ability to fund capital expenditures and significantly increase the The property’s financial condition is strained and is likely to default unless conditions improve in the near term

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 153 of 349 stress (e.g. interest rates, economic growth) risk of default Cash-flow predictability (a) For complete and stabilised property. The property’s leases are long-term with creditworthy tenants and their maturity dates are scattered. The property has a track record of tenant retention upon lease expiration. Its vacancy rate is low. Expenses (maintenance, insurance, security, and property taxes) are predictable Most of the property’s leases are long-term, with tenants that range in creditworthiness. The property experiences a normal level of tenant turnover upon lease expiration. Its vacancy rate is low. Expenses are predictable Most of the property’s leases are medium rather than long￾term with tenants that range in creditworthiness. The property experiences a moderate level of tenant turnover upon lease expiration. Its vacancy rate is moderate. Expenses are relatively predictable but vary in relation to revenue The property’s leases are of various terms with tenants that range in creditworthiness. The property experiences a very high level of tenant turnover upon lease expiration. Its vacancy rate is high. Significant expenses are incurred preparing space for new tenants

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 154 of 349 (b) For complete but not stabilised property Leasing activity meets or exceeds projections. The project should achieve stabilisation in the near future Leasing activity meets or exceeds projections. The project should achieve stabilisation in the near future Most leasing activity is within projections; however, stabilisation will not occur for some time Market rents do not meet expectations. Despite achieving target occupancy rate, cash flow coverage is tight due to disappointing revenue (c) For construction phase The property is entirely pre-leased through the tenor of the loan or pre￾sold to an investment grade tenant or buyer, or the bank has a binding commitment for take-out financing from an investment grade lender The property is entirely pre￾leased or pre￾sold to a creditworthy tenant or buyer, or the bank has a binding commitment for permanent financing from a creditworthy lender Leasing activity is within projections but the building may not be pre￾leased and there may not exist a take-out financing. The bank may be the permanent lender The property is deteriorating due to cost overruns, market deterioration, tenant cancellations or other factors. There may be a dispute with the party providing the permanent financing

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 155 of 349 Asset characteristics Location Property is located in highly desirable location that is convenient to services that tenants desire Property is located in desirable location that is convenient to services that tenants desire The property location lacks a competitive advantage The property’s location, configuration, design and maintenance have contributed to the property’s difficulties Design and condition Property is favoured due to its design, configuration, and maintenance, and is highly competitive with new properties Property is appropriate in terms of its design, configuration and maintenance. The property’s design and capabilities are competitive with new properties Property is adequate in terms of its configuration, design and maintenance Weaknesses exist in the property’s configuration, design or maintenance Property is under construction Construction budget is conservative and technical hazards are limited. Contractors are highly qualified Construction budget is conservative and technical hazards are limited. Contractors are highly qualified Construction budget is adequate and contractors are ordinarily qualified Project is over budget or unrealistic given its technical hazards. Contractors may be under qualified

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 156 of 349 Strength of Sponsor/Developer Financial capacity and willingnes s to support the property. The sponsor/develop er made a substantial cash contribution to the construction or purchase of the property. The sponsor/develop er has substantial resources and limited direct and contingent liabilities. The sponsor/develop er’s properties are diversified geographically and by property type The sponsor/develop er made a material cash contribution to the construction or purchase of the property. The sponsor/develop er’s financial condition allows it to support the property in the event of a cash flow shortfall. The sponsor/develop er’s properties are located in several geographic regions The sponsor/develop er’s contribution may be immaterial or non-cash. The sponsor/develop er is average to below average in financial resources The sponsor/devel oper lacks capacity or willingness to support the property

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 157 of 349 Reputation and track record with similar properties. Experienced management and high sponsors’ quality. Strong reputation and lengthy and successful record with similar properties Appropriate management and sponsors’ quality. The sponsor or management has a successful record with similar properties Moderate management and sponsors’ quality. Management or sponsor track record does not raise serious concerns Ineffective management and substandard sponsors’ quality. Management and sponsor difficulties have contributed to difficulties in managing properties in the past Relationsh ips with relevant real estate actors Strong relationships with leading actors such as leasing agents Proven relationships with leading actors such as leasing agents Adequate relationships with leasing agents and other parties providing important real estate services Poor relationships with leasing agents and/or other parties providing important real estate services Security Package Nature of lien Perfected first lien Perfected first lien. Lenders in some markets extensively use loan structures that include junior liens. Perfected first lien. Lenders in some markets extensively use loan structures that include junior liens. Ability of lender to foreclose is constrained

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 158 of 349 Junior liens may be indicative of this level of risk if the total LTV inclusive of all senior positions does not exceed a typical first loan LTV. Junior liens may be indicative of this level of risk if the total LTV inclusive of all senior positions does not exceed a typical first loan LTV. Assignment of rents (for projects leased to long-term tenants) The lender has obtained an assignment. They maintain current tenant information that would facilitate providing notice to remit rents directly to the lender, such as a current rent roll and copies of the project’s leases The lender has obtained an assignment. They maintain current tenant information that would facilitate providing notice to the tenants to remit rents directly to the lender, such as current rent roll and copies of the project’s leases The lender has obtained an assignment. They maintain current tenant information that would facilitate providing notice to the tenants to remit rents directly to the lender, such as current rent roll and copies of the project’s leases The lender has not obtained an assignment of the leases or has not maintained the information necessary to readily provide notice to the building’s tenants Quality of the insurance coverage Appropriate Substandard

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 159 of 349 13.15 Table 26 below sets out the supervisory rating grades for object finance exposures subject to the supervisory slotting approach. Table 26 Strong Good Satisfactory Weak Financial strength Market conditions Demand is strong and growing, strong entry barriers, low sensitivity to changes in technology and economic outlook Demand is strong and stable. Some entry barriers, some sensitivity to changes in technology and economic outlook Demand is adequate and stable, limited entry barriers, significant sensitivity to changes in technology and economic outlook Demand is weak and declining, vulnerable to changes in technology and economic outlook, highly uncertain environment Financial ratios (DSCR and LTV) Strong financial ratios considering the type of asset. Very robust economic assumptions Strong / acceptable financial ratios considering the type of asset. Robust project economic assumptions Standard financial ratios for the asset type Aggressive financial ratios considering the type of asset Stress analysis Stable long￾term revenues, capable of withstanding severely stressed conditions through an economic cycle Satisfactory short-term revenues. Loan can withstand some financial adversity. Default is only likely under severe economic Uncertain short-term revenues. Cash flows are vulnerable to stresses that are not uncommon through an economic Revenues subject to strong uncertainties; even in normal economic conditions the asset may default, unless conditions

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 160 of 349 conditions cycle. The loan may default in a normal downturn improve Market liquidity Market is structured on a worldwide basis; assets are highly liquid Market is worldwide or regional; assets are relatively liquid Market is regional with limited prospects in the short term, implying lower liquidity Local market and/or poor visibility. Low or no liquidity, particularly on niche markets Political and legal environment Political risk, including transfer risk Very low; strong mitigation instruments, if needed Low; satisfactory mitigation instruments, if needed Moderate; fair mitigation instruments High; no or weak mitigation instruments Legal and regulatory risks Jurisdiction is favourable to repossession and enforcement of contracts Jurisdiction is favourable to repossession and enforcement of contracts Jurisdiction is generally favourable to repossession and enforcement of contracts, even if repossession might be long and/or difficult Poor or unstable legal and regulatory environment. Jurisdiction may make repossession and enforcement of contracts lengthy or impossible

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 161 of 349 Transaction characteristics Financing term compared to the economic life of the asset Full payout profile/minimum balloon. No grace period Balloon more significant, but still at satisfactory levels Important balloon with potentially grace periods Repayment in fine or high balloon Operating risk Permits / licensing All permits have been obtained; asset meets current and foreseeable safety regulations All permits obtained or in the process of being obtained; asset meets current and foreseeable safety regulations Most permits obtained or in process of being obtained, outstanding ones considered routine, asset meets current safety regulations Problems in obtaining all required permits, part of the planned configuration and/or planned operations might need to be revised Scope and nature of O & M contracts Strong long￾term O&M contract, preferably with contractual performance incentives, and/or O&M reserve accounts (if needed) Long-term O&M contract, and/or O&M reserve accounts (if needed) Limited O&M contract or O&M reserve account (if needed) No O&M contract: risk of high operational cost overruns beyond mitigants

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 162 of 349 Operator’s financial strength, track record in managing the asset type and capability to re-market asset when it comes off-lease Excellent track record and strong re￾marketing capability Satisfactory track record and re￾marketing capability Weak or short track record and uncertain re-marketing capability No or unknown track record and inability to re-market the asset Asset characteristics Configuration, size, design and maintenance (ie age, size for a plane) compared to other assets on the same market Strong advantage in design and maintenance. Configuration is standard such that the object meets a liquid market Above average design and maintenance. Standard configuration, maybe with very limited exceptions — such that the object meets a liquid market Average design and maintenance. Configuration is somewhat specific, and thus might cause a narrower market for the object Below average design and maintenance. Asset is near the end of its economic life. Configuration is very specific; the market for the object is very narrow Resale value Current resale value is well above debt value Resale value is moderately above debt value Resale value is slightly above debt value Resale value is below debt value sensitivity of the asset value and liquidity to economic cycles Asset value and liquidity are relatively insensitive to economic cycles Asset value and liquidity are sensitive to economic cycles Asset value and liquidity are quite sensitive to economic cycles Asset value and liquidity are highly sensitive to economic cycles

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 163 of 349 Strength of sponsor Operator’s financial strength, track record in managing the asset type and capability to re-market asset when it comes off-lease Excellent track record and strong re￾marketing capability Satisfactory track record and re￾marketing capability Weak or short track record and uncertain re-marketing capability No or unknown track record and inability to re￾market the asset Sponsors’ track record and financial strength Sponsors with excellent track record and high financial standing Sponsors with good track record and good financial standing Sponsors with adequate track record and good financial standing Sponsors with no or questionable track record and/or financial weaknesses Security Package Asset control Legal documentation provides the lender effective control (e.g. a first perfected security interest, or a leasing structure including such security) on the Legal documentation provides the lender effective control (e.g. a perfected security interest, or a leasing structure including such security) on the Legal documentation provides the lender effective control (e.g. a perfected security interest, or a leasing structure including such security) on the The contract provides little security to the lender and leaves room to some risk of losing control on the asset

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 164 of 349 asset, or on the company owning it asset, or on the company owning it asset, or on the company owning it Rights and means at the lender's disposal to monitor the location and condition of the asset The lender is able to monitor the location and condition of the asset, at any time and place (regular reports, possibility to lead inspections) The lender is able to monitor the location and condition of the asset, almost at any time and place The lender is able to monitor the location and condition of the asset, almost at any time and place The lender is able to monitor the location and condition of the asset are limited Insurance against damages Insurance against damages Insurance against damages Insurance against damages Insurance against damages

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 165 of 349 13.16 Table 27 below sets out the supervisory rating grades for commoditiesfinance exposures subject to the supervisory slotting approach. Table 27 Strong Good Satisfactory Weak Financial strength Degree of over￾collateralisation of trade Strong Good Satisfactory Weak Political and legal environment Country risk No country risk Limited exposure to country risk (in particular, offshore location of reserves in an emerging country) Exposure to country risk (in particular, offshore location of reserves in an emerging country) Strong exposure to country risk (in particular, inland reserves in an emerging country) Mitigation of country risks Very strong mitigation: Strong offshore mechanisms Strategic commodity 1st class buyer Strong mitigation: Offshore mechanisms Strategic commodity Strong buyer Acceptable mitigation: Offshore mechanisms Less strategic commodity Acceptable buyer Only partial mitigation: No offshore mechanisms Non-strategic commodity Weak buyer Asset characteristics Liquidity and susceptibility to damage Commodity is quoted and can be hedged Commodity is quoted and can be hedged Commodity is not quoted but is liquid. There Commodity is not quoted. Liquidity is

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 166 of 349 through futures or over-the￾counter (OTC) instruments. Commodity is not susceptible to damage through OTC instruments. Commodity is not susceptible to damage is uncertainty about the possibility of hedging. Commodity is not susceptible to damage limited given the size and depth of the market. No appropriate hedging instruments. Commodity is susceptible to damage Strength of sponsor Financial strength of trader Very strong, relative to trading philosophy and risks Strong Adequate Weak Track record, including ability to manage the logistic process Extensive experience with the type of transaction in question. Strong record of operating success and cost efficiency Sufficient experience with the type of transaction in question. Above average record of operating success and cost efficiency Limited experience with the type of transaction in question. Average record of operating success and cost efficiency Limited or uncertain track record in general. Volatile costs and profits Trading controls and hedging policies Strong standards for counterparty selection, hedging, and monitoring Adequate standards for counterparty selection, hedging, and monitoring Past deals have experienced no or minor problems Trader has experienced significant losses on past deals Quality of financial disclosure Excellent Good Satisfactory Financial disclosure contains some

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 167 of 349 uncertainties or is insufficient Security package Asset control First perfected security interest provides the lender legal control of the assets at any time if needed First perfected security interest provides the lender legal control of the assets at any time if needed At some point in the process, there is a rupture in the control of the assets by the lender. The rupture is mitigated by knowledge of the trade process or a third party undertaking as the case may be Contract leaves room for some risk of losing control over the assets. Recovery could be jeopardised Insurance against damages Strong insurance coverage including collateral damages with top quality insurance companies Satisfactory insurance coverage (not including collateral damages) with good quality insurance companies Fair insurance coverage (not including collateral damages) with acceptable quality insurance companies Weak insurance coverage (not including collateral damages) or with weak quality insurance companies

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 168 of 349 14.IRB Approach: RWA for purchased receivables 14.1 This chapter presents the method of calculating the unexpected loss capital requirements for purchased receivables. For such assets, there are internal ratings-based (IRB) capital charges for both default risk and dilution risk. Risk-weighted assets for default risk 14.2 For receivables belonging unambiguously to one asset class, the IRB risk weight for default risk is based on the risk-weight function applicable to that particular exposure type, as long as the bank can meet the qualification standards for this particular risk-weight function. For example, if banks cannot comply with the standards for qualifying revolving retail exposures (defined in paragraph 10.22), they should use the risk-weight function for other retail exposures. For hybrid pools containing mixtures of exposure types, if the purchasing bank cannot separate the exposures by type, the risk-weight function producing the highest capital requirements for the exposure types in the receivable pool applies. 14.3 For purchased retail receivables, a bank must meet the risk quantification standards for retail exposures but can utilize external and internal reference data to estimate the probabilities of default (PDs) and losses-given-default (LGDs). Theestimates for PD and LGD (or expected loss, EL) must be calculated for the receivables on a stand-alone basis; that is, without regard to any assumption of recourse or guarantees from the seller or other parties. 14.4 For purchased corporate receivables the purchasing bank is expected to apply the existing IRB risk quantification standards for the bottom-up approach. However, for eligible purchased corporate receivables, and subject to supervisory permission, a bank may employ the following top-down procedure for calculating IRB risk weights for default risk:

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 169 of 349 (1) The purchasing bank will estimate the pool’s one-year EL for default risk, expressed in percentage of the exposure amount (i.e. the total exposure-at-default, or EAD, amount to the bank by all obligors in the receivables pool). The estimated EL must be calculated for the receivables on a stand-alone basis; that is, without regard to any assumption of recourse or guarantees from the seller or other parties. The treatment of recourse or guarantees covering default risk (and/or dilution risk) is discussed separately below. (2) Given the EL estimate for the pool’s default losses, the risk weight for defaultrisk is determined by the risk-weight function for corporate exposures60 . As described below, the precise calculation of risk weights for default risk depends on the bank’s ability to decompose EL into its PD and LGD components in a reliable manner. Banks can utilize external and internal data to estimate PDs and LGDs. However, the advanced approach will not be available for banks that use the foundation approach for corporate exposures. Foundation IRB treatment 14.5 The risk weight under the foundation IRB treatment is determined as follows: (1) If the purchasing bank is unable to decompose EL into its PD and LGD components in a reliable manner, the risk weight is determined from the corporate risk-weight function using the following specifications: (a) If the bank can demonstrate that the exposures are exclusively seniorclaims to corporate borrowers: (i) An LGD of 40% can be used. (ii) PD will be calculated by dividing the EL using this LGD. (iii) EAD will be calculated as the outstanding amount minus the capital charge for dilution prior to credit risk

60 The firm-size adjustment for small or medium-sized entities, as defined in paragraph 11.8, will be the weighted average by individual exposure of the pool of purchased corporate receivables. If the bank does not have the information to calculate the average size of the pool, the firm-size adjustment will not apply.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 170 of 349 mitigation (KDilution). (iv) EAD for a revolving purchase facility is the sum of the currentamount of receivables purchased plus 40% of any undrawn purchase commitments minus KDilution. (b) If the bank cannot demonstrate that the exposures are exclusively seniorclaims to corporate borrowers: (i) PD is the bank’s estimate of EL. (ii) LGD will be 100%. (iii) EAD is the amount outstanding minus KDilution. (iv) EAD for a revolving purchase facility is the sum of the currentamount of receivables purchased plus 40% of any undrawn purchase commitments minus KDilution. (2) If the purchasing bank is able to estimate PD in a reliable manner, the risk weight is determined from the corporate risk-weight functions according to the specifications for LGD, effective maturity (M) and the treatment of guarantees under the foundation approach as given in paragraphs 12.6 to 12.14, 12.20 to 12.26 and 12.44. Advanced IRB treatment 14.6 Under the advanced IRB approach, if the purchasing bank can estimate either the pool’s default-weighted average loss rates given default (as defined in paragraph 16.82) or average PD in a reliable manner, the bank may estimate the other parameter based on an estimate of the expected long-run loss rate. The bank may: (i) use an appropriate PD estimate to infer the long-run default￾weighted average loss rate given default; or (ii) use a long-run default-weighted average loss rate given default to infer the appropriate PD. In either case, the LGD used for the IRB capital calculation for purchased receivables cannot be less than the long-run default-weighted average loss rate given default and must be consistent with the concepts defined in paragraph 16.82. The risk weight for the purchased receivables will be determined using the bank’s estimated PD and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 171 of 349 LGD as inputs to the corporaterisk-weight function. Similar to the foundation IRB treatment, EAD will be the amount outstanding minus KDilution. EAD for a revolving purchase facility will be the sum of the current amount of receivables purchased plus 40% of any undrawn purchase commitments minus KDilution (thus, banks using the advanced IRB approach will not be permitted to use their internal EAD estimates for undrawn purchase commitments). 14.7 For drawn amounts, M will equal the pool’s exposure-weighted average effective maturity (as defined in paragraphs 12.44 to 12.55). This same value of M will also be used for undrawn amounts under a committed purchase facility provided the facility contains effective covenants, early amortization triggers, or other features that protect the purchasing bank against a significant deterioration in the qualityof the future receivables it is required to purchase over the facility’s term. Absentsuch effective protections, the M for undrawn amounts will be calculated as the sum of: (a) the longest-dated potential receivable under the purchase agreement;and (b) the remaining maturity of the purchase facility. Risk-weighted assets for dilution risk 14.8 Dilution refers to the possibility that the receivable amount is reduced through cash or non-cash credits to the receivable’s obligor61 . For both corporate and retail receivables, unless the bank can demonstrate to its supervisor that the dilution risk for the purchasing bank is immaterial, the treatment of dilution risk must be the following: (1) At the level of either the pool as a whole (top-down approach) or the individual receivables making up the pool (bottom-up approach), the purchasing bank will estimate the one-year EL for dilution risk, also expressed in percentage of the receivables amount. Banks can utilize externaland internal data to estimate EL. As with the treatments of

61 Examples include offsets or allowances arising from returns of goods sold, disputes regarding product quality, possible debts of the borrower to a receivables obligor, and any payment or promotional discounts offered by the borrower (e.g. a credit for cash payments within 30 days)

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 172 of 349 default risk, this estimate must be computed on a stand-alone basis; that is, under the assumption of no recourse or other support from the seller or third-party guarantors. (2) For the purpose of calculating risk weights for dilution risk, the corporaterisk-weight function must be used with the following settings: (a) The PD must be set equal to the estimated EL. (b) The LGD must be set at 100%. (c) An appropriate maturity treatment applies when determining the capital requirement for dilution risk. If a bank can demonstrate that the dilutionrisk is appropriately monitored and managed to be resolved within one year, the supervisor may allow the bank to apply a one-year maturity. 14.9 This treatment will be applied regardless of whether the underlying receivables are corporate or retail exposures, and regardless of whether the risk weights for default risk are computed using the standard IRB treatments or, for corporate receivables, the top-down treatment described above. Treatment of purchase price discounts for receivables 14.10 In many cases, the purchase price of receivables will reflect a discount (not to be confused with the discount concept defined in paragraphs 12.29 and 12.62) that provides first loss protection for default losses, dilution losses or both. To the extent that a portion of such a purchase price discount may be refunded to the seller based on the performance of the receivables, the purchaser may recognizethis refundable amount as first-loss protection and hence treat this exposure under the securitization chapters 18 to 23, while the seller providing such a refundable purchase price discount must treat the refundable amount as a first-loss position under the securitization chapters. Non-refundable purchase price discounts for receivables do not affect either the EL-provision calculation in chapter 15 or the calculation of risk-weighted assets.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 173 of 349 14.11 When collateral or partial guarantees obtained on receivables provide first loss protection (collectively referred to as mitigants in this paragraph), and these mitigants cover default losses, dilution losses, or both, they may also be treated as first loss protection under the securitization chapters (see paragraph 22.10). When the same mitigant covers both default and dilution risk, banks using the Securitization Internal Ratings-Based Approach (SEC-IRBA) that are able to calculate an exposure-weighted LGD must do so as defined in paragraph 22.21. Recognition of credit risk mitigants 14.12 Credit risk mitigants will be recognized generally using the same type of framework as set forth in paragraphs 12.21 to 12.2862.In particular, a guarantee provided by the seller or a third party will be treated using the existing IRB rules for guarantees, regardless of whether the guarantee covers default risk, dilution risk, or both. (1) If the guarantee covers both the pool’s default risk and dilution risk, the bankwill substitute the risk weight for an exposure to the guarantor in place of the pool’s total risk weight for default and dilution risk. (2) If the guarantee covers only default risk or dilution risk, but not both, the bank will substitute the risk weight for an exposure to the guarantor in placeof the pool’s risk weight for the corresponding risk component (default or dilution). The capital requirement for the other component will then be added. (3) If a guarantee covers only a portion of the default and/or dilution risk, the uncovered portion of the default and/or dilution risk will be treated as per the existing credit risk mitigation rules for proportional or tranched coverage (i.e. the risk weights of the uncovered risk components will be added to the risk weights of the covered risk components)

62 At SAMA’s discretion, banks may recognize guarantors that are internally rated and associated with a PD equivalent to less than A- under the foundation IRB approach for purposes of determining capital requirements for dilution risk.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 174 of 349 15.IRB Approach: Treatment of expected losses and provisions 15.1 This chapter discusses the calculation of expected losses (EL) under the internal ratings-based (IRB) approach, and the method by which the difference between provisions (e.g. specific provisions, partial write-offs, portfolio-specific general provisions such as country risk provisions or general provisions) and EL may be included in or must be deducted from regulatory capital, as outlined in the definition of capital rules, articles 2.2.3 and 4.1.4 – Section A of SAMA Guidance Document Concerning the Implementation of Basel III (Circular No. 341000015689, Date: 19 December 2012). The treatment of EL and provisions related to securitization exposures is outlined in paragraph 18.36. Calculation of expected losses 15.2 A bank must sum the EL amount (defined as EL multiplied by exposure at default)associated with its exposures to which the IRB approach is applied (excluding theEL amount associated with securitization exposures) to obtain a total EL amount. 15.3 Banks must calculate EL as probability of default (PD) x loss-given-default (LGD) for corporate, sovereign, bank, and retail exposures not in default. For corporate,sovereign, bank, and retail exposures that are in default, banks must use their best estimate of expected loss as defined in paragraph 16.85 for exposures subject to the advanced approach and for exposures subject to the foundation approach banks must use the supervisory LGD. For exposures subject to the supervisory slotting criteria EL is calculated as described in the chapter on the supervisory slotting approach (paragraphs 13.8 to 13.12). Securitization exposures do not contribute to the EL amount, as set out in in paragraph 18.36.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 175 of 349 Calculation of provisions Exposures subject to the IRB approach for credit risk 15.4 Total eligible provisions are defined as the sum of all provisions (e.g. specific provisions, partial write-offs, portfolio-specific general provisions such as countryrisk provisions or general provisions) that are attributed to exposures treated under the IRB approach. In addition, total eligible provisions may include any discounts on defaulted assets. General and specific provisions set aside against securitization exposures must not be included in total eligible provisions. Portion of exposures subject to the standardized approach for credit risk 15.5 Banks using the standardized approach for a portion of their credit risk exposures (see paragraphs 10.43 to 10.48), must determine the portion of general provisions attributed to the standardized or IRB treatment of provisions according to the methods outlined in paragraphs 15.6 and 15.7 below. 15.6 Banks should generally attribute total general provisions on a pro rata basis according to the proportion of credit risk-weighted assets subject to the standardized and IRB approaches. However, when one approach to determining credit risk-weighted assets (i.e. standardized or IRB approach) is used exclusively within an entity, general provisions booked within the entity using the standardized approach may be attributed to the standardized treatment. Similarly, general provisions booked within entities using the IRB approach may be attributed to the total eligible provisions as defined in paragraph 15.4. 15.7 At SAMA’s discretion, banks using both the standardized and IRB approaches may rely on their internal methods for allocating general provisions for recognition in capital under either the standardized or IRB approach, subject to the following conditions. Where the internal allocation method is made available, the national supervisor will establish the standards surrounding their use. Banks will need to obtain prior approval from their

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 176 of 349 SAMA to use an internal allocation method for this purpose. Treatment of EL and provisions 15.8 As specified in articles 2.2.3 and 4.1.4 – Section A of SAMA Guidance Document Concerning the Implementation of Basel III (Circular No. 341000015689, Date: 19 December 2012), Banks using the IRB approach must compare the total amount of total eligible provisions (as defined in paragraph 15.4) with the total EL amount as calculated within the IRB approach (as defined in paragraph 15.2). In addition, article 2.2.3 in the aforementioned rules outlines the treatment for that portion of a bank that is subject to the standardized approach for credit risk when the bank uses both the standardized and IRB approaches. 15.9 Where the calculated EL amount is lower than the total eligible provisions of the bank, SAMA will consider whether the EL fully reflects the conditions in the market in which it operates before allowing the difference to be included in Tier 2 capital. If specific provisions exceed the EL amount on defaulted assets thisassessment also needs to be made before using the difference to offset the EL amount on non-defaulted assets.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 177 of 349 16.IRB Approach: Minimum requirements to use IRB approach 16.1 This chapter presents the minimum requirements for entry and on-going use of the internal ratings-based (IRB) approach. The minimum requirements are set outin the following 11 sections: (1) Composition of minimum requirements (2) Compliance with minimum requirements (3) Rating system design (4) Risk rating system operations (5) Corporate governance and oversight (6) Use of internal ratings (7) Risk quantification (8) Validation of internal estimates (9) Supervisory loss-given-default (LGD) and exposure at default (EAD) estimates (10) Requirements for recognition of leasing (11) Disclosure requirements 16.2 The minimum requirementsin the sectionsthat follow cut across asset classes. Therefore, more than one asset class may be discussed within the context of agiven minimum requirement.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 178 of 349 Section 1: composition of minimum requirements 16.3 To be eligible for the IRB approach a bank must demonstrate to SAMA that it meets certain minimum requirements at the outset and on an ongoing basis. Many of these requirements are in the form of objectives that a qualifying bank’s risk rating systems must fulfil. The focus is on banks’ abilities to rank orderand quantify risk in a consistent, reliable and valid fashion. 16.4 The overarching principle behind these requirements is that rating and risk estimation systems and processes provide for a meaningful assessment of borrower and transaction characteristics; a meaningful differentiation of risk; and reasonably accurate and consistent quantitative estimates of risk. Furthermore, the systems and processes must be consistent with internal use of these estimates. 16.5 The minimum requirements set out in this chapter apply to all asset classes unless noted otherwise. The standards related to the process of assigning exposures to borrower or facility grades (and the related oversight, validation, etc.) apply equally to the process of assigning retail exposures to pools of homogenous exposures, unless noted otherwise. 16.6 The minimum requirements set out in this chapter apply to both foundation and advanced approaches unless noted otherwise. Generally, all IRB banks must produce their own estimates of probability of default (PD63) and must adhere to the overall requirements for rating system design, operations, controls, and corporate governance, as well as the requisite requirements for estimation and validation of PD measures. Banks wishing to use their own estimates of LGD and EAD must also meet the incremental minimum requirements for these risk factors included in paragraphs 16.82 to 16.110.

63 Banks are not required to produce their own estimates of PD for exposures subject to the supervisory slotting approach

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 179 of 349 Section 2: compliance with minimum requirements 16.7 To be eligible for an IRB approach, a bank must demonstrate to SAMA that it meets the IRB requirements in this framework, at the outset and on an ongoing basis. Banks’ overall credit risk management practices must also be consistent with the evolving sound practice/guidelines issued by SAMA. 16.8 There may be circumstances when a bank is not in complete compliance with all the minimum requirements. Where this is the case, the bank must produce a plan for a timely return to compliance, and seek approval from its supervisor, or the bank must demonstrate that the effect of such non￾compliance is immaterial in terms of the risk posed to the institution. Failure to produce an acceptable plan or satisfactorily implement the plan or to demonstrate immateriality will lead SAMA to reconsider the bank’s eligibility for the IRB approach. Furthermore,for the duration of any non￾compliance, SAMA will consider the need for the bank to hold additional capital under the supervisory review process or take other appropriate supervisory action.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 180 of 349 Section 3: rating system design 16.9 The term “rating system” comprises all of the methods, processes, controls, anddata collection and IT systems that support the assessment of credit risk, the assignment of internal risk ratings, and the quantification of default and loss estimates. 16.10 Within each asset class, a bank may utilize multiple rating methodologies /systems. For example, a bank may have customized rating systems for specific industries or market segments (e.g. middle market, and large corporate). If a bank chooses to use multiple systems, the rationale for assigning a borrower to a rating system must be documented and applied in a manner that best reflects thelevel of risk of the borrower. Banks must not allocate borrowers across rating systems inappropriately to minimize regulatory capital requirements (i.e. cherry- picking by choice of rating system). Banks must demonstrate that each system used for IRB purposes is in compliance with the minimum requirements at the outset and on an ongoing basis. Rating dimensions : standards for corporate, sovereign and bank exposures 16.11 A qualifying IRB rating system must have two separate and distinct dimensions: (1) the risk of borrower default; and (2) transaction-specific factors. 16.12 The first dimension must be oriented to the risk of borrower default. Separate exposures to the same borrower must be assigned to the same borrower grade, irrespective of any differencesin the nature of each specific transaction. There are two exceptions to this. Firstly, in the case of country transfer risk, where a bank may assign different borrower grades depending on whether the facility is denominated in local or foreign currency. Secondly, when the treatment of associated guarantees to a facility may be reflected in an adjusted borrower grade. In either case, separate exposures may result in multiple grades for the same borrower. A bank must articulate in its credit policy the relationship between borrower grades in terms of the level of risk each grade

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 181 of 349 implies. Perceived and measured risk must increase as credit quality declines from one grade to the next. The policy must articulate the risk of each grade in terms of both a description of the probability of default risk typical for borrowers assigned the grade and the criteria used to distinguish that level of credit risk. 16.13 The second dimension must reflect transaction-specific factors, such as collateral, seniority, product type, etc. For exposures subject to the foundation IRB approach, this requirement can be fulfilled by the existence of a facility dimension, which reflects both borrower and transaction-specific factors. For example, a rating dimension that reflects expected loss (EL) by incorporating both borrower strength (PD) and loss severity (LGD) considerations would qualify. Likewise a rating system that exclusively reflects LGD would qualify. Where a rating dimension reflects EL and does not separately quantify LGD, the supervisory estimates of LGD must be used. 16.14 For banks using the advanced approach, facility ratings must reflect exclusively LGD. These ratings can reflect any and all factors that can influence LGD including, but not limited to, the type of collateral, product, industry, and purpose. Borrower characteristics may be included as LGD rating criteria only to the extent they are predictive of LGD. Banks may alter the factors that influence facility grades across segments of the portfolio as long as they can satisfy their supervisor that it improves the relevance and precision of their estimates. 16.15 Banks using the supervisory slotting criteria are exempt from this two￾dimensional requirement for these exposures. Given the interdependence between borrower/transaction characteristics in exposures subject to the supervisory slotting approaches, banks may satisfy the requirements under this heading through a single rating dimension that reflects EL by incorporating both borrower strength (PD) and loss severity (LGD) considerations. This exemption does not apply to banks using the general corporate foundation or advanced approach for the specialized lending (SL) sub-class.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 182 of 349 Rating dimensions: standards for retail exposures 16.16 Rating systems for retail exposures must be oriented to both borrower and transaction risk, and must capture all relevant borrower and transaction characteristics. Banks must assign each exposure that falls within the definition of retail for IRB purposes into a particular pool. Banks must demonstrate that this process provides for a meaningful differentiation of risk, provides for a grouping of sufficiently homogenous exposures, and allows for accurate and consistent estimation of loss characteristics at pool level. 16.17 For each pool, banks must estimate PD, LGD, and EAD. Multiple pools may share identical PD, LGD and EAD estimates. At a minimum, banks should consider the following risk drivers when assigning exposures to a pool: (1) Borrower risk characteristics (e.g. borrower type, demographics such as age /occupation). (2) Transaction risk characteristics, including product and/or collateral types (e.g. loan to value measures, seasoning64,guarantees; and seniority (first vs. second lien)). Banks must explicitly address cross collateral provisions wherepresent. (3) Delinquency of exposure: Banks are expected to separately identify exposures that are delinquent and those that are not.

64 For each pool where the banks estimate PD and LGD, banks should analyze the representativeness of the age of the facilities (in terms of time since origination for PD and time since the date of default for LGD) in the data used to derive the estimates of the bank’s actual facilities. In certain market conditions, default rates peak several years after origination or recovery rates show a low point several years after default, as such banks should adjust the estimates with an adequate margin of conservatism to account for the lack of representativeness as well as anticipated implications of rapid exposure growth.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 183 of 349 Rating structure : standards for corporate, sovereign and bank exposures 16.18 A bank must have a meaningful distribution of exposures across grades with no excessive concentrations, on both its borrower-rating and its facility-rating scales. 16.19 To meet this objective, a bank must have a minimum ofseven borrower grades for non-defaulted borrowers and one for those that have defaulted. Banks with lending activities focused on a particular market segment may satisfy this requirement with the minimum number of grades. 16.20 A borrower grade is defined as an assessment of borrower risk on the basis of aspecified and distinct set of rating criteria, from which estimates of PD are derived. The grade definition must include both a description of the degree of default risk typical for borrowers assigned the grade and the criteria used to distinguish that level of credit risk. Furthermore, “+” or “-” modifiers to alpha or numeric grades will only qualify as distinct grades if the bank has developed complete rating descriptions and criteria for their assignment, and separately quantifies PDs for these modified grades. 16.21 Banks with loan portfolios concentrated in a particular market segment and rangeof default risk must have enough grades within that range to avoid undue concentrations of borrowers in particular grades. Significant concentrations within a single grade or grades must be supported by convincing empirical evidence that the grade or grades cover reasonably narrow PD bands and that the default risk posed by all borrowers in a grade fall within that band. 16.22 There is no specific minimum number of facility grades for banks using the advanced approach for estimating LGD. A bank must have a sufficient number offacility grades to avoid grouping facilities with widely varying LGDs into a single grade. The criteria used to define facility grades must be grounded in empirical evidence. 16.23 Banks using the supervisory slotting criteria must have at least four grades for non-defaulted borrowers, and one for defaulted borrowers. The requirements for SL exposures that qualify for the corporate foundation and advanced approachesare the same as those for general corporate exposures.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 184 of 349 Rating structure: standards for retail exposures 16.24 For each pool identified, the bank must be able to provide quantitative measures of loss characteristics (PD, LGD, and EAD) for that pool. The level of differentiation for IRB purposes must ensure that the number of exposures in a given pool is sufficient so as to allow for meaningful quantification and validation of the loss characteristics at the pool level. There must be a meaningful distribution of borrowers and exposures across pools. A single pool must not include an undue concentration of the bank’s total retail exposure. Rating criteria 16.25 A bank must have specific rating definitions, processes and criteria for assigningexposures to grades within a rating system. The rating definitions and criteria must be both plausible and intuitive and must result in a meaningful differentiation of risk. (1) The grade descriptions and criteria must be sufficiently detailed to allow those charged with assigning ratings to consistently assign the same grade to borrowers or facilities posing similar risk. This consistency should exist across lines of business, departments and geographic locations. If rating criteria and procedures differ for different types of borrowers or facilities, thebank must monitor for possible inconsistency, and must alter rating criteria to improve consistency when appropriate. (2) Written rating definitions must be clear and detailed enough to allow third parties to understand the assignment of ratings, such as internal audit or anequally independent function and supervisors, to replicate rating assignments and evaluate the appropriateness of the grade/pool assignments. (3) The criteria must also be consistent with the bank’s internal lending standards and its policies for handling troubled borrowers and facilities.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 185 of 349 16.26 To ensure that banks are consistently taking into account available information, they must use all relevant and material information in assigning ratings to borrowers and facilities. Information must be current. The less information a bank has, the more conservative must be its assignments of exposures to borrower and facility grades or pools. An external rating can be the primary factor determining an internal rating assignment; however, the bank must ensure that it considers other relevant information. Rating criteria: exposures subject to the supervisory slotting approach 16.27 Banks using the supervisory slotting criteria must assign exposures to their internal rating grades based on their own criteria, systems and processes, subject to compliance with the requisite minimum requirements. Banks must then map these internal rating grades into the five supervisory rating categories. The slotting criteria tables in the supervisory slotting approach chapter 13 provide, for each sub-class of SL exposures, the general assessment factors and characteristics exhibited by the exposures that fall under each of the supervisorycategories. Each lending activity has a unique table describing the assessment factors and characteristics. 16.28 The criteria that banks use to assign exposures tointernal grades will not perfectly align with criteria that define the supervisory categories; however, banks must demonstrate that their mapping process has resulted in an alignment of grades which is consistent with the preponderance of the characteristics in the respective supervisory category. Banks should take special care to ensure that any overrides of their internal criteria do not render the mapping process ineffective. Rating assignment horizon 16.29 Although the time horizon used in PD estimation is one year (as described in paragraph 16.62), banks are expected to use a longer time horizon in assigning ratings.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 186 of 349 16.30 A borrower rating must represent the bank’s assessment of the borrower’s abilityand willingness to contractually perform despite adverse economic conditions or the occurrence of unexpected events. The range of economic conditions that are considered when making assessments must be consistent with current conditionsand those that are likely to occur over a business cycle within the respective industry/geographic region. Rating systems should be designed in such a way that idiosyncratic or industry-specific changes are a driver of migrations from onecategory to another, and business cycle effects may also be a driver. 16.31 PD estimates for borrowers that are highly leveraged or for borrowers whose assets are predominantly traded assets must reflect the performance of the underlying assets based on periods of stressed volatilities. 16.32 Given the difficulties in forecasting future events and the influence they will have on a particular borrower’s financial condition, a bank must take a conservative view of projected information. Furthermore, where limited data are available, a bank must adopt a conservative bias to its analysis. Use of models 16.33 The requirements in this section apply to statistical models and other mechanical methods used to assign borrower or facility ratings or in estimation of PDs, LGDs, or EADs. Credit scoring models and other mechanical rating procedures generally use only a subset of available information. Although mechanical rating procedures may sometimes avoid some of the idiosyncratic errors made by rating systems in which human judgement plays a large role, mechanical use of limited information also is a source of rating errors. Credit scoring models and other mechanical procedures are permissible as the primary or partial basis of rating assignments, and may play a role in the estimation of loss characteristics. Sufficient human judgement and human oversight is necessary to ensure that all relevant and material information, including that which is outside the scope of the model, is also taken into consideration, and that the model is used appropriately.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 187 of 349 (1) The burden is on the bank to satisfy its supervisor that a model or procedure has good predictive power and that regulatory capital requirements will not be distorted as a result of its use. The variables that are input to the model must form a reasonable set of predictors. The model must be accurate on average across the range of borrowers or facilities to which the bank is exposed and there must be no known material biases. (2) The bank must have in place a process for vetting data inputs into a statistical default or loss prediction model which includes an assessment ofthe accuracy, completeness and appropriateness of the data specific to theassignment of an approved rating. (3) The bank must demonstrate that the data used to build the model are representative of the population of the bank’s actual borrowers or facilities. (4) When combining model results with human judgement, the judgement must take into account all relevant and material information not considered by the model. The bank must have written guidance describing how human judgement and model results are to be combined. (5) The bank must have procedures for human review of model-based rating assignments. Such procedures should focus on finding and limiting errors associated with known model weaknesses and must also include credibleongoing efforts to improve the model’s performance. (6) The bank must have a regular cycle of model validation that includes monitoring of model performance and stability; review of model relationships; and testing of model outputs against outcomes.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 188 of 349 Documentation of rating system design 16.34 Banks must document in writing their rating systems’ design and operational details. The documentation must evidence banks’ compliance with the minimumstandards, and must address topics such as portfolio differentiation, rating criteria, responsibilities of parties that rate borrowers and facilities, definition of what constitutes a rating exception, parties that have authority to approve exceptions, frequency of rating reviews, and management oversight of the ratingprocess. A bank must document the rationale for its choice of internal rating criteria and must be able to provide analyses demonstrating that rating criteria and procedures are likely to result in ratings that meaningfully differentiate risk. Rating criteria and procedures must be periodically reviewed to determine whether they remain fully applicable to the current portfolio and to external conditions. In addition, a bank must document a history of major changes in the risk rating process, and such documentation must support identification of changes made to the risk rating process subsequent to the last supervisory review. The organization of rating assignment, including the internal controlstructure, must also be documented. 16.35 Banks must document the specific definitions of default and loss used internally and demonstrate consistency with the reference definitions set out in paragraphs 16.67 to 16.75. 16.36 If the bank employs statistical models in the rating process, the bank must document their methodologies. This material must: (1) Provide a detailed outline of the theory, assumptions and/or mathematicaland empirical basis of the assignment of estimates to grades, individual obligors, exposures, or pools, and the data source(s) used to estimate the model; (2) Establish a rigorous statistical process (including out-of-time and out￾of-sample performance tests) for validating the model; and (3) Indicate any circumstances under which the model does not work effectively.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 189 of 349 16.37 Use of a model obtained from a third-party vendor that claims proprietary technology is not a justification for exemption from documentation or any other of the requirements for internal rating systems. The burden is on the model’s vendor and the bank to satisfy SAMA. Section 4: risk rating system operations Coverage of ratings 16.38 For corporate, sovereign and bank exposures, each borrower and all recognized guarantors must be assigned a rating and each exposure must be associated witha facility rating as part of the loan approval process. Similarly, for retail, each exposure must be assigned to a pool as part of the loan approval process. 16.39 Each separate legal entity to which the bank is exposed must be separately rated. A bank must have policies acceptable to its supervisor regarding the treatment of individual entities in a connected group including circumstances under which the same rating may or may not be assigned to some or all related entities. Those policies must include a process for the identification ofspecific wrong way risk for each legal entity to which the bank is exposed. Transactions with counterparties where specific wrong way risk has been identified need to be treated differently when calculating the EAD for such exposures (see paragraph 7.48 in the CCR framework). Integrity of rating process: standards for corporate, sovereign and bank exposures 16.40 Rating assignments and periodic rating reviews must be completed or approved by a party that does not directly stand to benefit from the extension of credit. Independence of the rating assignment process can be achieved through a range of practices that will be carefully reviewed by SAMA. These operational processes must be documented in the bank’s procedures and incorporated into bank policies. Credit policies and underwriting procedures must reinforce and foster the independence of the rating process.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 190 of 349 16.41 Borrowers and facilities must have their ratings refreshed at least on an annual basis. Certain credits, especially higher risk borrowers or problem exposures, must be subject to more frequent review. In addition, banks must initiate a new rating if material information on the borrower or facility comes to light. 16.42 The bank must have an effective process to obtain and update relevant and material information on the borrower’s financial condition, and on facility characteristics that affect LGDs and EADs (such as the condition of collateral). Upon receipt, the bank needs to have a procedure to update the borrower’s rating in a timely fashion. Integrity of rating process: standards for retail exposures 16.43 A bank must review the loss characteristics and delinquency status of each identified risk pool on at least an annual basis. It must also review the status of individual borrowers within each pool as a means of ensuring that exposures continue to be assigned to the correct pool. This requirement may be satisfied byreview of a representative sample of exposures in the pool. Overrides 16.44 For rating assignments based on expert judgement, banks must clearly articulate the situations in which bank officers may override the outputs of the rating process, including how and to what extent such overrides can be used and by whom. For model-based ratings, the bank must have guidelines and processes for monitoring cases where human judgement has overridden the model’s rating, variables were excluded or inputs were altered. These guidelines must include identifying personnel that are responsible for approving these overrides. Banks must identify overrides and separately track their performance.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 191 of 349 Data maintenance 16.45A bank must collect and store data on key borrower and facility characteristics to provide effective support to its internal credit risk measurement and management process, to enable the bank to meet the other requirements in this document, and to serve as a basis for supervisory reporting. These data should be sufficiently detailed to allow retrospective re-allocation of obligors and facilities to grades, for example if increasing sophistication of the internal rating system suggests that finer segregation of portfolios can be achieved. Furthermore, banks must collect and retain data on aspects of their internal ratings as required by Pillar 3 Disclosure Requirements Framework. Data maintenance: for corporate, sovereign and bank exposures 16.46 Banks must maintain rating histories on borrowers and recognized guarantors, including the rating since the borrower/guarantor was assigned an internal grade, the dates the ratings were assigned, the methodology and key data used to derive the rating and the person/model responsible. The identity of borrowers and facilities that default, and the timing and circumstances of such defaults, must be retained. Banks must also retain data on the PDs and realized default rates associated with rating grades and ratings migration in order to track the predictive power of the borrower rating system. 16.47 Banks using the advanced IRB approach must also collect and store a completehistory of data on the LGD and EAD estimates associated with each facility andthe key data used to derive the estimate and the person/model responsible. Banks must also collect data on the estimated and realized LGDs and EADs associated with each defaulted facility. Banks that reflect the credit risk mitigating effects of guarantees/credit derivatives through LGD must retain data on the LGDof the facility before and after evaluation of the effects of the guarantee/credit derivative. Information about the components of loss or recovery for each defaulted exposure must be retained, such as amounts recovered, source of recovery (e.g. collateral, liquidation proceeds and guarantees), time period required for recovery, and administrative costs.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 192 of 349 16.48 Banks under the foundation approach which utilize supervisory estimates are encouraged to retain the relevant data (i.e. data on loss and recovery experiencefor corporate exposures under the foundation approach, data on realized lossesfor banks using the supervisory slotting criteria). Data maintenance: for retail exposures 16.49 Banks must retain data used in the process of allocating exposures to pools, including data on borrower and transaction risk characteristics used either directly or through use of a model, as well as data on delinquency. Banks must also retain data on the estimated PDs, LGDs and EADs, associated with pools ofexposures. For defaulted exposures, banks must retain the data on the pools to which the exposure was assigned over the year prior to default and the realized outcomes on LGD and EAD. Stress tests used in assessment of capital adequacy 16.50 An IRB bank must have in place sound stress testing processes for use in the assessment of capital adequacy. Stress testing must involve identifying possibleevents or future changes in economic conditions that could have unfavorable effects on a bank’s credit exposures and assessment of the bank’s ability to withstand such changes. Examples of scenarios that could be used are: (1) Economic or industry downturns; (2) Market-risk events; and (3) Liquidity conditions.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 193 of 349 16.51 In addition to the more general tests described above, the bank must perform a credit risk stress test to assess the effect of certain specific conditions on its IRB regulatory capital requirements. The test to be employed would be one chosen by the bank, subject to supervisory review. The test to be employed must be meaningful and reasonably conservative. Individual banks may develop different approaches to undertaking this stress test requirement, depending on their circumstances. For this purpose, the objective is not to require banks to consider worst-case scenarios. The bank’s stress test in this context should, however, consider at least the effect of mild recession scenarios. In this case, one example might be to use two consecutive quarters of zero growth to assess the effect on the bank’s PDs, LGDs and EADs, taking account – on a conservative basis – of the bank’s international diversification. 16.52 Whatever method is used, the bank must include a consideration of the following sources of information. First, a bank’s own data should allow estimation of the ratings migration of at least some of its exposures. Second, banks should consider information about the impact of smaller deterioration in the credit environment on a bank’s ratings, giving some information on the likely effect of bigger, stress circumstances. Third, banks should evaluate evidence of ratings migration in external ratings. This would include the bank broadly matching its buckets to rating categories. Section 5: corporate governance and oversight Corporate governance 16.53 All material aspects of the rating and estimation processes must be approved by the bank’s board of directors or a designated authority. These parties must possess a general understanding of the bank’s risk rating system and detailed comprehension of its associated management reports. Senior management must provide notice to the board of directors or a designated committee thereof of material changes or exceptions from established policies that will materially impact the operations of the bank’s rating system.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 194 of 349 16.54 Senior management also must have a good understanding of the rating system’s design and operation, and must approve material differences between established procedure and actual practice. Management must also ensure, on anongoing basis, that the rating system is operating properly. Management and staff in the credit control function must meet regularly to discuss the performance of the rating process, areas needing improvement, and the status ofefforts to improve previously identified deficiencies. 16.55 Internal ratings must be an essential part of the reporting to these parties. Reporting must include risk profile by grade, migration across grades, estimation of the relevant parameters per grade, and comparison of realized default rates (and LGDs and EADs for banks on advanced approaches) against expectations. Reporting frequencies may vary with the significance and type of information andthe level of the recipient. Credit risk control 16.56 Banks must have independent credit risk control units that are responsible for the design or selection, implementation and performance of their internal rating systems. The unit(s) must be functionally independent from the personnel and management functions responsible for originating exposures. Areas of responsibility must include: (1) Testing and monitoring internal grades; (2) Production and analysis of summary reports from the bank’s rating system, to include historical default data sorted by rating at the time of default and one year prior to default, grade migration analyses, and monitoring of trendsin key rating criteria; (3) Implementing procedures to verify that rating definitions are consistentlyapplied across departments and geographic areas; (4) Reviewing and documenting any changesto the rating process, including thereasons for the changes; and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 195 of 349 (5) Reviewing the rating criteria to evaluate if they remain predictive of risk. Changes to the rating process, criteria or individual rating parameters mustbe documented and retained for SAMA to review. 16.57 A credit risk control unit must actively participate in the development, selection,implementation and validation of rating models. It must assume oversight and supervision responsibilities for any models used in the rating process, and ultimate responsibility for the ongoing review and alterations to rating models. Internal and external audit 16.58 Internal audit or an equally independent function must review at least annually, the bank’s rating system and its operations, including the operations of the creditfunction and the estimation of PDs, LGDs and EADs. Areas of review include adherence to all applicable minimum requirements. Internal audit must document its findings.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 196 of 349 Section 6: use of internal ratings 16.59 Internal ratings and default and loss estimates must play an essential role in the credit approval, risk management, internal capital allocations, and corporate governance functions of banks using the IRB approach. Ratings systems and estimates designed and implemented exclusively for the purpose of qualifying for the IRB approach and used only to provide IRB inputs are not acceptable. It is recognized that banks will not necessarily be using exactly the same estimates for both IRB and all internal purposes. For example, pricing models are likely to use PDs and LGDs relevant to the life of the asset. Where there are such differences, a bank must document them and demonstrate their reasonableness to SAMA. 16.60 A bank must have a credible track record in the use of internal ratings information. Thus, the bank must demonstrate that it has been using a rating system that was broadly in line with the minimum requirements articulated in this document for at least the three years prior to qualification. A bank using the advanced IRB approach must demonstrate that it has been estimating and employing LGDs and EADs in a manner that is broadly consistent with the minimum requirements for use of own estimates of LGDs and EADs for at least the three years prior to qualification. Improvements to a bank’s rating system will not render a bank non-compliant with the three-year requirement.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 197 of 349 Section 7: risk quantification Overall requirements for estimation (structure and intent) 16.61 This section addresses the broad standards for own-estimates of PD, LGD, and EAD. Generally, all banks using the IRB approaches must estimate a PD65 for each internal borrower grade for corporate, sovereign and bank exposures or for eachpool in the case of retail exposures. 16.62 PD estimates must be a long-run average of one-year default rates for borrowers in the grade, with the exception of retail exposures as set out in paragraphs 16.80 and 16.81. Requirements specific to PD estimation are provided in paragraphs 16.76 to 16.81. Banks on the advanced approach must estimate an appropriate LGD (as defined in paragraphs 16.82 to 16.87) for each of its facilities (or retail pools). For exposures subject to the advanced approach, banks must also estimate an appropriate long-run default-weighted average EAD for each of its facilities as defined in paragraphs 16.88 and 16.89. Requirements specific to EAD estimation appear in paragraphs 16.88 to 16.98. For corporate, sovereign and bank exposures, banks that do not meet the requirements for own-estimates of EAD or LGD, above, must use the supervisory estimates of these parameters. Standards for useof such estimates are set out in paragraphs 16.127 to 16.144. 16.63 Internal estimates of PD, LGD, and EAD must incorporate all relevant, materialand available data, information and methods. A bank may utilize internal dataand data from external sources (including pooled data). Where internal or external data is used, the bank must demonstrate that its estimates are representative of long run experience. 16.64 Estimates must be grounded in historical experience and empirical evidence, and not based purely on subjective or judgmental considerations. Any changes in lending practice or the process for pursuing recoveries over the observation period must be taken into account. A bank’s estimates must promptly reflect the implications of technical advances and new data and other information, as it becomes available. Banks must review their estimates

65 Banks are not required to produce their own estimates of PD for exposures subject to the supervisory slotting approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 198 of 349 on a yearly basis or more frequently. 16.65 The population of exposures represented in the data used for estimation, and lending standards in use when the data were generated, and other relevant characteristics should be closely matched to or at least comparable with those ofthe bank’s exposures and standards. The bank must also demonstrate that economic or market conditions that underlie the data are relevant to current andforeseeable conditions. For estimates of LGD and EAD, banks must take into account paragraphs 16.82 to 16.98. The number of exposures in the sample and the data period used for quantification must be sufficient to provide the bank with confidence in the accuracy and robustness of its estimates. The estimation technique must perform well in out-of-sample tests. 16.66 In general, estimates of PDs, LGDs, and EADs are likely to involve unpredictable errors. In order to avoid over-optimism, a bank must add to its estimates a margin of conservatism that is related to the likely range of errors. Where methods and data are less satisfactory and the likely range of errors is larger, the margin of conservatism must be larger. SAMA may, on case by case basis, allow some flexibility in application of the required standards for data that are collected prior to the date of implementation of this Framework. However, in such cases banks must demonstrate that appropriate adjustments have been made to achieve broad equivalence to the data without such flexibility. Data collected beyond the date of implementation must conform to the minimum standards unless otherwise stated. Definition of default 16.67 A default is considered to have occurred with regard to a particular obligor wheneither or both of the two following events have taken place. (1) The bank considers that the obligor is unlikely to pay its credit obligations tothe banking group in full, without recourse by the bank to actions such as realizing security (if held). (2) The obligor is past due more than 90 days on any material credit obligation to the banking group. Overdrafts will be considered as being past due once the customer has breached an advised limit or been advised of a limit smaller than current outstandings.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 199 of 349 16.68 The elements to be taken as indications of unlikeliness to pay include: (1) The bank puts the credit obligation on non-accrued status. (2) The bank makes a charge-off or account-specific provision resulting from a significant perceived decline in credit quality subsequent to the bank taking on the exposure. (3) The bank sells the credit obligation at a material credit-related economic loss. (4) The bank consents to a distressed restructuring of the credit obligation where this is likely to result in a diminished financial obligation caused by the material forgiveness, or postponement, of principal, interest or (whererelevant) fees. (5) The bank has filed for the obligor’s bankruptcy or a similar order in respectof the obligor’s credit obligation to the banking group. (6) The obligor has sought or has been placed in bankruptcy or similar protection where this would avoid or delay repayment of the credit obligation to the banking group. 16.69 SAMA will provide appropriate guidance as to how these elements must be implemented and monitored. 16.70 For retail exposures, the definition of default can be applied at the level of a particular facility, rather than at the level of the obligor. As such, default by a borrower on one obligation does not require a bank to treat all other obligationsto the banking group as defaulted. 16.71 A bank must record actual defaults on IRB exposure classes using this reference definition. A bank must also use the reference definition for its estimation of PDs, and (where relevant) LGDs and EADs. In arriving at these estimations, a bank may use external data available to it that is not itself consistent with that definition, subject to the requirements set out in paragraph 16.77. However, in such cases, banks must demonstrate to SAMA that appropriate adjustments to the data have been made to achieve broad equivalence with the reference definition. This same condition would apply to any internal data used up to implementation of this Framework. Internal data (including that pooled by banks) used in such estimates beyond the date of implementation of this Framework must be consistent with the reference

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 200 of 349 definition. 16.72 If the bank considers that a previously defaulted exposure’s status is such that no trigger of the reference definition any longer applies, the bank must rate the borrower and estimate LGD as they would for a non-defaulted facility. Should the reference definition subsequently be triggered, a second default would be deemed to have occurred. Re-ageing 16.73 The bank must have clearly articulated and documented policies in respect of the counting of days past due, in particular in respect of the re-ageing of the facilities and the granting of extensions, deferrals, renewals and rewrites to existing accounts. At a minimum, the re-ageing policy must include: (a) approval authorities and reporting requirements; (b) minimum age of a facility before it is eligible for re-ageing; (c) delinquency levels of facilities that are eligible for re- ageing; (d) maximum number of re-ageings per facility; and (e) a reassessment of the borrower’s capacity to repay. These policies must be applied consistently over time, and must support the ‘use test’ (ie if a bank treats a re-aged exposure in a similar fashion to other delinquent exposures more than the past-due cut off point, this exposure must be recorded as in default for IRB purposes). Treatment of overdrafts 16.74 Authorized overdrafts must be subject to a credit limit set by the bank and brought to the knowledge of the client. Any break of this limit must be monitored; if the account were not brought under the limit after 90 to 180 days (subject to the applicable past-due trigger), it would be considered as defaulted. Non-authorized overdrafts will be associated with a zero limit for IRB purposes. Thus, days past due commence once any credit is granted to an unauthorized customer; if such credit were not repaid within 90 to 180 days, the exposure would be considered in default. Banks must have in place rigorous internal policies for assessing the creditworthiness of customers who are offered overdraft accounts.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 201 of 349 Definition of loss for all asset classes 16.75 The definition of loss used in estimating LGD is economic loss. When measuring economic loss, all relevant factors should be taken into account. This must include material discount effects and material direct and indirect costs associated with collecting on the exposure. Banks must not simply measure the loss recorded in accounting records, although they must be able to compare accounting and economic losses. The bank’s own workout and collection expertise significantly influences their recovery rates and must be reflected in their LGD estimates, but adjustments to estimates for such expertise must be conservative until the bank has sufficient internal empirical evidence of the impact of its expertise. Requirements specific to PD estimation : corporate, sovereign and bank exposures 16.76 Banks must use information and techniques that take appropriate account of the long-run experience when estimating the average PD for each rating grade. For example, banks may use one or more of the three specific techniques set out below: internal default experience, mapping to external data, and statistical default models. 16.77 Banks may have a primary technique and use others as a point of comparison and potential adjustment. SAMA will not be satisfied by mechanical application of a technique without supporting analysis. Banks must recognize the importance of judgmental considerations in combining results of techniques and in making adjustments for limitations of techniques and information. For all methods listed below, banks must estimate a PD for each rating grade based on the observed historical average one-year default rate that is a simple average based on number of obligors (count weighted). Weighting approaches, such as EAD weighting, are not permitted. (1) A bank may use data on internal default experience for the estimation of PD. A bank must demonstrate in its analysis that the estimates are reflective of underwriting standards and of any differences in the rating system that generated the data and the current rating system. Where

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 202 of 349 only limited data are available, or where underwriting standards or rating systems have changed, the bank must add a greater margin of conservatism in its estimate of PD. The use of pooled data across institutions may also be recognized. A bank must demonstrate that the internal rating systems and criteria of other banks in the pool are comparable with its own. (2) Banks may associate or map their internal grades to the scale used by an external credit assessment institution or similar institution and then attribute the default rate observed for the external institution’s grades to the bank’s grades. Mappings must be based on a comparison of internal rating criteria to the criteria used by the external institution and on a comparison of the internal and external ratings of any common borrowers. Biases or inconsistencies in the mapping approach or underlying data must be avoided. The external institution’s criteria underlying the data used for quantification must be oriented to the risk of the borrower and not reflect transaction characteristics. The bank’s analysis must include a comparison of the default definitions used, subject to the requirements in paragraphs 16.67 to 16.72. The bank must document the basis for the mapping. (3) A bank is allowed to use a simple average of default-probability estimates for individual borrowers in a given grade, where such estimates are drawn from statistical default prediction models. The bank’s use of default probability models for this purpose must meet the standards specified in paragraph 16.33. 16.78 Irrespective of whether a bank is using external, internal, or pooled data sources, or a combination of the three, for its PD estimation, the length of the underlying historical observation period used must be at least five years for at least one source. If the available observation period spans a longer period for any source, and this data are relevant and material, this longer period must be used. The data should include a representative mix of good and bad years.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 203 of 349 Requirements specific to PD estimation: retail exposures 16.79 Given the bank-specific basis of assigning exposures to pools, banks must regard internal data as the primary source of information for estimating loss characteristics. Banks are permitted to use external data or statistical models for quantification provided a strong link can be demonstrated between: (a) the bank’ s process of assigning exposures to a pool and the process used by the external data source; and (b) between the bank’s internal risk profile and the composition of the external data. In all cases banks must use all relevant and material data sources as points of comparison. 16.80 One method for deriving long-run average estimates of PD and default￾weightedaverage loss rates given default (as defined in paragraph 16.82) for retail would be based on an estimate of the expected long-run loss rate. A bank may (i) use an appropriate PD estimate to infer the long-run default￾weighted average loss rate given default, or (ii) use a long-run default￾weighted average loss rate given default to infer the appropriate PD. In either case, it is important to recognize thatthe LGD used for the IRB capital calculation cannot be less than the long-run default-weighted average loss rate given default and must be consistent with theconcepts defined in paragraph 16.82. 16.81 Irrespective of whether banks are using external, internal, pooled data sources, or a combination of the three, for their estimation of loss characteristics, the length of the underlying historical observation period used must be at least five years. If the available observation spans a longer period for any source, and these data are relevant, this longer period must be used. The data should include a representative mix of good and bad years of the economic cycle relevant for the portfolio. The PD should be based on the observed historical average one-year default rate.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 204 of 349 Requirements specific to own-LGD estimates: standards for all asset classes 16.82 A bank must estimate an LGD for each facility that aims to reflect economic downturn conditions where necessary to capture the relevant risks. This LGD cannot be less than the long-run default-weighted average loss rate given defaultcalculated based on the average economic loss of all observed defaults within the data source for that type of facility. In addition, a bank must take into account the potential for the LGD of the facility to be higher than the default-weighted average during a period when credit losses are substantially higher than average. For certain types of exposures, loss severities may not exhibit such cyclical variability and LGD estimates may not differ materially from the long-run default- weighted average. However, for other exposures, this cyclical variability in loss severities may be important and banks will need to incorporate it into their LGD estimates. For this purpose, banks may make reference to the averages of loss severities observed during periods of high credit losses, forecasts based on appropriately conservative assumptions, or other similar methods. Appropriate estimates of LGD during periods of high credit losses might be formed using either internal and/or external data. SAMA will continue to monitor and encourage the development of appropriate approaches to this issue. 16.83 In its analysis, the bank must consider the extent of any dependence between the risk of the borrower and that of the collateral or collateral provider. Cases where there is a significant degree of dependence must be addressed in a conservative manner. Any currency mismatch between the underlying obligation and the collateral must also be considered and treated conservatively in the bank’s assessment of LGD. 16.84 LGD estimates must be grounded in historical recovery rates and, when applicable, must not solely be based on the collateral’s estimated market value. This requirement recognizes the potential inability of banks to gain both control of their collateral and liquidate it expeditiously. To the extent that LGD estimates take into account the existence of collateral, banks must establish internal requirements for collateral management, operational procedures, legal certainty and risk management process that are generally consistent with those required for the foundation IRB approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 205 of 349 16.85 Recognizing the principle that realized losses can at times systematically exceed expected levels, the LGD assigned to a defaulted asset should reflect the possibility that the bank would have to recognize additional, unexpected losses during the recovery period. For each defaulted asset, the bank must also construct its best estimate of the expected loss on that asset based on current economic circumstances and facility status. The amount, if any, by which the LGD on a defaulted asset exceeds the bank’s best estimate of expected loss on the asset represents the capital requirement for that asset, and should be set by the bank on a risk-sensitive basis in accordance with paragraph 11.3. Instances where the best estimate of expected loss on a defaulted asset is less than the sum of specific provisions and partial charge￾offs on that asset will attract supervisory scrutiny and must be justified by the bank. Requirements specific to own-LGD estimates: additional standards for corporateand sovereign exposures 16.86 Estimates of LGD must be based on a minimum data observation period that should ideally cover at least one complete economic cycle but must in any case be no shorter than a period of seven years for at least one source. If the available observation period spans a longer period for any source, and the data are relevant, this longer period must be used. Requirements specific to own-LGD estimates: additional standards for retail exposures 16.87 The minimum data observation period for LGD estimates for retail exposures isfive years. The less data a bank has the more conservative it must be in its estimation.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 206 of 349 Requirements specific to own-EAD estimates: standards for all asset classes 16.88 EAD for an on-balance sheet or off-balance sheet item is defined as the expected gross exposure of the facility upon default of the obligor. For on￾balance sheet items, banks must estimate EAD at no less than the current drawn amount, subject to recognizing the effects of on-balance sheet netting as specified in the foundation approach. The minimum requirements for the recognition of netting are the same as those under the foundation approach. The additional minimum requirements for internal estimation of EAD under the advanced approach, therefore, focus on the estimation of EAD for off￾balance sheet items (excluding transactions that expose banks to counterparty credit risk as set out in chapter 5 of the Counterparty Credit Risk (CCR) framework). Banks using the advanced approach must have established procedures in place for the estimation of EAD for off-balance sheet items. These must specify the estimates of EAD to be used for each facility type. Banks’ estimates of EAD shouldreflect the possibility of additional drawings by the borrower up to and after the time a default event is triggered. Where estimates of EAD differ by facility type, the delineation of these facilities must be clear and unambiguous. 16.89 Under the advanced approach, banks must assign an estimate of EAD for each eligible facility. It must be an estimate of the long-run default-weighted average EAD for similar facilities and borrowers over a sufficiently long period of time, butwith a margin of conservatism appropriate to the likely range of errors in the estimate. If a positive correlation can reasonably be expected between the defaultfrequency and the magnitude of EAD, the EAD estimate must incorporate a largermargin of conservatism. Moreover, for exposures for which EAD estimates are volatile over the economic cycle, the bank must use EAD estimates that are appropriate for an economic downturn, if these are more conservative than the long-run average. For banks that have been able to develop their own EAD models, this could be achieved by considering the cyclical nature, if any, of the drivers of such models. Other banks may have sufficient internal data to examine the impact of previous recession(s). However, some banks may only have the option of making conservative use of external data. Moreover, where a bank bases its estimates on alternative measures of central tendency (such as the median or a higher percentile estimate) or only on ‘downturn’ data, it should explicitly confirm

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 207 of 349 that the basic downturn requirement of the framework is met, ie the bank’s estimates do not fall below a (conservative) estimate of the long-run default￾weighted average EAD for similar facilities. 16.90 The criteria by which estimates of EAD are derived must be plausible and intuitive, and represent what the bank believes to be the material drivers of EAD.The choices must be supported by credible internal analysis by the bank. The bank must be able to provide a breakdown of its EAD experience by the factors itsees as the drivers of EAD. A bank must use all relevant and material informationin its derivation of EAD estimates. Across facility types, a bank must review its estimates of EAD when material new information comes to light and at least on an annual basis. 16.91 Due consideration must be paid by the bank to its specific policies and strategiesadopted in respect of account monitoring and payment processing. The bank must also consider its ability and willingness to prevent further drawings in circumstances short of payment default, such as covenant violations or other technical default events. Banks must also have adequate systems and procedures in place to monitor facility amounts, current outstandings against committed lines and changes in outstandings per borrower and per grade. The bank must be able to monitor outstanding balances on a daily basis. 16.92 Banks’ EAD estimates must be developed using a 12-month fixed-horizon approach; i.e. for each observation in the reference data set, default outcomes must be linked to relevant obligor and facility characteristics twelve months priorto default. 16.93 As set out in paragraph 16.65, banks’ EAD estimates should be based on reference data that reflect the obligor, facility and bank management practice characteristics of the exposures to which the estimates are applied. Consistent with this principle, EAD estimates applied to particular exposures should not be based on data that comingle the effects of disparate characteristics or data from exposures that exhibit different characteristics (e.g. same broad product grouping but different customers that are managed differently by the bank). The estimates should be based on appropriately homogenous segments. Alternatively, the estimates should be based on an estimation approach that effectively disentangles the impact of the different characteristics exhibited within the relevant dataset. Practices that generally do not comply with this

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 208 of 349 principle include use of estimatesbased or partly based on: (1) SME/midmarket data being applied to large corporate obligors. (2) Data from commitments with ‘small’ unused limit availability being appliedto facilities with ‘large’ unused limit availability. (3) Data from obligors already identified as problematic at reference date being applied to current obligors with no known issues (e.g. customers at reference date who were already delinquent, watch listed by the bank, subject to recent bank-initiated limit reductions, blocked from further drawdowns or subject to other types of collections activity). (4) Data that has been affected by changes in obligors’ mix of borrowing and other credit-related products over the observation period unless that data has been effectively mitigated for such changes, e.g. by adjusting the data to remove the effects of the changes in the product mix. SAMA expects banks to demonstrate a detailed understanding of the impact of changes in customer product mix on EAD reference data sets (and associated EAD estimates) and that the impact is immaterial or has been effectively mitigated within each bank’s estimation process. Banks’ analyses in this regard will be actively challenged by SAMA. Effective mitigation would not include: setting floors to credit conversion factor (CCF)/EAD observations; use of obligor-level estimates that do not fully cover the relevant product transformation options or inappropriately combine products with very different characteristics (e.g. revolving and non-revolving products); adjusting only ‘material’ observations affected by product transformation; generally excluding observations affected by product profile transformation (thereby potentially distorting the representativeness of the remaining data).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 209 of 349 16.94 A well-known feature of the commonly used undrawn limit factor (ULF) approach66 to estimating CCFs is the region of instability associated with facilities close to being fully drawn at reference date. Banks should ensure that their EAD estimatesare effectively quarantined from the potential effects of this region of instability. (1) An acceptable approach could include using an estimation method other than the ULF approach that avoids the instability issue by not using potentially small undrawn limits that could approach zero in the denominator or, as appropriate, switching to a method other than the ULF asthe region of instability is approached, e.g. a limit factor, balance factor or additional utilization factor approach 67 . Note that, consistent with paragraph 16.93, including limit utilization as a driver in EAD models could quarantine much of the relevant portfolio from this issue but, in the absence of other actions, leaves open how to develop appropriate EAD estimates to be applied to exposures within the region of instability. (2) Common but ineffective approaches to mitigating this issue include cappingand flooring reference data (e.g. observed CCFs at 100 per cent and zero respectively) or omitting observations that are judged to be affected. 16.95 EAD reference data must not be capped to the principal amount outstanding or facility limits. Accrued interest, other due payments and limit excesses should be included in EAD reference data.

66 A specific type of CCF, where predicted additional drawings in the lead- up to default are expressed as a percentage of the undrawn limit that remains available to the obligor under the terms and conditions of a facility, ie EAD=B0=Bt+ULF[Lt –Bt], where B0 = facility balance at date of default; Bt = current balance (for predicted EAD) or balance at reference date (for observed EAD); Lt = current limit (for predicted EAD) or limit at reference date (for realized/observed EAD). 67 A limit factor (LF) is a specific type of CCF, where the predicted balance at default is expressed as a percentage of the total limit that is available to the obligor under the terms and conditions of a credit facility, ie EAD=B0= LF[Lt], where B0 = facility balance at date of default; Bt = current balance (for predicted EAD) or balance at reference date (for observed EAD); Lt = current limit (for predicted EAD) or limit at reference date (for realized/observed EAD). A balance factor (BF) is a specific type of CCF, where the predicted balance at default is expressed as a percentage of the current balance that has been drawn down under a credit facility, i.e. EAD=B0=BF[Bt]. An additional utilization factor (AUF) is a specific type of CCF, where predicted additional drawings in the lead-up to default are expressed as a percentage of the total limit that is available to the obligor under the terms and conditions of a credit facility, i.e. EAD = B0 = Bt + AUF[Lt].

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 210 of 349 16.96 For transactions that expose banks to counterparty credit risk, estimates of EAD must fulfil the requirements set forth in the counterparty credit risk standards. Requirementsspecific to own-EAD estimates: additionalstandards for corporate and sovereign exposures 16.97 Estimates of EAD must be based on a time period that must ideally cover a complete economic cycle but must in any case be no shorter than a period of seven years. If the available observation period spans a longer period for any source, and the data are relevant, this longer period must be used. EAD estimates must be calculated using a default-weighted average and not a time￾weighted average.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 211 of 349 Requirements specific to own-EAD estimates: additional standards for retail exposures 16.98 The minimum data observation period for EAD estimates for retail exposures is five years. The less data a bank has, the more conservative it must be in its estimation. Requirements for assessing effect of guarantees : standards for corporate and sovereign exposures where own estimates of LGD are used and standards for retailexposures 16.99 When a bank uses its own estimates of LGD, it may reflect the risk-mitigating effect of guarantees through an adjustment to PD or LGD estimates. The option to adjust LGDs is available only to those banks that have been approved to use their own internal estimates of LGD. For retail exposures, where guarantees exist, either in support of an individual obligation or a pool of exposures, a bank may reflect the risk-reducing effect either through its estimates of PD or LGD, provided this is done consistently. In adopting one or the other technique, a bank must adopt a consistent approach, both across types of guarantees and over time. 16.100 In all cases, both the borrower and all recognized guarantors must be assigned aborrower rating at the outset and on an ongoing basis. A bank must follow all minimum requirements for assigning borrower ratings set out in this document,including the regular monitoring of the guarantor’s condition and ability and willingness to honour its obligations. Consistent with the requirements in paragraphs 16.46 and 16.47, a bank must retain all relevant information on the borrower absent the guarantee and the guarantor. In the case of retail guarantees, these requirements also apply to the assignment of an exposure to a pool, and the estimation of PD.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 212 of 349 16.101 In no case can the bank assign the guaranteed exposure an adjusted PD or LGD such that the adjusted risk weight would be lower than that of a comparable, direct exposure to the guarantor. Neither criteria nor rating processes are permitted to consider possible favorable effects of imperfect expected correlation between default events for the borrower and guarantor for purposes of regulatory minimum capital requirements. As such, the adjusted risk weight must not reflect the risk mitigation of “double default.” 16.102 In case the bank applies the standardized approach to direct exposures to the guarantor, the guarantee may only be recognized by treating the covered portion of the exposure as a direct exposure to the guarantor under the standardized approach. Similarly, in case the bank applies the foundation IRB approach to direct exposures to the guarantor, the guarantee may only be recognized by applying the foundation IRB approach to the covered portion of the exposure.Alternatively, banks may choose to not recognize the effect of guarantees on their exposures. 16.103 There are no restrictions on the types of eligible guarantors. The bank must, however, have clearly specified criteria for the types of guarantors it will recognize for regulatory capital purposes. 16.104 The guarantee must be evidenced in writing, non-cancellable on the part of the guarantor, in force until the debt is satisfied in full (to the extent of the amount and tenor of the guarantee) and legally enforceable against the guarantor in a jurisdiction where the guarantor has assets to attach and enforce a judgement. The guarantee must also be unconditional; there should be no clause in the protection contract outside the direct control of the bank that could prevent the protection provider from being obliged to pay out in a timely manner in the event that the original counterparty fails to make the payment(s) due. However, under the advanced IRB approach, guarantees that only cover loss remaining after the bank has first pursued the original obligor for payment and has completed the workout process may be recognized. 16.105 In case of guarantees where the bank applies the standardized approach to the covered portion of the exposure, the scope of guarantors and the minimum requirements as under the standardized approach apply.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 213 of 349 16.106 A bank must have clearly specified criteria for adjusting borrower grades or LGD estimates (or in the case of retail and eligible purchased receivables, the process of allocating exposures to pools) to reflect the impact of guarantees for regulatory capital purposes. These criteria must be as detailed as the criteria for assigning exposures to grades consistent with paragraphs 16.25 and 16.26, and must follow all minimum requirements for assigning borrower or facility ratings set out in this document. 16.107 The criteria must be plausible and intuitive, and must address the guarantor’s ability and willingness to perform under the guarantee. The criteria must also address the likely timing of any payments and the degree to which the guarantor’ s ability to perform under the guarantee is correlated with the borrower’s ability to repay. The bank’s criteria must also consider the extent to which residual risk to the borrower remains, for example a currency mismatch between the guarantee and the underlying exposure. 16.108 In adjusting borrower grades or LGD estimates (or in the case of retail and eligible purchased receivables, the process of allocating exposures to pools), banks must take all relevant available information into account. Requirements for assessing effect of credit derivatives: standards for corporate andsovereign exposures where own estimates of LGD are used and standards for retail exposures 16.109 The minimum requirements for guarantees are relevant also for single-name credit derivatives. Additional considerations arise in respect of asset mismatches. The criteria used for assigning adjusted borrower grades or LGD estimates (or pools) for exposures hedged with credit derivatives must require that the asset on which the protection is based (the reference asset) cannot be different from the underlying asset, unless the conditions outlined in the foundation approach are met. 16.110 In addition, the criteria must address the payout structure of the credit derivative and conservatively assess the impact this has on the level and timing of recoveries. The bank must also consider the extent to which other forms of residual risk remain.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 214 of 349 Requirementsfor assessing effect of guarantees and credit derivatives:standards for banks using foundation LGD estimates 16.111 The minimum requirements outlined in paragraphs 16.99 to 16.110 apply to banks using the foundation LGD estimates with the following exceptions: (1) The bank is not able to use an ‘LGD-adjustment’ option; and (2) The range of eligible guarantees and guarantors is limited to those outlined in paragraph 12.28. Requirements specific to estimating PD and LGD (or EL) for qualifying purchasedreceivables 16.112 The following minimum requirements for risk quantification must be satisfied for any purchased receivables (corporate or retail) making use of the top￾down treatment of default risk and/or the IRB treatments of dilution risk. 16.113 The purchasing bank will be required to group the receivables into sufficiently homogeneous pools so that accurate and consistent estimates of PD and LGD (or EL) for default losses and EL estimates of dilution losses can be determined. In general, the risk bucketing process will reflect the seller’s underwriting practices and the heterogeneity of its customers. In addition, methods and data for estimating PD, LGD, and EL must comply with the existing risk quantification standards for retail exposures. In particular, quantification should reflect all information available to the purchasing bank regarding the quality of the underlying receivables, including data for similar pools provided by the seller, by the purchasing bank, or by external sources. The purchasing bank must determine whether the data provided by the seller are consistent with expectations agreed upon by both parties concerning, for example, the type, volume and on-going quality of receivables purchased. Where this is not the case, the purchasing bank is expected to obtain and rely upon more relevant data.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 215 of 349 16.114 A bank purchasing receivables has to justify confidence that current and future advances can be repaid from the liquidation of (or collections against) the receivables pool. To qualify for the top-down treatment of default risk, the receivable pool and overall lending relationship should be closely monitored and controlled. Specifically, a bank will have to demonstrate the following: (1) Legal certainty (see paragraph 16.115). (2) Effectiveness of monitoring systems (see paragraph 16.116) (3) Effectiveness of work-out systems (see paragraph 16.117) (4) Effectiveness of systems for controlling collateral, credit availability, and cash (see paragraph 16.118) (5) Compliance with the bank’sinternal policies and procedures (see paragraphs 16.119 and 16.120) 16.115 Legal certainty: the structure of the facility must ensure that under all foreseeable circumstances the bank has effective ownership and control of the cash remittances from the receivables, including incidences of seller or servicer distress and bankruptcy. When the obligor makes payments directly to a seller or servicer, the bank must verify regularly that payments are forwarded completely and within the contractually agreed terms. As well, ownership over the receivables and cash receipts should be protected against bankruptcy ‘stays’ or legal challenges that could materially delay the lender’s ability to liquidate/assign the receivables or retain control over cash receipts. 16.116 Effectiveness of monitoring systems: the bank must be able to monitor both thequality of the receivables and the financial condition of the seller and servicer. Inparticular: (1) The bank must: (a) assess the correlation among the quality of the receivables and the financial condition of both the seller and servicer; and (b) have in place internal policies and procedures that provide adequate safeguards to protect against such contingencies, including the assignment of an internal risk rating for each seller and servicer.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 216 of 349 (2) The bank must have clear and effective policies and procedures for determining seller and servicer eligibility. The bank or its agent must conductperiodic reviews of sellers and servicers in order to verify the accuracy of reports from the seller/servicer, detect fraud or operational weaknesses, and verify the quality of the seller’s credit policies and servicer’s collection policies and procedures. The findings of these reviews must be well documented. (3) The bank must have the ability to assess the characteristics of the receivablespool, including: (a) over-advances; (b) history of the seller’s arrears, bad debts, and bad debt allowances; (c) payment terms; and (d) potential contra accounts. (4) The bank must have effective policies and procedures for monitoring on anaggregate basis single-obligor concentrations both within and across receivables pools. (5) The bank must receive timely and sufficiently detailed reports of receivables ageings and dilutions to: (a) ensure compliance with the bank’s eligibility criteria and advancing policies governing purchased receivables; and (b) provide an effective means with which to monitor and confirm the seller’s terms of sale (e.g. invoice date ageing) and dilution.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 217 of 349 16.117 Effectiveness of work-out systems: an effective programme requires systems and procedures not only for detecting deterioration in the seller’s financial condition and deterioration in the quality of the receivables at an early stage, but also for addressing emerging problems pro-actively. In particular: (1) The bank should have clear and effective policies, procedures, and information systems to monitor compliance with (a) all contractual terms of the facility (including covenants, advancing formulas, concentration limits, early amortization triggers, etc.) as well as (b) the bank’s internal policies governing advance rates and receivables eligibility. The bank’s systems should track covenant violations and waivers as well as exceptions to established policies and procedures. (2) To limit inappropriate draws, the bank should have effective policies andprocedures for detecting, approving, monitoring, and correcting over- advances. (3) The bank should have effective policies and procedures for dealing with financially weakened sellers or servicers and/or deterioration in the quality ofreceivable pools. These include, but are not necessarily limited to, early termination triggers in revolving facilities and other covenant protections, a structured and disciplined approach to dealing with covenant violations, and clear and effective policies and procedures for initiating legal actions and dealing with problem receivables. 16.118 Effectiveness of systems for controlling collateral, credit availability, and cash: the bank must have clear and effective policies and procedures governing the control of receivables, credit, and cash. In particular: (1) Written internal policies must specify all material elements of the receivables purchase programme, including the advancing rates, eligible collateral, necessary documentation, concentration limits, and how cash receipts are to be handled. These elements should take appropriate account of all relevant and material factors, including the seller’s/servicer’s financial condition, risk concentrations, and trends in the quality of the receivables and the seller’s customer base.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 218 of 349 (2) Internal systems must ensure that funds are advanced only against specified supporting collateral and documentation (such as servicer attestations, invoices, shipping documents, etc.). 16.119 Compliance with the bank’s internal policies and procedures: given the relianceon monitoring and control systems to limit credit risk, the bank should have aneffective internal process for assessing compliance with all critical policies and procedures, including: (1) Regular internal and/or external audits of all critical phases of the bank’s receivables purchase programme. (2) Verification of the separation of duties: (a) between the assessment of the seller/servicer and the assessment of the obligor; and (b) between the assessment of the seller/servicer and the field audit of the seller/servicer. 16.120 A bank’s effective internal process for assessing compliance with all critical policies and procedures should also include evaluations of back office operations,with particular focus on qualifications, experience, staffing levels, and supporting systems.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 219 of 349 Section 8: validation of internal estimates 16.121 Banks must have a robust system in place to validate the accuracy and consistency of rating systems, processes, and the estimation of all relevant risk components. A bank must demonstrate to its supervisor that the internal validation process enables it to assess the performance of internal rating and riskestimation systems consistently and meaningfully. 16.122 Banks must regularly compare realized default rates with estimated PDs for eachgrade and be able to demonstrate that the realized default rates are within the expected range for that grade. Banks using the advanced IRB approach must complete such analysis for their estimates of LGDs and EADs. Such comparisonsmust make use of historical data that are over as long a period as possible. The methods and data used in such comparisons by the bank must be clearly documented by the bank. This analysis and documentation must be updated at least annually. 16.123 Banks must also use other quantitative validation tools and comparisons with relevant external data sources. The analysis must be based on data that are appropriate to the portfolio, are updated regularly, and cover a relevant observation period. Banks’ internal assessments of the performance of their ownrating systems must be based on long data histories, covering a range of economic conditions, and ideally one or more complete business cycles. 16.124 Banks must demonstrate that quantitative testing methods and other validation methods do not vary systematically with the economic cycle. Changes in methodsand data (both data sources and periods covered) must be clearly and thoroughlydocumented. 16.125 Banks must have well-articulated internal standards for situations where deviations in realized PDs, LGDs and EADs from expectations become significantenough to call the validity of the estimates into question. These standards must take account of business cycles and similar systematic variability in default experiences. Where realized values continue to be higher than expected values, banks must revise estimates upward to reflect their default and loss experience.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 220 of 349 16.126 Where banks rely on supervisory, rather than internal, estimates of risk parameters, they are encouraged to compare realized LGDs and EADs to those set by SAMA. The information on realized LGDs and EADs should formpart of the bank’s assessment of economic capital. Section 9: supervisory LGD and EAD estimates 16.127 Banks under the foundation IRB approach, which do not meet the requirementsfor own-estimates of LGD and EAD, above, must meet the minimum requirements described in the standardized approach to receive recognition for eligible financial collateral (as set out in the credit risk mitigation section of the standardized approach, chapter 9). They must meet the following additional minimum requirements in order to receive recognition for additional collateral types. Definition of eligibility of commercial and residential real estate as collateral 16.128 Eligible commercial and residential real estate collateral for corporate, sovereign and bank exposures are defined as: (1) Collateral where the risk of the borrower is not materially dependent upon the performance of the underlying property or project, but rather on the underlying capacity of the borrower to repay the debt from other sources. Assuch, repayment of the facility is not materially dependent on any cash flow generated by the underlying commercial or residential real estate serving as collateral; and (2) Additionally, the value of the collateral pledged must not be materially dependent on the performance of the borrower. This requirement is not intended to preclude situations where purely macro-economic factors affectboth the value of the collateral and the performance of the borrower.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 221 of 349 16.129 In light of the generic description above and the definition of corporate exposures, income producing real estate that falls under the SL asset class is specifically excluded from recognition as collateral for corporate exposures.68 Operational requirements for eligible commercial or residential real estate 16.130 Subject to meeting the definition above, commercial and residential real estate will be eligible for recognition as collateral for corporate claims only if all of the following operational requirements are met. (1) Legal enforceability: any claim on collateral taken must be legally enforceable in all relevant jurisdictions, and any claim on collateral must be properly filed on a timely basis. Collateral interests must reflect a perfected lien (i.e. all legal requirements for establishing the claim have been fulfilled). Furthermore, the collateral agreement and the legal process underpinning it must be such that they provide for the bank to realize the value of the collateral within a reasonable timeframe. (2) Objective market value of collateral: the collateral must be valued at or less than the current fair value under which the property could be sold under private contract between a willing seller and an arm’s-length buyer on the date of valuation. (3) Frequent revaluation: the bank is expected to monitor the value of the collateral on a frequent basis and at a minimum once every year. More frequent monitoring is suggested where the market is subject to significant changes in conditions. Statistical methods of evaluation (e.g. reference to house price indices, sampling) may be used to update

68 In exceptional circumstances for well-developed and long-established markets, mortgages on office and/or multi-purpose commercial premises and/or multi-tenanted commercial premises may have the potential to receive recognition as collateral in the corporate portfolio. This exceptional treatment will be subject to very strict conditions. In particular, two tests must be fulfilled, namely that (i) losses stemming from commercial real estate lending up to the lower of 50% of the market value or 60% of loan-to value based on mortgage-lending- value must not exceed 0.3% of the outstanding loans in any given year; and that (ii) overall losses stemming from commercial real estate lending must not exceed 0.5% of the outstanding loans in any given year. This is, if either of these tests is not satisfied in a given year, the eligibility to use this treatment will cease and the original eligibility criteria would need to be satisfied again before it could be applied in the future. Countries applying such a treatment must publicly disclose that these are met.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 222 of 349 estimates or to identify collateral that may have declined in value and that may need re- appraisal. A qualified professional must evaluate the property when information indicates that the value of the collateral may have declined materially relative to general market prices or when a credit event, such as default, occurs. (4) Junior liens: In some member countries, eligible collateral will be restricted to situations where the lender has a first charge over the property. Junior liens may be taken into account where there is no doubt that the claim for collateral is legally enforceable and constitutes an efficient credit risk mitigant. Where junior liens are recognized the bank must first take the haircut value of the collateral, then reduce it by the sum of all loans with liens that rank higher than the junior lien, the remaining value is the collateral that supports the loan with the junior lien. In cases where liens are held by third parties that rank pari passu with the lien of the bank, only the proportion of the collateral (after the application of haircuts and reductions due to the value of loans with liens that rank higher than the lien of the bank) that is attributable to the bank may be recognized. 16.131 Additional collateral management requirements are as follows: (1) The types of commercial and residential real estate collateral accepted by the bank and lending policies (advance rates) when this type of collateral is taken must be clearly documented. (2) The bank must take stepsto ensure that the property taken as collateral is adequately insured against damage or deterioration. (3) The bank must monitor on an ongoing basis the extent of any permissible prior claims (e.g. tax) on the property. (4) The bank must appropriately monitor the risk of environmental liability arising in respect of the collateral, such as the presence of toxic material on a property.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 223 of 349 Requirements for recognition of financial receivables : definition of eligiblereceivables 16.132 Eligible financial receivables are claims with an original maturity of less than or equal to one year where repayment will occur through the commercial or financial flows related to the underlying assets of the borrower. This includes both self-liquidating debt arising from the sale of goods or services linked to a commercial transaction and general amounts owed by buyers, suppliers, renters, national and local governmental authorities, or other non-affiliated parties not related to the sale of goods or services linked to a commercial transaction. Eligible receivables do not include those associated with securitizations, sub- participations or credit derivatives. Requirements for recognition of financial receivables: legal certainty 16.133 The legal mechanism by which collateral is given must be robust and ensure that the lender has clear rights over the proceeds from the collateral. 16.134 Banks must take all steps necessary to fulfil local requirements in respect of the enforceability of security interest, e.g. by registering a security interest with a registrar. There should be a framework that allows the potential lender to have a perfected first priority claim over the collateral. 16.135 All documentation used in collateralized transactions must be binding on all parties and legally enforceable in all relevant jurisdictions. Banks must have conducted sufficient legal review to verify this and have a well-founded legal basis to reach this conclusion, and undertake such further review as necessary toensure continuing enforceability. 16.136 The collateral arrangements must be properly documented, with a clear and robust procedure for the timely collection of collateral proceeds. Banks’ procedures should ensure that any legal conditions required for declaring the default of the customer and timely collection of collateral are observed. In the event of the obligor’s financial distress or default, the bank should have legal authority to sell or assign the receivables to other parties without consent of thereceivables’ obligors.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 224 of 349 Requirements for recognition of financial receivables: risk management 16.137 The bank must have a sound process for determining the credit risk in the receivables. Such a process should include, among other things, analyses of the borrower’s business and industry (e.g. effects of the business cycle) and the types of customers with whom the borrower does business. Where the bank relies on the borrower to ascertain the credit risk of the customers, the bank must review the borrower’s credit policy to ascertain its soundness and credibility. 16.138 The margin between the amount of the exposure and the value of the receivables must reflect all appropriate factors, including the cost of collection, concentration within the receivables pool pledged by an individual borrower, and potential concentration risk within the bank’s total exposures. 16.139 The bank must maintain a continuous monitoring process that is appropriate for the specific exposures (either immediate or contingent) attributable to the collateral to be utilized as a risk mitigant. This process may include, as appropriate and relevant, ageing reports, control of trade documents, borrowing base certificates, frequent audits of collateral, confirmation of accounts, control of the proceeds of accounts paid, analyses of dilution (credits given by the borrowerto the issuers) and regular financial analysis of both the borrower and the issuers of the receivables, especially in the case when a small number of large-sized receivables are taken as collateral. Observance of the bank’s overall concentrationlimits should be monitored. Additionally, compliance with loan covenants, environmental restrictions, and other legal requirements should be reviewed on aregular basis 16.140 The receivables pledged by a borrower should be diversified and not be unduly correlated with the borrower. Where the correlation is high, e.g. where some issuers of the receivables are reliant on the borrower for their viability or the borrower and the issuers belong to a common industry, the attendant risks should be taken into account in the setting of margins for the collateral pool as a whole. Receivables from affiliates of the borrower (including subsidiaries and employees) will not be recognized as risk mitigants.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 225 of 349 16.141 The bank should have a documented process for collecting receivable paymentsin distressed situations. The requisite facilities for collection should be in place, even when the bank normally looks to the borrower for collections. Requirements for recognition of other physical collateral 16.142 SAMA may allow for recognition of the credit risk mitigating effect of certain other physical collateral when the following conditions are met: (1) The bank demonstrates to the satisfaction of SAMA that there are liquid markets for disposal of collateral in an expeditious and economically efficient manner. Banks must carry out a reassessment of this condition both periodically and when information indicates material changes in the market. (2) The bank demonstrates to the satisfaction of SAMA that there are well￾established, publicly available market prices for the collateral. Banks must also demonstrate that the amount they receive when collateral is realized does not deviate significantly from these market prices. 16.143 In order for a given bank to receive recognition for additional physical collateral, it must meet all the requirements in paragraphs 16.130 and 16.131, subject to the following modifications: (1) With the sole exception of permissible prior claims specified in the footnote to paragraph 16.130, only first liens on, or charges over, collateral are permissible. As such, the bank must have priority over all other lenders to the realized proceeds of the collateral. (2) The loan agreement must include detailed descriptions ofthe collateral andthe right to examine and revalue the collateral whenever this is deemed necessary by the lending bank. (3) The types of physical collateral accepted by the bank and policies and practices in respect of the appropriate amount of each type of collateral relative to the exposure amount must be clearly documented in internal credit policies and procedures and available for examination and/or auditreview.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 226 of 349 (4) Bank credit policies with regard to the transaction structure must address appropriate collateral requirements relative to the exposure amount, the ability to liquidate the collateral readily, the ability to establish objectively a price or market value, the frequency with which the value can readily be obtained (including a professional appraisal or valuation), and the volatility of the value of the collateral. The periodic revaluation process must pay particular attention to “fashion-sensitive” collateral to ensure that valuations are appropriately adjusted downward of fashion, or model-year, obsolescence as well as physical obsolescence or deterioration. (5) In cases of inventories (e.g. raw materials, work-in-process, finished goods, dealers’ inventories of autos) and equipment, the periodic revaluation process must include physical inspection of the collateral. 16.144 General Security Agreements, and other forms of floating charge, can provide the lending bank with a registered claim over a company’s assets. In cases where the registered claim includes both assets that are not eligible as collateral under the foundation IRB and assets that are eligible as collateral under the foundation IRB, the bank may recognize the latter. Recognition is conditional on the claims meeting the operational requirements set out in paragraphs 16.127 to 16.143.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 227 of 349 Section 10: requirements for recognition of leasing 16.145 Leases other than those that expose the bank to residual value risk (see paragraph 16.146) will be accorded the same treatment as exposures collateralized by the same type of collateral. The minimum requirements for the collateral type must be met (commercial or residential real estate or other collateral). In addition, the bank must also meet the following standards: (1) Robust risk management on the part of the lessor with respect to the location of the asset, the use to which it is put, its age, and planned obsolescence; (2) A robust legal framework establishing the lessor’s legal ownership of theasset and its ability to exercise its rights as owner in a timely fashion; and (3) The difference between the rate of depreciation of the physical asset and therate of amortization of the lease payments must not be so large as to overstate the credit risk mitigation attributed to the leased assets. 16.146 Leases that expose the bank to residual value risk will be treated in the following manner. Residual value risk is the bank’s exposure to potential loss due to the fair value of the equipment declining below its residual estimate at lease inception. (1) The discounted lease payment stream will receive a risk weight appropriate for the lessee’s financial strength (PD) and supervisory or own-estimate of LGD, whichever is appropriate. (2) The residual value will be risk-weighted at 100%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 228 of 349 Section 11: disclosure requirements 16.147 In order to be eligible for the IRB approach, banks must meet the disclosure requirements set out in Pillar 3 Disclosure Requirements Framework. These areminimum requirements for use of IRB: failure to meet these will render banksineligible to use the relevant IRB approach.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 229 of 349 Transition Phase-in for standardized approach treatment of equity exposures 17.1 The risk weight treatment described in paragraph 7.50 will be subject to a five-year linear phase-in arrangement from 1 January 2023. For speculative unlisted equity exposures, the applicable risk weight will start at 100% and increase by 60 percentage points at the end of each year until the end of Year 5. For all other equity holdings, the applicable risk weight will start at 100% and increase by 30 percentage points at the end of each year until the end of Year 5. Phase-in for the removal of the internal ratings-based approach for equity exposures 17.2 The requirement to use the standardized approach for equity exposures in paragraph 10.41 will be subject to a five-year linear phase-in arrangement from 1 January 2023. During the phase-in period, the risk weight for equity exposures will be the greater of: (1) The risk weight as calculated using the internal ratings-based approach that applied to equity exposures prior to 1 January 2023; and (2) The risk weight set for the linear phase-in arrangement under the standardized approach for credit risk (see paragraph 17.1 above).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 230 of 349 18. Securitization: general provisions Scope and definitions of transactions covered under the securitization framework 18.1 Banks must apply the securitization framework for determining regulatory capital requirements on exposures arising from traditional and synthetic securitizations or similar structures that contain features common to both. Since securitizations may be structured in many different ways, the capital treatment of a securitization exposure must be determined on the basis of its economic substance rather than its legal form. Banks are encouraged to consult with SAMA when there is uncertainty about whether a given transaction should be considered a securitization. For example, transactions involving cash flows from real estate (e.g. rents) may be considered specialized lending exposures, if warranted. 18.2 A traditional securitization is a structure where the cash flow from an underlying pool of exposures is used to service at least two different stratified risk positions or tranches reflecting different degrees of credit risk. Payments to the investors depend upon the performance of the specified underlying exposures, as opposed to being derived from an obligation of the entity originating those exposures. The stratified/tranched structures that characterize securitizations differ from ordinary senior/subordinated debt instruments in that junior securitization tranches can absorb losses without interrupting contractual payments to more senior tranches, whereas subordination in a senior/subordinated debt structure is a matter of priority of rights to the proceeds of liquidation. 18.3 A synthetic securitization is a structure with at least two different stratified risk positions or tranches that reflect different degrees of credit risk where credit risk of an underlying pool of exposures is transferred, in whole or in part, through the use of funded (e.g. credit-linked notes) or unfunded (e.g. credit default swaps) credit derivatives or guarantees that serve to hedge the credit risk of the portfolio. Accordingly, the investors’ potential risk is dependent upon the performance of the underlying pool.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 231 of 349 18.4 Banks’ exposures to a securitization are hereafter referred to as “securitization exposures”. Securitization exposures can include but are not restricted to the following: asset-backed securities, mortgage-backed securities, credit enhancements, liquidity facilities, interest rate or currency swaps, credit derivatives and tranched cover as described in 9.81. Reserve accounts, such as cash collateral accounts, recorded as an asset by the originating bank must also be treated as securitization exposures. 18.5 Resecuritization exposure is a securitization exposure in which the risk associated with an underlying pool of exposures is tranched and at least one of the underlying exposures is a securitization exposure. In addition, an exposure to one or more resecuritization exposures is a resecuritization exposure. An exposure resulting from retranching of a securitization exposure is not a resecuritization exposure if the bank is able to demonstrate that the cash flows to and from the bank could be replicated in all circumstances and conditions by an exposure to the securitization of a pool of assets that contains no securitization exposures. 18.6 Underlying instruments in the pool being securitized may include but are not restricted to the following: loans, commitments, asset-backed and mortgage￾backed securities, corporate bonds, equity securities, and private equity investments. The underlying pool may include one or more exposures. Definitions and general terminology 18.7 For risk-based capital purposes, a bank is considered to be an originator with regard to a certain securitization if it meets either of the following conditions: (1) The bank originates directly or indirectly underlying exposures included in the securitization; or (2) The bank serves as a sponsor of an asset-backed commercial paper (ABCP) conduit or similar programme that acquires exposures from third-party entities. In the context of such programmes, a bank would generally be considered a sponsor and, in turn, an originator if it, in fact or in substance, manages or advises the programme, places securities

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 232 of 349 into the market, or provides liquidity and/or credit enhancements. 18.8 An ABCP programme predominantly issues commercial paper to third-party investors with an original maturity of one year or less and is backed by assets or other exposures held in a bankruptcy-remote, special purpose entity. 18.9 A clean-up call is an option that permits the securitization exposures (e.g. asset- backed securities) to be called before all of the underlying exposures or securitization exposures have been repaid. In the case of traditional securitizations, this is generally accomplished by repurchasing the remaining securitization exposures once the pool balance or outstanding securities have fallen below some specified level. In the case of a synthetic transaction, the clean- up call may take the form of a clause that extinguishes the credit protection. 18.10 A credit enhancement is a contractual arrangement in which the bank or other entity retains or assumes a securitization exposure and, in substance, provide some degree of added protection to other parties to the transaction. 18.11 A credit-enhancing interest-only strip (I/O) is an on-balance sheet asset that (1) Represents a valuation of cash flows related to future margin income, and (2) Is subordinated. 18.12 An early amortization provision is a mechanism that, once triggered, accelerates the reduction of the investor’s interest in underlying exposures of a securitization of revolving credit facilities and allows investors to be paid out prior to the originally stated maturity of the securities issued. A securitization of revolving credit facilities is a securitization in which one or more underlying exposures represent, directly or indirectly, current or future draws on a revolving credit facility. Examples of revolving credit facilities include but are not limited to credit card exposures, home equity lines of credit, commercial lines of credit, and other lines of credit. 18.13 Excess spread (or future margin income) is defined as gross finance charge collections and other income received by the trust or special purpose entity (SPE, as defined below) minus certificate interest,servicing fees, charge-offs, and other senior trust or SPE expenses.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 233 of 349 18.14 Implicit support arises when a bank provides support to a securitization in excess of its predetermined contractual obligation. 18.15 For risk-based capital purposes, an internal ratings-based (IRB) pool means a securitization pool for which a bank is able to use an IRB approach to calculate capital requirements for all underlying exposures given that it has approval to apply IRB for the type of underlying exposures and it has sufficient information to calculate IRB capital requirements for these exposures. A bank which has a SAMA-approved IRB approach for the entire pool of exposures underlying a given securitization exposure that cannot estimate capital requirements for all underlying exposures using an IRB approach would be expected to demonstrate to SAMA why it is unable to do so. However, SAMA may prohibit a bank from treating an IRB pool as such in the case of particular structures or transactions, including transactions with highly complex loss allocations, tranches whose credit enhancement could be eroded for reasons other than portfolio losses, and tranches of portfolios with high internal correlations (such as portfolios with high exposure to single sectors or with high geographical concentration). 18.16 For risk-based capital purposes, a mixed pool means a securitization pool for which a bank is able to calculate IRB parameters for some, but not all, underlying exposures in a securitization. 18.17 For risk-based capital purposes, a standardized approach (SA) pool means a securitization pool for which a bank does not have approval to calculate IRB parameters for any underlying exposures; or for which, while the bank has approval to calculate IRB parameters for some or all of the types of underlying exposures, it is unable to calculate IRB parameters for any underlying exposures because of lack of relevant data, or is prohibited by SAMA from treating the pool as an IRB pool pursuant to 18.15. 18.18 A securitization exposure (tranche) is considered to be a senior exposure (tranche) if it is effectively backed or secured by a first claim on the entire

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 234 of 349 amount of the assets in the underlying securitized pool.69While this generally includes only the most senior position within a securitization transaction, in some instances there may be other claims that, in a technical sense, may be more senior in the waterfall (e.g. a swap claim) but may be disregarded for the purpose of determining which positions are treated as senior. Different maturities of several senior tranches that share pro rata loss allocation shall have no effect on the seniority of these tranches, since they benefit from the same level of credit enhancement. The material effects of differing tranche maturities are captured by maturity adjustments on the risk weights to be assigned to the securitization exposures. For example: (1) In a typical synthetic securitization, an unrated tranche would be treated as a senior tranche, provided that all of the conditions for inferring a rating from a lower tranche that meets the definition of a senior tranche are fulfilled. (2) In a traditional securitization where all tranches above the first-loss piece are rated, the most highly rated position would be treated as a senior tranche. When there are several tranches that share the same rating, only the most senior tranche in the cash flow waterfall would be treated as senior (unless the only difference among them is the effective maturity). Also, when the different ratings of several senior tranches only result from a difference in maturity, all of these tranches should be treated as a senior tranche. (3) Usually, a liquidity facility supporting an ABCP programme would not be the most senior position within the programme; the commercial paper, which benefits from the liquidity support, typically would be the most senior position. However, a liquidity facility may be viewed as covering all losses on the underlying receivables pool that exceed the amount of overcollateralization/reserves provided by the seller and as being most senior if it is sized to cover all of the outstanding commercial paper and other senior debt supported by the pool, so that no cash flows from the

69 If a senior tranche is retranched or partially hedged (i.e. not on a pro rata basis), only the new senior part would be treated as senior for capital purposes.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 235 of 349 underlying pool could be transferred to the other creditors until any liquidity draws were repaid in full. In such a case, the liquidity facility can be treated as a senior exposure. Otherwise, if these conditions are not satisfied, or if for other reasons the liquidity facility constitutes a mezzanine position in economic substance rather than a senior position in the underlying pool, the liquidity facility should be treated as a non￾senior exposure. 18.19 For risk-based capital purposes, the exposure amount of a securitization exposure is the sum of the on-balance sheet amount of the exposure, or carrying value – which takes into account purchase discounts and writedowns/specific provisions the bank took on this securitization exposure – and the off-balance sheet exposure amount, where applicable. 18.20 A bank must measure the exposure amount of its off-balance sheet securitization exposures as follows: (1) For credit risk mitigants sold or purchased by the bank, use the treatment set out in 18.56 to 18.62; (2) For facilities that are not credit risk mitigants, use a credit conversion factor (CCF) of 100%. If contractually provided for, servicers may advance cash to ensure an uninterrupted flow of payments to investors so long as the servicer is entitled to full reimbursement and this right is senior to other claims on cash flows from the underlying pool of exposures. The undrawn portion of servicer cash advances or facilities may receive the CCF for unconditionally cancellable commitments under chapters 5 to 7 and; (3) For derivatives contracts other than credit risk derivatives contracts, such as interest rate or currency swaps sold or purchased by the bank, use the measurement approach set out in counterparty credit risk overview chapter of Minimum Capital Requirements for Counterparty Credit Risk and Credit Valuation Adjustment.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 236 of 349 18.21 An SPE is a corporation, trust or other entity organized for a specific purpose, the activities of which are limited to those appropriate to accomplish the purpose of the SPE, and the structure of which is intended to isolate the SPE from the credit risk of an originator or seller of exposures. SPEs, normally a trust or similar entity, are commonly used as financing vehicles in which exposures are sold to the SPE in exchange for cash or other assets funded by debt issued by the trust. 18.22 For risk-based capital purposes, tranche maturity (𝑀𝑇 ) is the tranche’s remaining effective maturity in years and can be measured at the bank’s discretion in either of the following manners. In all cases, 𝑀𝑇 will have a floor of one year and a cap of five years. (1) As the euro70 weighted-average maturity of the contractual cash flows of the tranche, as expressed below, where 𝐶𝐹𝑡 denotes the cash flows (principal, interest payments and fees) contractually payable by the borrower in period t. The contractual payments must be unconditional and must not be dependent on the actual performance of the securitized assets. If such unconditional contractual payment dates are not available, the final legal maturity shall be used. MT = ∑𝑡 tCFt ∑𝑡 CFt (2) On the basis of final legal maturity of the tranche, where 𝑀𝐿 is the final legal maturity of the tranche. 𝑀𝑇 = 1 + 80% (𝑀𝐿 − 1) 18.23 When determining the maturity of a securitization exposure, banks should take into account the maximum period of time they are exposed to potential losses from the securitized assets. In cases where a bank provides a commitment, the bank should calculate the maturity of the securitization exposure resulting from this commitment as the sum of the contractual maturity of the commitment and the longest maturity of the asset(s) to which

70 The euro designation is used for illustrative purposes only.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 237 of 349 the bank would be exposed after a draw has occurred. If those assets are revolving, the longest contractually possible remaining maturity of the asset that might be added during the revolving period would apply, rather than the (longest) maturity of the assets currently in the pool. The same treatment applies to all other instruments where the risk of the commitment/protection provider is not limited to losses realized until the maturity of that instrument (e.g. total return swaps). For credit protection instruments that are only exposed to losses that occur up to the maturity of that instrument, a bank would be allowed to apply the contractual maturity of the instrument and would not have to look through to the protected position.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 238 of 349 Operational requirements for the recognition of risk transference 18.24 An originating bank may exclude underlying exposures from the calculation of risk-weighted assets only if all of the following conditions have been met. Banks meeting these conditions must still hold regulatory capital against any securitization exposures they retain. (1) Significant credit risk associated with the underlying exposures has been transferred to third parties. (2) The transferor does not maintain effective or indirect control over the transferred exposures. The exposures are legally isolated from the transferor in such a way (e.g. through the sale of assets or through subparticipation) that the exposures are put beyond the reach of the transferor and its creditors, even in bankruptcy or receivership. Banks should obtain legal opinion71 that confirms true sale. The transferor’s retention of servicing rights to the exposures will not necessarily constitute indirect control of the exposures. The transferor is deemed to have maintained effective control over the transferred credit risk exposures if it: (a) Is able to repurchase from the transferee the previously transferred exposures in order to realize their benefits; or (b) Is obligated to retain the risk of the transferred exposures. (3) The securities issued are not obligations of the transferor. Thus, investors who purchase the securities only have claim to the underlying exposures. (4) The transferee is an SPE and the holders of the beneficial interests in that entity have the right to pledge or exchange them without restriction, unless such restriction is imposed by a risk retention requirement.

71 Legal opinion is not limited to legal advice from qualified legal counsel, but allows written advice from in-house lawyers.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 239 of 349 (5) Clean-up calls must satisfy the conditions set out in 18.28. (6) The securitization does not contain clauses that (a) Require the originating bank to alter the underlying exposures such that the pool’s credit quality is improved unless this is achieved by selling exposures to independent and unaffiliated third parties at market prices; (b) Allow for increases in a retained first-loss position or credit enhancement provided by the originating bank after the transaction’s inception; or (c) Increase the yield payable to parties other than the originating bank, such as investors and third-party providers of credit enhancements, in response to a deterioration in the credit quality of the underlying pool. (7) There must be no termination options/triggers except eligible clean-up calls,termination for specific changes in tax and regulation or early amortization provisions such as those set out in 18.27. 18.25 For synthetic securitizations, the use of credit risk mitigation (CRM) techniques (i.e. collateral, guarantees and credit derivatives) for hedging the underlying exposure may be recognized for risk-based capital purposes only if the conditions outlined below are satisfied: (1) Credit risk mitigants must comply with the requirements set out in chapter 9. (2) Eligible collateral islimited to thatspecified in 9.34. Eligible collateral pledged by SPEs may be recognized. (3) Eligible guarantors are defined in 9.76. Banks may not recognize SPEs as eligible guarantors in the securitization framework. (4) Banks must transfer significant credit risk associated with the underlying exposures to third parties. (5) The instruments used to transfer credit risk may not contain terms or conditions that limit the amount of credit risk transferred, such as those

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 240 of 349 provided below: (a) Clauses that materially limit the credit protection or credit risk transference (e.g. an early amortization provision in a securitization of revolving credit facilities that effectively subordinates the bank’s interest; significant materiality thresholds below which credit protection is deemed not to be triggered even if a credit event occurs; or clauses that allow for the termination of the protection due to deterioration in the credit quality of the underlying exposures); (b) Clauses that require the originating bank to alter the underlying exposure to improve the pool’s average credit quality; (c) Clauses that increase the banks’ cost of credit protection in response to deterioration in the pool’s quality; (d) Clauses that increase the yield payable to parties other than the originating bank, such as investors and third-party providers of credit enhancements, in response to a deterioration in the credit quality of the reference pool; and (e) Clauses that provide for increases in a retained first-loss position or credit enhancement provided by the originating bank after the transaction’s inception. (6) A bank should obtain legal opinion that confirms the enforceability of the contract. (7) Clean-up calls must satisfy the conditions set out in 18.28. 18.26 A securitization transaction is deemed to fail the operational requirements set out in 18.24 or 18.25 if the bank (1) Originates/sponsors a securitization transaction that includes one or more revolving credit facilities, and (2) The securitization transaction incorporates an early amortization or similar provision that, if triggered, would (a) Subordinate the bank’ssenior or pari passu interest in the underlying revolving credit facilities to the interest of other investors;

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 241 of 349 (b) Subordinate the bank’s subordinated interest to an even greater degree relative to the interests of other parties; or (c) In other ways increases the bank’s exposure to losses associated with the underlying revolving credit facilities. 18.27 If a securitization transaction contains one of the following examples of an early amortization provision and meetsthe operational requirements set forth in 18.24 or 18.25, an originating bank may exclude the underlying exposures associated with such a transaction from the calculation of risk-weighted assets, but must still hold regulatory capital against any securitization exposures they retain in connection with the transaction: (1) Replenishment structures where the underlying exposures do not revolve and the early amortization ends the ability of the bank to add new exposures; (2) Transactions of revolving credit facilities containing early amortization features that mimic term structures (i.e. where the risk on the underlying revolving credit facilities does not return to the originating bank) and where the early amortization provision in a securitization of revolving credit facilities does not effectively result in subordination of the originator’s interest; (3) Structures where a bank securitizes one or more revolving credit facilities and where investors remain fully exposed to future drawdowns by borrowers even after an early amortization event has occurred; or (4) The early amortization provision is solely triggered by events not related to the performance of the underlying assets or the selling bank, such as material changes in tax laws or regulations. 18.28 For securitization transactions that include a clean-up call, no capital will be required due to the presence of a clean-up call if the following conditions are met: (1) The exercise of the clean-up call must not be mandatory, in form or in substance, but rather must be at the discretion of the originating bank;

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 242 of 349 (2) The clean-up call must not be structured to avoid allocating losses to credit enhancements or positions held by investors or otherwise structured to provide credit enhancement; and (3) The clean-up call must only be exercisable when 10% or less of the original underlying portfolio or securities issued remains, or, for synthetic securitizations, when 10% or less of the original reference portfolio value remains. 18.29 Securitization transactions that include a clean-up call that does not meet all of the criteria stated in 18.28 above result in a capital requirement for the originating bank. For a traditional securitization, the underlying exposures must be treated as if they were not securitized. Additionally, banks must not recognize in regulatory capital any gain on sale, in accordance with SAMA Circular No. 341000015689, Date: 19 December 2012. For synthetic securitizations, the bank purchasing protection must hold capital against the entire amount of the securitized exposures as if they did not benefit from any credit protection. If a synthetic securitization incorporates a call (other than a clean-up call) that effectively terminates the transaction and the purchased credit protection on a specific date, the bank must treat the transaction in accordance with 18.65. 18.30 If a clean-up call, when exercised, is found to serve as a credit enhancement, the exercise of the clean-up call must be considered a form of implicit support provided by the bank and must be deducted from regulatory capital. Due diligence requirements 18.31 For a bank to use the risk weight approaches of the securitization framework, it must have the information specified in 18.32 to 18.34. Otherwise, the bank must assign a 1250% risk weight to any securitization exposure for which it cannot perform the required level of due diligence.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 243 of 349 18.32 As a general rule, a bank must, on an ongoing basis, have a comprehensive understanding of the risk characteristics of its individual securitization exposures, whether on- or off-balance sheet, as well as the risk characteristics of the pools underlying its securitization exposures. 18.33 Banks must be able to access performance information on the underlying pools on an ongoing basis in a timely manner. Such information may include, as appropriate: exposure type; percentage of loans 30, 60 and 90 days past due; default rates; prepayment rates; loans in foreclosure; property type; occupancy; average credit score or other measures of credit worthiness; average loan-to- value ratio; and industry and geographical diversification. For resecuritizations, banks should have information not only on the underlying securitization tranches, such as the issuer name and credit quality, but also on the characteristics and performance of the pools underlying the securitization tranches. 18.34 A bank must have a thorough understanding of all structural features of a securitization transaction that would materially impact the performance of the bank’s exposures to the transaction, such as the contractual waterfall and waterfall-related triggers, credit enhancements, liquidity enhancements, market value triggers, and deal-specific definitions of default.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 244 of 349 Calculation of capital requirements and risk-weighted assets 18.35 Regulatory capital is required for banks’ securitization exposures, including those arising from the provision of credit risk mitigants to a securitization transaction, investments in asset-backed securities, retention of a subordinated tranche, and extension of a liquidity facility or credit enhancement, as set forth in the following sections. Repurchased securitization exposures must be treated as retained securitization exposures. 18.36 For the purposes of the expected loss (EL) provision calculation set out in chapter 15, securitization exposures do not contribute to the EL amount. Similarly, neither general nor specific provisions against securitization exposures or underlying assets still held on the balance sheet of the originator are to be included in the measurement of eligible provisions. However, originator banks can offset 1250% risk-weighted securitization exposures by reducing the securitization exposure amount by the amount of their specific provisions on underlying assets of that transaction and non-refundable purchase price discounts on such underlying assets. Specific provisions on securitization exposures will be taken into account in the calculation of the exposure amount, as defined in 18.19 and 18.20. General provisions on underlying securitized exposures are not to be taken into account in any calculation. 18.37 The risk-weighted asset amount of a securitization exposure is computed by multiplying the exposure amount by the appropriate risk weight determined in accordance with the hierarchy of approaches in 18.41 to 18.48. Risk weight caps for senior exposures in accordance with 18.50 and 18.51 or overall caps in accordance with 18.52 to 18.55 may apply. Overlapping exposures will be risk-weighted as defined in 18.38 and 18.40. 18.38 For the purposes of calculating capital requirements, a bank’s exposure A overlaps another exposure B if in all circumstances the bank will preclude any loss for the bank on exposure B by fulfilling its obligations with respect to exposure A. For example, if a bank provides full credit support to some notes and holds a portion of these notes, its full credit support obligation precludes any loss from its exposure to the notes. If a bank can verify that fulfilling its obligations with respect to exposure A will preclude a loss from

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 245 of 349 its exposure to B under any circumstance, the bank does not need to calculate risk-weighted assets for its exposure B. 18.39 To arrive at an overlap, a bank may, for the purposes of calculating capital requirements, split or expand72 its exposures. For example, a liquidity facility may not be contractually required to cover defaulted assets or may not fund an ABCP programme in certain circumstances. For capital purposes, such a situation would not be regarded as an overlap to the notes issued by that ABCP conduit. However, the bank may calculate risk-weighted assetsfor the liquidity facility as if it were expanded (either in order to cover defaulted assets or in terms of trigger events) to preclude all losses on the notes. In such a case, the bank would only need to calculate capital requirements on the liquidity facility. 18.40 Overlap could also be recognized between relevant capital charges for exposures in the trading book and capital charges for exposures in the banking book, provided that the bank is able to calculate and compare the capital charges for the relevant exposures. 18.41 Securitization exposures will be treated differently depending on the type of underlying exposures and/or on the type of information available to the bank. Securitization exposures to which none of the approaches laid out in 18.42 to 18.48 can be applied must be assigned a 1250% risk weight. 18.42 A bank must use the Securitization Internal ratings-based approach (SEC￾IRBA) as described in chapter 22 for a securitization exposure of an IRB pool as defined in 18.15, unless otherwise determined by SAMA.

72 That is, splitting exposures into portions that overlap with another exposure held by the bank and other portions that do not overlap; and expanding exposures by assuming for capital purposes that obligations with respect to one of the overlapping exposures are larger than those established contractually. The latter could be done, for instance, by expanding either the trigger events to exercise the facility and/or the extent of the obligation.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 246 of 349 18.43 If a bank cannot use the SEC-IRBA, it must use the Securitization External Ratings-Based Approach (SEC-ERBA) as described in 20.1 to 20.7 for a securitization exposure to an SA pool as defined in 18.17 provided that (1) The bank is located in a jurisdiction that permits use of the SEC-ERBA and (2) The exposure has an external credit assessment that meets the operational requirements for an external credit assessment in paragraph 20.8, or there is an inferred rating that meets the operational requirements for inferred ratings in 20.9 and 20.10. 18.44 A bank operating in Saudi Arabia that permit to use the SEC-ERBA may use an Internal Assessment Approach (SEC-IAA) as described in 21.1 to 21.4 for an unrated securitization exposure (e.g. liquidity facilities and credit enhancements) to an SA pool within an ABCP programme. In order to use an SEC-IAA, a bank must have SAMA approval to use the IRB approach for non- securitization exposures. A bank should consult with SAMA on whether and when it can apply the IAA to its securitization exposures, especially where the bank can apply the IRB for some, but not all, underlying exposures. 18.45 A bank that cannot use the SEC-ERBA or an SEC-IAA for its exposure to an SApool may use the Standardized Approach (SEC-SA) as described in 19.1 to 19.15. 18.46 Securitization exposures of mixed pools: where a bank can calculate KIRB on at least 95% of the underlying exposure amounts of a securitization, the bank must apply the SEC-IRBA calculating the capital charge for the underlying pool as follows, where d is the percentage of the exposure amount of underlying exposures for which the bank can calculate KIRB over the exposure amount of all underlying exposures; and KIRB and KSA are as defined in 22.2 to 22.5 and 19.2 to 19.4, respectively: Capital charge for mixed pool = d × 𝐾𝐼𝑅𝐵 + (1− d) × 𝐾𝑆𝐴

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 247 of 349 18.47 Where the bank cannot calculate KIRB on at least 95% of the underlying exposures, the bank must use the hierarchy for securitization exposures of SA pools as set out in 18.43 to 18.45. 18.48 For resecuritization exposures, banks must apply the SEC-SA, with the adjustments in paragraph 19.16. For exposures to securitizations of non￾performing loans as defined in paragraph 23.1, banks must apply the framework with the adjustments laid out in Securitization of non-performing loans in chapter 23. 18.49 When a bank provides implicit support to a securitization, it must, at a minimum, hold capital against all of the underlying exposures associated with the securitization transaction as if they had not been securitized. Additionally, banks would not be permitted to recognize in regulatory capital any gain on sale, in accordance with SAMA Circular No. 341000015689, Date: 19 December 2012. Caps for securitization exposures 18.50 Banks may apply a “look-through” approach to senior securitization exposures, whereby the senior securitization exposure could receive a maximum risk weight equal to the exposure weighted-average risk weight applicable to the underlying exposures, provided that the bank has knowledge of the composition of the underlying exposures at all times. The applicable risk weight under the IRB framework would be calculated taking into account the expected loss portion. In particular: (1) In the case of pools where the bank uses exclusively the SA or the IRB approach, the risk weight cap for senior exposures would equal the exposure weighted-average risk weight that would apply to the underlying exposures under the SA or IRB framework, respectively. (2) In the case of mixed pools, when applying the SEC-IRBA, the SA part of the underlying pool would receive the corresponding SA risk weight, while the IRB portion would receive IRB risk weights. When applying the SEC-SA or the SEC-ERBA, the risk weight cap for senior exposures would be based on the SA exposure weighted-average risk weight of

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 248 of 349 the underlying assets, whether or not they are originally IRB. 18.51 Where the risk weight cap results in a lower risk weight than the floor risk weight of 15%, the risk weight resulting from the cap should be used. 18.52 A bank (originator, sponsor or investors) using the SEC-IRBA for a securitization exposure may apply a maximum capital requirement for the securitization exposures it holds equal to the IRB capital requirement (including the expected loss portion) that would have been assessed against the underlying exposures had they not been securitized and treated under the appropriate sections of chapters 10 to chapter 16. In the case of mixed pools, the overall cap should be calculated by adding up the capital before securitization; that is, by adding up the capital required under the general credit risk framework for the IRB and for the SA part of the underlying pool. 18.53 An originating or sponsor bank using the SEC-ERBA or SEC-SA for a securitization exposure may apply a maximum capital requirement for the securitization exposures it holds equal to the capital requirement that would have been assessed against the underlying exposures had they not been securitized. In the case of mixed pools, the overall cap should be calculated by adding up the capital before securitization; that is, by adding up the capital required under the general credit risk framework for the IRB and for the SA part of the underlying pool, respectively. The IRB part of the capital requirement includes the expected loss portion. 18.54 The maximum aggregated capital requirement for a bank's securitization exposures in the same transaction will be equal to KP * P. In order to apply a maximum capital charge to a bank's securitization exposure, a bank will need the following inputs: (1) The largest proportion of interest that the bank holds for each tranche of a given pool (P). In particular: (a) For a bank that has one or more securitization exposure(s) that reside in a single tranche of a given pool, P equals the proportion (expressed as a percentage) of securitization exposure(s) that the bank holds in that given tranche (calculated as the total nominal

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 249 of 349 amount of the bank's securitization exposure(s) in the tranche) divided by the nominal amount of the tranche. (b) For a bank that has securitization exposures that reside in different tranches of a given securitization, P equals the maximum proportion of interest across tranches, where the proportion of interest for each of the different tranches should be calculated as described above. (2) Capital charge for underlying pool (KP): (a) For an IRB pool, KP equals KIRB as defined in 22.2 to 22.13. (b) For an SA pool, KP equals KSA as defined in 19.2 to 19.5. (c) For a mixed pool, KP equals the exposure-weighted average capital charge of the underlying pool using KSA for the proportion of the underlying pool for which the bank cannot calculate KIRB, and KIRB for the proportion of the underlying pool for which a bank can calculate KIRB 18.55 In applying the capital charge cap, the entire amount of any gain on sale and credit-enhancing interest-only strips arising from the securitization transaction must be deducted in accordance with SAMA Circular No. 341000015689, Date: 19 December 2012. Treatment of credit risk mitigation for securitization exposures 18.56 A bank may recognize credit protection purchased on a securitization exposure when calculating capital requirements subject to the following: (1) Collateral recognition is limited to that permitted under the credit risk mitigation framework – in particular, paragraph 9.34 when the bank applies the SEC-ERBA or SEC-SA, and paragraph 12.7 when the bank applies the SEC-IRBA. Collateral pledged by SPEs may be recognized; (2) Credit protection provided by the entities listed in paragraph 9.75 may

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 250 of 349 berecognized. SPEs cannot be recognized as eligible guarantors; and (3) Where guarantees or credit derivatives fulfil the minimum operational conditions as specified in paragraphs 9.69 to 9.74, banks can take account of such credit protection in calculating capital requirements for securitization exposures. 18.57 When a bank provides full (or pro rata) credit protection to a securitization exposure, the bank must calculate its capital requirements as if it directly holds the portion of the securitization exposure on which it has provided credit protection (in accordance with the definition of tranche maturity given in 18.22 and 18.23). 18.58 Provided that the conditions set out in 18.56 are met, the bank buying full (or pro rata) credit protection may recognize the credit risk mitigation on the securitization exposure in accordance with the CRM framework. 18.59 In the case of tranched credit protection, the original securitization tranche will be decomposed into protected and unprotected sub-tranches:73 (1) The protection provider must calculate its capital requirement as if directly exposed to the particular sub-tranche of the securitization exposure on which it is providing protection, and as determined by the hierarchy of approaches for securitization exposures and according to 18.60 to 18.62. (2) Provided that the conditions set out in 18.56 are met, the protection buyer may recognize tranched protection on the securitization exposure. In doing so, it must calculate capital requirements for each sub-tranche separately and as follows: (a) Forthe resulting unprotected exposure(s), capital requirements will be calculated as determined by the hierarchy of approaches for securitization exposures and according to 18.60 to 18.62.

73 The envisioned decomposition is theoretical and it should not be viewed as a new securitization transaction. The resulting subtranches should not be considered resecuritisations solely due to the presence of the credit protection.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 251 of 349 (b) For the guaranteed/protected portion, capital requirements will be calculated according to the applicable CRM framework (in accordance with the definition of tranche maturity given in 18.22 and 18.23). 18.60 If, according to the hierarchy of approaches determined by 18.41 to 18.48, the bank must use the SEC-IRBA or SEC-SA, the parameters A and D should be calculated separately for each of the subtranches as if the latter would have been directly issued as separate tranches at the inception of the transaction. The value for KIRB (respectively KSA) will be computed on the underlying portfolio of the original transaction. 18.61 If, according to the hierarchy of approaches determined by 18.41 to 18.48, the bank must use the SEC-ERBA for the original securitization exposure; the relevant risk weights for the different subtranches will be calculated subject to the following: (1) For the sub-tranche of highest priority,74 the bank will use the risk weight of the original securitization exposure. (2) For a sub-tranche of lower priority: (a) Banks must infer a rating from one of the subordinated tranches in the original transaction. The risk weight of the sub-tranche of lower priority will be then determined by applying the inferred rating to the SEC- ERBA. Thickness input T will be computed for the sub￾tranche of lower priority only. (b) Should it not be possible to infer a rating the risk weight for the sub￾tranche of lower priority will be computed using the SEC-SA applying the adjustments to the determination of A and D described in 18.60 above. The risk weight for this sub-tranche will be obtained

74 ‘Sub-tranche of highest priority’ only describes the relative priority of the decomposed tranche. The calculation of the risk weight of each sub- tranche is independent from the question if this sub-tranche is protected (i.e. risk is taken by the protection provider) or is unprotected (i.e. risk is taken by the protection buyer).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 252 of 349 as the greater of (i) The risk weight determined through the application of the SEC-SA with the adjusted A, D points and (ii) The SEC-ERBA risk weight of the original securitization exposure prior to recognition of protection. 18.62 Under all approaches, a lower-priority sub-tranche must be treated as a non￾senior securitization exposure even if the original securitization exposure prior to protection qualifies as senior as defined in 18.18. 18.63 A maturity mismatch exists when the residual maturity of a hedge is less than that of the underlying exposure. 18.64 When protection is bought on a securitization exposure(s), for the purpose of setting regulatory capital against a maturity mismatch, the capital requirement will be determined in accordance with 9.10 to 9.14. When the exposures being hedged have different maturities, the longest maturity must be used. 18.65 When protection is bought on the securitized assets, maturity mismatches may arise in the context of synthetic securitizations (when, for example, a bank uses credit derivatives to transfer part or all of the credit risk of a specific pool of assetsto third parties). When the credit derivatives unwind, the transaction will terminate. This implies that the effective maturity of all the tranches of the synthetic securitization may differ from that of the underlying exposures. Banks thatsynthetically securitize exposures held on their balance sheet by purchasing tranched credit protection must treat such maturity mismatchesin the following manner: For securitization exposures that are assigned a risk weight of 1250%, maturity mismatches are not taken into account. For all other securitization exposures, the bank must apply the maturity mismatch treatment set forth in 9.10 to 9.14. When the exposures being hedged have different maturities, the longest maturity must be used.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 253 of 349 Simple, transparent and comparable securitizations: scope of and conditions for alternative treatment 18.66 Only traditional securitizations including exposures to ABCP conduits and exposures to transactions financed by ABCP conduits fall within the scope of the simple, transparent and comparable (STC) framework. Exposures to securitizations that are STC-compliant can be subject to alternative capital treatment as determined by 19.20 to 19.22, 20.11 to 20.14 and 22.27 to 22.29. 18.67 For regulatory capital purposes, the following will be considered STC￾compliant: (1) Exposures to non-ABCP, traditional securitizations that meet the criteria in 18.72 to 18.95; and (2) Exposures to ABCP conduits and/or transactions financed by ABCP conduits, where the conduit and/or transactions financed by it meet the criteria in 18.96 to 18.165. 18.68 The originator/sponsor must disclose to investors all necessary information at the transaction level to allow investors to determine whether the securitization is STC- compliant. Based on the information provided by the originator/sponsor, the investor must make its own assessment of the securitization’s STC compliance status as defined in 18.67 above, before applying the alternative capital treatment. 18.69 For retained positions where the originator has achieved significant risk transfer in accordance with 18.24, the determination shall be made only by the originator retaining the position. 18.70 STC criteria need to be met at all times. Checking the compliance with some of the criteria might only be necessary at origination (or at the time of initiating the exposure, in case of guarantees or liquidity facilities) to an STC securitization. Notwithstanding, investors and holders of the securitization positions are expected to take into account developments that may invalidate the previous compliance assessment, for example deficiencies in the frequency and content of the investor reports, in the alignment of interest, or changes in the transaction documentation at variance with relevant STC criteria.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 254 of 349 18.71 In cases where the criteria refer to underlying assets – including, but not limited to 18.94 and 18.95 and the pool is dynamic, the compliance with the criteria will be subject to dynamic checks every time that assets are added to the pool. Simple, transparent and comparable term securitizations: criteria for regulatory capital purposes 18.72 All criteria must be satisfied in order for a securitization to receive alternative regulatory capital treatment. Criterion A1: Nature of assets 18.73 In simple, transparent and comparable securitizations, the assets underlying the securitization should be credit claims or receivables that are homogeneous. In assessing homogeneity, consideration should be given to asset type, jurisdiction, legal system and currency. As more exotic asset classes require more complex and deeper analysis, credit claims or receivables should have contractually identified periodic payment streams relating to rental, 75 principal, interest, or principal and interest payments. Any referenced interest payments or discount rates should be based on commonly encountered market interest rates, 76 but should not reference complex or complicated formulae or exotic derivatives. 77 (1) For capital purposes, the “homogeneity” criterion should be assessed taking into account the following principles: (a) The nature of assets should be such that investors would not need to analyze and assess materially different legal and/or credit risk factors and risk profiles when carrying out risk analysis and due diligence checks.

75 Payments on operating and financing leases are typically considered to be rental payments rather than payments of principal and interest. 76 Commonly encountered market interest rates may include rates reflective of a lender’s cost of funds, to the extent that sufficient data are provided to investors to allow them to assess their relation to other market rates. 77 The Global Association of Risk Professionals defines an exotic instrument as a financial asset or instrument with features making it more complex than simpler, plain vanilla, products.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 255 of 349 (b) Homogeneity should be assessed on the basis of common risk drivers, including similar risk factors and risk profiles. (c) Credit claims or receivables included in the securitization should have standard obligations, in terms of rights to payments and/or income from assets and that result in a periodic and well-defined stream of payments to investors. Credit card facilities should be deemed to resultin a periodic and well-defined stream of payments to investors for the purposes of this criterion. (d) Repayment of noteholders should mainly rely on the principal and interest proceeds from the securitized assets. Partial reliance on refinancing or re-sale of the asset securing the exposure may occur provided that re-financing is sufficiently distributed within the pool and the residual values on which the transaction relies are sufficiently low and that the reliance on refinancing is thus not substantial. (2) Examples of “commonly encountered market interest rates” would include: (a) Interbank rates and rates set by monetary policy authorities, such as the London Interbank Offered Rate (Libor), the Euro Interbank Offered Rate (Euribor) and the fed funds rate; and (b) Sectoral rates reflective of a lender’s cost of funds, such as internal interest ratesthat directly reflect the market costs of a bank’s funding or that of a subset of institutions. (3) Interest rate caps and/or floors would not automatically be considered exotic derivatives.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 256 of 349 Criterion A2: Asset performance history 18.74 In order to provide investors with sufficient information on an asset class to conduct appropriate due diligence and access to a sufficiently rich data set to enable a more accurate calculation of expected loss in different stress scenarios, verifiable loss performance data, such as delinquency and default data, should be available for credit claims and receivables with substantially similar risk characteristics to those being securitized, for a time period long enough to permit meaningful evaluation by investors. Sources of and access to data and the basis for claiming similarity to credit claims or receivables being securitized should be clearly disclosed to all market participants. (1) In addition to the history of the asset class within a jurisdiction, investors should consider whether the originator, sponsor, servicer and other parties with a fiduciary responsibility to the securitization have an established performance history for substantially similar credit claims or receivables to those being securitized and for an appropriately long period of time. It is not the intention of the criteria to form an impediment to the entry of new participants to the market, but rather that investors should take into account the performance history of the asset class and the transaction parties when deciding whether to invest in a securitization. 78 (2) The originator/sponsor of the securitization, as well as the original lender who underwrites the assets, must have sufficient experience in originating exposures similar to those securitized. For capital purposes, investors must determine whether the performance history of the originator and the original lender for substantially similar claims or receivables to those being securitized has been established for an "appropriately long period of time”. This performance history must be no shorter than a period of seven years for non-retail exposures. For retail exposures, the minimum performance history is five years.

78 This “additional consideration” may form part of investors’ due diligence process, but does not form part of the criteria when determining whether a securitization can be considered “simple, transparent and comparable”.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 257 of 349 Criterion A3: Payment status 18.75 Non-performing credit claims and receivables are likely to require more complex and heightened analysis. In order to ensure that only performing credit claims and receivables are assigned to a securitization, credit claims or receivables being transferred to the securitization may not, at the time of inclusion in the pool, include obligations that are in default or delinquent or obligations for which the transferor79 or parties to the securitization80 are aware of evidence indicating a material increase in expected losses or of enforcement actions. (1) To prevent credit claims or receivables arising from credit-impaired borrowers from being transferred to the securitization, the originator or sponsor should verify that the credit claims or receivables meet the following conditions: (a) The obligor has not been the subject of an insolvency or debt restructuring process due to financial difficulties within three years priorto the date of origination;81 and (b) The obligor is not recorded on a public credit registry of persons with an adverse credit history; and, (c) The obligor does not have a credit assessment by an ECAI or a credit score indicating a significant risk of default; and (d) The credit claim or receivable is not subject to a dispute between the obligor and the original lender. (2) The assessment of these conditions should be carried out by the

79 Eg the originator or sponsor. 80 Eg the servicer or a party with a fiduciary responsibility 81 This condition would not apply to borrowers that previously had credit incidents but were subsequently removed from credit registries as a result of the borrower cleaning their records. This is the case in jurisdictions in which borrowers have the “right to be forgotten”.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 258 of 349 originator or sponsor no earlier than 45 days prior to the closing date. Additionally, at the time of this assessment, there should to the best knowledge of the originator or sponsor be no evidence indicating likely deterioration in the performance status of the credit claim or receivable. (3) Additionally, at the time of their inclusion in the pool, at least one payment should have been made on the underlying exposures, except in the case of revolving asset trust structures such as those for credit card receivables, trade receivables, and other exposures payable in a single instalment, at maturity. Criterion A4: Consistency of underwriting 18.76 Investor analysis should be simpler and more straightforward where the securitization is of credit claims or receivables that satisfy materially non￾deteriorating origination standards. To ensure that the quality of the securitized credit claims and receivables is not affected by changes in underwriting standards, the originator should demonstrate to investors that any credit claims or receivables being transferred to the securitization have been originated in the ordinary course of the originator’s business to materially non-deteriorating underwriting standards. Where underwriting standards change, the originator should disclose the timing and purpose of such changes. Underwriting standards should not be less stringent than those applied to credit claims and receivables retained on the balance sheet. These should be credit claims or receivables which have satisfied materially non￾deteriorating underwriting criteria and for which the obligors have been assessed as having the ability and volition to make timely payments on obligations; or on granular pools of obligors originated in the ordinary course of the originator’s business where expected cash flows have been modelled to meet stated obligations of the securitization under prudently stressed loan loss scenarios. (1) In all circumstances, all credit claims or receivables must be originated in accordance with sound and prudent underwriting criteria based on an assessment that the obligor has the “ability and volition to make timely payments” on its obligations.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 259 of 349 (2) The originator/sponsor of the securitization is expected, where underlying credit claims or receivables have been acquired from third parties, to review the underwriting standards (i.e. to check their existence and assess their quality) of these third parties and to ascertain that they have assessed the obligors’ “ability and volition to make timely payments on obligations”. Criterion A5: Asset selection and transfer 18.77 Whilst recognizing that credit claims or receivables transferred to a securitization will be subject to defined criteria, 82 the performance of the securitization should not rely upon the ongoing selection of assets through active management83 on a discretionary basis of the securitization’s underlying portfolio. Credit claims or receivables transferred to a securitization should satisfy clearly defined eligibility criteria. Credit claims or receivables transferred to a securitization after the closing date may not be actively selected, actively managed or otherwise cherry- picked on a discretionary basis. Investors should be able to assess the credit risk of the asset pool prior to their investment decisions. 18.78 In order to meet the principle of true sale, the securitization should effect true sale such that the underlying credit claims or receivables: (1) Are enforceable against the obligor and their enforceability isincluded in the representations and warranties of the securitization; (2) Are beyond the reach of the seller, its creditors or liquidators and are not subject to material recharacterisation or clawback risks;

82 Eg the size of the obligation, the age of the borrower or the loan-to- value of the property, debt-to-income and/or debt service coverage ratios. 83 Provided they are not actively selected or otherwise cherry-picked on a discretionary basis, the addition of credit claims or receivables during the revolving periods or their substitution or repurchasing due to the breach of representations and warranties do not represent active portfolio management.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 260 of 349 (3) Are not effected through credit default swaps, derivatives or guarantees, but by a transfer of the credit claims or the receivables to the securitization; (4) Demonstrate effective recourse to the ultimate obligation for the underlying credit claims or receivables and are not a securitization of other securitizations; and (5) For regulatory capital purposes, an independent third-party legal opinion must support the claim that the true sale and the transfer of assets under the applicable laws comply with the points under 18.78 (1) to 18.78 (4). 18.79 Securitizations employing transfers of credit claims or receivables by other means should demonstrate the existence of material obstacles preventing true sale at issuance84 and should clearly demonstrate the method of recourse to ultimate obligors.85 In such jurisdictions, any conditions where the transfer of the credit claims or receivable is delayed or contingent upon specific events and any factors affecting timely perfection of claims by the securitization should be clearly disclosed. The originator should provide representations and warranties that the credit claims or receivables being transferred to the securitization are not subject to any condition or encumbrance that can be foreseen to adversely affect enforceability in respect of collections due.

84 Eg the immediate realization of transfer tax or the requirement to notify all obligors of the transfer. 85 Eg equitable assignment, perfected contingent transfer.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 261 of 349 Criterion A6: Initial and ongoing data 18.80 To assist investors in conducting appropriate due diligence prior to investing in a new offering, sufficient loan-level data in accordance with applicable laws or, in the case of granular pools, summary stratification data on the relevant risk characteristics of the underlying pool should be available to potential investors before pricing of a securitization. To assist investors in conducting appropriate and ongoing monitoring of their investments’ performance and so that investors that wish to purchase a securitization in the secondary market have sufficient information to conduct appropriate due diligence, timely loan-level data in accordance with applicable laws or granular pool stratification data on the risk characteristics of the underlying pool and standardized investor reports should be readily available to current and potential investors at least quarterly throughout the life of the securitization. Cut-off dates of the loan-level or granular pool stratification data should be aligned with those used for investor reporting. To provide a level of assurance that the reporting of the underlying credit claims or receivables is accurate and that the underlying credit claims or receivables meet the eligibility requirements, the initial portfolio should be reviewed86 for conformity with the eligibility requirements by an appropriate legally accountable and independent third party, such as an independent accounting practice or the calculation agent or management company for the securitization.

86 The review should confirm that the credit claims or receivables transferred to the securitization meet the portfolio eligibility requirements. The review could, for example, be undertaken on a representative sample of the initial portfolio, with the application of a minimum confidence level. The verification report need not be provided but its results, including any material exceptions, should be disclosed in the initial offering documentation.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 262 of 349 Criterion B7: Redemption cash flows 18.81 Liabilities subject to the refinancing risk of the underlying credit claims or receivables are likely to require more complex and heightened analysis. To help ensure that the underlying credit claims or receivables do not need to be refinanced over a short period of time, there should not be a reliance on the sale or refinancing of the underlying credit claims or receivables in order to repay the liabilities, unless the underlying pool of credit claims or receivables is sufficiently granular and has sufficiently distributed repayment profiles. Rights to receive income from the assets specified to support redemption payments should be considered as eligible credit claims or receivables in this regard. 87 Criterion B8: Currency and interest rate asset and liability mismatches 18.82 To reduce the payment risk arising from the different interest rate and currency profiles of assets and liabilities and to improve investors’ ability to model cash flows, interest rate and foreign currency risks should be appropriately mitigated88 at all times, and if any hedging transaction is executed the transaction should be documented according to industry￾standard master agreements. Only derivatives used for genuine hedging of asset and liability mismatches of interest rate and / or currency should be allowed. (1) For capital purposes, the term “appropriately mitigated” should be understood as not necessarily requiring a completely perfect hedge. The appropriateness of the mitigation of interest rate and foreign currency through the life of the transaction must be demonstrated by making available to potential investors, in a timely and regular manner,

87 For example, associated savings plans designed to repay principal at maturity. 88 The term “appropriately mitigated” should be understood as not necessarily requiring a matching hedge. The appropriateness of hedging through the life of the transaction should be demonstrated and disclosed on a continuous basis to investors.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 263 of 349 quantitative information including the fraction of notional amounts that are hedged, as well as sensitivity analysis that illustrates the effectiveness of the hedge under extreme but plausible scenarios. (2) If hedges are not performed through derivatives, then those risk￾mitigating measures are only permitted if they are specifically created and used for the purpose of hedging an individual and specific risk, and not multiple risks at the same time (such as credit and interest rate risks). Non-derivative risk mitigation measures must be fully funded and available at all times. Criterion B9: Payment priorities and observability 18.83 To prevent investors being subjected to unexpected repayment profiles during the life of a securitization, the priorities of payments for all liabilities in all circumstances should be clearly defined at the time of securitization and appropriate legal comfort regarding their enforceability should be provided. To ensure that junior noteholders do not have inappropriate payment preference over senior noteholders that are due and payable, throughout the life of a securitization, or, where there are multiple securitizations backed by the same pool of credit claims or receivables, throughout the life of the securitization programme, junior liabilities should not have payment preference over senior liabilities which are due and payable. The securitization should not be structured as a “reverse” cash flow waterfall such that junior liabilities are paid where due and payable senior liabilities have not been paid. To help provide investors with full transparency over any changes to the cash flow waterfall, payment profile or priority of payments that might affect a securitization, all triggers affecting the cash flow waterfall, payment profile or priority of payments of the securitization should be clearly and fully disclosed both in offering documents and in investor reports, with information in the investor report that clearly identifies the breach status, the ability for the breach to be reversed and the consequences of the breach. Investor reports should contain information that allows investors to monitor the evolution over time of the indicators that are subject to triggers. Any triggers breached between

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 264 of 349 payment dates should be disclosed to investors on a timely basis in accordance with the terms and conditions of all underlying transaction documents. 18.84 Securitizationsfeaturing a replenishment period should include provisions for appropriate early amortization events and/or triggers of termination of the replenishment period, including, notably: (1) Deterioration in the credit quality of the underlying exposures; (2) A failure to acquire sufficient new underlying exposures of similar credit quality; and (3) The occurrence of an insolvency-related event with regard to the originator or the servicer. 18.85 Following the occurrence of a performance-related trigger, an event of default or an acceleration event, the securitization positions should be repaid in accordance with a sequential amortization priority of payments, in order of tranche seniority,and there should not be provisions requiring immediate liquidation of the underlying assets at market value. 18.86 To assist investors in their ability to appropriately model the cash flow waterfall of the securitization, the originator or sponsor should make available to investors, both before pricing of the securitization and on an ongoing basis, a liability cash flow model or information on the cash flow provisions allowing appropriate modelling of the securitization cash flow waterfall. 18.87 To ensure that debt forgiveness, forbearance, payment holidays and other asset performance remedies can be clearly identified, policies and procedures, definitions, remedies and actions relating to delinquency, default or restructuring of underlying debtors should be provided in clear and consistent terms, such that investors can clearly identify debt forgiveness, forbearance, payment holidays, restructuring and other asset performance remedies on an ongoing basis.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 265 of 349 Criterion B10: Voting and enforcement rights 18.88 To help ensure clarity for securitization note holders of their rights and ability to control and enforce on the underlying credit claims or receivables, upon insolvency of the originator or sponsor, all voting and enforcement rights related to the credit claims or receivables should be transferred to the securitization. Investors’ rights in the securitization should be clearly defined in all circumstances, including the rights of senior versus junior note holders. Criterion B11: Documentation disclosure and legal review 18.89 To help investors to fully understand the terms, conditions, legal and commercial information prior to investing in a new offering89 and to ensure that this information is set out in a clear and effective manner for all programmes and offerings, sufficient initial offering90 and draft underlying91 documentation should be made available to investors (and readily available to potential investors on a continuous basis) within a reasonably sufficient period of time prior to pricing, or when legally permissible, such that the investor is provided with full disclosure of the legal and commercial information and comprehensive risk factors needed to make informed investment decisions. Final offering documents should be available from the closing date and all final underlying transaction documents shortly thereafter. These should be composed such that readers can readily find, understand and use relevant information. To ensure that all the securitization’s underlying documentation has been subject to appropriate review prior to publication, the terms and documentation of the securitization should be reviewed by an appropriately experienced third party legal practice, such as a legal counsel

89 For the avoidance of doubt, any type of securitization should be allowed to fulfil the requirements of 18.894018.89 once it meets its prescribed standards of disclosure and legal review. 22 Eg offering memorandum, draft offering document or draft prospectus, such as a “red herring” 91 Eg asset sale agreement, assignment, novation or transfer agreement; servicing, backup servicing, administration and cash management agreements; trust/management deed, security deed, agency agreement, account bank agreement, guaranteed investment contract, incorporated terms or master trust framework or master definitions agreement as applicable; any relevant inter-creditor agreements, swap or derivative documentation, subordinated loan agreements, start-up loan agreements and liquidity facility agreements; and any other relevant underlying documentation, including legal opinions.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 266 of 349 already instructed by one of the transaction parties, e.g. by the arranger or the trustee. Investors should be notified in a timely fashion of any changes in such documents that have an impact on the structural risks in the securitization. Criterion B12: Alignment of interest 18.90 In order to align the interests of those responsible for the underwriting of the credit claims or receivables with those of investors, the originator or sponsor ofthe credit claims or receivables should retain a material net economic exposure and demonstrate a financial incentive in the performance of these assets following their securitization. Criterion C13: Fiduciary and contractual responsibilities 18.91 To help ensure servicers have extensive workout expertise, thorough legal and collateral knowledge and a proven track record in loss mitigation, such parties should be able to demonstrate expertise in the servicing of the underlying credit claims or receivables, supported by a management team with extensive industry experience. The servicer should at all times act in accordance with reasonable and prudent standards. Policies, procedures and risk management controls should be well documented and adhere to good market practices and relevant regulatory regimes. There should be strong systems and reporting capabilities in place. (1) In assessing whether “strong systems and reporting capabilities are in place” for capital purposes, well documented policies, procedures and risk management controls, as well as strong systems and reporting capabilities, may be substantiated by a third-party review for non￾banking entities.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 267 of 349 18.92 The party or parties with fiduciary responsibility should act on a timely basis in the best interests of the securitization note holders, and both the initial offering and all underlying documentation should contain provisions facilitating the timely resolution of conflicts between different classes of note holders by the trustees, to the extent permitted by applicable law. The party or parties with fiduciary responsibility to the securitization and to investors should be able to demonstrate sufficient skills and resources to comply with their duties of care in the administration of the securitization vehicle. To increase the likelihood that those identified as having a fiduciary responsibility towards investors as well as the servicer execute their duties in full on a timely basis, remuneration should be such that these parties are incentivized and able to meet their responsibilities in full and on a timely basis. Criterion C14: Transparency to investors 18.93 To help provide full transparency to investors, assist investors in the conduct of their due diligence and to prevent investors being subject to unexpected disruptions in cash flow collections and servicing, the contractual obligations, duties and responsibilities of all key parties to the securitization, both those with a fiduciary responsibility and of the ancillary service providers, should be defined clearly both in the initial offering and all underlying documentation. Provisions should be documented for the replacement of servicers, bank account providers, derivatives counterparties and liquidity providers in the event of failure or non- performance or insolvency or other deterioration of creditworthiness of any such counterparty to the securitization. To enhance transparency and visibility over all receipts, payments and ledger entries at all times, the performance reports to investors should distinguish and report the securitization’s income and disbursements, such as scheduled principal, redemption principal, scheduled interest, prepaid principal, past due interest and fees and charges, delinquent, defaulted and restructured amounts under debt forgiveness and payment holidays, including accurate accounting for amounts attributable to principal and interest deficiency ledgers.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 268 of 349 (1) For capital purposes, the terms “initial offering” and “underlying transaction documentation” should be understood in the context defined by 18.89. (2) The term “income and disbursements” should also be understood as including deferment, forbearance, and repurchases among the items described. Criterion D15: Credit risk of underlying exposures 18.94 At the portfolio cut-off date the underlying exposures have to meet the conditions under the Standardized Approach for credit risk, and after taking intoaccount any eligible credit risk mitigation, for being assigned a risk weight equal to or smaller than: (1) 40% on a value-weighted average exposure basis for the portfolio where the exposures are "regulatory residential real estate" exposures as defined in paragraph 7.69; (2) 50% on an individual exposure basis where the exposure is a "regulatory commercial real estate" exposure as defined in paragraph 7.70, an "other real estate" exposure as defined in paragraph 7.80 or a land ADC exposure as defined in paragraph 7.82; (3) 75% on an individual exposure basis where the exposure is a "regulatory retail" exposure, as defined in paragraph 7.57; or (4) 100% on an individual exposure basis for any other exposure. Criterion D16: Granularity of the pool 18.95 At the portfolio cut-off date, the aggregated value of all exposures to a single obligor shall not exceed 1% of the aggregated outstanding exposure value of all exposures in the portfolio. Where structurally concentrated corporate loan markets available for securitization subject to ex ante supervisory approval and only for corporate exposures, the applicable maximum concentration threshold could be increased to 2% if the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 269 of 349 originator or sponsor retains subordinated tranche(s) that form loss absorbing credit enhancement, as defined in 22.16, and which cover at least the first 10% of losses. These tranche(s) retained by the originator or sponsor shall not be eligible for the STC capital treatment. Simple, transparent and comparable short-term securitizations: criteria for regulatory capital purposes 18.96 The following definitions apply when the terms are used in 18.97 to 18.165: (1) ABCP conduit/conduit – ABCP conduit, being the special purpose vehicle which can issue commercial paper; (2) ABCP programme – the programme of commercial paper issued by an ABCP conduit; (3) Assets/asset pool – the credit claims and/or receivables underlying a transaction in which the ABCP conduit holds a beneficial interest; (4) Investor – the holder of commercial paper issued under an ABCP programme, or any type of exposure to the conduit representing a financing liability of the conduit, such as loans; (5) Obligor – borrower underlying a credit claim or a receivable that is part of anasset pool; (6) Seller – a party that: (a) Concluded (in its capacity as original lender) the original agreement that created the obligations or potential obligations (under a credit claim or a receivable) of an obligor or purchased the obligations or potential obligations from the original lender(s); and (b) Transferred those assets through a transaction or passed on the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 270 of 349 interest92 to the ABCP conduit. (7) Sponsor – sponsor of an ABCP conduit. It may also be noted that other relevant parties with a fiduciary responsibility in the management and administration of the ABCP conduit could also undertake control of some of the responsibilities of the sponsor; and (8) Transaction – An individual transaction in which the ABCP conduit holds a beneficial interest. A transaction may qualify as a securitization, but may also be a direct asset purchase, the acquisition of undivided interest in a replenishing pool of asset, a secured loan etc. 18.97 For exposures at the conduit level (e.g. exposure arising from investing in the commercial papers issued by the ABCP programme or sponsoring arrangements at the conduit/programme level), compliance with the short￾term STC capital criteria is only achieved if the criteria are satisfied at both the conduit and transaction levels. 18.98 In the case of exposures at the transaction level, compliance with the short￾term STC capital criteria is considered to be achieved if the transaction level criteria are satisfied for the transactions to which support is provided. Criterion A1: Nature of assets (conduit level) 18.99 The sponsor should make representations and warranties to investors that the criterion set out in 18.100 below are met, and explain how this is the case on an overall basis. Only if specified should this be done for each transaction. Provided that each individual underlying transaction is homogeneous in terms of asset type, a conduit may be used to finance transactions of different asset types. Programme wide credit enhancement should not prevent a conduit from qualifying for STC, regardless of whether such enhancement

92 For instance, transactions in which assets are sold to a special purpose entity sponsored by a bank’s customer and then either a security interest in the assets is granted to the ABCP conduit to secure a loan made by the ABCP conduit to the sponsored special purpose entity, or an undivided interest is sold to the ABCP conduit.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 271 of 349 technically creates resecuritisation. Criterion A1: Nature of assets (transaction level) 18.100 The assets underlying a transaction in a conduit should be credit claims or receivables that are homogeneous, in terms of asset type.93 The assets underlying each individual transaction in a conduit should not be composed of “securitization exposures” as defined in 18.4. Credit claims or receivables underlying a transaction in a conduit should have contractually identified periodic payment streams relating to rental,94 principal, interest, or principal and interest payments. Credit claims or receivables generating a single payment stream would equally qualify as eligible. Any referenced interest payments or discount rates should be based on commonly encountered market interest rates, 95 but should not reference complex or complicated formulae or exotic derivatives. 96 Additional guidance for Criterion A1 18.101 The “homogeneity” criterion should be assessed taking into account the following principles: (1) The nature of assets should be such that there would be no need to analyze and assess materially different legal and/or credit risk factors and risk profiles when carrying out risk analysis and due diligence checks for the transaction. (2) Homogeneity should be assessed on the basis of common risk drivers, including similar risk factors and risk profiles.

93 For the avoidance of doubt, this criterion does not automatically exclude securitizations of equipment leases and securitizations of auto loans and leases from the short-term STC framework. 94 Payments on operating and financing lease are typically considered to be rental payments rather than payments of principal and interest. 95 Commonly encountered market interest rates may include rates reflective of a lender’s cost of funds, to the extent sufficient data is provided to the sponsors to allow them to assess their relation to other market rates. 96 The Global Association of Risk Professionals defines an exotic instrument as a financial asset or instrument with features making it more complex than simpler, plain vanilla, products.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 272 of 349 (3) Credit claims or receivables included in the securitization should have standard obligations, in terms of rights to payments and/or income from assets and that result in a periodic and well-defined stream of payments to investors. Credit card facilities should be deemed to result in a periodic and well-defined stream of payments to investors for the purposes of this criterion. (4) Repayment of the securitization exposure should mainly rely on the principal and interest proceeds from the securitized assets. Partial reliance on refinancing or re-sale of the asset securing the exposure may occur provided that re-financing is sufficiently distributed within the pool and the residual values on which the transaction relies are sufficiently low and that the reliance on refinancing is thus not substantial. 18.102 Examples of “commonly encountered market interest rates” would include: (1) Interbank rates and rates set by monetary policy authorities, such as Libor, Euribor and the fed funds rate; and (2) Sectoral rates reflective of a lender’s cost of funds, such as internal interest rates that directly reflect the market costs of a bank’s funding or that of a subset of institutions. 18.103 Interest rate caps and/or floors would not automatically be considered exotic derivatives. 18.104 The transaction level requirement is still met if the conduit does not purchase the underlying asset with a refundable purchase price discount but instead acquires a beneficial interest in the form of a note which itself might qualify as a securitization exposure, as long as the securitization exposure is not subject to any further tranching (i.e. has the same economic characteristic as the purchase of the underlying asset with a refundable purchase price discount).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 273 of 349 Criterion A2: Asset performance history (conduit level) 18.105 In order to provide investors with sufficient information on the performance history of the asset types backing the transactions, the sponsor should make available to investors, sufficient loss performance data of claims and receivables with substantially similar risk characteristics,such as delinquency and default data of similar claims, and for a time period long enough to permit meaningful evaluation. The sponsor should disclose to investors the sources of such data and the basis for claiming similarity to credit claims or receivables financed by the conduit. Such loss performance data may be provided on a stratified basis.97 Criterion A2: Asset performance history (transaction level) 18.106 In order to provide the sponsor with sufficient information on the performance history of each asset type backing the transactions and to conduct appropriate due diligence and to have access to a sufficiently rich data set to enable a more accurate calculation of expected loss in different stress scenarios, verifiable loss performance data, such as delinquency and default data, should be available for credit claims and receivables with substantially similar risk characteristics to those being financed by the conduit, for a time period long enough to permit meaningful evaluation by the sponsor.

97 Stratified means by way of example, all materially relevant data on the conduit’s composition (outstanding balances, industry sector, obligor concentrations, maturities, etc.) and conduit’s overview and all materially relevant data on the credit quality and performance of underlying transactions, allowing investors to identify collections, and as applicable, debt restructuring, forgiveness, forbearance, payment holidays, repurchases, delinquencies and defaults.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 274 of 349 Additional requirement for Criterion A2 18.107 The sponsor of the securitization, as well as the original lender who underwrites the assets, must have sufficient experience in the risk analysis/underwriting of exposures or transactions with underlying exposures similar to those securitized. The sponsor should have well documented procedures and policies regarding the underwriting of transactions and the ongoing monitoring of the performance of the securitized exposures. The sponsor should ensure that the seller(s) and all other parties involved in the origination of the receivables have experience in originating same or similar assets, and are supported by a management with industry experience. For the purpose of meeting the short-term STC capital criteria, investors must request confirmation from the sponsor that the performance history of the originator and the original lender for substantially similar claims or receivables to those being securitized has been established for an "appropriately long period of time”. This performance history must be no shorter than a period of five years for non-retail exposures. For retail exposures, the minimum performance history is three years. Criterion A3: Asset performance history (conduit level) 18.108 The sponsor should, to the best of its knowledge and based on representations from sellers, make representations and warranties to investors that the criterion set out in 18.109 below is met with respect to each transaction.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 275 of 349 Criterion A3: Asset performance history (transaction level) 18.109 The sponsor should obtain representations from sellers that the credit claims or receivables underlying each individual transaction are not, at the time of acquisition of the interests to be financed by the conduit, in default or delinquent or subject to a material increase in expected losses or of enforcement actions. Additional requirement for Criterion A3 18.110 To prevent credit claims or receivables arising from credit-impaired borrowers from being transferred to the securitization, the original seller or sponsor should verify that the credit claims or receivables meet the following conditions for each transaction: (1) The obligor has not been the subject of an insolvency or debt restructuring process due to financial difficulties in the three years prior to the date of origination;98 (2) The obligor is not recorded on a public credit registry of persons with an adverse credit history; (3) The obligor does not have a credit assessment by an external credit assessment institution or a credit score indicating a significant risk of default; and (4) The credit claim or receivable is not subject to a dispute between the obligor and the original lender.

98 This condition would not apply to borrowers that previously had credit incidents but were subsequently removed from credit registries as a result of the borrowers cleaning their records. This is the case in jurisdictions in which borrowers have the “right to be forgotten”.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 276 of 349 18.111 The assessment of these conditions should be carried out by the original seller or sponsor no earlier than 45 days prior to acquisition of the transaction by the conduit or, in the case of replenishing transactions, no earlier than 45 days prior to new exposures being added to the transaction. In addition, at the time of the assessment, there should to the best knowledge of the original seller or sponsor be no evidence indicating likely deterioration in the performance status of the credit claim or receivable. Further, at the time of their inclusion in the pool, at least one payment should have been made on the underlying exposures, except in the case of replenishing asset trust structures such as those for credit card receivables, trade receivables, and other exposures payable in a single instalment, at maturity. Criterion A4: Consistency of underwriting (conduit level) 18.112 The sponsor should make representations and warranties to investors that: (1) It has taken steps to verify that for the transactions in the conduit, any underlying credit claims and receivables have been subject to consistent underwriting standards, and explain how. (2) When there are material changes to underwriting standards, it will receive from sellers disclosure about the timing and purpose of such changes. 18.113 The sponsor should also inform investors of the material selection criteria applied when selecting sellers (including where they are not financial institutions). Criterion A4: Consistency of underwriting (transaction level) 18.114 The sponsor should ensure that sellers (in their capacity of original lenders) intransactions with the conduit demonstrate to it that: (1) Any credit claims or receivables being transferred to or through a transaction held by the conduit have been originated in the ordinary

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 277 of 349 course of the seller’s business subject to materially non-deteriorating underwriting standards. Those underwriting standards should also not be less stringent than those applied to credit claims and receivables retained on the balance sheet of theseller and not financed by the conduit; and (2) The obligors have been assessed as having the ability and volition to make timely payments on obligations. 18.115 The sponsor should also ensure that sellers disclose to it the timing and purpose of material changes to underwriting standards. Additional requirement for Criterion A4 18.116 In all circumstances, all credit claims or receivables must be originated in accordance with sound and prudent underwriting criteria based on an assessment that the obligor has the “ability and volition to make timely payments” on its obligations. The sponsor of the securitization is expected, where underlying credit claims or receivables have been acquired from third parties, to review the underwriting standards (i.e. to check their existence and assess their quality) of these third parties and to ascertain that they have assessed the obligors’ “ability and volition to make timely payments” on their obligations. Criterion A5: Asset selection and transfer (conduit level) 18.117 The sponsor should: (1) Provide representations and warranties to investors about the checks, in nature and frequency, it has conducted regarding enforceability of underlying assets. (2) Disclose to investors the receipt of appropriate representations and warranties from sellers that the credit claims or receivables being transferred to the transactions in the conduit are not subject to any condition or encumbrance that can be foreseen to adversely affect

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 278 of 349 enforceability in respect of collections due. Criterion A5: Asset selection and transfer (transaction level) 18.118 The sponsor should be able to assess thoroughly the credit risk of the asset pool prior to its decision to provide full support to any given transaction or to the conduit. The sponsor should ensure that credit claims or receivables transferred to or through a transaction financed by the conduit: (1) Satisfy clearly defined eligibility criteria; and (2) Are not actively selected after the closing date, actively managed99 or otherwise cherry-picked on a discretionary basis.

99 Provided they are not actively selected or otherwise cherry picked on a discretionary basis, the addition of credit claims or receivables during the replenishment periods or their substitution or repurchasing due to the breach of representations and warranties do not represent active portfolio management.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 279 of 349 18.119 The sponsor should ensure that the transactions in the conduit effect true sale such that the underlying credit claims or receivables: (1) Are enforceable against the obligor; (2) Are beyond the reach of the seller, its creditors or liquidators and are not subject to material re-characterization or clawback risks; (3) Are not effected through credit default swaps, derivatives or guarantees, but by a transfer100 of the credit claims or the receivables to the transaction; and (4) Demonstrate effective recourse to the ultimate obligation for the underlying credit claims or receivables and are not a re-securitization position. 18.120 The sponsor should ensure that in applicable jurisdictions, for conduits employing transfers of credit claims or receivables by other means, sellers can demonstrate to it the existence of material obstacles preventing true sale at issuance (e.g. the immediate realization of transfer tax or the requirement to notify all obligors of the transfer) and should clearly demonstrate the method of recourse to ultimate obligors (e.g. equitable assignment, perfected contingent transfer). In such jurisdictions, any conditions where the transfer of the credit claims or receivables is delayed or contingent upon specific events and any factors affecting timely perfection of claims by the conduit should be clearly disclosed. 18.121 The sponsor should ensure that it receives from the individual sellers (either in their capacity as original lender or servicer) representations and warranties that the credit claims or receivables being transferred to or through the transaction are not subject to any condition or encumbrance that can be foreseen to adversely affect enforceability in respect of

100 This requirement should not affect jurisdictions whose legal frameworks provide for a true sale with the same effects as described above, but by means other than a transfer of the credit claims or receivables.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 280 of 349 collections due. Additional requirement for Criterion A5 18.122 An in-house legal opinion or an independent third-party legal opinion must support the claim that the true sale and the transfer of assets under the applicable laws comply with 18.118 (1) and 18.118 (2) at the transaction level. Criterion A6: Initial and ongoing data (conduit level) 18.123 To assist investors in conducting appropriate due diligence prior to investing in a new programme offering, the sponsor should provide to potential investors sufficient aggregated data that illustrate the relevant risk characteristics of the underlying asset pools in accordance with applicable laws. To assist investors in conducting appropriate and ongoing monitoring of their investments’ performance and so that investors who wish to purchase commercial paper have sufficient information to conduct appropriate due diligence, the sponsor should provide timely and sufficient aggregated data that provide the relevant risk characteristics of the underlying pools in accordance with applicable laws. The sponsor should ensure that standardized investor reports are readily available to current and potential investors at least monthly. Cut off dates of the aggregated data should be aligned with those used for investor reporting.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 281 of 349 Criterion A6: Initial and ongoing data (transaction level) 18.124 The sponsor should ensure that the individual sellers (in their capacity of servicers) provide it with: (1) Sufficient asset level data in accordance with applicable laws or, in the case of granular pools, summary stratification data on the relevant risk characteristics of the underlying pool before transferring any credit claims or receivables to such underlying pool. (2) Timely asset level data in accordance with applicable laws or granular pool stratification data on the risk characteristics of the underlying pool on an ongoing basis. Those data should allow the sponsor to fulfil its fiduciary duty at the conduit level in terms of disclosing information to investors including the alignment of cut off dates of the asset level or granular pool stratification data with those used for investor reporting. 18.125 The seller may delegate some of these tasks and, in this case, the sponsor should ensure that there is appropriate oversight of the outsourced arrangements. Additional requirement for Criterion A6 18.126 The standardized investor reports which are made readily available to current and potential investors at least monthly should include the following information: (1) Materially relevant data on the credit quality and performance of underlying assets, including data allowing investors to identify dilution, delinquencies and defaults, restructured receivables, forbearance, repurchases, losses, recoveries and other asset performance remedies in the pool; (2) The form and amount of credit enhancement provided by the seller and sponsor at transaction and conduit levels, respectively; (3) Relevant information on the support provided by the sponsor; and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 282 of 349 (4) The status and definitions of relevant triggers (such as performance, termination or counterparty replacement triggers). Criterion B7: Full support (conduit level only) 18.127 The sponsor should provide the liquidity facility(ies) and the credit protection support101 for any ABCP programme issued by a conduit. Such facility(ies) and support should ensure that investors are fully protected against credit risks, liquidity risks and any material dilution risks of the underlying asset pools financed by the conduit. As such, investors should be able to rely on the sponsorto ensure timely and full repayment of the commercial paper. Additional requirement for Criterion B7 18.128 While liquidity and credit protection support at both the conduit level and transaction level can be provided by more than one sponsor, the majority of the support (assessed in terms of coverage) has to be made by a single sponsor (referred to as the “main sponsor”). 102 An exception can however be made for a limited period of time, where the main sponsor has to be replaced due to a material deterioration in its credit standing.

101 A sponsor can provide full support either at ABCP programme level or at transaction level, i.e. by fully supporting each transaction within an ABCP programme. 102 “Liquidity and credit protection support” refers to support provided by the sponsors. Any support provided by the seller is excluded.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 283 of 349 18.129 The full support provided should be able to irrevocably and unconditionally pay the ABCP liabilities in full and on time. The list of risks provided in 18.127 that have to be covered is not comprehensive but rather provides typical examples. 18.130 Under the terms of the liquidity facility agreement: (1) Upon specified events affecting its creditworthiness, the sponsor shall be obliged to collateralize its commitment in cash to the benefit of the investorsor otherwise replace itself with another liquidity provider. (2) If the sponsor does not renew its funding commitment for a specific transaction or the conduit in its entirety, the sponsor shall collateralize its commitments regarding a specific transaction or, if relevant, to the conduit in cash at the latest 30 days prior to the expiration of the liquidity facility,and no new receivables should be purchased under the affected commitment. 18.131 The sponsor should provide investors with full information about the terms of the liquidity facility (facilities) and the credit support provided to the ABCP conduit and the underlying transactions (in relation to the transactions, redacted where necessary to protect confidentiality). Criterion B8: Redemption cash flow (transaction level only) 18.132 Unless the underlying pool of credit claims or receivables is sufficiently granular and has sufficiently distributed repayment profiles, the sponsor should ensure that the repayment of the credit claims or receivables underlying any of the individual transactions relies primarily on the general ability and willingness of the obligor to pay rather than the possibility that the obligor refinances or sells the collateral and that such repayment does not primarily rely on the drawing of an external liquidity facility provided to this transaction.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 284 of 349 Additional requirement for Criterion B8 18.133 Sponsors cannot use support provided by their own liquidity and credit facilitiestowards meeting this criterion. For the avoidance of doubt, the requirement that the repayment shall not primarily rely on the drawing of an external liquidity facility does not apply to exposures in the form of the notes issued by the ABCP conduit. Criterion B9: Currency and interest rate asset and liability mismatches (conduit level) 18.134 The sponsor should ensure that any payment risk arising from different interest rate and currency profiles not mitigated at transaction-level or arising at conduit level is appropriately mitigated. The sponsor should also ensure that derivative are used for genuine hedging purposes only and that hedging transactions are documented according to industry-standard master agreements. The sponsor should provide sufficient information to investors to allow them to assess how the payment risk arising from the different interest rate and currency profiles of assets and liabilities are appropriately mitigated, whether at the conduit or at transaction level. Criterion B9: Currency and interest rate asset and liability mismatches (transaction level) 18.135 To reduce the payment risk arising from the different interest rate and currency profiles of assets and liabilities, if any, and to improve the sponsor’s ability to analyze cash flows of transactions, the sponsor should ensure that interest rate and foreign currency risks are appropriately mitigated. The sponsor should also ensure that derivatives are used for genuine hedging purposes only and that hedging transactions are documented according to industry-standard master agreements.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 285 of 349 Additional requirement for Criterion B9 18.136 The term “appropriately mitigated” should be understood as not necessarily requiring a completely perfect hedge. The appropriateness of the mitigation of interest rate and foreign currency risks through the life of the transaction must be demonstrated by making available, in a timely and regular manner, quantitative information including the fraction of notional amounts that are hedged, as well as sensitivity analysis that illustrates the effectiveness of the hedge under extreme but plausible scenarios. The use of risk-mitigating measures other than derivatives is permitted only if the measures are specifically created and used for the purpose of hedging an individual and specific risk. Non-derivative risk mitigation measures must be fully funded and available at all times. Criterion B10: Payment priorities and observability (conduit level) 18.137 The commercial paper issued by the ABCP programme should not include extension options or other features which may extend the final maturity of the asset-backed commercial paper, where the right of trigger does not belong exclusively to investors. The sponsor should: (1) Make representations and warranties to investors that the criterion set out in 18.138 to 18.143 is met and in particular, that it has the ability to appropriately analyze the cash flow waterfall for each transaction which qualifies as a securitization; and (2) Make available to investors a summary (illustrating the functioning) of these waterfalls and of the credit enhancement available at programme level and transaction level. Criterion B10: Payment priorities and observability (transaction level) 18.138 To prevent the conduit from being subjected to unexpected repayment profiles from the transactions, the sponsor should ensure that priorities of payments are clearly defined at the time of acquisition of the interests in

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 286 of 349 these transactions by the conduit; and appropriate legal comfort regarding the enforceability is provided. 18.139 For all transactions which qualify as a securitization, the sponsor should ensure that all triggers affecting the cash flow waterfall, payment profile or priority of payments are clearly and fully disclosed to the sponsor both in the transactions’ documentation and reports, with information in the reports that clearly identifies any breach status, the ability for the breach to be reversed and the consequences of the breach. Reports should contain information that allows sponsors to easily ascertain the likelihood of a trigger being breached or reversed. Any triggers breached between payment dates should be disclosed to sponsors on a timely basis in accordance with the terms and conditions of the transaction documents. 18.140 For any of the transactions where the beneficial interest held by the conduit qualifies as a securitization position, the sponsor should ensure that any subordinated positions do not have inappropriate payment preference over payments to the conduit (which should always rank senior to any other position) and which are due and payable. 18.141 Transactions featuring a replenishment period should include provisions for appropriate early amortization events and/or triggers of termination of the replenishment period, including, notably, deterioration in the credit quality of the underlying exposures; a failure to replenish sufficient new underlying exposures of similar credit quality; and the occurrence of an insolvency related event with regard to the individual sellers. 18.142 To ensure that debt forgiveness, forbearance, payment holidays, restructuring, dilution and other asset performance remedies can be clearly identified, policies and procedures, definitions, remedies and actions relating to delinquency, default, dilution or restructuring of underlying debtors should be provided in clear and consistent terms, such that the sponsor can clearly identify debt forgiveness, forbearance, payment holidays, restructuring, dilution and other asset performance remedies on an ongoing basis. 18.143 For each transaction which qualifies as a securitization, the sponsor should ensure it receives both before the conduit acquires a beneficial interest in the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 287 of 349 transaction and on an ongoing basis, the liability cash flow analysis or information on the cash flow provisions allowing appropriate analysis of the cash flow waterfall of these transactions. Criterion B11: Voting and enforcement rights (conduit level) 18.144 To provide clarity to investors, the sponsor should make sufficient information available in order for investors to understand their enforcement rights on the underlying credit claims or receivables in the event of insolvency of the sponsor. Criterion B11: Voting and enforcement rights (transaction level) 18.145 For each transaction, the sponsor should ensure that, in particular upon insolvency of the seller or where the obligor is in default on its obligation, all voting and enforcement rights related to the credit claims or receivables are, if applicable: (1) Transferred to the conduit; and (2) Clearly defined under all circumstances, including with respect to the rights of the conduit versus other parties with an interest (e.g. sellers), where relevant. Criterion B12: Documentation, disclosure and legal review (conduitlevel only) 18.146 To help investors understand fully the terms, conditions, and legal information prior to investing in a new programme offering and to ensure that this information is set out in a clear and effective manner for all programme offerings, the sponsor should ensure that sufficient initial offering documentation for the ABCP programme is provided to investors (and readily available to potential investors on a continuous basis) within a reasonably sufficient period of time prior to issuance, such that the investor is provided with full disclosure of the legal information and comprehensive risk factors

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 288 of 349 needed to make informed investment decisions. These should be composed such that readers can readily find, understand and use relevant information. 18.147 The sponsor should ensure that the terms and documentation of a conduit and the ABCP programme it issues are reviewed and verified by an appropriately experienced and independent legal practice prior to publication and in the case of material changes. The sponsor should notify investors in a timely fashion of any changes in such documents that have an impact on the structural risks in the ABCP programme. Additional requirement for Criterion B12 18.148 To understand fully the terms, conditions and legal information prior to including a new transaction in the ABCP conduit and ensure that this information is set out in a clear and effective manner, the sponsor should ensure that it receives sufficient initial offering documentation for each transaction and that it is provided within a reasonably sufficient period of time prior to the inclusion in the conduit, with full disclosure of the legal information and comprehensive risk factors needed to supply liquidity and/or credit support facilities. The initial offering document for each transaction should be composed such that readers can readily find, understand and use relevant information. The sponsor should also ensure that the terms and documentation of a transaction are reviewed and verified by an appropriately experienced and independent legal practice prior to the acquisition of the transaction and in the case of material changes. Criterion B13: Alignment of interest (conduit level only) 18.149 In order to align the interests of those responsible for the underwriting of the credit claims and receivables with those of investors, a material net economic exposure should be retained by the sellers or the sponsor at transaction level, orby the sponsor at the conduit level. Ultimately, the sponsor should disclose to investors how and where a material net economic exposure is retained by the seller at transaction level or by the sponsor at transaction or conduit level, and demonstrate the existence of a financial incentive in the performance of the assets.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 289 of 349 Criterion B14: Cap on maturity transformation (conduit level only) 18.150 Maturity transformation undertaken through ABCP conduits should be limited. The sponsor should verify and disclose to investors that the weighted average maturity of all the transactions financed under the ABCP conduit is three years or less. This number should be calculated as the higher of: (1) The exposure-weighted average residual maturity of the conduit’s beneficial interests held or the assets purchased by the conduit in order to finance the transactions of the conduit103; and (2) The exposure-weighted average maturity of the underlying assets financed by the conduit calculated by: (a) Taking an exposure-weighted average of residual maturities of the underlying assets in each pool; and (b) Taking an exposure-weighted average across the conduit of the pool-level averages as calculated in Step 2a. 104 Criterion C15: Financial institution (conduit level only) 18.151 The sponsor should be a financial institution that is licensed to take deposits from the public, and is subject to appropriate prudential standards and levels of supervision. Criterion C16: Fiduciary and contractual responsibilities (conduit level) 18.152 The sponsorshould, based on the representations received from seller(s) and all other parties responsible for originating and servicing the asset pools,

103 Including purchased securitization notes, loans, asset-backed deposits and purchased credit claims and/or receivables held directly on the conduit’s balance sheet. 104 Where it is impractical for the sponsor to calculate the pool-level weighted average maturity in Step 2a (because the pool is very granular or dynamic), sponsors may instead use the maximum maturity of the assets in the pool as defined in the legal agreements governing the pool (e.g. investment guidelines).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 290 of 349 make representations and warranties to investors that: (1) The various criteria defined at the level of each underlying transaction are met, and explain how; (2) Seller(s)’s policies, procedures and risk management controls are well￾documented, adhere to good market practices and comply with the relevant regulatory regimes; and that strong systems and reporting capabilities are in place to ensure appropriate origination and servicing of the underlying assets. 18.153 The sponsor should be able to demonstrate expertise in providing liquidity and credit support in the context of ABCP conduits, and is supported by a management team with extensive industry experience. The sponsor should at all times act in accordance with reasonable and prudent standards. Policies, procedures and risk management controls of the sponsor should be well documented and the sponsor should adhere to good market practices and relevant regulatory regime. There should be strong systems and reporting capabilities in place at the sponsor. The party or parties with fiduciary responsibility should act on a timely basis in the best interests of the investors. Criterion C16: Fiduciary and contractual responsibilities (transaction level) 18.154 The sponsor should ensure that it receives representations from the sellers(s) and all other parties responsible for originating and servicing the asset pools that they: (1) Have well-documented procedures and policies in place to ensure appropriate servicing of the underlying assets; (2) Have expertise in the origination of same or similar assets to those in the asset pools; (3) Have extensive servicing and workout expertise, thorough legal and collateral knowledge and a proven track record in loss mitigation for the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 291 of 349 same or similar assets; (4) Have expertise in the servicing of the underlying credit claims or receivables;and (5) Are supported by a management team with extensive industry experience. Additional requirement for Criterion C16 18.155 In assessing whether “strong systems and reporting capabilities are in place”, well documented policies, procedures and risk management controls, as well as strong systems and reporting capabilities, may be substantiated by a third￾party review for sellers that are non-banking entities. Criterion C17: Transparency to investors (conduit level) 18.156 The sponsor should ensure that the contractual obligations, duties and responsibilities of all key parties to the conduit, both those with a fiduciary responsibility and the ancillary service providers, are defined clearly both in the initial offering and any relevant underlying documentation of the conduit and the ABCP programme it issues. The “underlying documentation” does not refer to the documentation of the underlying transactions. 18.157 The sponsor should also make representations and warranties to investors that the duties and responsibilities of all key parties are clearly defined at transaction level. 18.158 The sponsorshould ensure that the initial offering documentation disclosed to investors contains adequate provisions regarding the replacement of key counterparties of the conduit (e.g. bank account providers and derivatives counterparties) in the event of failure or non-performance or insolvency or deterioration of creditworthiness of any such counterparty. 18.159 The sponsor should also make representations and warranties to investors that provisions regarding the replacement of key counterparties at transaction level are well-documented. 18.160 The sponsor should provide sufficient information to investors about the liquidity facility(ies) and credit support provided to the ABCP programme for them to understand its functioning and key risks.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 292 of 349 Criterion C17: Transparency to investors (transaction level) 18.161 The sponsor should conduct due diligence with respect to the transactions on behalf of the investors. To assist the sponsor in meeting its fiduciary and contractual obligations, the duties and responsibilities of all key parties to all transactions (both those with a fiduciary responsibility and of the ancillary service providers) should be defined clearly in all underlying documentation of these transactions and made available to the sponsor. 18.162 The sponsor should ensure that provisions regarding the replacement of key counterparties (in particular the servicer or liquidity provider) in the event of failure or non-performance or insolvency or other deterioration of any such counterparty for the transactions are well-documented (in the documentation of these individual transactions). 18.163 The sponsor should ensure that for all transactions the performance reports include all of the following: the transactions’ income and disbursements, such as scheduled principal, redemption principal, scheduled interest, prepaid principal, past due interest and fees and charges, delinquent, defaulted, restructured and diluted amounts, as well as accurate accounting for amounts attributable to principal and interest deficiency ledgers. Criterion D18: Credit risk of underlying exposures (transaction level only) 18.164 At the date of acquisition of the assets, the underlying exposures have to meet the conditions under the Standardized Approach for credit risk and, after account is taken of any eligible credit risk mitigation, be assigned a risk weight equal to or smaller than: (1) 40% on a value-weighted average exposure basis for the portfolio where the exposures are "regulatory residential real estate" exposures as defined in paragraph 7.69; (2) 50% on an individual exposure basis where the exposure is a "regulatory commercial real estate" exposure as defined in paragraph 7.70, an "other real estate" exposure as defined in paragraph 7.80 or a land ADC exposure as defined in paragraph 7.82;

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 293 of 349 (3) 75% on an individual exposure basis where the exposure is a "regulatory retail" exposure as defined in paragraph 7.57; or (4) 100% on an individual exposure basis for any other exposure. Criterion D19: Granularity of the pool (conduit level only) 18.165 At the date of acquisition of any assets securitized by one of the conduits' transactions, the aggregated value of all exposures to a single obligor at that date shall not exceed 2% of the aggregated outstanding exposure value of all exposures in the programme. Where structurally concentrated corporate loan markets, subject to ex ante supervisory approval and only for corporate exposures, the applicable maximum concentration threshold could be increased to 3% if the sellers or sponsor retain subordinated tranche(s) that form loss-absorbing credit enhancement, as defined in 22.16,

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 294 of 349 19. Securitization: standardized approach Standardized approach (SEC-SA) 19.1 To calculate capital requirements for a securitization exposure to a standardized approach (SA) pool using the securitization standardized approach (SEC-SA), a bank would use a supervisory formula and the following bank-supplied inputs: the SA capital charge had the underlying exposures not been securitized (𝐾𝑆𝐴); the ratio of delinquent underlying exposures to total underlying exposures in the securitization pool (𝑊); the tranche attachment point (A); and the tranche detachment point (D). The inputs A and D are defined in paragraphs 22.14 and 22.15 respectively. Where the only difference between exposures to a transaction is related to maturity, A and D will be the same. 𝐾𝑆𝐴 and 𝑊 are defined in 19.2 to 19.4 and 19.6. 19.2 𝐾𝑆𝐴 is defined as the weighted-average capital charge of the entire portfolio of underlying exposures, calculated using the risk-weighted asset amounts in chapter 7 in relation to the sum of the exposure amounts of underlying exposures, multiplied by 8%. This calculation should reflect the effects of any credit risk mitigant that is applied to the underlying exposures (either individually or to the entire pool), and hence benefits all of the securitization exposures. 𝐾𝑆𝐴 is expressed as a decimal between zero and one (that is, a weighted-average risk weight of 100% means that 𝐾𝑆𝐴 would equal 0.08). 19.3 For structures involving a special purpose entity (SPE), all of the SPE’s exposures related to the securitization are to be treated as exposures in the pool. Exposures related to the securitization that should be treated as exposures in the pool include assets in which the SPE may have invested, comprising reserve accounts, cash collateral accounts and claims against counterparties resulting from interest swaps or currency swaps.105 Notwithstanding, the bank can exclude the SPE’s exposures from the pool for capital calculation purposes if the bank can demonstrate to SAMA that

105 In particular, in the case of swaps other than credit derivatives, the numerator of KSA must include the positive current market value times the risk weight of the swap provider times 8%. In contrast, the denominator should not take into account such a swap, as such a swap would not provide a credit enhancement to any tranche.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 295 of 349 the risk does not affect its particular securitization exposure or that the risk is immaterial – for example, because it has been mitigated.106 19.4 In the case of funded synthetic securitizations, any proceeds of the issuances of credit-linked notes or other funded obligations of the SPE that serve as collateral for the repayment of the securitization exposure in question, and for which the bank cannot demonstrate to SAMA that they are immaterial, have to be included in the calculation of 𝐾𝑆𝐴 if the default risk of the collateral is subject to the tranched loss allocation.107 19.5 In cases where a bank has set aside a specific provision or has a non￾refundable purchase price discount on an exposure in the pool, 𝐾𝑆𝐴 must be calculated using the gross amount of the exposure without the specific provision and/or non- refundable purchase price discount. 19.6 The variable 𝑊 equals the ratio of the sum of the nominal amount of delinquent underlying exposures (as defined in paragraph 20.7 below) to the nominal amount of underlying exposures. 19.7 Delinquent underlying exposures are underlying exposures that are 90 days or more past due, subject to bankruptcy or insolvency proceedings, in the process of foreclosure, held as real estate owned, or in default, where default is defined within the securitization deal documents. 19.8 The inputs 𝐾𝑆𝐴 and 𝑊 are used as inputs to calculate 𝐾𝐴, as follows: 𝐾𝐴 = (1 − 𝑊) × 𝐾𝑆𝐴 + 0.5𝑊 19.9 In case a bank does not know the delinquency status, as defined above, for no more than 5% of underlying exposures in the pool, the bank may still use

106 Certain best market practices can eliminate or at least significantly reduce the potential risk from a default of a swap provider. Examples of such features could be cash collateralization of the market value in combination with an agreement of prompt additional payments in case of an increase of the market value of the swap and minimum credit quality of the swap provider with the obligation to post collateral or present an alternative swap provider without any costs for the SPE in the event of a credit deterioration on the part of the original swap provider. If SAMA are satisfied with these risk mitigants and accept that the contribution of these exposures to the risk of the holder of a securitization exposure is insignificant, SAMA may allow the bank to exclude these exposures from the KSA calculation. 107 As in the case of swaps other than credit derivatives, the numerator of KSA (i.e. weighted-average capital charge of the entire portfolio of underlying exposures) must include the exposure amount of the collateral times its risk weight times 8%, but the denominator should be calculated without recognition of the collateral.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 296 of 349 the SEC-SA by adjusting its calculation of 𝐾𝐴 as follows: 𝐾 𝐴=[ 𝐸𝐴𝐷𝑠𝑢𝑏𝑝𝑜𝑜𝑙 1 𝑤ℎ𝑒𝑟𝑒 𝑊 𝑘𝑛𝑜𝑤𝑛 𝐸𝐴𝐷 𝑇𝑜𝑡𝑎𝑙 ×𝐾𝐴 𝑠𝑢𝑏𝑝𝑜𝑜𝑙 1 𝑤ℎ𝑒𝑟𝑒 𝑊 𝑘𝑛𝑜𝑤𝑛]+ 𝐸𝐴𝐷𝑠𝑢𝑏𝑝𝑜𝑜𝑙 2 𝑤ℎ𝑒𝑟𝑒 𝑊 𝑢𝑛𝑘𝑛𝑜𝑤𝑛 𝐸𝐴𝐷 𝑇𝑜𝑡𝑎𝑙 19.10 If the bank does not know the delinquency status for more than 5%, the securitization exposure must be risk weighted at 1250%. 19.11 Capital requirements are calculated under the SEC-SA as follows, where KSSFA(KA) isthe capital requirement per unit of the securitization exposure and the variables a, u, and l are defined as: (1) 𝑎 = – (1 / (𝑝 ∗ 𝐾𝐴 )) (2) 𝑢 = 𝐷 – 𝐾𝐴 (3) 𝑙 = 𝑚𝑎𝑥 (𝐴 – 𝐾𝐴 ; 0) 19.12 The supervisory parameter p in the context of the SEC-SA is set equal to 1 for a securitization exposure that is not a resecuritization exposure. 19.13 The risk weight assigned to a securitization exposure when applying the SEC-SA would be calculated as follows: (1) When D for a securitization exposure is less than or equal to KA, the exposure must be assigned a risk weight of 1250%. (2) When A for a securitization exposure is greater than or equal to KA, the risk weight of the exposure, expressed as a percentage, would equal KSSFA(𝐾𝐴) times 12.5. (3) When A is less than KA and D is greater than KA, the applicable risk weight is a weighted average of 1250% and 12.5 times KSSFA(𝐾𝐴) according

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 297 of 349 to the following formula: 19.14 The risk weight for market risk hedgessuch as currency or interest rate swaps will be inferred from a securitization exposure that is pari passu to the swaps or, if such an exposure does not exist, from the next subordinated tranche. 19.15 The resulting risk weight is subject to a floor risk weight of 15%. Moreover, when a bank applies the SEC-SA to an unrated junior exposure in a transaction where the more senior tranches (exposures) are rated and therefore no rating can be inferred for the junior exposure, the resulting risk weight under SEC-SA for the junior unrated exposure shall not be lower than the risk weight for the next more senior rated exposure. Resecuritisation exposures 19.16 For resecuritization exposures, banks must apply the SEC-SA specified in 19.1 to 19.15, with the following adjustments: (1) The capital requirement of the underlying securitization exposures is calculated using the securitization framework; (2) Delinquencies (W) are set to zero for any exposure to a securitization tranchein the underlying pool; and (3) The supervisory parameter p is set equal to 1.5, rather than 1 as for securitization exposures. 19.17 If the underlying portfolio of a resecuritization consists in a pool of exposures to securitization tranches and to other assets, one should separate the exposures to securitization tranches from exposures to assets that are not securitizations. The KA parameter should be calculated for each subset individually, applying separate W parameters; these calculated in accordance with 19.6 and 19.7 in the subsets where the exposures are to assets that are not securitization tranches, and set to zero where the exposures are to securitization tranches. The KA for the resecuritization exposure is then obtained as the nominal exposure weighted- average of the KA’s for each

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 298 of 349 subset considered. 19.18 The resulting risk weight is subject to a floor risk weight of 100%. 19.19 The caps described in 18.50 to 18.55 cannot be applied to resecuritization exposures. Alternative capital treatment for term STC securitizations and short- term STC securitizations meeting the STC criteria for capital purposes 19.20 Securitization transactions that are assessed as simple, transparent and comparable (STC)-compliant for capital purposes as defined in 18.67 can be subject to capital requirements under the securitization framework, taking into account that, when the SEC-SA is used, 19.21 and 19.22 are applicable instead of 19.12 and 19.15 respectively. 19.21 The supervisory parameter p in the context of the SEC-SA is set equal to 0.5 for an exposure to an STC securitization. 19.22 The resulting risk weight is subject to a floor risk weight of 10% for senior tranches, and 15% for non-senior tranches.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 299 of 349 20. Securitization: External- ratings-based approach (SEC- ERBA) External-ratings-based approach (SEC-ERBA) 20.1 For securitization exposures that are externally rated, or for which an inferred rating is available, risk-weighted assets under the securitization external ratings- based approach (SEC-ERBA) will be determined by multiplying securitization exposure amounts (as defined in 18.19) by the appropriate risk weights as determined by 19.2 to 19.7, provided that the operational criteria in 20.8 to 20.10 are met.108 20.2 For exposures with short-term ratings, or when an inferred rating based on a short-term rating is available, the following risk weights in table 28 below will apply: ERBA risk weights for short-term ratings Table 28 External credit assessment A-1/P-1 A-2/P-2 A-3/P-3 All other ratings Risk weight 15% 50% 100% 1250% 20.3 For exposures with long-term ratings, or when an inferred rating based on a long-term rating is available, the risk weights depend on (1) The external rating grade or an available inferred rating; (2) The seniority of the position; (3) The tranche maturity; and (4) In the case of non-senior tranches, the tranche thickness. 20.4 Specifically, for exposures with long-term ratings, risk weights will be determined according to Table 29 and will be adjusted for tranche maturity (calculated according to 18.22 and 18.23), and tranche thickness for non￾senior tranches according to 20.5.

108 The rating designations used in Tables 28 and 29 are for illustrative purposes only and do not indicate any preference for, or endorsement of, any particular external assessment system.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 300 of 349 ERBA risk weights for long-term ratings Table 29 Rating Senior tranche Non-senior (thin) tranche Tranche maturity (MT) Tranche maturity (MT) 1 year 5 years 1 year 5 years AAA 15% 20% 15% 70% AA+ 15% 30% 15% 90% AA 25% 40% 30% 120% AA- 30% 45% 40% 140% A+ 40% 50% 60% 160% A 50% 65% 80% 180% A- 60% 70% 120% 210% BBB+ 75% 90% 170% 260% BBB 90% 105% 220% 310% BBB- 120% 140% 330% 420% BB+ 140% 160% 470% 580% BB 160% 180% 620% 760% BB- 200% 225% 750% 860% B+ 250% 280% 900% 950% B 310% 340% 1050% 1050% B- 380% 420% 1130% 1130% CCC+/CCC/CCC- 460% 505% 1250% 1250% Below CCC- 1250% 1250% 1250% 1250%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 301 of 349 20.5 The risk weight assigned to a securitization exposure when applying the SEC-ERBA is calculated as follows: (1) To account for tranche maturity, banks shall use linear interpolation between the risk weights for one and five years. (2) To account for tranche thickness, banks shall calculate the risk weight for non- senior tranches as follows, where T equals tranche thickness, and is measured a minus A, as defined, respectively, in 22.15 and 22.14 : 20.6 In the case of market risk hedges such as currency or interest rate swaps, the risk weight will be inferred from a securitization exposure that is pari passu to the swaps or, ifsuch an exposure does not exist, from the nextsubordinated tranche. 20.7 The resulting risk weight is subject to a floor risk weight of 15%. In addition, the resulting risk weight should never be lower than the risk weight corresponding to a senior tranche of the same securitization with the same rating and maturity. Operational requirements for use of external credit assessments 20.8 The following operational criteria concerning the use of external credit assessments apply in the securitization framework: (1) To be eligible for risk-weighting purposes, the external credit assessment must take into account and reflect the entire amount of credit risk exposure the bank has with regard to all payments owed to it. For example, if a bank is owed both principal and interest, the assessment must fully take into account and reflect the credit risk associated with timely repayment of both principal and interest. (2) The external credit assessments must be from an eligible external credit assessment institution (ECAI) as recognized by SAMA in accordance with SAMA Circular No. BCS 242, Date: 11 April 2007 (Mapping of

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 302 of 349 Credit Assessment Ratings Provided by Eligible External Credit Assessment Institution to Determine Risk Weighted Exposures) as outlined in chapter 8 with the following exception. In contrast with 8.3 (3), an eligible credit assessment, procedures, methodologies, assumptions and the key elements underlying the assessments must be publicly available, on a non-selective basis and free of charge.109 In other words, a rating must be published in an accessible form and included in the ECAI’s transition matrix. Also, loss and cash flow analysis as well as sensitivity of ratings to changes in the underlying rating assumptions should be publicly available. Consequently, ratings that are made available only to the parties to a transaction do not satisfy this requirement. (3) Eligible ECAIs must have a demonstrated expertise in assessing securitizations, which may be evidenced by strong market acceptance. (4) Where two or more eligible ECAIs can be used and these assess the credit risk ofthe same securitization exposure differently, paragraph 8.8 will apply. (5) Where credit risk mitigation (CRM) is provided to specific underlying exposures or the entire pool by an eligible guarantor as defined in chapter 9 and is reflected in the external credit assessment assigned to a securitization exposure(s), the risk weight associated with that external credit assessment should be used. In order to avoid any double-counting, no additional capital recognition is permitted. If the CRM provider is not recognized as an eligible guarantor under chapter 9, the covered securitization exposures should be treated as unrated. (6) In the situation where a credit risk mitigant solely protects a specific securitization exposure within a given structure (e.g. asset-backed security tranche) and this protection is reflected in the external credit

109Where the eligible credit assessment is not publicly available free of charge, the ECAI should provide an adequate justification, within its own publicly available code of conduct, in accordance with the “comply or explain” nature of the International Organization of Securities Commissions’ Code of Conduct Fundamentals for Credit Rating Agencies.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 303 of 349 assessment, the bank must treat the exposure as if it is unrated and then apply the CRM treatment outlined in chapter 9 or in the foundation internal ratings-based (IRB) approach of chapters 10 to 16, to recognize the hedge. (7) A bank is not permitted to use any external credit assessment for risk￾weighting purposes where the assessment is at least partly based on unfunded support provided by the bank. For example, if a bank buys asset- backed commercial paper (ABCP) where it provides an unfunded securitization exposure extended to the ABCP programme (e.g. liquidity facility or credit enhancement), and that exposure plays a role in determining the credit assessment on the ABCP, the bank must treat the ABCP as if it were not rated. The bank must continue to hold capital against the other securitization exposures it provides (e.g. against the liquidity facility and/or credit enhancement). Operational requirements for inferred ratings 20.9 In accordance with the hierarchy of approaches determined in 18.41 to 18.47, a bank must infer a rating for an unrated position and use the SEC-ERBA provided that the requirements set out in 20.10 are met. These requirements are intended to ensure that the unrated position is pari passu or senior in all respects to an externally-rated securitization exposure termed the “reference securitization exposure”. 20.10 The following operational requirements must be satisfied to recognize inferred ratings: (1) The reference securitization exposure (e.g. asset-backed security) must rank pari passu or be subordinate in all respects to the unrated securitization exposure. Credit enhancements, if any, must be taken into account when assessing the relative subordination of the unrated exposure and the reference securitization exposure. For example, if the reference securitization exposure benefits from any third-party guarantees or other credit enhancements that are not available to the unrated exposure, then the latter may not be assigned an inferred rating based on the reference securitization exposure.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 304 of 349 (2) The maturity of the reference securitization exposure must be equal to or longer than that of the unrated exposure. (3) On an ongoing basis, any inferred rating must be updated continuously to reflect any subordination of the unrated position or changes in the external rating of the reference securitization exposure. (4) The external rating of the reference securitization exposure must satisfy the general requirements for recognition of external ratings as delineated in 20.8. Alternative capital treatment for term STC securitizations and short- term STC securitizations meeting the STC criteria for capital purposes 20.11 Securitization transactions that are assessed as simple, transparent and comparable (STC)-compliant for capital purposes as defined in 18.67 can be subject to capital requirements under the securitization framework, taking into account that, when the SEC-ERBA is used, 20.12, 20.13, and 20.14 are applicable instead of 20.2, 20.4 and 20.7 respectively. 20.12 For exposures with short-term ratings, or when an inferred rating based on a short-term rating is available, the following risk weights in table 30 below will apply: ERBA STC risk weights for short-term ratings Table 30 External credit assessment A-1/P-1 A-2/P-2 A-3/P-3 All other ratings Risk weight 10% 30% 60% 1250% 20.13 For exposures with long-term ratings, risk weights will be determined according to Table 31 and will be adjusted for tranche maturity (calculated according to 18.22 and 18.23), and tranche thickness for non-senior tranches according to 20.5 and 20.6.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 305 of 349 ERBA STC risk weights for long-term ratings Table 31 Rating Senior tranche Non-senior (thin) tranche Tranche maturity (MT) Tranche maturity (MT) 1 year 5 years 1 year 5 years AAA 10% 10% 15% 40% AA+ 10% 15% 15% 55% AA 15% 20% 15% 70% AA- 15% 25% 25% 80% A+ 20% 30% 35% 95% A 30% 40% 60% 135% A- 35% 40% 95% 170% BBB+ 45% 55% 150% 225% BBB 55% 65% 180% 255% BBB- 70% 85% 270% 345% BB+ 120% 135% 405% 500% BB 135% 155% 535% 655% BB- 170% 195% 645% 740% B+ 225% 250% 810% 855% B 280% 305% 945% 945% B- 340% 380% 1015% 1015% CCC+/CCC/CCC- 415% 455% 1250% 1250% Below CCC- 1250% 1250% 1250% 1250% 20.14 The resulting risk weight is subject to a floor risk weight of 10% for senior tranches, and 15% for non-senior tranches.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 306 of 349 21. Securitization: Internal assessment approach (SEC- IAA) Internal assessment approach (SEC-IAA) 21.1 In the event that banks have securitization exposures where the IAA treatment applies, banks shall notify SAMA of the transactions and seek approval to apply the IAA treatment. Subject to SAMA approval, a bank may use its internal assessments of the credit quality of its securitization exposures extended to ABCP programmes (e.g. liquidity facilities and credit enhancements) provided that the bank has at least one approved IRB model (which does not need to be applicable to the securitized exposures) and if the bank's internal assessment process meets the operational requirements set out below. Internal assessments of exposures provided to ABCP programmes must be mapped to equivalent external ratings of an ECAI. Those rating equivalents are used to determine the appropriate risk weights under the SEC￾ERBA for the exposures. 21.2 A bank's internal assessment process must meet the following operational requirements in order to use internal assessments in determining the IRB capital requirement arising from liquidity facilities, credit enhancements, or other exposures extended to an ABCP programme: (1) For the unrated exposure to qualify for the internal assessment approach (SEC-IAA), the ABCP must be externally rated. The ABCP itself is subject to the SEC-ERBA. (2) The internal assessment of the credit quality of a securitization exposure to the ABCP programme must be based on ECAI criteria for the asset type purchased, and must be the equivalent of at least investment grade when initially assigned to an exposure. In addition, the internal assessment must be used in the bank's internal risk management processes, including management information and economic capital systems, and generally must meet all the relevant requirements of the IRB framework. (3) In order for banks to use the SEC-IAA, SAMA must be satisfied

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 307 of 349 (a) That the ECAI meets the ECAI eligibility criteria outlined in chapter 8 and (b) With the ECAI rating methodologies used in the process. (4) Banks demonstrate to the satisfaction of SAMA how these internal assessments correspond to the relevant ECAI's standards. For instance, when calculating the credit enhancement level in the context of the SEC￾IAA, SAMA may, if warranted, disallow on a full or partial basis any seller- provided recourse guarantees or excess spread, or any other first￾loss credit enhancements that provide limited protection to the bank. (5) The bank's internal assessment process must identify gradations of risk. Internal assessments must correspond to the external ratings of ECAIs. (6) The bank's internal assessment process, particularly the stress factors for determining credit enhancement requirements, must be at least as conservative as the publicly available rating criteria of the major ECAIs that are externally rating the ABCP programme's commercial paper for the asset type being purchased by the programme. However, banks should consider,to some extent, all publicly available ECAI rating methodologies in developing their internal assessments. (a) In the case where the commercial paper issued by an ABCP programme is externally rated by two or more ECAIs and the different ECAIs' benchmark stress factors require different levels of credit enhancementto achieve the same external rating equivalent, the bank must apply the ECAI stress factor that requires the most conservative or highest level of credit protection. For example, if one ECAI required enhancement of 2.5 to 3.5 times historical losses for an asset type to obtain a single A rating equivalent and another required two to three times historical losses, the bank must use the higher range of stress factors in determining the appropriate level of seller-provided credit enhancement. (b) When selecting ECAIs to externally rate an ABCP, a bank must not

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 308 of 349 choose only those ECAIs that generally have relatively less restrictive rating methodologies. In addition, if there are changes in the methodology of one of the selected ECAIs, including the stress factors, that adversely affect the external rating of the programme's commercial paper, then the revised rating methodology must be considered in evaluating whether the internal assessments assigned to ABCP programme exposures are in need of revision. (c) A bank cannot utilize an ECAI's rating methodology to derive an internal assessment if the ECAI's process or rating criteria are not publicly available. However, banks should consider the non-publicly available methodology - to the extent that they have access to such information -in developing their internal assessments, particularly if it is more conservative than the publicly available criteria. (d) In general, if the ECAI rating methodologies for an asset or exposure are not publicly available, then the IAA may not be used. However, in certain instances - for example, for new or uniquely structured transactions, which are not currently addressed by the rating criteria of an ECAI rating the programme's commercial paper - a bank may discuss the specific transaction with SAMA to determine whether the IAA may be applied to the related exposures. (7) Internal or external auditors, an ECAI, or the bank's internal credit review or risk management function must perform regular reviews of the internal assessment process and assess the validity of those internal assessments. If the bank's internal audit, credit review or risk management functions perform the reviews of the internal assessment process, then these functions must be independent of the ABCP programme business line, as well as the underlying customer relationships. (8) The bank must track the performance of itsinternal assessments over time to evaluate the performance of the assigned internal assessments and make adjustments, as necessary, to its assessment process when the performance of the exposures routinely diverges from the assigned

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 309 of 349 internal assessments on those exposures. (9) The ABCP programme must have credit and investment guidelines, i.e. underwriting standards, for the ABCP programme. In the consideration of an asset purchase, the ABCP programme (i.e. the programme administrator) should develop an outline of the structure of the purchase transaction. Factors that should be discussed include the type of asset being purchased; type and monetary value of the exposures arising from the provision of liquidity facilities and credit enhancements; loss waterfall; and legal and economic isolation of the transferred assets from the entity selling the assets. (10) A credit analysis of the asset seller's risk profile must be performed and should consider, for example, past and expected future financial performance; current market position; expected future competitiveness; leverage, cash flow and interest coverage; and debt rating. In addition, a review of the seller's underwriting standards, servicing capabilities and collection processes should be performed. (11) The ABCP programme's underwriting policy must establish minimum asset eligibility criteria that, among other things: (a) Exclude the purchase of assets that are significantly past due or defaulted; (b) Limit excess concentration to individual obligor or geographical area; and (c) Limit the tenor of the assets to be purchased. (12) The ABCP programme should have collection processes established that consider the operational capability and credit quality of the servicer. The programme should mitigate to the extent possible seller/servicer risk through various methods, such as triggers based on current credit quality that would preclude commingling of funds and impose lockbox arrangements that would help ensure the continuity of payments to the ABCP programme.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 310 of 349 (13) The aggregate estimate of loss on an asset pool that the ABCP programme is considering purchasing must consider all sources of potential risk, such as credit and dilution risk. If the seller-provided credit enhancement is sized based on only credit-related losses, then a separate reserve should be established for dilution risk, if dilution risk is material for the particular exposure pool. In addition, in sizing the required enhancement level, the bank should review several years of historical information, including losses, delinquencies, dilutions and the turnover rate of the receivables. Furthermore, the bank should evaluate the characteristics of the underlying asset pool (e.g. weighted-average credit score) and should identify any concentrations to an individual obligor or geographical region and the granularity of the asset pool. (14) The ABCP programme must incorporate structural features into the purchase of assets in order to mitigate potential credit deterioration of the underlying portfolio. Such features may include wind-down triggers specific to a pool of exposures. 21.3 The exposure amount of the securitization exposure to the ABCP programme must be assigned to the risk weight in the SEC-ERBA appropriate to the credit rating equivalent assigned to the bank's exposure. 21.4 If a bank's internal assessment process is no longer considered adequate, SAMA may preclude the bank from applying the SEC-IAA to its ABCP exposures, both existing and newly originated, for determining the appropriate capital treatment until the bank has remedied the deficiencies. In this instance, the bank must revert to the SEC-SA described in 19.1 to 19.15.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 311 of 349 22. Securitization: Internal- ratings-based approach Internal ratings-based approach (SEC-IRBA) 22.1 To calculate capital requirements for a securitization exposure to an internal ratings-based (IRB) pool, a bank must use the securitization internal ratings￾based approach (SEC-IRBA) and the following bank-supplied inputs: the IRB capital charge had the underlying exposures not been securitized (KIRB), the tranche attachment point (A), the tranche detachment point (D) and the supervisory parameter p, as defined below. Where the only difference between exposures to a transaction is related to maturity, A and D will be the same. Definition of KIRB 22.2 KIRB is the ratio of the following measures, expressed in decimal form (e.g. a capital charge equal to 15% of the pool would be expressed as 0.15): (1) The IRB capital requirement (including the expected loss portion and, where applicable, dilution risk as discussed in paragraphs 22.11 to 22.13 below) for the underlying exposures in the pool; to (2) The exposure amount of the pool (e.g. the sum of drawn amounts related to securitized exposures plus the exposure-at-default associated with undrawn commitments related to securitized exposures).110 111

110 KIRB must also include the unexpected loss and the expected loss associated with defaulted exposures in the underlying pool. 111 Undrawn balances should not be included in the calculation of KIRB in cases where only the drawn balances of revolving facilities have been securitized.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 312 of 349 22.3 Notwithstanding the clarification in paragraphs 18.46 and 18.47 for mixed pools, 22.2 (1) must be calculated in accordance with applicable minimum IRB standards in chapters 10 to 16 as if the exposures in the pool were held directly by the bank. This calculation should reflect the effects of any credit risk mitigant that is applied on the underlying exposures (either individually or to the entire pool), and hence benefits all of the securitization exposures. 22.4 For structures involving a special purpose entity (SPE), all of the SPE's exposures related to the securitization are to be treated as exposures in the pool. Exposures related to the securitization that should be treated as exposures in the pool could include assets in which the SPE may have invested a reserve account, such as a cash collateral account or claims against counterparties resulting from interestswaps or currency swaps. 112 Notwithstanding, the bank can exclude the SPE's exposures from the pool for capital calculation purposes if the bank can demonstrate to SAMA that the risk of the SPE's exposures is immaterial (for example, because it has been mitigated113) or that it does not affect the bank's securitization exposure.

112 In particular, in the case of swaps other than credit derivatives, the numerator of KIRB must include the positive current market value times the risk weight of the swap provider times 8%. In contrast, the denominator should not take into account such a swap, as such a swap would not provide a credit enhancement to any tranche. 113 Certain best market practices can eliminate or at least significantly reduce the potential risk from a default of a swap provider. Examples of such features could be: cash collateralization of the market value in combination with an agreement of prompt additional payments in case of an increase of the market value of the swap; and minimum credit quality of the swap provider with the obligation to post collateral or present an alternative swap provider without any costs for the SPE in the event of a credit deterioration on the part of the original swap provider. If SAMA are satisfied with these risk mitigants and accept that the contribution of these exposures to the risk of the holder of a securitization exposure is insignificant, SAMA may allow the bank to exclude these exposures from the KIRB calculation.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 313 of 349 22.5 In the case of funded synthetic securitizations, any proceeds of the issuances of credit-linked notes or other funded obligations of the SPE that serve as collateral for the repayment of the securitization exposure in question and for which the bank cannot demonstrate to SAMA that it is immaterial must be included in the calculation of KIRB if the default risk of the collateral is subject to the tranched loss allocation. 114 22.6 To calculate KIRB, the treatment for eligible purchased receivables described in paragraphs 10.25 to 10.29, 14.2 to 14.7, 16.106, 16.108, 16.112 to 16.120 may be used, with the particularities specified in 22.7 to 22.9, if, according to IRB minimum requirements: (1) For non-retail assets, it would be an undue burden on a bank to assess the default risk of individual obligors; and (2) For retail assets, a bank is unable to primarily rely on internal data. 22.7 22.6 above applies to any securitized exposure, not just purchased receivables. For this purpose, "eligible purchased receivables" should be understood as referring to any securitized exposure for which the conditions of paragraph 22.6 are met, and "eligible purchased corporate receivables" should be understood as referring to any securitized non-retail exposure. All other IRB minimum requirements must be met by the bank. 22.8 SAMA may deny the use of a top-down approach, as defined in 14.8 (1), for eligible purchased receivables for securitized exposures depending on the bank's compliance with minimum requirements. 22.9 The requirements to use a top-down approach for the eligible purchased receivables are generally unchanged when applied to securitizations except in the following cases: (1) The requirement in paragraph 10.30 for the bank to have a claim on all proceeds from the pool of receivables or a pro-rata interest in the

114 As in the case of swaps other than credit derivatives, the numerator of K IRB (i.e. quantity 22.2(1)) must include the exposure amount of the collateral times its risk weight times 8%, but the denominator should be calculated without recognition of the collateral.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 314 of 349 proceeds does not apply. Instead, the bank must have a claim on all proceeds from the pool of securitized exposures that have been allocated to the bank's exposure in the securitization in accordance with the terms of the related securitization documentation; (2) In paragraph 16.113, the purchasing bank should be interpreted as the bank calculating KIRB; (3) In paragraphs 16.115 to 16.120 "a bank" should be read as "the bank estimating probability of default, loss-given-default (LGD) or expected loss for the securitized exposures"; and (4) If the bank calculating KIRB cannot itself meet the requirements in paragraphs 16.115 to 16.119, it must instead ensure that it meets these requirements through a party to the securitization acting for and in the interest of the investors in the securitization, in accordance with the terms of the related securitization documents. Specifically, requirements for effective control and ownership must be met for all proceeds from the pool of securitized exposures that have been allocated to the bank's exposure to the securitization. Further, in paragraph 16.117 (1), the relevant eligibility criteria and advancing policies are those of the securitization, not those of the bank calculating KIRB. 22.10 In cases where a bank has set aside a specific provision or has a non￾refundable purchase price discount on an exposure in the pool, the quantities defined in paragraphs 22.2 (1) and 22.2 (2) must be calculated using the gross amount of the exposure without the specific provision and/or non￾refundable purchase price discount. 22.11 Dilution risk in a securitization must be recognized if it is not immaterial, as demonstrated by the bank to SAMA (see paragraph 14.8), whereby the provisions of paragraphs 22.2 to 22.5 shall apply.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 315 of 349 22.12 Where default and dilution risk are treated in an aggregate manner (e.g. an identical reserve or overcollateralization is available to cover losses for both risks), in order to calculate capital requirements for the securitization exposure, a bank must determine KIRB for dilution risk and default risk, respectively, and combine them into a single KIRB prior to applying the SEC￾IRBA. 22.13 In certain circumstances, pool level credit enhancement will not be available to cover losses from either credit risk or dilution risk. In the case of separate waterfalls for credit risk and dilution risk, a bank should consult with SAMA as to how the capital calculation should be performed. Definition of attachment point (A), detachment point (D) and supervisory parameter (p) 22.14 The input A represents the threshold at which losses within the underlying poolwould first be allocated to the securitization exposure. This input, which is a decimal value between zero and one, equals the greater of (1) zero and (2) The ratio of (a) The outstanding balance of all underlying assets in the securitization minus the outstanding balance of all tranches that rank senior or pari passu to the tranche that contains the securitization exposure of the bank (including the exposure itself) to (b) The outstanding balance of all underlying assets in the securitization.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 316 of 349 22.15 The input D represents the threshold at which losses within the underlying pool result in a total loss of principal for the tranche in which a securitization exposure resides. This input, which is a decimal value between zero and one, equals the greater of (1) zero and (2) The ratio of (a) The outstanding balance of all underlying assets in the securitization minus the outstanding balance of all tranches that rank senior to the tranche that contains the securitization exposure of the bank to (b) The outstanding balance of all underlying assets in the securitization. 22.16 For the calculation of A and D, overcollateralization and funded reserve accounts must be recognized as tranches; and the assets forming these reserve accounts must be recognized as underlying assets. Only the loss￾absorbing part of the funded reserve accounts that provide credit enhancement can be recognized as tranches and underlying assets. Unfunded reserve accounts, such as those to be funded from future receipts from the underlying exposures (e.g. unrealized excess spread) and assets that do not provide credit enhancement like pure liquidity support, currency or interest￾rate swaps, or cash collateral accounts related to these instruments must not be included in the above calculation of A and D. Banks should take into consideration the economic substance of the transaction and apply these definitions conservatively in the light of the structure.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 317 of 349 22.17 The supervisory parameter p in the context of the SEC-IRBA is expressed as follows, where: (1) 0.3 denotes the p-parameter floor; (2) N is the effective number of loans in the underlying pool, calculated as described in 22.20; (3) KIRB is the capital charge of the underlying pool (as defined in 22.2 to 22.5); (4) LGD is the exposure-weighted average loss-given-default of the underlying pool, calculated as described in 22.21); (5) MT is the maturity of the tranche calculated according to 18.22 and 18.23; and (6) The parameters A, B, C, D, and E are determined according to Table 32: Look-up table for supervisory parameters A, B, C, D and E Table 32 A B C D E Wholesale Senior, granular (N≥25) 0 3.56 -1.85 0.55 0.07 Senior, non-granular (N<25) 0.11 2.61 -2.91 0.68 0.07 Non-senior, granular (N≥25) 0.16 2.87 -1.03 0.21 0.07 Non-senior, non￾granular (N<25) 0.22 2.35 -2.46 0.48 0.07 Retail Senior 0 0 -7.48 0.71 0.24 Non-senior 0 0 -5.78 0.55 0.27

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 318 of 349 22.18 If the underlying IRB pool consists of both retail and wholesale exposures, the pool should be divided into one retail and one wholesale subpool and, for each subpool, a separate p-parameter (and the corresponding input parameters N, KIRB and LGD) should be estimated. Subsequently, a weighted average p-parameter for the transaction should be calculated on the basis of the p-parameters of each subpool and the nominal size of the exposures in each subpool. 22.19 If a bank applies the SEC-IRBA to a mixed pool as described in 18.46 and 18.47, the calculation of the p-parameter should be based on the IRB underlying assets only. The SA underlying assetsshould not be considered for this purpose. 22.20 The effective number of exposures, N, is calculated as follows, where EADi represents the exposure-at-default associated with the ith instrument in the pool. Multiple exposures to the same obligor must be consolidated (i.e. treated as a single instrument). 22.21 The exposure-weighted average LGD is calculated as follows, where LGDi represents the average LGD associated with all exposures to the ith obligor. When default and dilution risks for purchased receivables are treated in an aggregate manner (e.g. a single reserve or overcollateralization is available to cover losses from either source) within a securitization, the LGD input must be constructed as a weighted average of the LGD for default risk and the 100% LGD for dilution risk.The weights are the stand-alone IRB capital charges for default risk and dilution risk, respectively.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 319 of 349 22.22 Under the conditions outlined below, banks may employ a simplified method for calculating the effective number of exposures and the exposure-weighted average LGD. Let Cm in the simplified calculation denote the share of the pool corresponding to the sum of the largest m exposures (e.g. a 15% share corresponds to a value of 0.15). The level of m is set by each bank. (1) If the portfolio share associated with the largest exposure, C1 , is no more than 0.03 (or 3% of the underlying pool), then for purposes of the SEC-IRBA the bank may set LGD as 0.50 and N equal to the following amount: (2) Alternatively, if only C1 is available and this amount is no more than 0.03, then the bank may set LGD as 0.50 and N as 1/C1 . Calculation of risk weight 22.23 The formulation of the SEC-IRBA is expressed as follows, where: (1) is the capital requirement per unit of securitization exposure under the SEC-IRBA, which is a function of three variables; (2) The constant e is the base of the natural logarithm (which equals 2.71828); (3) The variable a is defined as -(1 / (p * KIRB)); (4) The variable u is defined as D - KIRB; and (5) The variable l is defined as the maximum of A - KIRB and zero.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 320 of 349 22.24 The risk weight assigned to a securitization exposure when applying the SEC￾IRBA is calculated as follows: (1) When D for a securitization exposure is less than or equal to KIRB, the exposure must be assigned a risk weight of 1250%. (2) When A for a securitization exposure is greater than or equal to KIRB, the risk weight of the exposure, expressed as a percentage, would equal times 12.5. (3) When A is less than KIRB and D is greater than KIRB, the applicable risk weight is a weighted average of 1250% and 12.5 times according to thefollowing formula: 22.25 The risk weight for market risk hedges such as currency or interest rate swaps will be inferred from a securitization exposure that is pari passu to the swaps or, if such an exposure does not exist, from the next subordinated tranche. 22.26 The resulting risk weight is subject to a floor risk weight of 15%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 321 of 349 Alternative capital treatment for term securitizations and short-term securitizations meeting the STC criteria for capital purposes 22.27 Securitization transactions that are assessed as simple, transparent and comparable (STC)-compliant for capital purposes in 18.67 can be subject to capital requirements under the securitization framework, taking into account that, when the SEC-IRBA is used, 22.28 and 22.29 are applicable instead of 22.17 and 22.26 respectively. 22.28 The supervisory parameter p in SEC-IRBA for an exposure to an STC securitization is expressed as follows, where: (1) 0.3 denotes the p-parameter floor; (2) N isthe effective number of loansin the underlying pool, calculated as described in 22.20; (3) KIRB is the capital charge of the underlying pool (as defined in 22.2 to 22.5); (4) LGD is the exposure-weighted average loss-given-default of the underlying pool, calculated as described in 22.21; (5) MT is the maturity of the tranche calculated according to 18.22 and 18.23; and (6) The parameters A, B, C, D, and E are determined according to Table 33:

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 322 of 349 Look-up table for supervisory parameters A, B, C, D and E Table 33 A B C D E Wholesale Senior, granular (N≥25) 0 3.56 -1.85 0.55 0.07 Senior, non-granular (N<25) 0.11 2.61 -2.91 0.68 0.07 Non-senior, granular (N≥25) 0.16 2.87 -1.03 0.21 0.07 Non-senior, non￾granular (N<25) 0.22 2.35 -2.46 0.48 0.07 Retail Senior 0 0 -7.48 0.71 0.24 Non-senior 0 0 -5.78 0.55 0.27 22.29 The resulting risk weight is subject to a floor risk weight of 10% for senior tranches, and 15% for non-senior tranches.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 323 of 349 23. Securitizations of non- performing loans Securitization of non-performing loans 23.1 A non-performing loan securitization (NPL securitization) means a securitization where the underlying pool's variable W, as defined in 19.6, is equal to or higher than 90% at the origination cut-off date and at any subsequent date on which assets are added to or removed from the underlying pool due to replenishment, restructuring or any other relevant reason. The underlying pool of exposures of an NPL securitization may only comprise loans, loan-equivalent financial instruments or tradable instruments used for the sole purpose of loan subparticipation as referred to in 18.24 (2). Loan-equivalent financial instruments include, for example, bonds not listed on a trading venue. For the avoidance of doubt, an NPL securitization may not be backed by exposures to other securitizations. 23.2 SAMA may provide for a stricter definition of NPL securitizations than that laid out in 23.1 above. For these purposes, SAMA may: (1) Raise the minimum level of W to a level higher than 90%; or (2) Require that the non-delinquent exposures in the underlying pool comply with a set of minimum criteria, or preclude certain types of non-delinquent exposures from forming part of the underlying pools of NPL securitizations. 23.3 A bank is precluded from applying the SEC-IRBA to an exposure to an NPL securitization where the bank uses the foundation approach as referred to in 10.35 to calculate the KIRB of the underlying pool of exposures. 23.4 The risk weight applicable to exposures to NPL securitizations according to Internal ratings-based approach (SEC-IRBA) set out in chapter 22, Standardized approach (SEC-SA) outlined in chapter 19, or the look-through approach in 24718.50 is floored at 100%.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 324 of 349 23.5 Where, according to the hierarchy of approaches in 18.41 to 18.47, the bank must use the SEC-IRBA or the SEC-SA, a bank may apply a risk weight of 100% to the senior tranche of an NPL securitization provided that the NPL securitization is a traditional securitization and the sum of the non￾refundable purchase price discounts (NRPPD), calculated as described in 23.6 below, is equal to or higher than 50% of the outstanding balance of the pool of exposures. 23.6 For the purposes of 23.5, NRPPD is the difference between the outstanding balance of the exposures in the underlying pool and the price at which these exposures are sold by the originator to the securitization entity, when neither originator nor the original lender are reimbursed for this difference. In cases where the originator underwrites tranches of the NPL securitization for subsequent sale, the NRPPD may include the differences between the nominal amount of the tranches and the price at which these tranches are first sold to unrelated third parties. For any given piece of a securitization tranche, only its initial sale from the originator to investors is taken into account in the determination of NRPPD. The purchase prices of subsequent re-sales are not considered. 23.7 An originator or sponsor bank may apply the capital requirement cap specified in 18.54 to the aggregated capital requirement for its exposures to the same NPL securitization. The same applies to an investor bank, provided that it is usingthe SEC-IRBA for an exposure to the NPL securitization.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 325 of 349 24. Equity investments in funds Introduction 24.1 Equity investments in funds that are held in the banking book must be treated in a manner consistent with one or more of the following three approaches, which vary in their risk sensitivity and conservatism: the “look-through approach” (LTA), the “mandate-based approach” (MBA), and the “fall-back approach” (FBA). The requirements set out in this chapter apply to banks’ equity investments in all types of funds, including off-balance sheet exposures (e.g. unfunded commitments to subscribe to a fund’s future capital calls). Exposures, including underlying exposures held by funds, that are required to be deducted according to the Regulatory Capital Under Basel III Framework (SAMA Circular No. 341000015689, Date: 19 December 2012) are excluded from the risk weighting treatment outlined in this chapter. The look-through approach 24.2 The LTA requires a bank to risk weight the underlying exposures of a fund as if the exposures were held directly by the bank. This is the most granular and risk-sensitive approach. It must be used when: (1) There is sufficient and frequent information provided to the bank regarding the underlying exposures of the fund; and (2) Such information is verified by an independent third party. 24.3 To satisfy condition (1) above, the frequency of financial reporting of the fund must be the same as, or more frequent than, that of the bank’s and the granularity of the financial information must be sufficient to calculate the corresponding risk weights. To satisfy condition (2) above, there must be verification of the underlying exposures by an independent third party, such as the depository or the custodian bank or, where applicable, the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 326 of 349 management company.115 24.4 Under the LTA banks must risk weight all underlying exposures of the fund as if those exposures were directly held. This includes, for example, any underlying exposure arising from the fund’s derivatives activities for situations in which the underlying receives a risk weighting treatment under the calculation of minimum risk based capital requirements and the associated counterparty credit risk (CCR) exposure. Instead of determining a credit valuation adjustment (CVA) charge associated with the fund’s derivatives exposures in accordance with the Minimum Capital Requirements for CVA, banks must multiply the CCR exposure by a factor of 1.5 before applying the risk weight associated with the counterparty. 116 24.5 Banks may rely on third-party calculations for determining the risk weights associated with their equity investments in funds (i.e. the underlying risk weights of the exposures of the fund) if they do not have adequate data or information to perform the calculations themselves. In such cases, the applicable risk weight shall be 1.2 times higher than the one that would be applicable if the exposure were held directly by the bank. 117 The mandate-based approach 24.6 The second approach, the MBA, provides a method for calculating regulatory capital that can be used when the conditions for applying the LTA are not met. 24.7 Under the MBA, banks may use the information contained in a fund's mandate or in the national regulations governing such investment funds.118 To ensure that all underlying risks are taken into account (including CCR) and

115 An external audit is not required. 116 A bank is only required to apply the 1.5 factor for transactions that are within the scope of the Minimum Capital Requirements for CVA. 117 For instance, any exposure that is subject to a 20% risk weight under the standardized approach would be weighted at 24% (1.2 * 20%) when the look through is performed by a third party. 118 Information used for this purpose is not strictly limited to a fund’s mandate or national regulations governing like funds. It may also be drawn from other disclosures of the fund.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 327 of 349 that the MBA renders capital requirements no less than the LTA, the risk￾weighted assets for the fund's exposures are calculated as the sum of the following three items : (1) Balance sheet exposures (i.e. the funds' assets) are risk weighted assuming the underlying portfolios are invested to the maximum extent allowed under the fund's mandate in those assets attracting the highest capital requirements, and then progressively in those other assets implying lower capital requirements. If more than one risk weight can be applied to a given exposure, the maximum risk weight applicable must be used.119 (2) Whenever the underlying risk of a derivative exposure or an off-balance￾sheet item receives a risk weighting treatment under the risk-based capital requirements standards, the notional amount of the derivative position or of the off-balance sheet exposure is risk weighted accordingly.120 121 (3) The CCR associated with the fund's derivative exposures is calculated using the standardized approach to counterparty credit risk (SA-CCR, see standardized approach for counterparty credit risk). SA-CCR calculates the counterparty credit risk exposure of a netting set of derivatives by multiplying (i) the sum of the replacement cost and potential future exposure; by (ii) an alpha factor set at 1.4. Whenever the replacement cost is unknown, the exposure measure for CCR will be calculated in a conservative manner by using the sum of the notional amounts of the derivatives in the netting set as a proxy for the replacement cost, and the multiplier used in the calculation of the potential future exposure will be equal to 1. Whenever the potential future exposure is unknown, it will be calculated as 15% of the sum of

119 For instance, for investments in corporate bonds with no ratings restrictions, a risk weight of 150% must be applied. 120 If the underlying is unknown, the full notional amount of derivative positions must be used for the calculation. 121 If the notional amount of derivatives mentioned in Error! Reference source not found. is unknown, it will be estimated conservatively using the maximum notional amount of derivatives allowed under the mandate.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 328 of 349 the notional values of the derivatives in the netting set.122 The risk weight associated with the counterparty is applied to the counterparty credit risk exposure. Instead of determining a CVA charge associated with the fund's derivative exposures in accordance with the Minimum Capital Requirements for CVA, banks must multiply the CCR exposure by a factor of 1.5 before applying the risk weight associated with the counterparty. 123 The fall-back approach 24.8 Where neither the LTA nor the MBA is feasible, banks are required to apply the FBA. The FBA applies a 1250% risk weight to the bank’s equity investment in the fund. Treatment of funds that invest in other funds 24.9 When a bank has an investment in a fund (e.g. Fund A) that itself has an investment in another fund (e.g. Fund B), which the bank identified by using either the LTA or the MBA, the risk weight applied to the investment of the first fund (i.e. Fund A’s investment in Fund B) can be determined by using one of the three approaches set out above. For all subsequent layers (e.g. Fund B’s investments in Fund C and so forth), the risk weights applied to an investment in another fund (Fund C) can be determined by using the LTA under the condition that the LTA was also used for determining the risk weight for the investment in the fund at the previous layer (Fund B). Otherwise, the FBA must be applied. Partial use of an approach 24.10 A bank may use a combination of the three approaches when determining the capital requirements for an equity investment in an individual fund, provided

122 For instance, if both the replacement cost and add-on components are unknown, the CCR exposure will be calculated as: 1.4 * (sum of notionals in netting set +0.15*sum of notionals in netting set). 123 A bank is only required to apply the 1.5 factor for transactions that are within the scope of the Minimum Capital Requirements for CVA.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 329 of 349 that the conditions set out in paragraphs 24.1 to Error! Reference source not found. are met. Leverage adjustment 24.11 Leverage is defined as the ratio of total assets to total equity. Leverage is taken into account in the MBA by using the maximum financial leverage permitted in the fund’s mandate or in the national regulation governing the fund. 24.12 When determining the capital requirement related to its equity investment in a fund, a bank must apply a leverage adjustment to the average risk weight of the fund, as set out in Error! Reference source not found., subject to a cap of 1250%. 24.13 After calculating the total risk-weighted assets of the fund according to the LTA or the MBA, banks will calculate the average risk weight of the fund (Avg RWfund) by dividing the total risk-weighted assets by the total assets of the fund. Using Avg RWfund and taking into account the leverage of a fund (Lvg), the risk- weighted assets for a bank’s equity investment in a fund can be represented as follows: 24.14 The effect of the leverage adjustments depends on the underlying riskiness of the portfolio (i.e. the average risk weight) as obtained by applying the standardized approach or the IRB approaches for credit risk. The formula can therefore be re- written as: Application of the LTA and MBA to banks using the IRB approach 24.15 Equity investments in funds that are held in the banking book must be treated in a consistent manner based on 24.1 to Error! Reference source not found., as adjusted by Error! Reference source not found. to Error! Reference source not found.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 330 of 349 24.16 Under the LTA: (1) Banks using an IRB approach must calculate the IRB risk components (i.e. PD of the underlying exposures and, where applicable, LGD and EAD) associated with the fund’s underlying exposures (except where the underlying exposures are equity exposures, in respect of which the standardized approach must be used as required by 10.34). (2) Banks using an IRB approach may use the standardized approach for credit risk (chapter 7) when applying risk weights to the underlying components of funds if they are permitted to do so under the provisions relating to the adoption of the IRB approach set out in chapter 10 in the case of directly held investments. In addition, when an IRB calculation is not feasible(e.g. the bank cannot assign the necessary risk components to the underlying exposures in a manner consistent with its own underwriting criteria), the methods set out in Error! Reference source not found. below must be used. (3) Banks may rely on third-party calculations for determining the risk weights associated with their equity investments in funds (i.e. the underlying risk weights of the exposures of the fund) if they do not have adequate data or information to perform the calculations themselves. In this case, the third party must use the methods set out in Error! Reference source not found. below, with the applicable risk weight set 1.2 times higher than the one that would be applicable if the exposure were held directly by the bank. 24.17 In cases when the IRB calculation is not feasible (Error! Reference source not found. (2) above), a third-party is performing the calculation of risk weights (Error! Reference source not found. (3) above) or when the bank is using the MBA the following methods must be used to determine the risk weights associated with the fund’s underlying exposures: (1) For securitization exposures, the Securitization External-ratings-based approach (SEC-ERBA) set out in chapter 20; the Standardized approach (SEC-SA) set out in chapter 19, if the bank is not able to use the SEC￾ERBA; or a 1250% risk weight where the specified requirements for using the SEC-ERBA or SEC-SA are not met; and

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 331 of 349 (2) The standardized approach (chapter 7) for all other exposures.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 332 of 349 25. Capital treatment of unsettled transactions and failed trades Overarching principles 25.1 Banks are exposed to the risk associated with unsettled securities, commodities, and foreign exchange transactionsfrom trade date. Irrespective of the booking or the accounting of the transaction, unsettled transactions must be taken into account for regulatory capital requirements purposes. 25.2 Banks are encouraged to develop, implement and improve systems for tracking and monitoring the credit risk exposure arising from unsettled transactions and failed trades as appropriate so that they can produce management information that facilitates timely action. Banks must closely monitor securities, commodities,and foreign exchange transactions that have failed, starting the first day they fail. Delivery-versus-payment transactions 25.3 Transactions settled through a delivery-versus-payment system (DvP), 124 providing simultaneous exchanges of securities for cash, expose firms to a risk of loss on the difference between the transaction valued at the agreed settlement price and the transaction valued at current market price (i.e. positive current exposure). Banks must calculate a capital requirement for such exposures if the payments have not yet taken place five business days after the settlement date,see paragraph Error! Reference source not found. below. Non-delivery-versus-payment transactions (free deliveries) 25.4 Transactions where cash is paid without receipt of the corresponding receivable (securities, foreign currencies, gold, or commodities) or, conversely, deliverables were delivered without receipt of the corresponding cash payment (non-DvP, or free deliveries) expose firms to a risk of loss on the full amount of cash paid or deliverables delivered. Banks that have made

124 For the purpose of this Framework, DvP transactions include payment- versus-payment transactions.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 333 of 349 the first contractual payment/delivery leg must calculate a capital requirement for the exposure if the second leg has not been received by the end of the business day. The requirement increases if the second leg has not been received within five business days. See paragraphs Error! Reference source not found. to Error! Reference source not found.. Scope of requirements 25.5 The capital treatment set out in this chapter is applicable to all transactions on securities, foreign exchange instruments, and commodities that give rise to a risk of delayed settlement or delivery. This includes transactions through recognized clearing houses and central counterparties that are subject to daily mark-to- market and payment of daily variation margins and that involve a mismatched trade. The treatment does not apply to the instruments that are subject to the counterparty credit risk requirements set out in the Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) (i.e. over-the-counter derivatives, exchange￾traded derivatives, long settlement transactions, securities financing transactions). 25.6 Where they do not appear on the balance sheet (i.e. settlement date accounting), the unsettled exposure amount will receive a 100% credit conversion factor to determine the credit equivalent amount. 25.7 In cases of a system-wide failure of a settlement, clearing system or central counterparty, SAMA may waive capital requirements until the situation is rectified. 25.8 Failure of a counterparty to settle a trade in itself will not be deemed a default for purposes of credit risk under the Basel Framework. Capital requirements for DvP transactions 25.9 For DvP transactions, if the payments have not yet taken place five business days after the settlement date, firms must calculate a capital requirement by multiplying the positive current exposure of the transaction by the appropriate factor, according to the Table 34 below.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 334 of 349 Table 34 Number of business days after the agreed settlement date Corresponding risk multiplier From 5 to 15 8% From 16 to 30 50% From 31 to 45 75% 46 or more 100% Capital requirements for non-DvP transactions (free deliveries) 25.10 For non-DvP transactions (i.e. free deliveries), after the first contractual payment/delivery leg, the bank that has made the payment will treat its exposure as a loan if the second leg has not been received by the end of the business day.125 This means that: (1) For counterparties to which the bank applies the standardized approach to credit risk, the bank will use the risk weight applicable to the counterparty set out in chapter 7. (2) For counterparties to which the bank applies the internal ratings-based (IRB) approach to credit risk, the bank will apply the appropriate IRB formula (set out in chapter 11) applicable to the counterparty (set out in chapter 10). When applying this requirement, if the bank has no other banking book exposures to the counterparty (that are subject to the IRB approach), the bank may assign a probability of default to the counterparty on the basis of its external rating. Banks using the Advanced IRB approach may use a 45% loss-given- default

125 If the dates when two payment legs are made are the same according to the time zones where each payment is made, it is deemed that they are settled on the same day. For example, if a bank in Tokyo transfers Yen on day X (Japan Standard Time) and receives corresponding US Dollar via the Clearing House Interbank Payments System on day X (US Eastern Standard Time), the settlement is deemed to take place on the same value date.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 335 of 349 (LGD) in lieu of estimating LGDs so long as they apply it to all failed trade exposures. Alternatively, banks using the IRB approach may opt to apply the standardized approach risk weights applicable to the counterparty set out in chapter 7. 25.11 As an alternative to Error! Reference source not found. (1) and Error! Reference source not found. (2) above, when exposures are not material, banks may choose to apply a uniform 100% risk-weight to these exposures, in order to avoid the burden of a full credit assessment. 25.12 If five business days after the second contractual payment/delivery date the second leg has not yet effectively taken place, the bank that has made the firstpayment leg will risk weight the full amount of the value transferred plus replacement cost, if any, at 1250%. This treatment will apply until the second payment/delivery leg is effectively made.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 336 of 349 26.Illustrative risk weights calculated under the internal ratings-based (IRB) approach to credit risk. 26.1 Table 1 provides illustrative risk weights calculated for four exposure types under the IRB approach to credit risk. Each set of risk weights for unexpected loss (UL) was produced using the appropriate risk-weight function of the risk-weight functions set out in Chapter 11 of Minimum Capital Requirements for Credit Risk. The inputs used to calculate the illustrative risk weights include measures of the probability of default (PD), loss-given-default (LGD), and an assumed effective maturity (M) of 2.5 years, where applicable. 26.2 A firm-size adjustment applies to exposures made to small or medium-sized entity borrowers (defined as corporate exposures where the reported sales for the consolidated group of which the firm is a part is less than €50 million). Accordingly, the firm-size adjustment was made in determining the second set of risk weights provided in column two for corporate exposures given that the turnover of the firm receiving the exposure is assumed to be €5 million. Illustrative IRB risk weights for UL Table 1 Asset class Corporate Exposures Residential Mortgages Other Retail Exposures Qualifying Revolving Retail Exposures LGD: 40% 40% 45% 25% 45% 85% 50% 85% Turnover (millions of €): 50 5 Maturity: 2.5 years 2.5 years PD: 0.05% 17.47% 13.69% 6.23% 3.46% 6.63% 12.52% 1.68% 2.86% 0.10% 26.36% 20.71% 10.69% 5.94% 11.16% 21.08% 3.01% 5.12% 0.25% 43.97% 34.68% 21.30% 11.83% 21.15% 39.96% 6.40% 10.88% 0.40% 55.75% 43.99% 29.94% 16.64% 28.42% 53.69% 9.34% 15.88% 0.50% 61.88% 48.81% 35.08% 19.49% 32.36% 61.13% 11.16% 18.97% 0.75% 73.58% 57.91% 46.46% 25.81% 40.10% 75.74% 15.33% 26.06% 1.00% 82.06% 64.35% 56.40% 31.33% 45.77% 86.46% 19.14% 32.53% 1.30% 89.73% 70.02% 67.00% 37.22% 50.80% 95.95% 23.35% 39.70% 1.50% 93.86% 72.99% 73.45% 40.80% 53.37% 100.81% 25.99% 44.19% 2.00% 102.09% 78.71% 87.94% 48.85% 57.99% 109.53% 32.14% 54.63% 2.50% 108.58% 83.05% 100.64% 55.91% 60.90% 115.03% 37.75% 64.18% 3.00% 114.17% 86.74% 111.99% 62.22% 62.79% 118.61% 42.96% 73.03% 4.00% 124.07% 93.37% 131.63% 73.13% 65.01% 122.80% 52.40% 89.08% 5.00% 133.20% 99.79% 148.22% 82.35% 66.42% 125.45% 60.83% 103.41% 6.00% 141.88% 106.21% 162.52% 90.29% 67.73% 127.94% 68.45% 116.37% 10.00% 171.63% 130.23% 204.41% 113.56% 75.54% 142.69% 93.21% 158.47% 15.00% 196.92% 152.81% 235.72% 130.96% 88.60% 167.36% 115.43% 196.23%

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 337 of 349 20.00% 211.76% 167.48% 253.12% 140.62% 100.28% 189.41% 131.09% 222.86% 27.Illustrative examples for recognition of dilution risk when applying the Securitization Internal Ratings-Based Approach (SEC-IRBA) to securitization exposures. 27.1. The following two examples are provided to illustrate the recognition of dilution risk according to Paragraph 22.12 of Minimum Capital Requirements for Credit Risk and Paragraph 22.13 of Minimum Capital Requirements for Credit Risk . The first example in 27.2 to 27.5 assumes a common waterfall for default and dilution losses. The second example in 27.6 to 27.16 assumes a non-common waterfall for default and dilution losses. 27.2. Common waterfall for default and dilution losses: in the first example, it is assumed that losses resulting from either defaults or dilution within the securitised pool will be subject to a common waterfall, ie the loss allocation process does not distinguish between different sources of losses within the pool. 27.3. The pool is characterised as follows. For the sake of simplicity, it is assumed that all exposures have the same size, same PD, same LGD and same maturity. (1) Pool of €1,000,000 of corporate receivables (2) N = 100 (3) M = 2.5 years126 (4) PDDilution = 0.55% (5) LGDDilution =100% (6) PDDefault = 0.95% (7) LGDDefault = 45% 27.4. The capital structure is characterised as follows:

126 For the sake of simplicity, the possibility described in paragraph 14.8 of Minimum Capital Requirements for Credit Risk to set MDilution = 1 is not used in this example.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 338 of 349 (1) Tranche A is a senior note of €700,000 (2) Tranche B is a second-loss guarantee of €250,000 (3) Tranche C is a purchase discount of €50,000 (4) Final legal maturity of transaction / all tranches = 2.875 years, ie MT = 2.5 years127 27.5. RWA calculation: (1) Step 1: calculate KIRB, Dilution and KIRB, Default for the underlying portfolio: (a) KIRB, Dilution = €1,000,000 x (161.44% x 8% + 0.55% x 100%) / €1,000,000 = 13.47% (b) KIRB, Default = (€1,000,000 – €129,200)128 x (90.62% x 8% + 0.95% x 45%) / €1,000,000 = 6.69% (2) Step 2: calculate KIRB, Pool = KIRB, Dilution + KIRB, Default = 13.47% + 6.69% = 20.16% (3) Step 3: apply the SEC-IRBA to the three tranches (a) Pool parameters: (i) N = 100 (ii) LGDPool = (LGDDefault x KIRB, Default + LGDDilution x KIRB, Dilution) / KIRB, Pool = (45% x 6.69% + 100% x 13.47%) / 20.16% = 81.75% (b) Tranche parameters: (i) MT = 2.5 years

127 The rounding of the maturity calculation is shown for example purposes 128 As described in paragraph 14.5 of Minimum Capital Requirements for Credit Risk, when calculating the default risk of exposures with non-immaterial dilution risk “EAD will be calculated as the outstanding amount minus the capital requirement for dilution prior to credit risk mitigation”.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 339 of 349 (ii) Attachment and detachment points shown in Table 2 Attachment and detachment points for each tranche Table 2 Attachment point Detachment point Tranche A 30% 100% Tranche B 5% 30% Tranche C 0% 5% (4) Resulting risk-weighted exposure amounts shown in Table 3 Risk-weighted exposure amounts for each tranche Table 3 SEC-IRBA risk weight RWA Tranche A 21.22% €148,540 Tranche B 1013.85% €2,534,625 Tranche C 1250% €625,000 27.6. Non-common waterfall for default and dilution losses: in the second example, it is assumed that the securitisation transaction does not have one common waterfall for losses due to defaults and dilutions, ie for the determination of the risk of a specific tranche it is not only relevant what losses might be realised within the pool but also if those losses are resulting from default or a dilution event. 27.7. As the SEC-IRBA assumes that there is one common waterfall, it cannot be applied without adjustments. The following example illustrates one possible scenario and a possible adjustment specific to this scenario. 27.8. While this example is meant as a guideline, a bank should nevertheless consult with its national supervisor as to how the capital calculation should be performed (see paragraph 22.13 of Minimum Capital Requirements for Credit Risk). 27.9. The pool is characterized as in 27.3. 27.10. The capital structure is characterized as follows: (1) Tranche A is a senior note of €950,000 (2) Tranche C is a purchase discount of €50,000

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 340 of 349 (3) Tranches A and C will cover both default and dilution losses (4) In addition, the structure also contains a second-loss guarantee of €250,000 (Tranche B)129 that covers only dilution losses exceeding a threshold of €50,000 up to maximum aggregated amount of €300,000, which leads to the following two waterfalls: (a) Default waterfall (i) Tranche A is a senior note of €950,000 (ii)Tranche C is a purchase discount of €50,000130 (b) Dilution waterfall (i) Tranche A is a senior note of €700,000 (ii)Tranche B is a second-loss guarantee of €250,000 (iii)Tranche C is a purchase discount of €50,000131 (5) MT of all tranches is 2.5 years. 27.11.Tranche C is treated as described in 27.4 to 27.7. 27.12.Tranche B (second-loss guarantee) is exposed only to dilution risk, but not to default risk. Therefore, KIRB, for the purpose of calculating a capital requirement for Tranche B, can be limited to KIRB,Dilution. However, as the holder of Tranche B cannot be sure that Tranche C will still be available to cover the first dilution losses when they are realised – because the credit enhancement might already be depleted due to earlier default losses – to ensure a prudent treatment, it cannot recognise the purchase discount as credit enhancement for dilution risk. In the capital calculation, the bank providing Tranche B should assume that €50,000 of the securitised assets have already been defaulted and hence Tranche C is no longer available as credit enhancement and the exposure of the underlying assets has been

129 For the sake of simplicity, it is assumed that the second-loss guarantee is cash-collateralised 130 Subject to the condition that it is not already being used for realised dilution losses. 131 Subject to the condition that it is not already being used for realised default losses.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 341 of 349 reduced to €950,000. When calculating KIRB for Tranche B, the bank can assume that KIRB is not affected by the reduced portfolio size. 27.13. RWA calculation for tranche B: (1) Step 1: calculate KIRB,Pool. KIRB,Pool = KIRB,Dilution = 13.47% (2) Step 2: apply the SEC-IRBA. (a) Pool parameters: (i) N = 100 (ii) LGDPool = LGDDilution = 100% (b) Tranche parameters: (i) MT = 2.5 years (ii) Attachment point = 0% (iii) Detachment point = €250,000 / €950,000 = 26.32% (3) Resulting risk-weighted exposure amounts for Tranche B: (a) SEC-IRBA risk weight = 886.94% (b) RWA = €2,217,350 27.14.The holder of Tranche A (senior note) will take all default losses not covered by the purchase discount and all dilution losses not covered by the purchase discount or the second-loss guarantee. A possible treatment for Tranche A would be to add KIRB,Default and KIRB,Dilution (as in 27.4 to 27.7), but not to recognize the second-loss guarantee as credit enhancement at all because it is covering only dilution risk. 27.15.Although this is a simple approach, it is also fairly conservative. Therefore the following alternative for the senior tranche could be considered: (1) Calculate the RWA amount for Tranche A under the assumption that it is only exposed to losses resulting from defaults. This assumption implies that Tranche A is benefiting from a credit enhancement of €50,000. (2) Calculate the RWA amounts for Tranche C and (hypothetical) Tranche A* under the

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 342 of 349 assumption that they are only exposed to dilution losses. Tranche A* should be assumed to absorb losses above €300,000 up to €1,000,000. With respect to dilution losses, this approach would recognize that the senior tranche investor cannot be sure if the purchase price discount will still be available to cover those losses when needed as it might have already been used for defaults. Consequently, from the perspective of the senior investor, the purchase price discount could only be recognized for the calculation of the capital requirement for default or dilution risk but not for both.132 (3) Sum up the RWA amounts under 27.15(1) and 27.15(2) and apply the relevant risk weight floor in paragraph 22.26 of Minimum Capital Requirements for Credit Risk or paragraph 22.29 of Minimum Capital Requirements for Credit Risk to determine the final RWA amount for the senior note investor. 27.16. RWA calculation for Tranche A: (1) Step 1: calculate RWA for 27.15 (1). (a) Pool parameters: (i) KIRB,Pool = KIRB,Default = 6.69% (ii) LGDPool = LGDDefault = 45% (b) Tranche parameters: (i) MT = 2.5 years (ii) Attachment point = €50,000 / €1,000,000 = 5% (iii) Detachment point = €1,000,000 / €1,000,000 = 100% (c) Resulting risk-weighted exposure amounts: (i) SEC-IRBA risk weight = 51.67% (ii) RWA = €490,865

132 In this example, the purchase price discount was recognised in the default risk calculation, but banks could also choose to use it for the dilution risk calculation. It is also assumed that the second-loss dilution guarantee explicitly covers dilution losses above €50,000 up to €300,000. If the guarantee instead covered €250,000 dilution losses after the purchase discount has been depleted (irrespective of whether the purchase discount has been used for dilution or default losses), then the senior note holder should assume that he is exposed to dilution losses from €250,000 up to €1,000,000 (instead of €0 to €50,000 + €300,000 to €1,000,000).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 343 of 349 (2) Step 2: calculate RWA for 27.15(2). (a) Pool parameters: (i) KIRB,Pool = KIRB,Dilution = 13.47% (ii) LGDPool = LGDDilution = 100% (b) Tranche parameters: (i) MT = 2.5 years (ii) Attachment and detachment points shown in Table 4 Attachment and detachment points for each tranche Table 4 Attachment point Detachment point Tranche A* 30% 100% Tranche C 0% 5% (c) Resulting risk-weighted exposure amounts shown in Table 5 Risk-weighted exposure amounts for each tranche Table 5 SEC-IRBA risk weight RWA Tranche A* 11.16% €78,120 Tranche C 1250% €625,000

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 344 of 349 (3) Step 3: Sum up the RWA of 27.16 (1) and 27.16 (2)133 (a) Final RWA amount for investor in Tranche A = €490,865 + €78,120 + €625,000 = €1,193,985 (b) Implicit risk weight for Tranche A = max (15%, €1,193,985 / €950,000) = 125.68% 28. Equity investments in funds: illustrative example of the calculation of risk￾weighted assets (RWA) under the look-through approach (LTA) 28.1 Consider a fund that replicates an equity index. Moreover, assume the following: (1) The bank uses the standardised approach (SA) for credit risk when calculating its capital requirements for credit risk and for determining counterparty credit risk exposures it uses the SA-CCR. (2) The bank owns 20% of the shares of the fund. (3) The fund holds forward contracts on listed equities that are cleared through a qualifying central counterparty (with a notional amount of USD 100); and (4) The fund presents the following balance sheet: Assets Cash USD 20 Government bonds (AAA-rated) USD 30 Variation margin receivable (ie collateral posted by the bank to the CCP in respect of the forward contracts) USD 50 Liabilities Notes payable USD 5 Equity Shares, retained earnings and other reserves USD 95

133 The correct application of the overall risk weight floor is such that the intermediate results (in this case the risk weight for Tranche A*) are calculated without the floor and the floor is only enforced in the last step (ie Step 3(b)).

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 345 of 349 28.2 The funds exposures will be risk weighted as follows: (1) The RWA for the cash (RWAcash) are calculated as the exposure of USD 20 multiplied by the applicable SA risk weight of 0%. Thus, RWAcash = USD 0. (2) The RWA for the government bonds (RWAbonds) are calculated as the exposure of USD 30 multiplied by the applicable SA risk weight of 0%. Thus, RWAbonds = USD 0. (3) The RWA for the exposures to the listed equities underlying the forward contracts (RWAunderlying) are calculated by multiplying the following three amounts: (1) the SA credit conversion factor of 100% that is applicable to forward purchases; (2) the exposure to the notional of USD 100; and (3) the applicable risk weight for listed equities under the SA which is 250%. Thus, RWAunderlying = 100% * USD100 * 250% = USD 250. (4) The forward purchase equities expose the bank to counterparty credit risk in respect of the market value of the forwards and the collateral posted that is not held by the CCP on a bankruptcy remote basis. For the sake of simplicity, this example assumes the application of SA-CCR results in an exposure value of USD 56. The RWA for counterparty credit risk (RWACCR) are determined by multiplying the exposure amount by the relevant risk weight for trade exposures to CCPs, which 2% in this case (see chapter 8 of Minimum Capital Requirements for Credit Risk for the capital requirements for bank exposures to CCPs). Thus, RWACCR = USD 56 * 2% = USD 1.12. (Note: There is no credit valuation adjustment, or CVA, charge assessed since the forward contracts are cleared through a CCP.) 28.3 The total RWA of the fund are therefore USD 251.12 = (0 + 0 +250 + 1.12). 28.4 The leverage of a fund under the LTA is calculated as the ratio of the fund’s total assets to its total equity, which in this examples is 100/95. 28.5 Therefore, the RWA for the bank’s equity investment in the fund is calculated as the product of the average risk weight of the fund, the fund’s leverage and the size of the banks equity investment. That is: RWA = 𝑅𝑊𝐴𝑓𝑢𝑛𝑑 𝑇𝑜𝑡𝑎𝑙 𝐴𝑠𝑠𝑒𝑡𝑠𝑓𝑢𝑛𝑑  Leverage  Equity Investment = 251.12 100  100 95 (95 ∗ 20%)= USD 50.2

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 346 of 349 29.Equity investments in funds: illustrative example of the calculation of RWA under the mandate-based approach (MBA). 29.1 Consider a fund with assets of USD 100, where it is stated in the mandate that the fund replicates an equity index. In addition to being permitted to invest its assets in either cash or listed equities, the mandate allows the fund to take long positions in equity index futures up to a maximum nominal amount equivalent to the size of the fund’s balance sheet (USD 100). This means that the total on balance sheet and off balance sheet exposures of the fund can reach USD 200. Consider also that a maximum financial leverage (fund assets/fund equity) of 1.1 applies according to the mandate. The bank holds 20% of the shares of the fund, which represents an investment of USD 18.18. 29.2 First, the on-balance sheet exposures of USD 100 will be risk weighted according to the risk weights applied to listed equity exposures (RW=250%), ie RWAon-BS = USD 100 * 250% = USD 250. 29.3 Second, we assume that the fund has exhausted its limit on derivative positions, ie USD 100 notional amount. The RWA for the maximum notional amount of underlying the derivatives positions calculated by multiplying the following three amounts: (1) the SA credit conversion factor of 100% that is applicable to forward purchases; (2) the maximum exposure to the notional of USD 100; and (3) the applicable risk weight for listed equities under the SA which is 250%. Thus, RWAunderlying = 100% * USD100 * 250% = USD 250. 29.4 Third, we would calculate the counterparty credit risk associated with the derivative contract. As set out in paragraph 24.7 of Minimum Capital Requirements for Credit Risk (3): (1) If we do not know the replacement cost related to the futures contract, we would approximate it by the maximum notional amount, ie USD 100. (2) If we do not know the aggregate add-on for potential future exposure, we would approximate this by 15% of the maximum notional amount (ie 15% of USD 100=USD 15). (3) The CCR exposure is calculated by multiplying (i) the sum of the replacement cost and aggregate add-on for potential future exposure; by (ii) 1.4, which is the prescribed value of alpha.

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 347 of 349 29.5 The counterparty credit risk exposure in this example, assuming the replacement cost and aggregate add-on amounts are unknown, is therefore USD 161 (= 1.4 *(100+15)). Assuming the futures contract is cleared through a qualifying CCP, a risk weight of 2% applies, so that RWACCR = USD 161 * 2% = USD 3.2. There is no CVA charge assessed since the futures contract is cleared through a CCP. 29.6 The RWA of the fund is hence obtained by adding RWAon-BS, RWAunderlying and RWACCR, ie USD 503.2 (=250 + 250 + 3.2). 29.7 The RWA (USD 503.2) will be divided by the total assets of the fund (USD 100) resulting in an average risk-weight of 503.2%. The bank’s total RWA associated with its equity investment is calculated as the product of the average risk weight of the fund, the fund’s maximum leverage and the size of the bank’s equity investment. That is the bank’s total associated RWA are 503.2% * 1.1 * USD 18.18 = USD 100.6. 30.Equity investments in funds: illustrative examples of the leverage adjustment. 30.1 Consider a fund with assets of USD 100 that invests in corporate debt. Assume that the fund is highly levered with equity of USD 5 and debt of USD 95. Such a fund would have financial leverage of 100/5=20. Consider the two cases below. 30.2 In Case 1 the fund specializes in low-rated corporate debt, it has the following balance sheet: Assets Cash USD 10 A+ to A- bonds USD 20 BBB+ to BBB￾bonds USD 30 BB+ to BB- bonds USD 40 Liabilities Debt USD 95 Equity

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 348 of 349 Shares, retained earnings and other reserves USD 5 30.3 The average risk weight of the fund is (USD100% + USD2050% + USD3075% + USD40100%)/USD100 = 72.5%. The financial leverage of 20 would result in an effective risk weight of 1,450% for banks’ investments in this highly levered fund, however, this is capped at a conservative risk weight of 1,250%. 30.4 In Case 2 the fund specializes in high-rated corporate debt, it has the following balance sheet: Assets Cash USD 5 AAA to AA- bonds USD 75 A+ to A- bonds USD 20 Liabilities Debt USD 95 Equity Shares, retained earnings and other reserves USD 5 30.5 The average risk weight of the fund is (USD50% + USD7520% + USD20*50%)/USD100 = 25%. The financial leverage of 20 results in an effective risk weight of 500%. 30.6 The above examples illustrate that the rate at which the 1,250% cap is reached depends on the underlying riskiness of the portfolio (as judged by the average risk weight) as captured by SA risk weights or the IRB approach. For example, for a “ risky” portfolio (72.5% average risk weight), the 1,250% limit is reached fairly

Minimum Capital Requirements for Credit Risk Version Issuance Date Page Number 2.1 December 2022 349 of 349 quickly with a leverage of 17.2x, while for a “low risk” portfolio (25% average risk weight) this limit is reached at a leverage of 50x.

Page Number 1 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Saudi Central Bank (SAMA) Minimum Capital Requirements for Market Risk December 2022

Page Number 2 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Contents 1- Introduction................................................................................................................................... 4 2- Definitions:..................................................................................................................................... 4 3- Scope of application ...................................................................................................................... 8 Methods of measuring market risk .................................................................................................... 11 4- Trading Book Policy Statement (TPS) and definition of a trading desk ............................... 12 5- Boundary between the banking book and the trading book................................................... 16 Scope of the trading book .................................................................................................................. 16 Standards for assigning instruments to the regulatory books........................................................... 17 SAMA Supervisory expectation ......................................................................................................... 20 Documentation of instrument designation......................................................................................... 20 Restrictions on moving instruments between the regulatory books .................................................. 21 Treatment of internal risk transfers................................................................................................... 23 6- Standardised approach: general provisions and structure ..................................................... 26 General provisions ............................................................................................................................ 26 Structure of the standardised approach ............................................................................................ 26 Definition of correlation trading portfolio........................................................................................ 27 7- Standardised approach: sensitivities-based method................................................................ 28 Main concepts of the sensitivities-based method............................................................................... 28 Instruments subject to each component of the sensitivities-based method........................................ 29 Process to calculate the capital requirement under the sensitivities-based method......................... 30 Sensitivities-based method: risk factor and sensitivity definitions.................................................... 35 Sensitivities-based method: definition of delta risk buckets, risk weights and correlations............. 52 Sensitivities-based method: definition of vega risk buckets, risk weights and correlations ............. 70 Sensitivities-based method: definition of curvature risk buckets, risk weights and correlations ..... 71 8- Standardised approach: default risk capital requirement ...................................................... 73 Main concepts of default risk capital requirements.......................................................................... 73 Instruments subject to the default risk capital requirement .............................................................. 73 Overview of DRC requirement calculation ....................................................................................... 73 Default risk capital requirement for non-securitisations.................................................................. 74 Default risk capital requirement for securitisations (non-CTP)....................................................... 81 Default risk capital requirement for securitisations (CTP) .............................................................. 83 9- Standardised approach: residual risk add-on.......................................................................... 86 Instruments subject to the residual risk add-on ................................................................................ 86 Calculation of the residual risk add-on............................................................................................. 88 10- Internal models approach: general provisions....................................................................... 89

Page Number 3 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 General criteria ................................................................................................................................. 89 Qualitative standards ........................................................................................................................ 91 Model validation standards............................................................................................................... 94 External validation ............................................................................................................................ 95 Stress testing...................................................................................................................................... 96 11- Internal models approach: model requirements.................................................................... 97 Specification of market risk factors................................................................................................... 97 Model eligibility of risk factors ....................................................................................................... 100 12- Internal models approach: backtesting and P&L attribution test requirements ............. 108 Backtesting requirements ................................................................................................................ 109 PLA test requirements ..................................................................................................................... 112 Treatment for exceptional situations............................................................................................... 118 13- Internal models approach: capital requirements calculation ............................................. 118 Calculation of expected shortfall..................................................................................................... 118 Calculation of capital requirement for modellable risk factors...................................................... 124 Calculation of capital requirement for non-modellable risk factors............................................... 125 Calculation of default risk capital requirement .............................................................................. 127 Calculation of capital requirement for model-ineligible trading desks.......................................... 132 Aggregation of capital requirement ................................................................................................ 132 14- Simplified standardised approach......................................................................................... 134 Risk-weighted assets and capital requirements............................................................................... 134 Interest rate risk .............................................................................................................................. 135 Equity risk........................................................................................................................................ 151 Foreign exchange risk ..................................................................................................................... 155 Commodities risk ............................................................................................................................. 157 Treatment of options........................................................................................................................ 161 15- Transitional arrangements for Profit and loss (P&L) attribution (PLA).......................... 167 16- Guidance on use of the internal models approach ............................................................... 167 Trading desk-level backtesting ........................................................................................................ 167 Bank-wide backtesting..................................................................................................................... 169 Examples of the application of the principles for risk factor modellability .................................... 174 17- SAMA Reporting Requirements............................................................................................ 175 18- Implementation Timeline ....................................................................................................... 175

Page Number 4 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Minimum Capital Requirements for Market Risk 1- Introduction This framework sets outs the amended Minimum Capital Requirements for Market Risk, In addition, this framework shall supersede all SAMA circulars regarding the Minimum Capital Requirements of the Market Risk issued before the date of issuing this framework. This updated framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. 2- Definitions: Market risk: The risk of losses in on- and off-balance sheet risk positions arising from movements in market prices. Trading desk: A group of traders or trading accounts in a business line within a bank that follows defined trading strategies with the goal of generating revenues or maintaining market presence from assuming and managing risk. Pricing model: A model that is used to determine the value of an instrument (mark-to-market or mark-to-model) as a function of pricing parameters or to determine the change in the value of an instrument as a function of risk factors. A pricing model may be the combination of several calculations; eg a first valuation technique to compute a price, followed by valuation adjustments for risks that are not incorporated in the first step. Notional value: The notional value of a derivative instrument is equal to the number of units underlying the instrument multiplied by the current market value of each unit of the underlying. Financial instrument: Any contract that gives rise to both a financial asset of one entity and a financial liability or equity instrument of another entity. Financial instruments include primary financial instruments (or cash instruments) and derivative financial instruments. Instrument: The term used to describe financial instruments, instruments on foreign exchange (FX) and commodities.

Page Number 5 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Embedded derivative: A component of a financial instrument that includes a non￾derivative host contract. For example, the conversion option in a convertible bond is an embedded derivative. Look-through approach: An approach in which a bank determines the relevant capital requirements for a position that has underlyings (such as an index instrument, multi-underlying option, or an equity investment in a fund) as if the underlying positions were held directly by the bank. Risk factor: A principal determinant of the change in value of an instrument (eg an exchange rate or interest rate). Risk position: The portion of the current value of an instrument that may be subject to losses due to movements in a risk factor. For example, a bond denominated in a currency different to a bank’s reporting currency has risk positions in general interest rate risk, credit spread risk (non- securitisation) and FX risk, where the risk positions are the potential losses to the current value of the instrument that could occur due to a change in the relevant underlying risk factors (interest rates, credit spreads, or exchange rates). Risk bucket: A defined group of risk factors with similar characteristics. Risk class: A defined list of risks that are used as the basis for calculating market risk capital requirements: general interest rate risk, credit spread risk (non-securitisation), credit spread risk (securitisation: non-correlation trading portfolio), credit spread risk (securitisation: correlation trading portfolio), FX risk, equity risk and commodity risk. Sensitivity: A bank’s estimate of the change in value of an instrument due to a small change in one of its underlying risk factors. Delta and vega risks are sensitivities. Delta risk: The linear estimate of the change in value of a financial instrument due to a movement in the value of a risk factor. The risk factor could be the price of an equity or commodity, or a change in an interest rate, credit spread or FX rate.

Page Number 6 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Vega risk: The potential loss resulting from the change in value of a derivative due to a change in the implied volatility of its underlying. Curvature risk: The additional potential loss beyond delta risk due to a change in a risk factor for financial instruments with optionality. In the standardised approach in the market risk framework, it is based on two stress scenarios involving an upward shock and a downward shock to each regulatory risk factor. Value at risk (VaR): A measure of the worst expected loss on a portfolio of instruments resulting from market movements over a given time horizon and a pre-defined confidence level. Expected shortfall (ES): A measure of the average of all potential losses exceeding the VaR at a given confidence level. Jump-to-default (JTD): The risk of a sudden default. JTD exposure refers to the loss that could be incurred from a JTD event. Liquidity horizon: The time assumed to be required to exit or hedge a risk position without materially affecting market prices in stressed market conditions. Basis risk: The risk that prices of financial instruments in a hedging strategy are imperfectly correlated, reducing the effectiveness of the hedging strategy. Diversification: The reduction in risk at a portfolio level due to holding risk positions in different instruments that are not perfectly correlated with one another. Hedge: The process of counterbalancing risks from exposures to long and short risk positions in correlated instruments. Offset: The process of netting exposures to long and short risk positions in the same risk factor. Standalone: Being capitalised on a stand-alone basis means that risk positions are booked in a discrete, non-diversifiable trading book portfolio so that the risk associated with those risk positions cannot diversify, hedge or offset risk arising from other risk positions, nor be diversified, hedged or offset by them.

Page Number 7 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Real prices: A term used for assessing whether risk factors pass the risk factor eligibility test. A price will be considered real if it is (i) a price from an actual transaction conducted by the bank, (ii) a price from an actual transaction between other arm’s length parties (eg at an exchange), or (iii) a price taken from a firm quote (ie a price at which the bank could transact with an arm’s length party). Modellable risk factor: Risk factors that are deemed modellable, based on the number of representative real price observations and additional qualitative principles related to the data used for the calibration of the ES model. Risk factors that do not meet the requirements for the risk factor eligibility test are deemed as non-modellable risk factors (NMRF). Backtesting: The process of comparing daily actual and hypothetical profits and losses with model-generated VaR measures to assess the conservatism of risk measurement systems. Profit and loss (P&L) attribution (PLA): A method for assessing the robustness of banks’ risk management models by comparing the risk-theoretical P&L predicted by trading desk risk management models with the hypothetical P&L. Trading desk risk management model: The trading desk risk management model (pertaining to in-scope desks) includes all risk factors that are included in the bank’s ES model with supervisory parameters and any risk factors deemed not modellable, which are therefore not included in the ES model for calculating the respective regulatory capital requirement, but are included in NMRFs. Actual P&L (APL): The actual P&L derived from the daily P&L process. It includes intraday trading as well as time effects and new and modified deals, but excludes fees and commissions as well as valuation adjustments for which separate regulatory capital approaches have been otherwise specified as part of the rules or which are deducted from Common Equity Tier 1. Any other valuation adjustments that are market risk-related must be included in the APL. As is the case for the hypothetical P&L, the APL should include FX and commodity risks from positions held in the banking book Hypothetical P&L (HPL): The daily P&L produced by revaluing the positions held at the end of the previous day using the market data at the end of the current day. Commissions, fees, intraday trading and new/modified deals, valuation adjustments for which separate regulatory capital approaches have been otherwise specified as part of the rules and valuation adjustments which are deducted from CET1 are excluded

Page Number 8 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 from the HPL. Valuation adjustments updated daily should usually be included in the HPL. Time effects should be treated in a consistent manner in the HPL and risk-theoretical P&L. Risk-theoretical P&L (RTPL): The daily desk-level P&L that is predicted by the valuation engines in the trading desk risk management model using all risk factors used in the trading desk risk management model (ie including the NMRFs). Credit valuation adjustment (CVA): An adjustment to the valuation of a derivative transaction to account for the credit risk of contracting parties. CVA risk: The risk of changes to CVA arising from changes in credit spreads of the contracting parties, compounded by changes to the value or variability in the value of the underlying of the derivative transaction. 3- Scope of application 3.1 This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 3.2 This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators. 3.3 The risks subject to market risk capital requirements include but are not limited to: (1) Default risk, interest rate risk, credit spread risk, equity risk, foreign exchange (FX) risk and commodities risk for trading book instruments; and (2) FX risk and commodities risk for banking book instruments. 3.4 All transactions, including forward sales and purchases, shall be included in the calculation of capital requirements as of the date on which they were entered into. Although regular reporting will in principle take place quarterly, banks are expected to manage their market risk in such a way that the capital requirements are being met on a continuous basis, including at the close of each business day. Banks should not window-dress by showing significantly lower market risk positions on reporting dates. Banks will also be expected to maintain strict risk management systems to ensure that intraday exposures are not excessive. If a bank

Page Number 9 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 fails to meet the capital requirements at any time, Bank shall takes immediate measures to rectify the situation and immediately notify SAMA. 3.5 A matched currency risk position will protect a bank against loss from movements in exchange rates, but will not necessarily protect its capital adequacy ratio. If a bank has its capital denominated in its domestic currency and has a portfolio of foreign currency assets and liabilities that is completely matched, its capital/asset ratio will fall if the domestic currency depreciates. By running a short risk position in the domestic currency, the bank can protect its capital adequacy ratio, although the risk position would lead to a loss if the domestic currency were to appreciate. SAMA may allow Banks who protect their capital adequacy ratio in this way and exclude certain currency risk positions from the calculation of net open currency risk positions, subject to meeting each of the following conditions: (1) The risk position is taken or maintained for the purpose of hedging partially or totally against the potential that changes in exchange rates could have an adverse effect on its capital ratio. (2) The risk position is of a structural (ie non-dealing) nature such as positions stemming from: (a) Investments in affiliated but not consolidated entities denominated in foreign currencies; or (b) Investments in consolidated subsidiaries or branches denominated in foreign currencies. (3) The exclusion is limited to the amount of the risk position that neutralises the sensitivity of the capital ratio to movements in exchange rates. (4) The exclusion from the calculation is made for at least six months. (5) The establishment of a structural FX position and any changes in its position must follow the bank’s risk management policy for structural FX positions. This policy must be shared with SAMA for notification. (6) Any exclusion of the risk position needs to be applied consistently, with the exclusionary treatment of the hedge remaining in place for the life of the assets or other items. (7) Banks are required to document and have available for SAMA review the positions and amounts to be excluded from market risk capital requirements. 3.6 No FX risk capital requirement need apply to positions related to items that are deducted from a bank’s capital when calculating its capital base.

Page Number 10 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 3.7 Holdings of capital instruments that are deducted from a bank’s capital or risk weighted at 1250% are not allowed to be included in the market risk framework. This includes: (1) Holdings of the bank’s own eligible regulatory capital instruments; and (2) Holdings of other banks’, securities firms’ and other financial entities’ eligible regulatory capital instruments, as well as intangible assets, (3) Where a bank demonstrates that it is an active market-maker, then SAMA will establish a dealer exception for holdings of other banks’, securities firms’, and other financial entities’ capital instruments in the trading book. In order to qualify for the dealer exception, the bank must have adequate systems and controls surrounding the trading of financial institutions’ eligible regulatory capital instruments. 3.8 In the same way as for credit risk and operational risk, the capital requirements for market risk apply on a worldwide consolidated basis. (1) Banking and financial entities in a group which is running a global consolidated trading book and whose capital is being assessed on a global basis allowed to include the net short and net long risk positions no matter where they are booked. 1 (2) SAMA will grant above treatment only when the standardised approach in [6] to [9] permits a full offset of the risk position (ie risk positions of the opposite sign do not attract a capital requirement). (3) Nonetheless, there will be circumstances in which SAMA demand that the individual risk positions be taken into the measurement system without any offsetting or netting against risk positions in the remainder of the group. This may be needed, for example, where there are obstacles to the quick repatriation of profits from a foreign subsidiary or where there are legal and procedural difficulties in carrying out the timely management of risks on a consolidated basis. (4) Moreover, SAMA will retain the right to continue to monitor the market risks of individual entities on a non-consolidated basis to ensure that significant imbalances within a group do not escape supervision. Banks should not conceal risk positions on reporting dates in such a way as to escape measurement.

1 The positions of less than wholly owned subsidiaries would be subject to the generally accepted accounting principles in the country where the parent company is supervised.

Page Number 11 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Methods of measuring market risk 3.9 In determining the market risk for regulatory capital requirements, a bank may choose between two broad methodologies: the standardised approach as described in [6] to [9] and internal models approach (IMA) for market risk as described in [10] to [13]. SAMA approval is required before using the IMA approach. SAMA may allow banks that maintain smaller or simpler trading books to use the simplified alternative to the standardised approach as set out in [14]. The use of the simplified alternative is subject to SAMA approval and oversight. (1) To determine the appropriateness of the simplified alternative for use by a bank for the purpose of its market risk capital requirements, SAMA will consider the following indicative criteria: (a) The bank should not be a global systemically important bank (G-SIB) or a domestic systemically important bank (D-SIB). (b) The bank should not use the IMA for any of its trading desks. (c) The bank should not hold any correlation trading positions. (2) SAMA can mandate that banks with relatively complex or sizeable risks in particular risk classes to apply the full standardised approach instead of the simplified alternative, even if those banks meet the indicative eligibility criteria referred to above. 3.10 All banks must calculate the capital requirements using the standardised approach any other approach must be approved by SAMA. Banks that are approved by SAMA to use the IMA for market risk capital requirements must also calculate and report the capital requirement values calculated as set out below. (1) A bank that uses the IMA for any of its trading desks must also calculate the capital requirement under the standardised approach for all instruments across all trading desks, regardless of whether those trading desks are eligible for the IMA. (2) In addition, a bank that uses the IMA for any of its trading desks must calculate the standardised approach capital requirement for each trading desk that is eligible for the IMA as if that trading desk were a standalone regulatory portfolio (ie with no offsetting across trading desks). This will: (a) Serve as an indication of the fallback capital requirement for those desks that fail the eligibility criteria for inclusion in the bank’s internal model as outlined in [10], [12] and [13];

Page Number 12 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) Generate information on the capital outcomes of the internal models relative to a consistent benchmark and facilitate comparison in implementation between banks and/or across jurisdictions; (c) Monitor over time the relative calibration of standardised and modelled approaches, facilitating adjustments as needed; and (d) Provide macroprudential insight in an ex ante consistent format. 3.11 All banks must calculate the market risk capital requirement using the standardised approach for the following: (1) Securitisation exposures; and (2) Equity investments in funds that cannot be looked through but are assigned to the trading book in accordance to the conditions set out in 5.8(b). 4- Trading Book Policy Statement (TPS) and definition of a trading desk 4.1 All banks with market risk exposures are required to have a Trading Book Policy Statement (TPS). A bank’s trading book policy statement must detail: (a) Whether the bank intends to operate a trading book and whether it has relevant positions in market risk; (b) Who can approve or modify the trading book policy statement; (c) The activities the bank considers to be trading and as constituting part of the trading book for the purposes of calculating capital; (d) The valuation methodology to be adopted for trading book exposures, including: (i) The extent to which an exposure can be marked-to-market daily by reference to an active, liquid two-way market; (ii) For exposures that are marked-to-model, the extent to which the bank can: (A) Identify the material risks of the exposure; (B) Hedge the material risks of the exposure with instruments for which there is an active, liquid two-way market; and (C) Derive reliable estimates for the key assumptions and parameters used in the model; and

Page Number 13 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (iii) The extent to which the bank can and is required to generate valuations for the exposure that can be validated externally in a consistent manner; (e) Whether there are any structural foreign exchange positions. Where appropriate, the operational definition of positions to be excluded from the calculation of a bank’s foreign exchange exposure must be outlined. A description of the policies covering the identification and management of structural foreign exchange positions, to ensure that trading activities are not classified as structural, must also be included; (f) When and how the statement will be subject to regular review; (g) The extent to which legal restrictions or other operational requirements would impede the bank’s ability to effect an immediate liquidation or hedge of an exposure in the trading book; and (h) The extent to which the bank is required to, and can, actively risk manage an exposure within its trading operations. 4.2 A bank must immediately notify SAMA of any material changes to its trading book policy statement. 4.3 The trading book policy statement must be incorporated in the bank’s risk management strategy required. 4.4 For the purposes of market risk capital calculations, a trading desk is a group of traders or trading accounts that implements a well-defined business strategy operating within a clear risk management structure. 4.5 Trading desks are defined by the bank but subject to SAMA approval for capital purposes. (1) A bank is allowed to propose the trading desk structure per their organisational structure, consistent with the requirements set out in [4.7]. (2) A bank must prepare a policy document for each trading desk it defines, documenting how the bank satisfies the key elements in [4.7]. (3) SAMA will treat the definition of the trading desk as part of the initial model approval for the trading desk, as well as ongoing approval: (a) SAMA will determine, based on the size of the bank’s overall trading operations, whether the proposed trading desk definitions are sufficiently granular.

Page Number 14 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) SAMA will check that the bank’s proposed definition of trading desk meets the criteria listed in key elements set out in [4.7]. 4.6 Within SAMA approved trading desk structure, banks may further define operational subdesks without the need for SAMA approval. These subdesks would be for internal operational purposes only and would not be used in the market risk capital framework. 4.7 The key attributes of a trading desk are as follows: (1) A trading desk for the purposes of the regulatory capital charge is an unambiguously defined group of traders or trading accounts. (a) A trading account is an indisputable and unambiguous unit of observation in accounting for trading activity. (b) The trading desk must have one head trader and can have up to two head traders provided their roles, responsibilities and authorities are either clearly separated or one has ultimate oversight over the other. (i) The head trader must have direct oversight of the group of traders or trading accounts. (ii) Each trader or each trading account in the trading desk must have a clearly defined specialty (or specialities). (c) Each trading account must only be assigned to a single trading desk. The desk must have a clearly defined risk scope consistent with its pre￾established objectives. The scope should include specification of the desk’s overall risk class and permitted risk factors. (d) There is a presumption that traders (as well as head traders) are allocated to one trading desk. A bank can deviate from this presumption and may assign an individual trader to work across several trading desks provided it can be justified to the SAMA on the basis of sound management, business and/or resource allocation reasons. Such assignments must not be made for the only purpose of avoiding other trading desk requirements (eg to optimise the likelihood of success in the backtesting and profit and loss attribution tests). (e) The trading desk must have a clear reporting line to bank senior management, and should have a clear and formal compensation policy clearly linked to the pre-established objectives of the trading desk.

Page Number 15 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) A trading desk must have a well-defined and documented business strategy, including an annual budget and regular management information reports (including revenue, costs and risk-weighted assets). (a) There must be a clear description of the economics of the business strategy for the trading desk, its primary activities and trading/hedging strategies. (i) Economics: what is the economics behind the strategy (eg trading on the shape of the yield curve)? How much of the activities are customer driven? Does it entail trade origination and structuring, or execution services, or both? (ii) Primary activities: what is the list of permissible instruments and, out of this list, which are the instruments most frequently traded? (iii) Trading/hedging strategies: how would these instruments be hedged, what are the expected slippages and mismatches of hedges, and what is the expected holding period for positions? (b) The management team at the trading desk (starting from the head trader) must have a clear annual plan for the budgeting and staffing of the trading desk. (c) A trading desk’s documented business strategy must include regular Management Information reports, covering revenue, costs and risk￾weighted assets for the trading desk. (3) A trading desk must have a clear risk management structure. (a) Risk management responsibilities: the bank must identify key groups and personnel responsible for overseeing the risk-taking activities at the trading desk. (b) A trading desk must clearly define trading limits based on the business strategy of the trading desk and these limits must be reviewed at least annually by senior management at the bank. In setting limits, the trading desk must have: (i) Well defined trading limits or directional exposures at the trading desk level that are based on the appropriate market risk metric (eg sensitivity of credit spread risk and/or jump-to-default for a credit trading desk), or just overall notional limits; and (ii) Well-defined trader mandates.

Page Number 16 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (c) A trading desk must produce, at least weekly, appropriate risk management reports. This would include, at a minimum: (i) Profit and loss reports, which would be periodically reviewed, validated and modified (if necessary) by Product Control; and (ii) Internal and regulatory risk measure reports, including trading desk value-at-risk (VaR) / expected shortfall (ES), trading desk VaR/ES sensitivities to risk factors, backtesting and p-value. 4.8 The bank must prepare, evaluate, and have available for SAMA the following for all trading desks: (1) Inventory ageing reports; (2) Daily limit reports including exposures, limit breaches, and follow-up action; (3) Reports on intraday limits and respective utilisation and breaches for banks with active intraday trading; and (4) Reports on the assessment of market liquidity. 4.9 Any foreign exchange or commodity positions held in the banking book must be included in the market risk capital requirement as set out in [3.3]. For regulatory capital calculation purposes, these positions will be treated as if they were held on notional trading desks within the trading book. 5- Boundary between the banking book and the trading book Scope of the trading book 5.1 A trading book consists of all instruments that meet the specifications for trading book instruments set out in [5.2] through [5.13]. All other instruments must be included in the banking book. 5.2 Instruments comprise financial instruments, foreign exchange (FX), and commodities. A financial instrument is any contract that gives rise to both a financial asset of one entity and a financial liability or equity instrument of another entity. Financial instruments include primary financial instruments (or cash instruments) and derivative financial instruments. A financial asset is any asset that is cash, the right to receive cash or another financial asset or a commodity, or an equity instrument. A financial liability is the contractual obligation to deliver cash or another financial asset or a commodity. Commodities also include non￾tangible (ie non-physical) goods such as electric power.

Page Number 17 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 The credit spread risk (CSR) capital requirement applies to money market instruments to the extent such instruments are covered instruments (ie they meet the definition of instruments to be included in the trading book as specified in [5.2] through [5.13]. 5.3 Banks may only include a financial instrument, instruments on FX or commodity in the trading book when there is no legal impediment against selling or fully hedging it. 5.4 Banks must fair value daily any trading book instrument and recognise any valuation change in the profit and loss (P&L) account. Instruments designated under the fair value option may be allocated to the trading book, but only if they comply with all the relevant requirements for trading book instruments set out in [5]. Standards for assigning instruments to the regulatory books 5.5 Any instrument a bank holds for one or more of the following purposes must, when it is first recognised on its books, be designated as a trading book instrument, unless specifically otherwise provided for in [5.3] or [5.8]: (1) short-term resale; (2) profiting from short-term price movements; (3) locking in arbitrage profits; or (4) hedging risks that arise from instruments meeting (1), (2) or (3) above. 5.6 Any of the following instruments is seen as being held for at least one of the purposes listed in [5.5] and must therefore be included in the trading book, unless specifically otherwise provided for in [5.3] or [5.8]: (1) instruments in the correlation trading portfolio; (2) instruments that would give rise to a net short credit or equity position in the banking book;2 or (3) instruments resulting from underwriting commitments, where underwriting commitments refer only to securities underwriting, and relate only to

2 A bank will have a net short risk position for equity risk or credit risk in the banking book if the present value of the banking book increases when an equity price decreases or when a credit spread on an issuer or group of issuers of debt increases.

Page Number 18 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 securities that are expected to be actually purchased by the bank on the settlement date. Banks should continuously manage and monitor their banking book positions to ensure that any instrument that individually has the potential to create a net short credit or equity position in the banking book is not actually creating a non-negligible net short position at any point in time. 5.7 Any instrument which is not held for any of the purposes listed in [5.5] at inception, nor seen as being held for these purposes according to [5.6], must be assigned to the banking book. 5.8 The following instruments must be assigned to the banking book: (1) unlisted equities; (2) instruments designated for securitisation warehousing; (3) real estate holdings, where in the context of assigning instrument to the trading book, real estate holdings relate only to direct holdings of real estate as well as derivatives on direct holdings; (4) retail and small or medium-sized enterprise (SME) credit; (5) equity investments in a fund, unless the bank meets at least one of the following conditions: (a) the bank is able to look through the fund to its individual components and there is sufficient and frequent information, verified by an independent third party, provided to the bank regarding the fund’s composition; or (b)the bank obtains daily price quotes for the fund and it has access to the information contained in the fund’s mandate or in the national regulations governing such investment funds; (6)hedge funds; (7)derivative instruments and funds that have the above instrument types as underlying assets; or (8)instruments held for the purpose of hedging a particular risk of a position in the types of instrument above. Retail and SME lending commitments are excluded from the trading book.

Page Number 19 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 5.9 There is a general presumption that any of the following instruments are being held for at least one of the purposes listed in [5.5] and therefore are trading book instruments, unless specifically otherwise provided for in [5.3] or [5.8]: (1) instruments held as accounting trading assets or liabilities;3 (2) instruments resulting from market-making activities; (3) equity investments in a fund excluding those assigned to the banking book in accordance with 5.8; (4) listed equities;4 (5) trading-related repo-style transaction;5 or (6) options including embedded derivatives6 from instruments that the institution issued out of its own banking book and that relate to credit or equity risk. Trading-related repo-style transactions comprise those entered into for the purposes of market-making, locking in arbitrage profits or creating short credit or equity positions. Liabilities issued out of the bank’s own banking book that contain embedded derivatives and thereby meet the criteria of 5.9 should be bifurcated. This means that banks should split the liability into two components: (i) the embedded derivative, which is assigned to the trading book; and (ii) the residual liability, which is retained in the banking book. No internal risk transfers are necessary for this bifurcation. Likewise, where such a liability is unwound, or where an embedded option is exercised, both the trading and banking book components are conceptually unwound simultaneously and instantly retired; no transfers between trading and banking book are necessary.

3 Under IFRS (IAS 39) and US GAAP, these instruments would be designated as held for trading. Under IFRS 9, these instruments would be held within a trading business model. These instruments would be fair valued through the P&L account. 4 Subject to SAMA review, certain listed equities may be excluded from the market risk framework. Examples of equities that may be excluded include, but are not limited to, equity positions arising from deferred compensation plans, convertible debt securities, loan products with interest paid in the form of “equity kickers”, equities taken as a debt previously contracted, bank￾owned life insurance products, and legislated programmes. The set of listed equities that the bank wishes to exclude from the market risk framework should be made available to, and discussed with, SAMA and should be managed by a desk that is separate from desks for proprietary or short-term buy/sell instruments. 5 Repo-style transactions that are (i) entered for liquidity management and (ii) valued at accrual for accounting purposes are not part of the presumptive list of [5.9]. 6 An embedded derivative is a component of a hybrid contract that includes a non- derivative host such as liabilities issued out of the bank’s own banking book that contain embedded derivatives. The embedded derivative associated with the issued instrument (ie host) should be bifurcated and separately recognised on the bank’s balance sheet for accounting purposes.

Page Number 20 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 An option that manages FX risk in the banking book is covered by the presumptive list of trading book instruments included in 5.9. Only with SAMA Written approval may a bank include in its banking book an option that manages banking book FX risk. The reference in 5.9 that relate to credit or equity risk include; a floor to an equity￾linked bond is an embedded option with an equity as part of the underlying, and therefore the embedded option should be bifurcated and included in the trading book. 5.10 Banks are allowed to deviate from the presumptive list specified in [5.9] according to the process set out below7 . (1) If a bank believes that it needs to deviate from the presumptive list established in [5.9] for an instrument, it must submit a request to SAMA and receive Written approval. In its request, the bank must provide evidence that the instrument is not held for any of the purposes in [5.5]. (2) In cases where this approval is not given by SAMA, the instrument must be designated as a trading book instrument. Banks must document any deviations from the presumptive list in detail on an on-going basis. SAMA Supervisory expectation 5.11 Notwithstanding the process established in [5.10] for instruments on the presumptive list, SAMA may require the bank to provide evidence that an instrument in the trading book is held for at least one of the purposes of [5.5]. If SAMA is of the view that a bank has not provided enough evidence or if SAMA believes the instrument customarily would belong in the banking book, SAMA may require the bank to assign the instrument to the banking book, except if it is an instrument listed under [5.6]. 5.12 SAMA may require the bank to provide evidence that an instrument in the banking book is not held for any of the purposes of [5.5]. If SAMA is of the view that a bank has not provided enough evidence, or if SAMA believes such instruments would customarily belong in the trading book, SAMA may require the bank to assign the instrument to the trading book, except if it is an instrument listed under [5.8]. Documentation of instrument designation 5.13 A bank must have clearly defined policies, procedures and documented practices for determining which instruments to include in or to exclude from the trading book for the purposes of calculating their regulatory capital, ensuring compliance

7 The presumptions for the designation of an instrument to the trading book or banking book set out in this text will be used where a designation of an instrument to the trading book or banking book is not otherwise specified in this text.

Page Number 21 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 with the criteria set forth in this section, and taking into account the bank’s risk management capabilities and practices. A bank’s internal control functions must conduct an ongoing evaluation of instruments both in and out of the trading book to assess whether its instruments are being properly designated initially as trading or non-trading instruments in the context of the bank’s trading activities. Compliance with the policies and procedures must be fully documented and subject to periodic (at least yearly) internal audit and the results must be available for SAMA review. Restrictions on moving instruments between the regulatory books 5.14 Apart from moves required by [5.5] through [5.10], there is a strict limit on the ability of banks to move instruments between the trading book and the banking book by their own discretion after initial designation, which is subject to the process in [5.15] and [5.16]. Switching instruments for regulatory arbitrage is strictly prohibited. In practice, switching should be rare and will be allowed by SAMA only in extraordinary circumstances. Examples are a major publicly announced event, such as a bank restructuring that results in the permanent closure of trading desks, requiring termination of the business activity applicable to the instrument or portfolio or a change in accounting standards that allows an item to be fair-valued through P&L. Market events, changes in the liquidity of a financial instrument, or a change of trading intent alone are not valid reasons for reassigning an instrument to a different book. When switching positions, banks must ensure that the standards described in [5.5] to [5.10] are always strictly observed. In the context of [5.14], “change in accounting standards” refers to the accounting standards themselves changing, rather than the accounting classification of an instrument changing. 5.15 Without exception, a capital benefit as a result of switching will not be allowed in any case or circumstance. This means that the bank must determine its total capital requirement (across the banking book and trading book) before and immediately after the switch. If this capital requirement is reduced as a result of this switch, the difference as measured at the time of the switch will be imposed on the bank as a disclosed Pillar 1 capital surcharge. This surcharge will be allowed to run off as the positions mature or expire, in a manner agreed with SAMA. To maintain operational simplicity, it is not envisaged that this additional capital requirement would be recalculated on an ongoing basis, although the positions would continue to also be subject to the ongoing capital requirements of the book into which they have been switched. If an instrument is reclassified for accounting purposes (eg reclassification to accounting trading assets or liabilities through P&L), an automatic prudential switch may be necessary given the requirements set out in [5.5] and 5.10. In this situation, The disallowance of capital benefits [5.15] (regarding an additional Pillar 1 capital requirement) as a result of switching positions from one book to another applies without exception and in any case or

Page Number 22 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 circumstance. It is therefore independent of whether the switch has been made at the discretion of the bank or is beyond its control, eg in the case of the delisting of an equity. 5.16 Any reassignment between books must be approved by senior management and SAMA as follows. Any reallocation of securities between the trading book and banking book, including outright sales at arm’s length, should be considered a reassignment of securities and is governed by requirements of this paragraph. (1) Any reassignment must be approved by senior management thoroughly documented; determined by internal review to be in compliance with the bank’s policies; subject to prior approval by SAMA based on supporting documentation provided by the bank; and publicly disclosed. (2) Unless required by changes in the characteristics of a position, any such reassignment is irrevocable. (3) If an instrument is reclassified to be an accounting trading asset or liability there is a presumption that this instrument is in the trading book, as described in [5.9]. Accordingly, in this case an automatic switch without approval of SAMA is acceptable. The treatment specified for internal risk transfers applies only to risk transfers done via internal derivatives trades. The reallocation of securities between trading and banking book should be considered a re-assignment of securities and is governed by [5.16]. 5.17 A bank must adopt relevant policies that must be updated at least yearly. Updates should be based on an analysis of all extraordinary events identified during the previous year. Updated policies with changes highlighted must be sent to SAMA. Policies must include the following: (1) The reassignment restriction requirements in [5.14] through [5.16], especially the restriction that re-designation between the trading book and banking book may only be allowed in extraordinary circumstances, and a description of the circumstances or criteria where such a switch may be considered. (2) The process for obtaining senior management and SAMA approval for such a transfer. (3) How a bank identifies an extraordinary event. (4) A requirement that re-assignments into or out of the trading book be publicly disclosed at the earliest reporting date.

Page Number 23 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Treatment of internal risk transfers 5.18 An internal risk transfer is an internal written record of a transfer of risk within the banking book, between the banking and the trading book or within the trading book (between different desks). 5.19 There will be no regulatory capital recognition for internal risk transfers from the trading book to the banking book. Thus, if a bank engages in an internal risk transfer from the trading book to the banking book (eg for economic reasons) this internal risk transfer would not be taken into account when the regulatory capital requirements are determined. 5.20 For internal risk transfers from the banking book to the trading book, [5.21] to [5.27] apply. Internal risk transfer of credit and equity risk from banking book to trading book. 5.21 When a bank hedges a banking book credit risk exposure or equity risk exposure using a hedging instrument purchased through its trading book (ie using an internal risk transfer), (1) The credit exposure in the banking book is deemed to be hedged for capital requirement purposes if and only if: (a) The trading book enters into an external hedge with an eligible third￾party protection provider that exactly matches the internal risk transfer; and (b) The external hedge meets the requirements of paragraphs 9.73 to 9.74 and 9.76 9.77 of the SAMA Minimum Capital Requirements for Market Risk vis-à-vis the banking book exposure8 . (2) The equity exposure in the banking book is deemed to be hedged for capital requirement purposes if and only if: (a) The trading book enters into an external hedge from an eligible third￾party protection provider that exactly matches the internal risk transfer; and (b) The external hedge is recognised as a hedge of a banking book equity exposure.

8 With respect to paragraph 9.74 of the SAMA Minimum Capital Requirements for Credit Risk, the cap of 60% on a credit derivative without a restructuring obligation only applies with regard to recognition of credit risk mitigation of the banking book instrument for regulatory capital purposes and not with regard to the amount of the internal risk transfer.

Page Number 24 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) External hedges for the purposes of 5.21 can be made up of multiple transactions with multiple counterparties as long as the aggregate external hedge exactly matches the internal risk transfer, and the internal risk transfer exactly matches the aggregate external hedge. 5.22 Where the requirements in [5.21] are fulfilled, the banking book exposure is deemed to be hedged by the banking book leg of the internal risk transfer for capital purposes in the banking book. Moreover both the trading book leg of the internal risk transfer and the external hedge must be included in the market risk capital requirements. 5.23 Where the requirements in [5.21] are not fulfilled, the banking book exposure is not deemed to be hedged by the banking book leg of the internal risk transfer for capital purposes in the banking book. Moreover, the third-party external hedge must be fully included in the market risk capital requirements and the trading book leg of the internal risk transfer must be fully excluded from the market risk capital requirements. 5.24 A banking book short credit position or a banking book short equity position created by an internal risk transfer9 and not capitalised under banking book rules must be capitalised under the market risk rules together with the trading book exposure. Internal risk transfer of general interest rate risk from banking book to trading book. 5.25 When a bank hedges a banking book interest rate risk exposure using an internal risk transfer with its trading book, the trading book leg of the internal risk transfer is treated as a trading book instrument under the market risk framework if and only if: (1) The internal risk transfer is documented with respect to the banking book interest rate risk being hedged and the sources of such risk; (2) The internal risk transfer is conducted with a dedicated internal risk transfer trading desk which has been specifically approved by SAMA for this purpose; and (3) The internal risk transfer must be subject to trading book capital requirements under the market risk framework on a stand-alone basis for the dedicated

9 Banking book instruments that are over-hedged by their respective documented internal risk transfer create a short (risk) position in the banking book.

Page Number 25 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 internal risk transfer desk, separate from any other Generalised Interest Rate Risk (GIRR) or other market risks generated by activities in the trading book. 5.26 Where the requirements in [5.25] are fulfilled, the banking book leg of the internal risk transfer must be included in the banking book’s measure of interest rate risk exposures for regulatory capital purposes. 5.27 The SAMA-approved internal risk transfer desk may include instruments purchased from the market (ie external parties to the bank). Such transactions may be executed directly between the internal risk transfer desk and the market. Alternatively, the internal risk transfer desk may obtain the external hedge from the market via a separate non-internal risk transfer trading desk acting as an agent, if and only if the GIRR internal risk transfer entered into with the non-internal risk transfer trading desk exactly matches the external hedge from the market. In this latter case the respective legs of the GIRR internal risk transfer are included in the internal risk transfer desk and the non-internal risk transfer desk. Internal risk transfers within the scope of application of the market risk capital requirement. 5.28 Internal risk transfers between trading desks within the scope of application of the market risk capital requirements (including FX risk and commodities risk in the banking book) will generally receive regulatory capital recognition. Internal risk transfers between the internal risk transfer desk and other trading desks will only receive regulatory capital recognition if the constraints in [5.25] to [5.27] are fulfilled. 5.29 The trading book leg of internal risk transfers must fulfil the same requirements under [25] as instruments in the trading book transacted with external counterparties. Eligible hedges for the CVA capital requirement. 5.30 Eligible external hedges that are included in the credit valuation adjustment (CVA) capital requirement must be removed from the bank’s market risk capital requirement calculation. FX and commodity risk, arising from CVA hedges that are eligible under the CVA standard, are excluded from the bank’s market risk capital requirements calculation 5.31 Banks may enter into internal risk transfers between the CVA portfolio and the trading book. Such an internal risk transfer consists of a CVA portfolio side and a non-CVA portfolio side. Where the CVA portfolio side of an internal risk transfer is recognised in the CVA risk capital requirement, the CVA portfolio side should

Page Number 26 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 be excluded from the market risk capital requirement, while the non-CVA portfolio side should be included in the market risk capital requirement. 5.32 In any case, such internal CVA risk transfers can only receive regulatory capital recognition if the internal risk transfer is documented with respect to the CVA risk being hedged and the sources of such risk. 5.33 Internal CVA risk transfers that are subject to curvature, default risk or residual risk add-on as set out in [6] through [9] may be recognised in the CVA portfolio capital requirement and market risk capital requirement only if the trading book additionally enters into an external hedge with an eligible third-party protection provider that exactly matches the internal risk transfer. 5.34 Independent from the treatment in the CVA risk capital requirement and the market risk capital requirement, internal risk transfers between the CVA portfolio and the trading book can be used to hedge the counterparty credit risk exposure of a derivative instrument in the trading or banking book as long as the requirements of [5.21] are met. 6- Standardised approach: general provisions and structure General provisions 6.1 For the purpose of calculating the market risk capital requirements, all Banks (D￾SIBs and Non D-SIBs) are required to calculate the market risk capital charge by using the Standardised Approach. 6.2 The risk-weighted assets for market risk under the standardised approach are determined by multiplying the capital requirements calculated as set out in [6] to [9] by 12.5. 6.3 A bank must also determine its regulatory capital requirements for market risk according to the standardised approach for market risk at the demand of SAMA. Structure of the standardised approach 6.4 The standardised approach capital requirement is the simple sum of three components: the capital requirement under the sensitivities-based method, the default risk capital (DRC) requirement and the residual risk add-on (RRAO). (1) The capital requirement under the sensitivities-based method must be calculated by aggregating three risk measures – delta, vega and curvature, as set out in [7]: (a) Delta: a risk measure based on sensitivities of an instrument to regulatory delta risk factors.

Page Number 27 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) Vega: a risk measure based on sensitivities to regulatory vega risk factors. (c) Curvature: a risk measure which captures the incremental risk not captured by the delta risk measure for price changes in an option. Curvature risk is based on two stress scenarios involving an upward shock and a downward shock to each regulatory risk factor. (d) The above three risk measures specify risk weights to be applied to the regulatory risk factor sensitivities. To calculate the overall capital requirement, the risk-weighted sensitivities are aggregated using specified correlation parameters to recognise diversification benefits between risk factors. In order to address the risk that correlations may increase or decrease in periods of financial stress, a bank must calculate three sensitivities-based method capital requirement values, based on three different scenarios on the specified values for the correlation parameters as set out in [7.6] and [7.7]]. (2) The DRC requirement captures the jump-to-default risk for instruments subject to credit risk as set out in [8.2]. It is calibrated based on the credit risk treatment in the banking book in order to reduce the potential discrepancy in capital requirements for similar risk exposures across the bank. Some hedging recognition is allowed for similar types of exposures (corporates, sovereigns, and local governments/municipalities). (3) SAMA recognaize that not all market risks can be captured in the standardised approach, as this might necessitate an unduly complex regime. An RRAO is thus introduced to ensure sufficient coverage of market risks for instruments specified in [9.2]. The calculation method for the RRAO is set out in [9.8]. Definition of correlation trading portfolio 6.5 For the purpose of calculating the credit spread risk capital requirement under the sensitivities based method and the DRC requirement, the correlation trading portfolio is defined as the set of instruments that meet the requirements of (1) or (2) below. (1) The instrument is a securitisation position that meets the following requirements: (a) The instrument is not a re-securitisation position, nor a derivative of securitisation exposures that does not provide a pro rata share in the proceeds of a securitisation tranche, where the definition of securitisation positon is identical to that used in the credit risk framework.

Page Number 28 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) All reference entities are single-name products, including single-name credit derivatives, for which a liquid two-way market exists10 , including traded indices on these reference entities. (c) The instrument does not reference an underlying that is treated as a retail exposure, a residential mortgage exposure, or a commercial mortgage exposure under the standardised approach to credit risk. (d) The instrument does not reference a claim on a special purpose entity. (2) The instrument is a non-securitisation hedge to a position described above. 7- Standardised approach: sensitivities-based method Main concepts of the sensitivities-based method 7.1 The sensitivities of financial instruments to a prescribed list of risk factors are used to calculate the delta, vega and curvature risk capital requirements. These sensitivities are risk-weighted and then aggregated, first within risk buckets (risk factors with common characteristics) and then across buckets within the same risk class as set out in [7.8] to [7.14]. The following terminology is used in the sensitivities-based method: (1) Risk class: seven risk classes are defined (in [7.39] to [7.89]). (a) General interest rate risk (GIRR) (b) Credit spread risk (CSR): non-securitisations (c) CSR: securitisations (non-correlation trading portfolio, or non-CTP) (d) CSR: securitisations (correlation trading portfolio, or CTP) (e) Equity risk (f) Commodity risk (g) Foreign exchange (FX) risk

10 A two-way market is deemed to exist where there are independent bona fide offers to buy and sell so that a price reasonably related to the last sales price or current bona fide competitive bid-ask quotes can be determined within one day and the transaction settled at such price within a relatively short time frame in conformity with trade custom.

Page Number 29 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) Risk factor: variables (eg an equity price or a tenor of an interest rate curve) that affect the value of an instrument as defined in [7.8] to [7.14] (3) Bucket: a set of risk factors that are grouped together by common characteristics (eg all tenors of interest rate curves for the same currency), as defined in [7.39] to [7.89]. (4) Risk position: the portion of the risk of an instrument that relates to a risk factor. Methodologies to calculate risk positions for delta, vega and curvature risks are set out in [7.3] to [7.5] and [7.15] to [7.26]. (a) For delta and vega risks, the risk position is a sensitivity to a risk factor. (b) For curvature risk, the risk position is based on losses from two stress scenarios. (5) Risk capital requirement: the amount of capital that a bank should hold as a consequence of the risks it takes; it is computed as an aggregation of risk positions first at the bucket level, and then across buckets within a risk class defined for the sensitivities-based method as set out in [7.3] to [7.7]. Instruments subject to each component of the sensitivities-based method 7.2 In applying the sensitivities-based method, all instruments held in trading desks as set out in [4] and subject to the sensitivities-based method (ie excluding instruments where the value at any point in time is purely driven by an exotic underlying as set out in [9.3]), are subject to delta risk capital requirements. Additionally, the instruments specified in (1) to (4) are subject to vega and curvature risk capital requirements: (1) Any instrument with optionality11 . (2) Any instrument with an embedded prepayment option12 this is considered an instrument with optionality according to above (1). The embedded option is subject to vega and curvature risk with respect to interest rate risk and CSR (non-securitisation and securitisation) risk classes. When the prepayment option is a behavioural option the instrument may also be subject to the

11 For example, each instrument that is an option or that includes an option (eg an embedded option such as convertibility or rate dependent prepayment and that is subject to the capital requirements for market risk). A non-exhaustive list of example instruments with optionality includes: calls, puts, caps, floors, swaptions, barrier options and exotic options. 12 An instrument with a prepayment option is a debt instrument which grants the debtor the right to repay part of or the entire principal amount before the contractual maturity without having to compensate for any foregone interest. The debtor can exercise this option with a financial gain to obtain funding over the remaining maturity of the instrument at a lower rate in other ways in the market.

Page Number 30 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 residual risk add-on (RRAO) as per [9]. The pricing model of the bank must reflect such behavioural patterns where relevant. For securitisation tranches, instruments in the securitised portfolio may have embedded prepayment options as well. In this case the securitisation tranche may be subject to the RRAO. (3) Instruments whose cash flows cannot be written as a linear function of underlying notional. For example, the cash flows generated by a plain-vanilla option cannot be written as a linear function (as they are the maximum of the spot and the strike). Therefore, all options are subject to vega risk and curvature risk. Instruments whose cash flows can be written as a linear function of underlying notional are instruments without optionality (eg cash flows generated by a coupon bearing bond can be written as a linear function) and are not subject to vega risk nor curvature risk capital requirements. (4) Curvature risks may be calculated for all instruments subject to delta risk, not limited to those subject to vega risk as specified in (1) to (3) above. For example, where a bank manages the non-linear risk of instruments with optionality and other instruments holistically, the bank may choose to include instruments without optionality in the calculation of curvature risk. This treatment is allowed subject to all of the following restrictions: (a) Use of this approach shall be applied consistently through time. (b) Curvature risk must be calculated for all instruments subject to the sensitivities- based method. Process to calculate the capital requirement under the sensitivities-based method 7.3 As set out in [7.1], the capital requirement under the sensitivities-based method is calculated by aggregating delta, vega and curvature capital requirements. The relevant paragraphs that describe this process are as follows: (1) The risk factors for delta, vega and curvature risks for each risk class are defined in [7.8] to [7.14]. (2) The methods to risk weight sensitivities to risk factors and aggregate them to calculate delta and vega risk positions for each risk class are set out in [7.4] and [7.15] to [7.95], which include the definition of delta and vega sensitivities, definition of buckets, risk weights to apply to risk factors, and correlation parameters. (3) The methods to calculate curvature risk are set out in [7.5] and [7.96] to [7.101], which include the definition of buckets, risk weights and correlation parameters.

Page Number 31 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (4) The risk class level capital requirement calculated above must be aggregated to obtain the capital requirement at the entire portfolio level as set out in [7.6] and [7.7]. Calculation of the delta and vega risk capital requirement for each risk class 7.4 For each risk class, a bank must determine its instruments’ sensitivity to a set of prescribed risk factors, risk weight those sensitivities, and aggregate the resulting risk-weighted sensitivities separately for delta and vega risk using the following step-by-step approach: (1) For each risk factor (as defined in [7.8] to [7.14]), a sensitivity is determined as set out in [7.15] to [7.38]. (2) Sensitivities to the same risk factor must be netted to give a net sensitivity S𝑘 across all instruments in the portfolio to each risk factor k. In calculating the net sensitivity, all sensitivities to the same given risk factor (eg all sensitivities to the one-year tenor point of the three-month Euribor swap curve) from instruments of opposite direction should offset, irrespective of the instrument from which they derive. For instance, if a bank’s portfolio is made of two interest rate swaps on three-month Euribor with the same fixed rate and same notional but of opposite direction, the GIRR on that portfolio would be zero. (3) The weighted sensitivity 𝑊S𝑘 is the product of the net sensitivity S 𝑘 and the corresponding risk weight RWk as defined in [7.39] to [7.95]. (4) Within bucket aggregation: the risk position for delta (respectively vega) bucket b, 𝐾𝑏, must be determined by aggregating the weighted sensitivities to risk factors within the same bucket using the prescribed correlation 𝜌𝑘ɭ set out in the following formula, where the quantity within the square root function is floored at zero: (5) Across bucket aggregation: The delta (respectively vega) risk capital requirement is calculated by aggregating the risk positions across the delta (respectively vega) buckets within each risk class, using the corresponding prescribed correlations 𝛾𝑏c as set out in the following formula, where: (a) Sb = ∑k WSk for all risk factors in bucket b, and Sc = ∑k WSk in bucket c.

Page Number 32 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) If these values for Sb and Sc described in above 7.4(a) produce a negative number for the overall sum of ∑𝑏 𝐾𝑏 2 + ∑𝑏 ∑c≠𝑏 𝛾𝑏c S𝑏Sc, the bank is to calculate the delta (respectively vega) risk capital requirement using an alternative specification whereby: (i) Sb=max [min (∑k WSk ,Kb), − Kb] for all risk factors in bucket b; and (ii) Sc=max [min (∑k WSk ,Kc), − Kc] for all risk factors in bucket c. Calculation of the curvature risk capital requirement for each risk class 7.5 For each risk class, to calculate curvature risk capital requirements a bank must apply an upward shock and a downward shock to each prescribed risk factor and calculate the incremental loss for instruments sensitive to that risk factor above that already captured by the delta risk capital requirement using the following step￾by-step approach: (1) For each instrument sensitive to curvature risk factor k, an upward shock and a downward shock must be applied to k. The size of shock (ie risk weight) is set out in [7.98] and [7.99]. (a) For example for GIRR, all tenors of all the risk free interest rate curves within a given currency (eg three-month Euribor, six-month Euribor, one year Euribor, etc for the euro) must be shifted upward applying the risk weight as set out in [7.99]. The resulting potential loss for each instrument, after the deduction of the delta risk positions, is the outcome of the upward scenario. The same approach must be followed on a downward scenario. (b) If the price of an instrument depends on several risk factors, the curvature risk must be determined separately for each risk factor. (2) The net curvature risk capital requirement, determined by the values 𝐶V𝑅 + 𝑘 and 𝐶V𝑅 − 𝑘 for a bank’s portfolio for risk factor k described in above 7.5 is calculated by the formula below. It calculates the aggregate incremental loss beyond the delta capital requirement for the prescribed shocks, where (a) i is an instrument subject to curvature risks associated with risk factor k;

Page Number 33 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) 𝑥𝑘 is the current level of risk factor k; (c) Vi (X k ) is the price of instrument i at the current level of risk factor k; (d) Vi (Xk (RW (curvature)+)) and Vi (Xk (RW (curvature)-) ) denote the price of instrument i after 𝑥𝑘 is shifted (ie “shocked”) upward and downward respectively; (e) (curvature) is the risk weight for curvature risk factor k for instrument i; and (f) 𝑠𝑖𝑘 is the delta sensitivity of instrument i with respect to the delta risk factor that corresponds to curvature risk factor k, where: (i) For the FX and equity risk classes, S𝑖𝑘 is the delta sensitivity of instrument i; and (iii) For the GIRR, CSR and commodity risk classes, S𝑖𝑘 is the sum of delta sensitivities to all tenors of the relevant curve of instrument i with respect to curvature risk factor k. (3) Within bucket aggregation: the curvature risk exposure must be aggregated within each bucket using the corresponding prescribed correlation 𝜌𝑘ɭ as set out in the following formula, where: (a) The bucket level capital requirement (𝐾𝑏) is determined as the greater of the capital requirement under the upward scenario ( + 𝑏 ) and the capital requirement under the downward scenario (𝐾𝑏− 𝑏 ). Notably, the selection of upward and downward scenarios is not necessarily the same across the high, medium and low correlations scenarios specified in [7.6]. (i) Where 𝐾𝑏 = 𝐾 + 𝑏 , this shall be termed “selecting the upward scenario”. (ii) Where 𝐾𝑏 = 𝐾𝑏− 𝑏 , this shall be termed “selecting the downward scenario”.

Page Number 34 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (iii) In the specific case where 𝐾 + 𝑏 = 𝐾𝑏− 𝑏 if ∑k 𝐶V𝑅 + 𝑘

∑k 𝐶V𝑅 − 𝑘 , it is deemed that the upward scenario is selected; otherwise the downward scenario is selected. (b) ψ(𝐶V𝑅𝑘, 𝐶V𝑅ɭ) takes the value 0 if 𝐶V𝑅𝑘 and 𝐶V𝑅ɭ both have negative signs and the value 1 otherwise. (4) Across bucket aggregation: curvature risk positions must then be aggregated across buckets within each risk class, using the corresponding prescribed correlations 𝛾𝑏c , where: (a) S𝑏 = ∑𝑘 𝐶V𝑅

𝑘 for all risk factors in bucket b, when the upward scenario has been selected for bucket b in above (3)(a). S𝑏 = ∑𝑘 𝐶V𝑅 − 𝑘 otherwise; and (b) (S𝑏, Sc) takes the value 0 if S𝑏 and Sc both have negative signs and 1 otherwise. The delta used for the calculation of the curvature risk capital requirement should be the same as that used for calculating the delta risk capital requirement. The assumptions that are used for the calculation of the delta (ie sticky delta for normal or log-normal volatilities) should also be used for calculating the shifted or shocked price of the instrument. [7.17] states that banks must determine each delta sensitivity, vega sensitivity and curvature scenario based on instrument prices or pricing models that an independent risk control unit within a bank uses to report market risks or actual profits and losses to senior management. Banks should use zero rate or market rate sensitivities consistent with the pricing models referenced in that paragraph. Calculation of aggregate sensitivities-based method capital requirement 7.6 In order to address the risk that correlations increase or decrease in periods of financial stress, the aggregation of bucket level capital requirements and risk class

Page Number 35 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 level capital requirements per each risk class for delta, vega, and curvature risks as specified in [7.4] to [7.5] must be repeated, corresponding to three different scenarios on the specified values for the correlation parameter 𝜌𝑘ɭ (correlation between risk factors within a bucket) and 𝛾𝑏c (correlation across buckets within a risk class). (1) Under the “medium correlations” scenario, the correlation parameters 𝜌𝑘ɭ and 𝛾𝑏c as specified in [7.39] to [7.101] apply. (2) Under the “high correlations” scenario, the correlation parameters 𝜌𝑘ɭ and 𝛾𝑏c that are specified in [7.39] to [7.101] are uniformly multiplied by 1.25, with 𝜌𝑘ɭ and 𝛾𝑏c subject to a cap at 100%. (3) Under the “low correlations” scenario, the correlation parameters 𝜌𝑘ɭ and 𝛾𝑏c that are specified in 7.39 to 7.101] are replaced by 𝜌 𝑙𝑜𝑤 𝑘ɭ = max(2 × 𝜌𝑘ɭ − 100%;75%×𝜌𝑘ɭ) and 𝛾 𝑙𝑜𝑤 𝑏𝑐 =max(2× 𝛾bc −100%;75%× 𝛾bc ). 7.7 The total capital requirement under the sensitivities-based method is aggregated as follows: (1) For each of three correlation scenarios, the bank must simply sum up the separately calculated delta, vega and curvature capital requirements for all risk classes to determine the overall capital requirement for that scenario. (2) The sensitivities-based method capital requirement is the largest capital requirement from the three scenarios. (a) For the calculation of capital requirements for all instruments in all trading desks using the standardised approach as set out in 3.10 and [17.2] and [13.40], the capital requirement is calculated for all instruments in all trading desks. (b) For the calculation of capital requirements for each trading desk using the standardised approach as if that desk were a standalone regulatory portfolio as set out in 3.8, the capital requirements under each correlation scenario are calculated and compared at each trading desk level, and the maximum for each trading desk is taken as the capital requirement. Sensitivities-based method: risk factor and sensitivity definitions Risk factor definitions for delta, vega and curvature risks

Page Number 36 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.8 GIRR factors (1) Delta GIRR: the GIRR delta risk factors are defined along two dimensions: (i) a risk-free yield curve for each currency in which interest rate-sensitive instruments are denominated and (ii) the following tenors: 0.25 years, 0.5 years, 1 year, 2 years, 3 years, 5 years, 10 years, 15 years, 20 years and 30 years, to which delta risk factors are assigned13 . (a) The risk-free yield curve per currency should be constructed using money market instruments held in the trading book that have the lowest credit risk, such as overnight index swaps (OIS). Alternatively, the risk-free yield curve should be based on one or more market￾implied swap curves used by the bank to mark positions to market. For example, interbank offered rate (BOR) swap curves. (b) When data on market-implied swap curves described in above (1)(a) are insufficient, the risk-free yield curve may be derived from the most appropriate sovereign bond curve for a given currency. In such cases the sensitivities related to sovereign bonds are not exempt from the CSR capital requirement: when a bank cannot perform the decomposition y=r+cs, any sensitivity to y is allocated both to the GIRR and to CSR classes as appropriate with the risk factor and sensitivity definitions in the standardised approach. Applying swap curves to bond-derived sensitivities for GIRR will not change the requirement for basis risk to be captured between bond and credit default swap (CDS) curves in the CSR class. (c) For the purpose of constructing the risk-free yield curve per currency, an OIS curve (such as Eonia or a new benchmark rate) and a BOR swap curve (such as three-month Euribor or other benchmark rates) must be considered two different curves. Two BOR curves at different maturities (eg three-month Euribor and six-month Euribor) must be considered two different curves. An onshore and an offshore currency curve (eg onshore Indian rupee and offshore Indian rupee) must be considered two different curves. (2) The GIRR delta risk factors also include a flat curve of market-implied inflation rates for each currency with term structure not recognised as a risk factor.

13 The assignment of risk factors to the specified tenors should be performed by linear interpolation or a method that is most consistent with the pricing functions used by the independent risk control function of a bank to report market risks or P&L to senior management.

Page Number 37 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (a) The sensitivity to the inflation rate from the exposure to implied coupons in an inflation instrument gives rise to a specific capital requirement. All inflation risks for a currency must be aggregated to one number via simple sum. (b) This risk factor is only relevant for an instrument when a cash flow is functionally dependent on a measure of inflation (eg the notional amount or an interest payment depending on a consumer price index). GIRR risk factors other than for inflation risk will apply to such an instrument notwithstanding. (c) Inflation rate risk is considered in addition to the sensitivity to interest rates from the same instrument, which must be allocated, according to the GIRR framework, in the term structure of the relevant risk-free yield curve in the same currency. (3) The GIRR delta risk factors also include one of two possible cross-currency basis risk factors14 for each currency (ie each GIRR bucket) with the term structure not recognised as a risk factor (ie both cross-currency basis curves are flat). (a) The two cross-currency basis risk factors are basis of each currency over USD or basis of each currency over EUR. For instance, an AUD￾denominated bank trading a JPY/USD cross-currency basis swap would have a sensitivity to the JPY/USD basis but not to the JPY/EUR basis. (b) Cross-currency bases that do not relate to either basis over USD or basis over EUR must be computed either on “basis over USD” or “basis over EUR” but not both. GIRR risk factors other than for cross￾currency basis risk will apply to such an instrument notwithstanding. (c) Cross-currency basis risk is considered in addition to the sensitivity to interest rates from the same instrument, which must be allocated, according to the GIRR framework, in the term structure of the relevant risk-free yield curve in the same currency.

14 Cross-currency basis are basis added to a yield curve in order to evaluate a swap for which the two legs are paid in two different currencies. They are in particular used by market participants to price cross-currency interest rate swaps paying a fixed or a floating leg in one currency, receiving a fixed or a floating leg in a second currency, and including an exchange of the notional in the two currencies at the start date and at the end date of the swap.

Page Number 38 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (4) Vega GIRR: within each currency, the GIRR vega risk factors are the implied volatilities of options that reference GIRR-sensitive underlyings; as defined along two dimensions:15 (a) The maturity of the option: the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (b) The residual maturity of the underlying of the option at the expiry date of the option: the implied volatility of the option as mapped to two (or one) of the following residual maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (5) Curvature GIRR: (a) The GIRR curvature risk factors are defined along only one dimension: the constructed risk-free yield curve per currency with no term structure decomposition. For example, the euro, Eonia, three-month Euribor and six- month Euribor curves must be shifted at the same time in order to compute the euro-relevant risk-free yield curve curvature risk capital requirement. For the calculation of sensitivities, all tenors (as defined for delta GIRR) are to be shifted in parallel. (b) There is no curvature risk capital requirement for inflation and cross￾currency basis risks. (6) The treatment described in above (1)(b) for delta GIRR also applies to vega GIRR and curvature GIRR risk factors. Different results can be produced depending on the bank’s curve methodology as diversification will be different for different methodologies. For example, if three-month Euribor is constructed as a “spread to EONIA”, this curve will be a spread curve and can be considered a different yield curve for the purpose of computing risk-weighted PV01 and subsequent diversification. 7.8(c)states that for the purpose of constructing the risk-free yield curve per currency, an overnight index swap curve (such as EONIA) and an interbank offered rate curve (such as three-month Euribor) must be considered two different curves, with distinct risk factors in each tenor bucket, for the purpose of computing the risk capital requirement.

15 For example, an option with a forward starting cap, lasting 12 months, consists of four consecutive caplets on USD three￾month Libor. There are four (independent) options, with option expiry dates in 12, 15, 18 and 21 months. These options are all on underlying USD three-month Libor; the underlying always matures three months after the option expiry date (its residual maturity being three months). Therefore, the implied volatilities for a regular forward starting cap, which would start in one year and last for 12 months should be defined along the following two dimensions: (i) the maturity of the option’s individual components (caplets) – 12, 15, 18 and 21 months; and (ii) the residual maturity of the underlying of the option – three months.

Page Number 39 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 For GIRR, CSR, equity risk, commodity risk or FX risk, risk factors need to be assigned to prescribed tenors. Banks are not permitted to perform capital computations based on internally used tenors. Risk factors and sensitivities must be assigned to the prescribed tenors. As stated in footnote 14 to [7.8] and footnote 19 to [7.25], the assignment of risk factors and sensitivities to the specified tenors should be performed by linear interpolation or a method that is most consistent with the pricing functions used by the independent risk control function of the bank to report market risks or profits and losses to senior management. When calculating the cross-currency basis spread (CCBS) capital requirement: since pricing models use a term structure-based CCBS curve, Banks may use a term structure-based CCBS curve and aggregate sensitivities to individual tenors by simple sum. Inflation and cross-currency bases are included in the GIRR vega risk capital requirement. As no maturity dimension is specified for the delta capital requirement for inflation or cross￾currency bases (ie the possible underlying of the option), the vega risk for inflation and cross-currency bases should be considered only along the single dimension of the maturity of the option. For the specified instruments, delta, vega and curvature capital requirements must be computed for both GIRR and CSR. Repo rate risk factors for fixed income funding instruments are subject to the GIRR capital requirement. A relevant repo curve should be considered by currency. The risk weights floored for interest rate and credit instruments is not permitted in the market risk standard when applying the risk weights for GIRR or for CSR, given that there is a possibility of the interest rates being negative (eg for JPY and EUR curves) 7.9 CSR non-securitisation risk factors (1) Delta CSR non-securitisation: the CSR non-securitisation delta risk factors are defined along two dimensions: (a) The relevant issuer credit spread curves (bond and CDS); and (b) The following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (2) Vega CSR non-securitisation: the vega risk factors are the implied volatilities of options that reference the relevant credit issuer names as underlyings (bond and CDS); further defined along one dimension - the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years.

Page Number 40 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) Curvature CSR non-securitisation: the CSR non-securitisation curvature risk factors are defined along one dimension: the relevant issuer credit spread curves (bond and CDS). For instance, the bond-inferred spread curve of an issuer and the CDS-inferred spread curve of that same issuer should be considered a single spread curve. For the calculation of sensitivities, all tenors (as defined for CSR) are to be shifted in parallel. For callable bonds, options on sovereign bond futures and bond options, the delta, vega and curvature capital requirements must be computed for both GIRR and CSR. Bond and CDS credit spreads are considered distinct risk factors under 7.19, and pkɭ (𝑏asis)

referenced in [7.54] and [7.55] is meant to capture only the bond-CDS basis. 7.10 CSR securitisation: non-CTP risk factors (1) For securitisation instruments that do not meet the definition of CTP as set out in [6.5] (ie, non-CTP), the sensitivities of delta risk factors (ie CS01) must be calculated with respect to the spread of the tranche rather than the spread of the underlying of the instruments. (2) Delta CSR securitisation (non-CTP): the CSR securitisation delta risk factors are defined along two dimensions: (a) Tranche credit spread curves; and (b) The following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years to which delta risk factors are assigned. (3) Vega CSR securitisation (non-CTP): Vega risk factors are the implied volatilities of options that reference non-CTP credit spreads as underlyings (bond and CDS); further defined along one dimension - the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (4) Curvature CSR securitisation (non-CTP): the CSR securitisation curvature risk factors are defined along one dimension, the relevant tranche credit spread curves (bond and CDS). For instance, the bond-inferred spread curve of a given Spanish residential mortgage- backed security (RMBS) tranche and the CDS-inferred spread curve of that given Spanish RMBS tranche would be considered a single spread curve. For the calculation of sensitivities, all the tenors are to be shifted in parallel. 7.11 CSR securitisation: CTP risk factors

Page Number 41 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) For securitisation instruments that meet the definition of a CTP as set out in [6.5], the sensitivities of delta risk factors (ie CS01) must be computed with respect to the names underlying the securitisation or nth-to-default instrument. (2) Delta CSR securitisation (CTP): the CSR correlation trading delta risk factors are defined along two dimensions: (a) The relevant underlying credit spread curves (bond and CDS); and (b) The following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years, to which delta risk factors are assigned. (3) Vega CSR securitisation (CTP): the vega risk factors are the implied volatilities of options that reference CTP credit spreads as underlyings (bond and CDS), as defined along one dimension, the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (4) Curvature CSR securitisation (CTP): the CSR correlation trading curvature risk factors are defined along one dimension, the relevant underlying credit spread curves (bond and CDS). For instance, the bond-inferred spread curve of a given name within an iTraxx series and the CDS-inferred spread curve of that given underlying would be considered a single spread curve. For the calculation of sensitivities, all the tenors are to be shifted in parallel. 7.12 Equity risk factors (1) Delta equity: the equity delta risk factors are: (a) all the equity spot prices; and (b) all the equity repurchase agreement rates (equity repo rates). (2) Vega equity: (a) The equity vega risk factors are the implied volatilities of options that reference the equity spot prices as underlyings as defined along one dimension, the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (b) There is no vega risk capital requirement for equity repo rates. (3) Curvature equity: (a) The equity curvature risk factors are all the equity spot prices.

Page Number 42 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) There is no curvature risk capital requirement for equity repo rates. Repo rate risk factors for fixed income funding instruments are subject to the GIRR capital requirement. A relevant repo curve should be considered by currency. 7.13 Commodity risk factors (1) Delta commodity: the commodity delta risk factors are all the commodity spot prices. However for some commodities such as electricity (which is defined to fall within bucket 3 (energy – electricity and carbon trading) in [7.82] the relevant risk factor can either be the spot or the forward price, as transactions relating to commodities such as electricity are more frequent on the forward price than transactions on the spot price. Commodity delta risk factors are defined along two dimensions: (a) Legal terms with respect to the delivery location16of the commodity; and (b) Time to maturity of the traded instrument at the following tenors: 0 years, 0.25 years, 0.5 years, 1 year, 2 years, 3 years, 5 years, 10 years, 15 years, 20 years and 30 years. (2) Vega commodity: the commodity vega risk factors are the implied volatilities of options that reference commodity spot prices as underlyings. No differentiation between commodity spot prices by the maturity of the underlying or delivery location is required. The commodity vega risk factors are further defined along one dimension, the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (3) Curvature commodity: the commodity curvature risk factors are defined along only one dimension, the constructed curve (ie no term structure decomposition) per commodity spot prices. For the calculation of sensitivities, all tenors (as defined for delta commodity) are to be shifted in parallel. The current prices for futures and forward contracts should be used to compute the commodity delta risk factors. Commodity delta should be allocated to the relevant tenor

16 For example, a contract that can be delivered in five ports can be considered having the same delivery location as another contract if and only if it can be delivered in the same five ports. However, it cannot be considered having the same delivery location as another contract that can be delivered in only four (or less) of those five ports.

Page Number 43 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 based on the tenor of the futures and forward contract and given that spot commodity price positions should be slotted into the first tenor (0 years). 7.14 FX risk factors (1) Delta FX: the FX delta risk factors are defined below. (a) The FX delta risk factors are all the exchange rates between the currency in which an instrument is denominated and the reporting currency. For transactions that reference an exchange rate between a pair of non-reporting currencies, the FX delta risk factors are all the exchange rates between: (i) the reporting currency; and (ii) both the currency in which an instrument is denominated and any other currencies referenced by the instrument.17 (b) Subject to SAMA approval, FX risk may alternatively be calculated relative to a base currency instead of the reporting currency. In such case the bank must account for not only: (i) the FX risk against the base currency; but also (ii) the FX risk between the reporting currency and the base currency (ie translation risk). (c) The resulting FX risk calculated relative to the base currency as set out in (b) is converted to the capital requirements in the reporting currency using the spot reporting/base exchange rate reflecting the FX risk between the base currency and the reporting currency. (d) The FX base currency approach may be allowed under the following conditions: (i) To use this alternative, a bank may only consider a single currency as its base currency; and (ii) The bank shall demonstrate to SAMA that calculating FX risk relative to their proposed base currency provides an appropriate risk representation for their portfolio (for example, by

17 For example, for an FX forward referencing USD/JPY, the relevant risk factors for a CAD- reporting bank to consider are the exchange rates USD/CAD and JPY/CAD. If that CAD- reporting bank calculates FX risk relative to a USD base currency, it would consider separate deltas for the exchange rate JPY/USD risk and CAD/USD FX translation risk and then translate the resulting capital requirement to CAD at the USD/CAD spot exchange rate.

Page Number 44 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 demonstrating that it does not inappropriately reduce capital requirements relative to those that would be calculated without the base currency approach) and that the translation risk between the base currency and the reporting currency is taken into account. (2) Vega FX: the FX vega risk factors are the implied volatilities of options that reference exchange rates between currency pairs; as defined along one dimension, the maturity of the option. This is defined as the implied volatility of the option as mapped to one or several of the following maturity tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (3) Curvature FX: the FX curvature risk factors are defined below. (a) The FX curvature risk factors are all the exchange rates between the currency in which an instrument is denominated and the reporting currency. For transactions that reference an exchange rate between a pair of non-reporting currencies, the FX risk factors are all the exchange rates between: (i) the reporting currency; and (ii) both the currency in which an instrument is denominated and any other currencies referenced by the instrument. (b) Where SAMA approval for the base currency approach has been granted for delta risks, FX curvature risks shall also be calculated relative to a base currency instead of the reporting currency, and then converted to the capital requirements in the reporting currency using the spot reporting/base exchange rate. (4) No distinction is required between onshore and offshore variants of a currency for all FX delta, vega and curvature risk factors. 7.14 states: “No distinction is required between onshore and offshore variants of a currency for all FX delta, vega and curvature risk factors.” This is also apply for deliverable/non-deliverable variants (eg KRO vs KRW, BRO vs BRL, INO vs INR) Sensitivities-based method: definition of sensitivities 7.15 Sensitivities for each risk class must be expressed in the reporting currency of the bank. 7.16 For each risk factor defined in [7.8] to [7.14], sensitivities are calculated as the change in the market value of the instrument as a result of applying a specified

Page Number 45 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 shift to each risk factor, assuming all the other relevant risk factors are held at the current level as defined in [7.17] to [7.38]. As per [7.17], a bank may make use of alternative formulations of sensitivities based on pricing models that the bank’s independent risk control unit uses to report market risks or actual profits and losses to senior management. In doing so, the bank is to demonstrate to SAMA that the alternative formulations of sensitivities yield results very close to the prescribed formulations. Requirements on instrument price or pricing models for sensitivity calculation 7.17 In calculating the risk capital requirement under the sensitivities-based method in [7], the bank must determine each delta and vega sensitivity and curvature scenario based on instrument prices or pricing models that an independent risk control unit within a bank uses to report market risks or actual profits and losses to senior management. [7.17] states that banks must determine each delta sensitivity, vega sensitivity and curvature scenario based on instrument prices or pricing models that an independent risk control unit within a bank uses to report market risks or actual profits and losses to senior management. Banks should use zero rate or market rate sensitivities consistent with the pricing models referenced in that paragraph. 7.18 A key assumption of the standardised approach for market risk is that a bank’s pricing models used in actual profit and loss reporting provide an appropriate basis for the determination of regulatory capital requirements for all market risks. To ensure such adequacy, banks must at a minimum establish a framework for Prudent Valuation Guidance set out in Basel Framework . Sensitivity definitions for delta risk 7.19 Delta GIRR: the sensitivity is defined as the PV01. PV01 is measured by changing the interest rate r at tenor t (rt) of the risk-free yield curve in a given currency by 1 basis point (ie 0.0001 in absolute terms) and dividing the resulting change in the market value of the instrument (Vi) by 0.0001 (ie 0.01%) as follows, where: (1) rt is the risk-free yield curve at tenor t; (2) cst is the credit spread curve at tenor t; and (3) Vi is the market value of the instrument i as a function of the risk-free interest rate curve and credit spread curve:

Page Number 46 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.20 Delta CSR non-securitisation, securitisation (non-CTP) and securitisation (CTP): the sensitivity is defined as CS01. The CS01 (sensitivity) of an instrument i is measured by changing a credit spread cs at tenor t (cst) by 1 basis point (ie 0.0001 in absolute terms) and dividing the resulting change in the market value of the instrument (Vi) by 0.0001 (ie 0.01%) as follows: In cases where the bank does not have counterparty-specific money market curves, the bank can proxy PV01 to CS01 7.21 Delta equity spot: the sensitivity is measured by changing the equity spot price by 1 percentage point (ie 0.01 in relative terms) and dividing the resulting change in the market value of the instrument (Vi) by 0.01 (ie 1%) as follows, where: (1) k is a given equity; (2) EQk is the market value of equity k; and (3) Vi is the market value of instrument i as a function of the price of equity k. 7.22 Delta equity repo rates: the sensitivity is measured by applying a parallel shift to the equity repo rate term structure by 1 basis point (ie 0.0001 in absolute terms) and dividing the resulting change in the market value of the instrument Vi by 0.0001 (ie 0.01%) as follows, where: (1) k is a given equity; (2) 𝑅TS𝑘 is the repo term structure of equity k; and (3) Vi is the market value of instrument i as a function of the repo term structure of equity k. 7.23 Delta commodity: the sensitivity is measured by changing the commodity spot price by 1 percentage point (ie 0.01 in relative terms) and dividing the resulting change in the market value of the instrument Vi by 0.01 (ie 1%) as follows, where: (1) k is a given commodity;

Page Number 47 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) CTYk is the market value of commodity k; and (3) Vi is the market value of instrument i as a function of the spot price of commodity k: 7.24 Delta FX: the sensitivity is measured by changing the exchange rate by 1 percentage point (ie 0.01 in relative terms) and dividing the resulting change in the market value of the instrument Vi by 0.01 (ie 1%), where: (1) k is a given currency; (2) FXk is the exchange rate between a given currency and a bank’s reporting currency or base currency, where the FX spot rate is the current market price of one unit of another currency expressed in the units of the bank’s reporting currency or base currency; and (3) Vi is the market value of instrument i as a function of the exchange rate k: Sensitivity definitions for vega risk 7.25 The option-level vega risk sensitivity to a given risk factor18 is measured by multiplying vega by the implied volatility of the option as follows, where: (1) vega, ∂vi ∂σi , is defined as the change in the market value of the option V𝑖 as a result of a small amount of change to the implied volatility 𝜎𝑖; and (2) the instrument’s vega and implied volatility used in the calculation of vega sensitivities must be sourced from pricing models used by the independent risk control unit of the bank. 7.26 The following sets out how to derive vega risk sensitivities in specific cases:

18 As specified in the vega risk factor definitions in [7.8] to [7.14], the implied volatility of the option must be mapped to one or more maturity tenors.

Page Number 48 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) Options that do not have a maturity, are assigned to the longest prescribed maturity tenor, and these options are also assigned to the RRAO. (2) Options that do not have a strike or barrier and options that have multiple strikes or barriers, are mapped to strikes and maturity used internally to price the option, and these options are also assigned to the RRAO. (3) CTP securitisation tranches that do not have an implied volatility, are not subject to vega risk capital requirement. Such instruments may not, however, be exempt from delta and curvature risk capital requirements. Under the sensitivities-based method and In the case where options do not have a specified maturity (eg cancellable swaps), the bank must assign those options to the longest prescribed maturity tenor for vega risk sensitivities and also assign such options to the RRAO. In the case of the bank viewing the optionality of the cancellable swap as a swaption, the bank must assign the swaption to the longest prescribed maturity tenor for vega risk sensitivities (as it does not have a specified maturity) and derive the residual maturity of the underlying of the option accordingly. Requirements on sensitivity computations 7.27 When computing a first-order sensitivity for instruments subject to optionality, banks should assume that the implied volatility either: (1) remains constant, consistent with a “sticky strike” approach; or (2) follows a “sticky delta” approach, such that implied volatility does not vary with respect to a given level of delta. 7.28 For the calculation of vega sensitivities, the distribution assumptions (ie log￾normal assumptions or normal assumptions) for pricing models are applied as follows: (1) For the computation of a vega GIRR or CSR sensitivity, banks may use either the log- normal or normal assumptions. (2) For the computation of a vega equity, commodity or FX sensitivity, banks must use the log-normal assumption.19

19 Since vega (, ∂v ∂σi ) of an instrument is multiplied by its implied volatility ( ), the vega risk sensitivity for that instrument will be the same under the log-normal assumption and the normal assumption. As a consequence, banks may use a log-normal or normal assumption for GIRR and CSR (in recognition of the trade-offs between constrained specification and computational burden for a standardised approach). For the other risk classes, banks must only use a log-normal assumption (in recognition that this is aligned with common practices across jurisdictions).

Page Number 49 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 To compute vega GIRR, banks may choose a mix of log-normal and normal assumptions for different currencies. 7.29 If, for internal risk management, a bank computes vega sensitivities using different definitions than the definitions set out in this standard, the bank may transform the sensitivities computed for internal risk management purposes to deduce the sensitivities to be used for the calculation of the vega risk measure. 7.30 All vega sensitivities must be computed ignoring the impact of credit valuation adjustments (CVA). Treatment of index instruments and multi-underlying options 7.31 In the delta and curvature risk context: for index instruments and multi-underlying options, a look-through approach should be used. However, a bank may opt not to apply the look-through approach for instruments referencing any listed and widely recognised and accepted equity or credit index, where: (1) it is possible to look-through the index (ie the constituents and their respective weightings are known); (2) the index contains at least 20 constituents; (3) no single constituent contained within the index represents more than 25% of the total index; (4) the largest 10% of constituents represents less than 60% of the total index; and (5) the total market capitalisation of all the constituents of the index is no less than USD 40 billion. 7.32 For a given instrument, irrespective of whether a look-through approach is adopted or not, the sensitivity inputs used for the delta and curvature risk calculation must be consistent. 7.33 Where a bank opts not to apply the look-through approach in accordance with [7.31], a single sensitivity shall be calculated to each widely recognised and accepted index that an instrument references. The sensitivity to the index should be assigned to the relevant delta risk bucket defined in [7.53] and [7.72] as follows: (1) Where more than 75% of constituents in that index (taking into account the weightings of that index) would be mapped to a specific sector bucket (ie bucket 1 to bucket 11 for equity risk, or bucket 1 to bucket 16 for CSR), the sensitivity to the index shall be mapped to that single specific sector bucket and treated like any other single-name sensitivity in that bucket.

Page Number 50 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) In all other cases, the sensitivity may be mapped to an “index” bucket (ie bucket 12 or bucket 13 for equity risk; or bucket 17 or bucket 18 for CSR). 7.34 A look-through approach must always be used for indices that do not meet the criteria set out in 7.31 to 7.31, and for any multi-underlying instruments that reference a bespoke set of equities or credit positions. (1) Where a look-through approach is adopted, for index instruments and multi￾underlying options other than the CTP, the sensitivities to constituent risk factors from those instruments or options are allowed to net with sensitivities to single-name instruments without restriction. (2) Index CTP instruments cannot be broken down into its constituents (ie the index CTP should be considered a risk factor as a whole) and the above￾mentioned netting at the issuer level does not apply either. (3) Where a look-through approach is adopted, it shall be applied consistently through time,20 and shall be used for all identical instruments that reference the same index. Treatment of equity investments in funds 7.35 For equity investments in funds that can be looked through as set out in 5.8(a), banks must apply a look-through approach and treat the underlying positions of the fund as if the positions were held directly by the bank (taking into account the bank’s share of the equity of the fund, and any leverage in the fund structure), except for the funds that meet the following conditions: (1) For funds that hold an index instrument that meets the criteria set out under [7.31], banks must still apply a look-through and treat the underlying positions of the fund as if the positions were held directly by the bank, but the bank may then choose to apply the “no look-through” approach for the index holdings of the fund as set out in [7.33]. (2) For funds that track an index benchmark, a bank may opt not to apply the look-through approach and opt to measure the risk assuming the fund is a position in the tracked index only where: (a) the fund has an absolute value of a tracking difference (ignoring fees and commissions) of less than 1%; and

20 In other words, a bank can initially not apply a look-through approach, and later decide to apply it. However once applied (for a certain type of instrument referencing a particular index), the bank will require SAMA approval to revert to a “no look-through” approach.

Page Number 51 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) the tracking difference is checked at least annually and is defined as the annualised return difference between the fund and its tracked benchmark over the last 12 months of available data (or a shorter period in the absence of a full 12 months of data). 7.36 For equity investments in funds that cannot be looked through (ie do not meet the criterion set out in 5.8(a)), but that the bank has access to daily price quotes and knowledge of the mandate of the fund (ie meet both the criteria set out in 5.8(b)), banks may calculate capital requirements for the fund in one of three ways: (1) If the fund tracks an index benchmark and meets the requirement set out in 7.35(a) and (b), the bank may assume that the fund is a position in the tracked index, and may assign the sensitivity to the fund to relevant sector specific buckets or index buckets as set out in [7.33]. (2) Subject to SAMA approval, the bank may consider the fund as a hypothetical portfolio in which the fund invests to the maximum extent allowed under the fund’s mandate in those assets attracting the highest capital requirements under the sensitivities-based method, and then progressively in those other assets implying lower capital requirements. If more than one risk weight can be applied to a given exposure under the sensitivities-based method, the maximum risk weight applicable must be used. (a) This hypothetical portfolio must be subject to market risk capital requirements on a stand-alone basis for all positions in that fund, separate from any other positions subject to market risk capital requirements. (b) The counterparty credit and CVA risks of the derivatives of this hypothetical portfolio must be calculated using the simplified methodology set out in accordance with paragraph 80(vii)(c) of the banking book equity investment in funds treatment. (3) A bank may treat their equity investment in the fund as an unrated equity exposure to be allocated to the “other sector” bucket (bucket 11). In applying this treatment, banks must also consider whether, given the mandate of the fund, the default risk capital (DRC) requirement risk weight prescribed to the fund is sufficiently prudent (as set out in [8.8]), and whether the RRAO should apply (as set out in [9.6]). 7.37 As per the requirement in 5.8, net long equity investments in a given fund in which the bank cannot look through or does not meet the requirements of 5.8 for the fund must be assigned to the banking book. Net short positions in funds, where the bank cannot look through or does not meet the requirements of 5.8,

Page Number 52 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 must be excluded from any trading book capital requirements under the market risk framework, with the net position instead subjected to a 100% capital requirement. Treatment of vega risk for multi-underlying instruments 7.38 In the vega risk context: (1) Multi-underlying options (including index options) are usually priced based on the implied volatility of the option, rather than the implied volatility of its underlying constituents and a look-through approach may not need to be applied, regardless of the approach applied to the delta and curvature risk calculation as set out in [7.31] through [6.35]. 21 (2) For indices, the vega risk with respect to the implied volatility of the multi￾underlying options will be calculated using a sector specific bucket or an index bucket defined in [7.53] and [7.72] as follows: (a) Where more than 75% of constituents in that index (taking into account the weightings of that index) would be mapped to a single specific sector bucket (ie bucket 1 to bucket 11 for equity risk; or bucket 1 to bucket 16 for CSR), the sensitivity to the index shall be mapped to that single specific sector bucket and treated like any other single-name sensitivity in that bucket. (b) In all other cases, the sensitivity may be mapped to an “index” bucket (ie bucket 12 or bucket 13 for equity risk or bucket 17 or bucket 18 for CSR). Sensitivities-based method: definition of delta risk buckets, risk weights and correlations 7.39 [7.41] to [7.89] set out buckets, risk weights and correlation parameters for each risk class to calculate delta risk capital requirement as set out in [7.4]. 7.40 The prescribed risk weights and correlations in [7.41] to [7.89] have been calibrated to the liquidity adjusted time horizon related to each risk class.

21 As specified in the vega risk factor definitions in [7.8] to [7.14], the implied volatility of an option must be mapped to one or more maturity tenors.

Page Number 53 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Delta GIRR buckets, risk weights and correlations 7.41 Each currency is a separate delta GIRR bucket, so all risk factors in risk-free yield curves for the same currency in which interest rate-sensitive instruments are denominated are grouped into the same bucket. 7.42 For calculating weighted sensitivities, the risk weights for each tenor in risk-free yield curves are set in Table 1 as follows: Delta GIRR buckets and risk weights Table 1 Tenor 0.25 year 0.5 year 1 year 2 year 3 year Risk weight 1.7% 1.7% 1.6% 1.3% 1.2% Tenor 5 year 10 year 15 year 20 year 30 year Risk weight (percentage points) 1.1% 1.1% 1.1% 1.1% 1.1% 7.43 The risk weight for the inflation risk factor and the cross-currency basis risk factors, respectively, is set at 1.6%. 7.44 For specified currencies by the Basel Committee,22 the above risk weights may, at the discretion of the bank, be divided by the square root of 2. 7.45 For aggregating GIRR risk positions within a bucket, the correlation parameter ρ kl between weighted sensitivities 𝑊S𝑘 and 𝑊Sl within the same bucket (ie same currency), same assigned tenor, but different curves is set at 99.90%. In aggregating delta risk positions for cross-currency basis risk for onshore and offshore curves, which must be considered two different curves as set out in [7.8], a bank may choose to aggregate all cross-currency basis risk for a currency (ie “Curr/USD” or “Curr/EUR”) for both onshore and offshore curves by a simple sum of weighted sensitivities. 7.46 The delta risk correlation ρkl between weighted sensitivities 𝑊S𝑘 and WSl within the same bucket with different tenor and same curve is set in the following Table 2:23

22 Specified currencies by the Basel Committee are: EUR, USD, GBP, AUD, JPY, SEK, CAD as well as the domestic reporting currency of a bank. 23The delta GIRR correlation parameters (ρkl) set out in Table 2 is determined by 𝑚a , where Tk (respectivelyTl ) is the tenor that relates to 𝑊Sk (respectively 𝑊Sl); and 𝜃 is set at 3%. For example, the correlation between a sensitivity to the one-year tenor of the Eonia swap curve and the a sensitivity to the five-year tenor of the Eonia swap curve in the same currency is 𝑚ax = 88.69%

Page Number 54 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.47 Between two weighted sensitivities 𝑊S𝑘 and 𝑊Sl within the same bucket with different tenor and different curves, the correlation ρkl is equal to the correlation parameter specified in [7.46] multiplied by 99.90%.24 7.48 The delta risk correlation ρkl between a weighted sensitivity 𝑊S𝑘 to the inflation curve and a weighted sensitivity 𝑊Sl to a given tenor of the relevant yield curve is 40%. 7.49 The delta risk correlation ρkl between a weighted sensitivity 𝑊S𝑘 to a cross￾currency basis curve and a weighted sensitivity 𝑊Sl to each of the following curves is 0%: (1) a given tenor of the relevant yield curve; (2) the inflation curve; or (3) another cross-currency basis curve (if relevant). 7.50 For aggregating GIRR risk positions across different buckets (ie different currencies), the parameter 𝛾𝑏c is set at 50%. Delta CSR non-securitisations buckets, risk weights and correlations 7.51 For delta CSR non-securitisations, buckets are set along two dimensions – credit quality and sector – as set out in Table 3. The CSR non-securitisation sensitivities

24 For example, the correlation between a sensitivity to the one-year tenor of the Eonia swap curve and a sensitivity to the five￾year tenor of the three-month Euribor swap curve in the same currency is (88.69%) ⋅ (0.999) = 88.60%.

Page Number 55 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 or risk exposures should first be assigned to a bucket defined before calculating weighted sensitivities by applying a risk weight. Buckets for delta CSR non-securitisations Table 3 Bucket number Credit quality Sector 1 Investment grade (IG) Sovereigns including central banks, multilateral development banks 2 Local government, government-backed non-financials, education, public administration 3 Financials including government-backed financials 4 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 5 Consumer goods and services, transportation and storage, administrative and support service activities 6 Technology, telecommunications 7 Health care, utilities, professional and technical activities 8 Covered bonds25 9 High yield (HY) & non-rated (NR) Sovereigns including central banks, multilateral development banks 10 Local government, government-backed non-financials, education, public administration 11 Financials including government-backed financials 12 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 13 Consumer goods and services, transportation and storage, administrative and support service activities 14 Technology, telecommunications 15 Health care, utilities, professional and technical activities 16 Other sector26 17 IG indices 18 HY indices Consistent with the treatment of external ratings under SAMA Minimum Capital Requirements for Credit Risk paragraphs 8.10 and 8.12, if there are two ratings which map into different risk weights, the higher risk weight should be applied. If there are three or more ratings with different risk weights, the ratings corresponding to the two lowest risk weights should be referred to and the higher of those two risk weights will be applied. Consistent with the treatment where there are no external ratings, banks may, subject to SAMA approval:

25 Covered bonds must meet the definition provided by Large Exposure Rules for Banks issued via SAMA circular No. 1651 / 67 dated 1441/01/09. 26 Credit quality is not a differentiating consideration for this bucket.

Page Number 56 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1

• For the purpose of assigning delta CSR non-securitisation risk weights, map the internal rating to an external rating, and assign a risk weight corresponding to either “investment grade” or “high yield” in [7.51];
• For the purpose of assigning default risk weights under the DRC requirement, map the internal rating to an external rating, and assign a risk weight corresponding to one of the seven external ratings in the table included [8.24]; or
• Apply the risk weights specified in [7.51] and [8.24] for unrated/non-rated categories. 7.52 To assign a risk exposure to a sector, banks must rely on a classification that is commonly used in the market for grouping issuers by industry sector. (1) The bank must assign each issuer to one and only one of the sector buckets in the table under [7.51]. (2) Risk positions from any issuer that a bank cannot assign to a sector in this fashion must be assigned to the other sector (ie bucket 16). 7.53 For calculating weighted sensitivities, the risk weights for buckets 1 to 18 are set out in Table 4. Risk weights are the same for all tenors (ie 0.5 years, 1 year, 3 years, 5 years, 10 years) within each bucket: Risk weights for buckets for delta CSR non-securitisations Table 4 Bucket number Risk weight 1 0.5% 2 1.0% 3 5.0% 4 3.0% 5 3.0% 6 2.0% 7 1.5% 8 2.5%27 9 2.0% 10 4.0% 11 12.0% 12 7.0% 13 8.5% 14 5.5% 15 5.0%

27 For covered bonds that are rated AA- or higher, the applicable risk weight may at the discretion of the bank be 1.5%..

Page Number 57 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 16 12.0% 17 1.5% 18 5.0% 7.54 For buckets 1 to 15, for aggregating delta CSR non-securitisations risk positions within a bucket, the correlation parameter 𝜌𝑘l between two weighted sensitivities 𝑊S𝑘 and 𝑊Sɭ within the same bucket, is set as follows, where: (1) 𝜌𝑘ɭ (𝑛ame) is equal to 1 where the two names of sensitivities k and ɭ are identical, and 35% otherwise; (2) 𝜌𝑘ɭ (tenor) is equal to 1 if the two tenors of the sensitivities k and ɭ are identical, and to 65% otherwise; and (3) 𝜌𝑘ɭ (𝑏asis) is equal to 1 if the two sensitivities are related to same curves, and 99.90% otherwise. 𝜌𝑘ɭ = 𝜌𝑘ɭ (name) . 𝜌𝑘ɭ (tenor) . 𝜌𝑘ɭ (basis)28 Bond and CDS credit spreads are considered distinct risk factors under 7.9, and 𝜌𝑘ɭ (basis) referenced in [7.54] and [7.55] is meant to capture only the bond-CDS basis. 7.55 For buckets 17 and 18, for aggregating delta CSR non-securitisations risk positions within a bucket, the correlation parameter 𝜌𝑘ɭ between two weighted sensitivities 𝑊S𝑘 and 𝑊S𝑙 within the same bucket is set as follows, where: (1) 𝜌k (name) is equal to 1 where the two names of sensitivities k and 𝑙 are identical, and 80% otherwise; (2) 𝜌k (tenor) is equal to 1 if the two tenors of the sensitivities k and 𝑙 are identical, and to 65% otherwise; and (3) 𝜌𝑘𝑙 (𝑏asis) is equal to 1 if the two sensitivities are related to same curves, and 99.90%. 7.56 The correlations above do not apply to the other sector bucket (ie bucket 16). (1) The aggregation of delta CSR non-securitisation risk positions within the other sector bucket (ie bucket 16) would be equal to the simple sum of the absolute

28 For example, a sensitivity to the five-year Apple bond curve and a sensitivity to the 10- year Google CDS curve would be 35% ⋅ 65% ⋅ 99.90% = 22.73%.

Page Number 58 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 values of the net weighted sensitivities allocated to this bucket. The same method applies to the aggregation of vega risk positions. (2) The aggregation of curvature CSR non-securitisation risk positions within the other sector bucket (ie bucket 16) would be calculated by the formula below. 7.57 For aggregating delta CSR non-securitisation risk positions across buckets 1 to 16, the correlation parameter 𝛾𝑏c is set as follows, where: (1) 𝛾𝑏c (rating) is equal to 50% where the two buckets b and c are both in buckets 1 to 15 and have a different rating category (either IG or HY/NR). 𝛾𝑏c (rating) is equal to 1 otherwise; and (2) 𝛾𝑏c (sector) is equal to 1 if the two buckets belong to the same sector, and to the specified numbers in Table 5 otherwise. Delta CSR securitisation (CTP) buckets, risk weights and correlations

Page Number 59 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.58 Sensitivities to CSR arising from the CTP and its hedges are treated as a separate risk class as set out in 7.1]. The buckets, risk weights and correlations for the CSR securitisations (CTP) apply as follows: (1) The same bucket structure and correlation structure apply to the CSR securitisations (CTP) as those for the CSR non-securitisation framework as set out in [7.51] to [7.57] with an exception of index buckets (ie buckets 17 and 18). (2) The risk weights and correlation parameters of the delta CSR non￾securitisations are modified to reflect longer liquidity horizons and larger basis risk as specified in [7.59] to [7.61]. 7.59 For calculating weighted sensitivities, the risk weights for buckets 1 to 16 are set out in Table 6. Risk weights are the same for all tenors (ie 0.5 years, 1 year, 3 years, 5 years, 10 years) within each bucket: 7.60 For aggregating delta CSR securitisations (CTP) risk positions within a bucket, the delta risk correlation 𝜌𝑘l is derived the same way as in [7.54] and [7.55], except that the correlation parameter applying when the sensitivities are not related to same curves, 𝜌𝑘l (𝑏asis) , is modified.

Page Number 60 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) 𝜌𝑘l (𝑏asis) is now equal to 1 if the two sensitivities are related to same curves, and 99.00% otherwise. (2) The identical correlation parameters for 𝜌𝑘l (name) and 𝜌𝑘l (tenor) to CSR non￾securitisation as set out in [7.54] and [7.55] apply. 7.61 For aggregating delta CSR securitisations (CTP) risk positions across buckets, the correlation parameters for 𝛾𝑏c are identical to CSR non-securitisation as set out in [7.57]. Delta CSR securitisation (non-CTP) buckets, risk weights and correlations 7.62 For delta CSR securitisations not in the CTP, buckets are set along two dimensions – credit quality and sector – as set out in Table 7. The delta CSR securitisation (non-CTP) sensitivities or risk exposures must first be assigned to a bucket before calculating weighted sensitivities by applying a risk weight. Buckets for delta CSR securitisations (non-CTP) Table 7 Bucket number Credit quality Sector 1 Senior investment grade (IG) RMBS – Prime 2 RMBS – Mid-prime 3 RMBS – Sub-prime 4 CMBS 5 Asset-backed securities (ABS) – Student loans 6 ABS – Credit cards 7 ABS – Auto 8 Collateralised loan obligation (CLO) non-CTP 9 Non-senior IG RMBS – Prime 10 RMBS – Mid-prime 11 RMBS – Sub-prime 12 Commercial mortgage-backed securities (CMBS) 13 ABS – Student loans 14 ABS – Credit cards 15 ABS – Auto 16 CLO non-CTP 17 High yield & non-rated RMBS – Prime 18 RMBS – Mid-prime 19 RMBS – Sub-prime 20 CMBS 21 ABS – Student loans 22 ABS – Credit cards 23 ABS – Auto

Page Number 61 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 24 CLO non-CTP 25 Other Sector29 7.63 To assign a risk exposure to a sector, banks must rely on a classification that is commonly used in the market for grouping tranches by type. (1) The bank must assign each tranche to one of the sector buckets in above Table 7. (2) Risk positions from any tranche that a bank cannot assign to a sector in this fashion must be assigned to the other sector (ie bucket 25). 7.64 For calculating weighted sensitivities, the risk weights for buckets 1 to 8 (senior IG) are set out in Table 8: 7.65 The risk weights for buckets 9 to 16 (non-senior investment grade) are then equal to the corresponding risk weights for buckets 1 to 8 scaled up by a multiplication by 1.25. For instance, the risk weight for bucket 9 is equal to 1.25 × 0.9% = 1.125%. 7.66 The risk weights for buckets 17 to 24 (high yield and non-rated) are then equal to the corresponding risk weights for buckets 1 to 8 scaled up by a multiplication by 1.75. For instance, the risk weight for bucket 17 is equal to 1.75 × 0.9% = 1.575%. 7.67 The risk weight for bucket 25 is set at 3.5%.

29 Credit quality is not a differentiating consideration for this bucket.

Page Number 62 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.68 For aggregating delta CSR securitisations (non-CTP) risk positions within a bucket, the correlation parameter 𝜌𝑘l between two sensitivities 𝑊S𝑘 and 𝑊Sl within the same bucket, is set as follows, where: (1) 𝜌𝑘l (tranche) is equal to 1 where the two names of sensitivities k and l are within the same bucket and related to the same securitisation tranche (more than 80% overlap in notional terms), and 40% otherwise; (2) 𝜌𝑘l (tenor) is equal to 1 if the two tenors of the sensitivities k and l are identical, and to 80% otherwise; and (3) 𝜌𝑘l (𝑏asis) is equal to 1 if the two sensitivities are related to same curves, and 99.90% otherwise. [7.68] includes 𝜌𝑘l (tranche) , which equals 1 where the two sensitivities within the same bucket are related to the same securitisation tranche, or 40% otherwise. There is no issuer factor. This mean a two sensitivities relating to the same issuer but different tranches require 40% correlation. There is no granularity for issuers in the delta CSR securitisation part as set out in [7.10]. Where two tranches have exactly the same issuer, same tenor and same basis, but different tranches (ie different credit quality), the correlation must be 40%. 7.69 The correlations above do not apply to the other sector bucket (ie bucket 25). (1) The aggregation of delta CSR securitisations (non-CTP) risk positions within the other sector bucket would be equal to the simple sum of the absolute values of the net weighted sensitivities allocated to this bucket. The same method applies to the aggregation of vega risk position. (2) The aggregation of curvature CSR risk positions within the other sector bucket (ie bucket 16) would be calculated by the formula below. 7.70 For aggregating delta CSR securitisations (non-CTP) risk positions across buckets 1 to 24, the correlation parameter 𝛾𝑏c is set as 0%. 7.71 For aggregating delta CSR securitisations (non-CTP) risk positions between the other sector bucket (ie bucket 25) and buckets 1 to 24, the correlation parameter

Page Number 63 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 𝛾𝑏c is set at 1. Bucket level capital requirements will be simply summed up to the overall risk class level capital requirements, with no diversification or hedging effects recognised with any bucket. Equity risk buckets, risk weights and correlations 7.72 For delta equity risk, buckets are set along three dimensions – market capitalisation, economy and sector – as set out in Table 9. The equity risk sensitivities or exposures must first be assigned to a bucket before calculating weighted sensitivities by applying a risk weight. Buckets for delta sensitivities to equity risk Table 9 Bucket number Market cap Economy Sector 1 Large Emerging market economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 2 Telecommunications, industrials 3 Basic materials, energy, agriculture, manufacturing, mining and quarrying 4 Financials including government-backed financials, real estate activities, technology 5 Advanced economy Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 6 Telecommunications, industrials 7 Basic materials, energy, agriculture, manufacturing, mining and quarrying 8 Financials including government-backed financials, real estate activities, technology 9 Small Emerging market economy All sectors described under bucket numbers 1, 2, 3 and 4 10 Advanced economy All sectors described under bucket numbers 5, 6, 7 and 8 11 Other sector30 12 Large market cap, advanced economy equity indices (non-sector specific) 13 Other equity indices (non-sector specific)

30 Market capitalisation or economy (ie advanced or emerging market) is not a differentiating consideration for this bucket.

Page Number 64 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.73 Market capitalisation (market cap) is defined as the sum of the market capitalisations based on the market value of the total outstanding shares issued by the same listed legal entity or a group of legal entities across all stock markets globally, where the total outstanding shares issued by the group of legal entities refer to cases where the listed entity is a parent company of a group of legal entities. Under no circumstances should the sum of the market capitalisations of multiple related listed entities be used to determine whether a listed entity is “large market cap” or “small market cap”. 7.74 Large market cap is defined as a market capitalisation equal to or greater than USD 2 billion and small market cap is defined as a market capitalisation of less than USD 2 billion. 7.75 The advanced economies are Canada, the United States, Mexico, the euro area, the non-euro area western European countries (the United Kingdom, Norway, Sweden, Denmark and Switzerland), Japan, Oceania (Australia and New Zealand), Singapore and Hong Kong SAR. An equity issuer must be allocated to a particular bucket according to the most material country or region in which the issuer operates. As stated in [7.76]: “For multinational multi￾sector equity issuers, the allocation to a particular bucket must be done according to the most material region and sector in which the issuer operates. 7.76 To assign a risk exposure to a sector, banks must rely on a classification that is commonly used in the market for grouping issuers by industry sector. (1) The bank must assign each issuer to one of the sector buckets in the table under [7.72] and it must assign all issuers from the same industry to the same sector. (2) Risk positions from any issuer that a bank cannot assign to a sector in this fashion must be assigned to the other sector (ie bucket 11). (3) For multinational multi-sector equity issuers, the allocation to a particular bucket must be done according to the most material region and sector in which the issuer operates. 7.77 For calculating weighted sensitivities, the risk weights for the sensitivities to each of equity spot price and equity repo rates for buckets 1 to 13 are set out in Table 10:

Page Number 65 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.78 For aggregating delta equity risk positions within a bucket, the correlation parameter 𝜌𝑘l between two sensitivities 𝑊S𝑘 and 𝑊Sl within the same bucket is set at as follows (1) The correlation parameter 𝜌𝑘l is set at 99.90%, where: (a) one is a sensitivity to an equity spot price and the other a sensitivity to an equity repo rates; and (b) both are related to the same equity issuer name. (2) The correlation parameter 𝜌𝑘l is set out in (a) to (d) below, where both sensitivities are to equity spot price, and where: (a) 15% between two sensitivities within the same bucket that fall under large market cap, emerging market economy (bucket number 1, 2, 3 or 4). (b) 25% between two sensitivities within the same bucket that fall under large market cap, advanced economy (bucket number 5, 6, 7 or 8). (c) 7.5% between two sensitivities within the same bucket that fall under small market cap, emerging market economy (bucket number 9). (d) 12.5% between two sensitivities within the same bucket that fall under small market cap, advanced economy (bucket number 10).

Page Number 66 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (e) 80% between two sensitivities within the same bucket that fall under either index bucket (bucket number 12 or 13) (3) The same correlation parameter 𝜌𝑘l as set out in above (2)(a) to (d) apply, where both sensitivities are to equity repo rates. (4) The correlation parameter 𝜌𝑘l is set as each parameter specified in above (2)(a) to (d) multiplied by 99.90%, where: (a) One is a sensitivity to an equity spot price and the other a sensitivity to an equity repo rate; and (b) Each sensitivity is related to a different equity issuer name. 7.79 The correlations set out above do not apply to the other sector bucket (ie bucket 11). (1) The aggregation of equity risk positions within the other sector bucket capital requirement would be equal to the simple sum of the absolute values of the net weighted sensitivities allocated to this bucket. The same method applies to the aggregation of vega risk positions. (2) The aggregation of curvature equity risk positions within the other sector bucket (ie bucket 11) would be calculated by the formula: 7.80 For aggregating delta equity risk positions across buckets 1 to 13, the correlation parameter 𝛾𝑏c is set at: (1) 15% if bucket b and bucket c fall within bucket numbers 1 to 10; (2) 0% if either of bucket b and bucket c is bucket 11; (3) 75% if bucket b and bucket c are bucket numbers 12 and 13 (i.e. one is bucket 12, one is bucket 13); and (4) 45% otherwise.

Page Number 67 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Commodity risk buckets, risk weights and correlations 7.81 For delta commodity risk, 11 buckets that group commodities by common characteristics are set out in Table 11. 7.82 For calculating weighted sensitivities, the risk weights for each bucket are set out in Table 11:

Page Number 68 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.83 For the purpose of aggregating commodity risk positions within a bucket using a correlation parameter, the correlation parameter 𝜌𝑘l between two sensitivities 𝑊S𝑘 and 𝑊Sl within the same bucket, is set as follows, where: (1) 𝜌𝑘l (cty) is equal to 1 where the two commodities of sensitivities k and l are identical, and to the intra-bucket correlations in Table 12 otherwise, where, any two commodities are considered distinct commodities if in the market two contracts are considered distinct when the only difference between each other is the underlying commodity to be delivered. For example, WTI and Brent in bucket 2 (ie energy – liquid combustibles) would typically be treated as distinct commodities; (2) 𝜌𝑘l (tenor) is equal to 1 if the two tenors of the sensitivities k and l are identical, and to 99.00% otherwise; and (3) 𝜌𝑘l (𝑏asis) is equal to 1 if the two sensitivities are identical in the delivery location of a commodity, and 99.90% otherwise. 𝜌𝑘l=𝜌𝑘l (cty) . 𝜌𝑘l (tenor) . 𝜌𝑘l (𝑏asis)31

31 For example, the correlation between the sensitivity to Brent, one-year tenor, for delivery in Le Havre and the sensitivity to WTI, five-year tenor, for delivery in Oklahoma is 95% ⋅ 99.00% ⋅ 99.90% = 93.96%.

Page Number 69 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Instruments with a spread as their underlying are considered sensitive to different risk factors. In the example cited, the swap will be sensitive to both WTI and Brent, each of which require a capital charge at the risk factor level (ie delta of WTI and delta of Brent). The correlation to aggregate capital charges is specified in [7.83]. 7.84 For determining whether the commodity correlation parameter (𝜌𝑘l (cty) ) as set out in Table 12 in 7.83(a) should apply, this paragraph provides non-exhaustive examples of further definitions of distinct commodities as follows: (1) For bucket 3 (energy – electricity and carbon trading): (a) Each time interval (i) at which the electricity can be delivered and (ii) that is specified in a contract that is made on a financial market is considered a distinct electricity commodity (eg peak and off-peak). (b) Electricity produced in a specific region (eg Electricity NE, Electricity SE or Electricity North) is considered a distinct electricity commodity. (2) For bucket 4 (freight): (a) Each combination of freight type and route is considered a distinct commodity. (b) Each week at which a good has to be delivered is considered a distinct commodity. 7.85 For aggregating delta commodity risk positions across buckets, the correlation parameter 𝛾𝑏c is set as follows: (1) 20% if bucket b and bucket c fall within bucket numbers 1 to 10; and (2) 0% if either bucket b or bucket c is bucket number 11. Foreign exchange risk buckets, risk weights and correlations 7.86 An FX risk bucket is set for each exchange rate between the currency in which an instrument is denominated and the reporting currency. 7.87 A unique relative risk weight equal to 15% applies to all the FX sensitivities.

Page Number 70 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.88 For specified currency pairs,32 and for currency pairs forming first- order crosses across these specified currency pairs,33 the above risk weight may at the discretion of the bank be divided by the square root of 2. 7.89 For aggregating delta FX risk positions across buckets, the correlation parameter 𝛾𝑏c is uniformly set to 60%. Sensitivities-based method: definition of vega risk buckets, risk weights and correlations 7.90 [7.91] to [7.95] set out buckets, risk weights and correlation parameters to calculate vega risk capital requirement as set out in [7.4]. 7.91 The same bucket definitions for each risk class are used for vega risk as for delta risk. 7.92 For calculating weighted sensitivities for vega risk, the risk of market illiquidity is incorporated into the determination of vega risk, by assigning different liquidity horizons for each risk class as set out in Table 13. The risk weight for each risk class34is also set out in Table 13.

32 Specified currency pairs are: SAR/USD, USD/EUR, USD/JPY, USD/GBP, USD/AUD, USD/CAD, USD/CHF, USD/MXN, USD/CNY, USD/NZD, USD/RUB, USD/HKD, USD/SGD, USD/TRY, USD/KRW, USD/SEK, USD/ZAR, USD/INR, USD/NOK, USD/BRL. 33 For example, EUR/AUD is not among the selected currency pairs specified by the Basel Committee, but is a first-order cross of USD/EUR and USD/AUD. 34 the risk weight for a given vega risk factor k (𝑅𝑊k) is determined by RWk = 𝑚in , where RW𝜕 is set at 55%; and 𝐿Hrisk class is specified per risk class in Table 13.

Page Number 71 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 7.93 For aggregating vega GIRR risk positions within a bucket, the correlation parameter ρkl is set as follows, where: (1) 𝜌kl (option maturity) is equal to e , where: (a) 𝛼 is set at 1%; (b) T𝑘 (respectively Tl ) is the maturity of the option from which the vega sensitivity V𝑅𝑘 (V𝑅l) is derived, expressed as a number of years; and (2) 𝜌kl (underlying maturity) is equal to e where: (a) 𝛼 is set at 1%; and (b) T𝑘 𝑈 (respectively Tl 𝑈) is the maturity of the underlying of the option from which the sensitivity V𝑅𝑘 (V𝑅l) is derived, expressed as a number of years after the maturity of the option. 7.95 For aggregating vega risk positions across different buckets within a risk class (GIRR and non- GIRR), the same correlation parameters for 𝛾𝑏c, as specified for delta correlations for each risk class in [7.39] to [7.89] are to be used for the aggregation of vega risk (eg 𝛾𝑏c = 50% is to be used for the aggregation of vega risk sensitivities across different GIRR buckets). Sensitivities-based method: definition of curvature risk buckets, risk weights and correlations 7.96 [7.97] to [7.101] set out buckets, risk weights and correlation parameters to calculate curvature risk capital requirement as set out in [7.5]. 7.97 The delta buckets are replicated for the calculation of curvature risk capital requirement, unless specified otherwise in the preceding paragraphs within [7.8] to [7.89]. 7.98 For calculating the net curvature risk capital requirement 𝐶V𝑅𝑘 for risk factor k for FX and equity risk classes, the curvature risk weight, which is the size of a shock to the given risk factor, is a relative shift equal to the respective delta risk weight. For FX curvature, for options that do not reference a bank’s reporting currency (or base currency as set out in 7.14) as an underlying, net curvature risk charges (𝐶V𝑅𝑘 + and 𝐶V𝑅𝑘 − ) may be divided by a scalar of 1.5. Alternatively, and subject to SAMA approval, a bank may apply the scalar of 1.5 consistently to all FX instruments provided curvature sensitivities are calculated for all

Page Number 72 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 currencies, including sensitivities determined by shocking the reporting currency (or base currency where used) relative to all other currencies. 7.99 For calculating the net curvature risk capital requirement 𝐶V𝑅𝑘 for curvature risk factor k for GIRR, CSR and commodity risk classes, the curvature risk weight is the parallel shift of all the tenors for each curve based on the highest prescribed delta risk weight for each risk class. For example, in the case of GIRR the risk weight assigned to 0.25-year tenor (ie the most punitive tenor risk weight) is applied to all the tenors simultaneously for each risk-free yield curve (consistent with a “translation”, or “parallel shift” risk calculation). 7.100 For aggregating curvature risk positions within a bucket, the curvature risk correlations 𝜌𝑘l are determined by squaring the corresponding delta correlation parameters 𝜌𝑘l except for CSR non- securitisations and CSR securitisations (CTP). In applying the high and low correlations scenario set out in [7.6], the curvature risk capital requirements are calculated by applying the curvature correlation parameters 𝜌𝑘l determined in this paragraph. (1) For CSR non-securitisations and CSR securitisations (CTP), consistent with [7.9] which defines a bucket along one dimension (ie the relevant credit spread curve), the correlation parameter 𝜌𝑘l as defined in [7.54] and [7.55] is not applicable to the curvature risk capital requirement calculation. Thus, the correlation parameter is determined by whether the two names of weighted sensitivities are the same. In the formula in [7.54] and [7.55], the correlation parameters 𝜌𝑘l (basis) and 𝜌𝑘l (tenor) need not apply and only correlation parameter 𝜌𝑘l (𝑛ame) applies between two weighted sensitivities within the same bucket. This correlation parameter should be squared. [7.100] states that, for curvature risk of CSR non-securitisation, the correlation parameters 𝜌𝑘l (basis) and 𝜌𝑘l (tenor) need not apply and only correlation parameter 𝜌𝑘l (𝑛ame) applies between two sensitivities WSk and WSl within the same bucket. 7.101 For aggregating curvature risk positions across buckets, the curvature risk correlations 𝛾𝑏c are determined by squaring the corresponding delta correlation parameters 𝛾𝑏c. For instance, when aggregating 𝐶V𝑅E𝑈𝑅 and 𝐶V𝑅𝑈S𝐷 for the GIRR, the correlation should be 50%2 = 25% . In applying the high and low correlations scenario set out in [7.6], the curvature risk capital requirements are calculated by applying the curvature correlation parameters 𝛾𝑏c, (ie the square of the corresponding delta correlation parameter).

Page Number 73 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 8- Standardised approach: default risk capital requirement Main concepts of default risk capital requirements 8.1 The default risk capital (DRC) requirement is intended to capture jump-to-default (JTD) risk that may not be captured by credit spread shocks under the sensitivities￾based method. DRC requirements provide some limited hedging recognition. In this chapter offsetting refers to the netting of exposures to the same obligor (where a short exposure may be subtracted in full from a long exposure) and hedging refers to the application of a partial hedge benefit from the short exposures (where the risk of long and short exposures in distinct obligors do not fully offset due to basis or correlation risks). Instruments subject to the default risk capital requirement 8.2 The DRC requirement must be calculated for instruments subject to default risk: (1) Non-securitisation portfolios (2) Securitisation portfolio (non-correlation trading portfolio, or non-CTP) (3) Securitisation (correlation trading portfolio, or CTP) Overview of DRC requirement calculation 8.3 The following step-by-step approach must be followed for each risk class subject to default risk. The specific definition of gross JTD risk, net JTD risk, bucket, risk weight and the method for aggregation of DRC requirement across buckets are separately set out per each risk class in subsections in [8.9] to [8.26]. (1) The gross JTD risk of each exposure is computed separately. (2) With respect to the same obligator, the JTD amounts of long and short exposures are offset (where permissible) to produce net long and/or net short exposure amounts per distinct obligor. (3) Net JTD risk positions are then allocated to buckets. (4) Within a bucket, a hedge benefit ratio is calculated using net long and short JTD risk positions. This acts as a discount factor that reduces the amount of net short positions to be netted against net long positions within a bucket. A prescribed risk weight is applied to the net positions which are then aggregated. (5) Bucket level DRC requirements are aggregated as a simple sum across buckets to give the overall DRC requirement.

Page Number 74 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 8.4 No diversification benefit is recognised between the DRC requirements for: (1) non-securitisations; (2) securitisations (non-CTP) ; and (3) securitisations (CTP). 8.5 For traded non-securitisation credit and equity derivatives, JTD risk positions by individual constituent issuer legal entity should be determined by applying a look￾through approach. The JTD equivalent is defined as the difference between the value of the security or product assuming that each single name referenced by the security or product, separately from the others, defaults (with zero recovery) and the value of the security or product assuming that none of the names referenced by the security or product default. 8.6 For the CTP, the capital requirement calculation includes the default risk for non￾securitisation hedges. These hedges must be removed from the calculation of default risk non-securitisation. 8.7 Claims on sovereigns, public sector entities and multilateral development banks would be subject to a zero default risk weight in line with paragraphs 7.1 through 7.11 in the SAMA Minimum Capital Requirements for Credit Risk framework. SAMA apply a non-zero risk weight to securities issued by certain foreign governments, including to securities denominated in a currency other than that of the issuing government. 8.8 For claims on an equity investment in a fund that is subject to the treatment specified in 7.36 (ie treated as an unrated “other sector” equity), the equity investment in the fund shall be treated as an unrated equity instrument. Where the mandate of that fund allows the fund to invest in primarily high-yield or distressed names, banks shall apply the maximum risk weight per Table 2 in [8.24] that is achievable under the fund’s mandate (by calculating the effective average risk weight of the fund when assuming that the fund invests first in defaulted instruments to the maximum possible extent allowed under its mandate, and then in CCC-rated names to the maximum possible extent, and then B-rated, and then BB-rated). Neither offsetting nor diversification between these generated exposures and other exposures is allowed. Default risk capital requirement for non-securitisations Gross jump-to-default risk positions (gross JTD)

Page Number 75 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 8.9 The gross JTD risk position is computed exposure by exposure. For instance, if a bank has a long position on a bond issued by Apple, and another short position on a bond issued by Apple, it must compute two separate JTD exposures. 8.10 For the purpose of DRC requirements, the determination of the long/short direction of positions must be on the basis of long or short with respect to whether the credit exposure results in a loss or gain in the case of a default. (1) Specifically, a long exposure is defined as a credit exposure that results in a loss in the case of a default. (2) For derivative contracts, the long/short direction is also determined by whether the contract will result in a loss in the case of a default (ie long or short position is not determined by whether the option or credit default swap (CDS), is bought or sold). Thus, for the purpose of DRC requirements, a sold put option on a bond is a long credit exposure, since a default results in a loss to the seller of the option. 8.11 The gross JTD is a function of the loss given default (LGD), notional amount (or face value) and the cumulative profit and loss (P&L) already realised on the position, where: (1) notional is the bond-equivalent notional amount (or face value) of the position; and (2) P&L is the cumulative mark-to-market loss (or gain) already taken on the exposure. P&L is equal to the market value minus the notional amount, where the market value is the current market value of the position. 8.12 For calculating the gross JTD, LGD is set as follows: (1) Equity instruments and non-senior debt instruments are assigned an LGD of 100%. (2) Senior debt instruments are assigned an LGD of 75%. (3) Covered bonds, as defined within [7.51], are assigned an LGD of 25%. (4) When the price of the instrument is not linked to the recovery rate of the defaulter (eg a foreign exchange-credit hybrid option where the cash flows are swap of cash flows, long EUR coupons and short USD coupons with a

Page Number 76 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 knockout feature that ends cash flows on an event of default of a particular obligor), there should be no multiplication of the notional by the LGD. 8.13 In calculating the JTD as set out in [8.11], the notional amount of an instrument that gives rise to a long (short) exposure is recorded as a positive (negative) value, while the P&L loss (gain) is recorded as a negative (positive) value. If the contractual or legal terms of the derivative allow for the unwinding of the instrument with no exposure to default risk, then the JTD is equal to zero. 8.14 The notional amount is used to determine the loss of principal at default, and the mark-to-market loss is used to determine the net loss so as to not double-count the mark-to-market loss already recorded in the market value of the position. (1) For all instruments, the notional amount is the notional amount of the instrument relative to which the loss of principal is determined. Examples are as follows: (a) For a bond, the notional amount is the face value. (b) For credit derivatives, the notional amount of a CDS contract or a put option on a bond is the notional amount of the derivative contract. (c) In the case of a call option on a bond, the notional amount to be used in the JTD calculation is zero (since, in the event of default, the call option will not be exercised). In this case, a JTD would extinguish the call option’s value and this loss would be captured through the mark￾to-market P&L term in the JTD calculation. (2) Table 1 illustrates examples of the notional amounts and market values for a long credit position with a mark-to-market loss to be used in the JTD calculation, where: (a) the bond-equivalent market value is an intermediate step in determining the P&L for derivative instruments; (b) the mark-to-market value of CDS or an option takes an absolute value; and (c) the strike amount of the bond option is expressed in terms of the bond price (not the yield).

Page Number 77 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 The convertible bonds are not treated the same way as vanilla bonds in computing the DRC requirement Banks should also consider the P&L of the equity optionality embedded within a convertible bond when computing its DRC requirement. A convertible bond can be decomposed into a vanilla bond and a long equity option. Hence, treating the convertible bond as a vanilla bond will potentially underestimate the JTD risk of the instrument. 8.15 To account for defaults within the one-year capital horizon, the JTD for all exposures of maturity less than one year and their hedges are scaled by a fraction of a year. No scaling is applied to the JTD for exposures of one year or greater.35 For example, the JTD for a position with a six month maturity would be weighted by one-half, while the JTD for a position with a one year maturity would have no scaling applied to the JTD. 8.16 Cash equity positions (ie stocks) are assigned to a maturity of either more than one year or three months, at banks’ discretion. [8.16]states that for the standardised approach DRC requirement, cash equity positions may be attributed a maturity of three months or a maturity of more than one year, at firms’ discretion. Such restrictions do not exist in [13] for the internal models approach, which allows banks discretion to apply a 60-day liquidity horizon for equity sub-portfolios. Furthermore, [8.15] states “... the JTD for all exposures of maturity less than one year and their hedges are scaled by a fraction of a year”. Given the above- mentioned paragraphs, for purposes of the standardised approach DRC requirement, the bank is not permitted to assign cash equities and equity derivatives such as index futures any maturity between three months and one year on a sub-portfolio basis in order to avoid broken hedges As required by [8.16], cash equity positions are assigned a maturity of either more than one year or three

35 Note that this paragraph refers to the scaling of gross JTD (ie not net JTD).

Page Number 78 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 months. There is no discretion permitted to assign cash equity positions to any maturity between three months and one year. In determining the offsetting criterion, [8.17] specifies that the maturity of the derivatives contract be considered, not the maturity of the underlying instrument. [8.18] further states that the maturity weighting applied to the JTD for any product with maturity of less than three months is floored at three months. To illustrate how the standardised approach DRC requirement should be calculated with a simple hypothetical portfolio, consider equity index futures with one month to maturity and a negative market value of EUR 10 million (–EUR 10 million, maturity 1M), hedged with the underlying equity positions with a positive market value of EUR 10 million (+EUR 10 million). Both positions in the example should be considered having a three-month maturity. Based on [8.15], which requires maturity scaling, defined as a fraction of the year, of positions and their hedge, the JTD for the above trading portfolio would be calculated as follows: 1/410 – 1/410 = 0. 8.17 For derivative exposures, the maturity of the derivative contract is considered in determining the offsetting criterion, not the maturity of the underlying instrument. 8.18 The maturity weighting applied to the JTD for any sort of product with a maturity of less than three months (such as short term lending) is floored at a weighting factor of one-fourth or, equivalently, three months (that means that the positions having shorter-than-three months remaining maturity would be regarded as having a remaining maturity of three months for the purpose of the DRC requirement). In the case where a total return swap (TRS) with a maturity of one month is hedged by the underlying equity, and if there were sufficient legal terms on the TRS such that there is no settlement risk at swap maturity as the swap is terminated based on the executed price of the stock/bond hedge and any unwind of the TRS can be delayed (beyond the swap maturity date) in the event of hedge disruption until the stock/bond can be liquidated. The net JTD for such a position would be zero. If the contractual/legal terms of the derivative allow for the unwinding of both legs of the position at the time of expiry of the first to mature with no exposure to default risk of the underlying credit beyond that point, then the JTD for the maturity-mismatched position is equal to zero. Net jump-to-default risk positions (net JTD) 8.19 Exposures to the same obligator may be offset as follows: (1) The gross JTD risk positions of long and short exposures to the same obligor may be offset where the short exposure has the same or lower seniority relative to the long exposure. For example, a short exposure in an equity may offset a long exposure in a bond, but a short exposure in a bond cannot offset a long exposure in the equity. (2) For the purposes of determining whether a guaranteed bond is an exposure to the underlying obligor or an exposure to the guarantor, the credit risk

Page Number 79 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 mitigation requirements set out in paragraphs 9.70 and 9.72 of the SAMA Minimum Capital Requirements for Credit Risk. (3) Exposures of different maturities that meet this offsetting criterion may be offset as follows. (a) Exposures with maturities longer than the capital horizon (one year) may be fully offset. (b) An exposure to an obligor comprising a mix of long and short exposures with a maturity less than the capital horizon (equal to one year) must be weighted by the ratio of the exposure’s maturity relative to the capital horizon. For example, with the one-year capital horizon, a three-month short exposure would be weighted so that its benefit against long exposures of longer-than- one-year maturity would be reduced to one quarter of the exposure size.36 8.20 In the case of long and short offsetting exposures where both have a maturity under one year, the scaling can be applied to both the long and short exposures. 8.21 Finally, the offsetting may result in net long JTD risk positions and net short JTD risk positions. The net long and net short JTD risk positions are aggregated separately as described below. Calculation of default risk capital requirement for non-securitisation 8.22 For the default risk of non-securitisations, three buckets are defined as: (1) corporates; (2) sovereigns; and (3) local governments and municipalities. 8.23 In order to recognise hedging relationship between net long and net short positions within a bucket, a hedge benefit ratio is computed as follows. (1) A simple sum of the net long JTD risk positions (not risk-weighted) must be calculated, where the summation is across the credit quality categories (ie

36 SAMA Minimum Capital Requirements for Credit Risk.

Page Number 80 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 rating bands). The aggregated amount is used in the numerator and denominator of the expression of the hedge benefit ratio (HBR) below. (2) A simple sum of the net (not risk-weighted) short JTD risk positions must be calculated, where the summation is across the credit quality categories (ie rating bands). The aggregated amount is used in the denominator of the expression of the HBR below. (3) The HBR is the ratio of net long JTD risk positions to the sum of net long JTD and absolute value of net short JTD risk positions: 8.24 For calculating the weighted net JTD, default risk weights are set depending on the credit quality categories (ie rating bands) for all three buckets (ie irrespective of the type of counterparty), as set out in Table 2: 8.25 The capital requirement for each bucket is to be calculated as the combination of the sum of the risk-weighted long net JTD, the HBR, and the sum of the risk￾weighted short net JTD, where the summation for each long net JTD and short net JTD is across the credit quality categories (ie rating bands). In the following formula, DRC stands for DRC requirement; and i refers to an instrument belonging to bucket b.

Page Number 81 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 8.26 No hedging is recognised between different buckets - the total DRC requirement for non- securitisations must be calculated as a simple sum of the bucket level capital requirements. Default risk capital requirement for securitisations (non-CTP) Gross jump-to-default risk positions (gross JTD) 8.27 For the computation of gross JTD on securitisations, the same approach must be followed as for default risk (non-securitisations), except that an LGD ratio is not applied to the exposure. Because the LGD is already included in the default risk weights for securitisations to be applied to the securitisation exposure (see below), to avoid double counting of LGD the JTD for securitisations is simply the market value of the securitisation exposure (ie the JTD for tranche positions is their market value). 8.28 For the purposes of offsetting and hedging recognition for securitisations (non￾CTP), positions in underlying names or a non-tranched index position may be decomposed proportionately into the equivalent replicating tranches that span the entire tranche structure. When underlying names are treated in this way, they must be removed from the non-securitisation default risk treatment. Net jump-to-default risk positions (net JTD) 8.29 For default risk of securitisations (non-CTP), offsetting is limited to a specific securitisation exposure (ie tranches with the same underlying asset pool). This means that: (1) no offsetting is permitted between securitisation exposures with different underlying securitised portfolio (ie underlying asset pools), even if the attachment and detachment points are the same; and (2) no offsetting is permitted between securitisation exposures arising from different tranches with the same securitised portfolio. 8.30 Securitisation exposures that are otherwise identical except for maturity may be offset. The same offsetting rules for non-securitisations including scaling down positions of less than one year as set out in [8.15] through [8.18] apply to JTD risk positions for securitisations (non- CTP). Offsetting within a specific securitisation exposure is allowed as follows. (1) Securitisation exposures that can be perfectly replicated through decomposition may be offset. Specifically, if a collection of long securitisation exposures can be replicated by a collection of short securitisation exposures, then the securitisation exposures may be offset.

Page Number 82 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) Furthermore, when a long securitisation exposure can be replicated by a collection of short securitisation exposures with different securitised portfolios, then the securitisation exposure with the “mixed” securitisation portfolio may be offset by the combination of replicating securitisation exposures. (3) After the decomposition, the offsetting rules would apply as in any other case. As in the case of default risk (non-securitisations), long and short securitisation exposures should be determined from the perspective of long or short the underlying credit, eg the bank making losses on a long securitisation exposure in the event of a default in the securitised portfolio. Calculation of default risk capital requirement for securitisations (non-CTP) 8.31 For default risk of securitisations (non-CTP), the buckets are defined as follows: (1) Corporates (excluding small and medium enterprises) – this bucket takes into account all regions. (2) Other buckets – these are defined along two dimensions: (a) Asset classes: the 11 asset classes are defined as asset-backed commercial paper; auto Loans/Leases; residential mortgage-backed securities (MBS); credit cards; commercial MBS; collateralised loan obligations; collateralised debt obligation (CDO)-squared; small and medium enterprises; student loans, other retail; and other wholesale. (b) Regions: the four regions are defined as Asia, Europe, North America and all other. 8.32 To assign a securitisation exposure to a bucket, banks must rely on a classification that is commonly used in the market for grouping securitisation exposures by type and region of underlying. (1) The bank must assign each securitisation exposure to one and only one of the buckets above and it must assign all securitisations with the same type and region of underlying to the same bucket. (2) Any securitisation exposure that a bank cannot assign to a type or region of underlying in this fashion must be assigned to the “other bucket”. 8.33 The capital requirement for default risk of securitisations (non-CTP) is determined using a similar approach to that for non-securitisations. The DRC requirement within a bucket is calculated as follows:

Page Number 83 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) The hedge benefit discount HBR, as defined in [8.23], is applied to net short securitisation exposures in that bucket. (2) The capital requirement is calculated as in [8.25]. 8.34 For calculating the weighted net JTD, the risk weights of securitisation exposures are defined by the tranche instead of the credit quality. The risk weight for securitisations (non-CTP) is applied as follows: (1) The default risk weights for securitisation exposures are based on the corresponding risk weights for banking book instruments, as set out in 18 to 22 of Minimum Capital Requirements for Credit Risk with the following modification: the maturity component in the banking book securitisation framework is set to zero (ie a one-year maturity is assumed) to avoid double￾counting of risks in the maturity adjustment (of the banking book approach) since migration risk in the trading book will be captured in the credit spread capital requirement. (2) Following the corresponding treatment in the banking book, the hierarchy of approaches in determining the risk weights should be applied at the underlying pool level. (3) The capital requirement under the standardised approach for an individual cash securitisation position can be capped at the fair value of the transaction. 8.35 No hedging is recognised between different buckets. Therefore, the total capital requirement for default risk securitisations must be calculated as a simple sum of the bucket-level capital requirements. Default risk capital requirement for securitisations (CTP) Gross jump-to-default risk positions (gross JTD) 8.36 For the computation of gross JTD on securitisations (CTP), the same approach must be followed as for default risk-securitisations (non-CTP) as described in [8.27]. 8.37 The gross JTD for non-securitisations (CTP) (ie single-name and index hedges) positions is defined as their market value. 8.38 Nth-to-default products should be treated as tranched products with attachment and detachment points defined below, where “Total names” is the total number of names in the underlying basket or pool: (1) Attachment point = (N – 1) / Total names (2) Detachment point = N / Total names

Page Number 84 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Net jump-to-default risk positions (net JTD) 8.39 Exposures that are otherwise identical except for maturity may be offset. The same concept of long and short positions from a perspective of loss or gain in the event of a default as set out in [8.10] and offsetting rules for non-securitisations including scaling down positions of less than one year as set out in [8.15] to [8.18] apply to JTD risk positions for securitisations (non-CTP). (1) For index products, for the exact same index family (eg CDX.NA.IG), series (eg series 18) and tranche (eg 0–3%), securitisation exposures should be offset (netted) across maturities (subject to the offsetting allowance as described above). (2) Long and short exposures that are perfect replications through decomposition may be offset as follows. When the offsetting involves decomposing single name equivalent exposures, decomposition using a valuation model would be allowed in certain cases as follows. Such decomposition is the sensitivity of the security’s value to the default of the underlying single name obligor. Decomposition with a valuation model is defined as follows: a single name equivalent constituent of a securitisation (eg tranched position) is the difference between the unconditional value of the securitisation and the conditional value of the securitisation assuming that the single name defaults, with zero recovery, where the value is determined by a valuation model. In such cases, the decomposition into single-name equivalent exposures must account for the effect of marginal defaults of the single names in the securitisation, where in particular the sum of the decomposed single name amounts must be consistent with the undecomposed value of the securitisation. Further, such decomposition is restricted to vanilla securitisations (eg vanilla CDOs, index tranches or bespokes); while the decomposition of exotic securitisations (eg CDO squared) is prohibited. (3) Moreover, for long and short positions in index tranches, and indices (non￾tranched), if the exposures are to the exact same series of the index, then offsetting is allowed by replication and decomposition. For instance, a long securitisation exposure in a 10–15% tranche vs combined short securitisation exposures in 10–12% and 12–15% tranches on the same index/series can be offset against each other. Similarly, long securitisation exposures in the various tranches that, when combined perfectly, replicate a position in the index series (non-tranched) can be offset against a short securitisation exposure in the index series if all the positions are to the exact same index and series (eg CDX.NA.IG series 18). Long and short positions in indices and single-name constituents in the index may also be offset by decomposition. For instance, single-name long securitisation exposures that perfectly replicate an index may be offset against a short securitisation exposure in the

Page Number 85 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 index. When a perfect replication is not possible, then offsetting is not allowed except as indicated in the next sentence. Where the long and short securitisation exposures are otherwise equivalent except for a residual component, the net amount must show the residual exposure. For instance, a long securitisation exposure in an index of 125 names, and short securitisation exposures of the appropriate replicating amounts in 124 of the names, would result in a net long securitisation exposure in the missing 125th name of the index. (4) Different tranches of the same index or series may not be offset (netted), different series of the same index may not be offset, and different index families may not be offset. Calculation of default risk capital requirement for securitisations (CTP) 8.40 For default risk of securitisations (CTP), each index is defined as a bucket of its own. A non- exhaustive list of indices include: CDX North America IG, iTraxx Europe IG, CDX HY, iTraxx XO, LCDX (loan index), iTraxx LevX (loan index), Asia Corp, Latin America Corp, Other Regions Corp, Major Sovereign (G7 and Western Europe) and Other Sovereign. 8.41 Bespoke securitisation exposures should be allocated to the index bucket of the index they are a bespoke tranche of. For instance, the bespoke tranche 5% - 8% of a given index should be allocated to the bucket of that index. 8.42 The default risk weights for securitisations applied to tranches are based on the corresponding risk weights for the banking book instruments, as set out in 18 to 22 of SAMA Minimum Capital Requirements for Credit Risk, with the following modification: the maturity component in the banking book securitisation framework is set to zero, ie a one-year maturity is assumed to avoid double￾counting of risks in the maturity adjustment (of the banking book approach) since migration risk in the trading book will be captured in the credit spread capital requirement.. 8.43 For the non-tranched products, the same risk weights for non-securitisations as set out in [8.24] apply. For the tranched products, banks must derive the risk weight using the banking book treatment as set out in [8.42]. 8.44 Within a bucket (ie for each index) at an index level, the capital requirement for default risk of securitisations (CTP) is determined in a similar approach to that for non-securitisations. (1) The hedge benefit ratio (HBR), as defined in [8.23], is modified and applied to net short positions in that bucket as in the formula below, where the subscript ctp for the term HBRctp indicates that the HBR is determined using

Page Number 86 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 the combined long and short positions across all indices in the CTP (ie not only the long and short positions of the bucket by itself). The summation of risk-weighted amounts in the formula spans all exposures relating to the index (ie index tranche, bespoke, non-tranche index or single name). (2) A deviation from the approach for non-securitisations is that no floor at zero applies at the bucket level, and consequently, the DRC requirement at the index level (𝐷𝑅𝐶𝑏) can be negative. 8.45 The total DRC requirement for securitisations (CTP) is calculated by aggregating bucket level capital amounts as follows. For instance, if the DRC requirement for the index CDX North America IG is +100 and the DRC requirement for the index Major Sovereign (G7 and Western Europe) is - 100, the total DRC requirement for the CTP is 100 − 0.5 × 100 = 50.37 9- Standardised approach: residual risk add-on 9.1 The residual risk add-on (RRAO) is to be calculated for all instruments bearing residual risk separately in addition to other components of the capital requirement under the standardised approach. Instruments subject to the residual risk add-on 9.2 Instruments with an exotic underlying and instruments bearing other residual risks are subject to the RRAO. 9.3 Instruments with an exotic underlying are trading book instruments with an underlying exposure that is not within the scope of delta, vega or curvature risk treatment in any risk class under the sensitivities-based method or default risk capital (DRC) requirements in the standardised approach.38

37 The procedure for the 𝐷𝑅𝐶𝑏 and 𝐷𝑅𝐶𝐶tp terms accounts for the basis risk in cross index hedges, as the hedge benefit from cross-index short positions is discounted twice, first by the hedge benefit ratio HBR in 𝐷𝑅𝐶𝑏 , and again by the term 0.5 in the 𝐷𝑅𝐶𝐶tp equation. 38 Examples of exotic underlying exposures include: longevity risk, weather, natural disasters, future realised volatility (as an underlying exposure for a swap).

Page Number 87 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 The future realised volatility is considered an “exotic underlying” for the purpose of the RRAO 9.4 Instruments bearing other residual risks are those that meet criteria (1) and (2) below: (1) Instruments subject to vega or curvature risk capital requirements in the trading book and with pay-offs that cannot be written or perfectly replicated as a finite linear combination of vanilla options with a single underlying equity price, commodity price, exchange rate, bond price, credit default swap price or interest rate swap; or (2) Instruments which fall under the definition of the correlation trading portfolio (CTP) in [6.5], except for those instruments that are recognised in the market risk framework as eligible hedges of risks within the CTP. The bonds with multiple call dates would be considered as instruments bearing other residual risks for the purpose of the RRAO as they are path-dependent options. 9.5 A non-exhaustive list of other residual risks types and instruments that may fall within the criteria set out in [9.4] include: (1) Gap risk: risk of a significant change in vega parameters in options due to small movements in the underlying, which results in hedge slippage. Relevant instruments subject to gap risk include all path dependent options, such as barrier options, and Asian options as well as all digital options. (2) Correlation risk: risk of a change in a correlation parameter necessary for determining the value of an instrument with multiple underlyings. Relevant instruments subject to correlation risk include all basket options, best-of￾options, spread options, basis options, Bermudan options and quanto options. (3) Behavioural risk: risk of a change in exercise/prepayment outcomes such as those that arise in fixed rate mortgage products where retail clients may make decisions motivated by factors other than pure financial gain (such as demographical features and/or and other social factors). A callable bond may only be seen as possibly having behavioural risk if the right to call lies with a retail client. 9.6 When an instrument is subject to one or more of the following risk types, this by itself will not cause the instrument to be subject to the RRAO: (1) Risk from a cheapest-to-deliver option;

Page Number 88 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) Smile risk: the risk of a change in an implied volatility parameter necessary for determining the value of an instrument with optionality relative to the implied volatility of other instruments optionality with the same underlying and maturity, but different moneyness; (3) Correlation risk arising from multi-underlying European or American plain vanilla options, and from any options that can be written as a linear combination of such options. This exemption applies in particular to the relevant index options; (4) Dividend risk arising from a derivative instrument whose underlying does not consist solely of dividend payments; and (5) Index instruments and multi-underlying options of which treatment for delta, vega or curvature risk are set out in [7.31] and [7.32]. These are subject to the RRAO if they fall within the definitions set out in this chapter. For funds that are subject to the treatment specified in 7.36 (ie treated as an unrated “other sector” equity), banks shall assume the fund is exposed to exotic underlying exposures, and to other residual risks, to the maximum possible extent allowed under the fund’s mandate. 9.7 In cases where a transaction exactly matches with a third-party transaction (ie a back-to-back transaction), the instruments used in both transactions must be excluded from the RRAO capital requirement. Any instrument that is listed and/or eligible for central clearing must be excluded from the RRAO. Hedges (for example, dividend swaps hedging dividend risks) may be excluded from the RRAO only if the hedge exactly matches the trade (ie via a back-to-back transaction) as per [9.7]. For the example cited, dividend swaps should remain within the RRAO. As per [9.7], The total return swap (TRS) on an underlying product may be excluded from the RRAO capital requirement if there is an equal and opposite exposure in the same TRS. If no exactly matching transaction exists, the entire notional of the TRS would be allocated to the RRAO. Calculation of the residual risk add-on 9.8 The residual risk add-on must be calculated in addition to any other capital requirements within the standardised approach. The residual risk add-on is to be calculated as follows. (1) The scope of instruments that are subject to the RRAO must not have an impact in terms of increasing or decreasing the scope of risk factors subject to the delta, vega, curvature or DRC treatments in the standardised approach.

Page Number 89 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) The RRAO is the simple sum of gross notional amounts of the instruments bearing residual risks, multiplied by a risk weight. (a) The risk weight for instruments with an exotic underlying specified in [9.3] is 1.0%. (b) The risk weight for instruments bearing other residual risks specified in [9.4] is 0.1%.39 10- Internal models approach: general provisions General criteria 10.1 The use of internal models for the purposes of determining market risk capital requirements is conditional upon the explicit approval from SAMA 10.2 SAMA will only approve a bank’s use of internal models to determine market risk capital requirements if, at a minimum: (1) SAMA is satisfied that the bank’s risk management system is conceptually sound and is implemented with integrity; (2) the bank has, in SAMA view, a sufficient number of staff skilled in the use of sophisticated models not only in the trading area but also in the risk control, audit and, if necessary, back office areas; (3) the bank’s trading desk risk management model has, in SAMA judgement, a proven track record of reasonable accuracy in measuring risk; (4) the bank regularly conducts stress tests along the lines set out in [10.19] to [10.23]; and (5) the positions included in the bank’s internal trading desk risk management models for determining minimum market risk capital requirements are held in trading desks that have been approved for the use of those models and that have passed the required tests described in [10.17]. (6) A bank must also be able to participate in testing exercises to provide any additional information required to satisfy SAMA of the adequacy of the internal model (both prior to model approval and subsequently, if SAMA wishes to review the internal model).

39 Where the bank cannot satisfy the RRAO provides a sufficiently prudent capital charge, then the bank will address any potentially under-capitalised risks by imposing a conservative additional capital charge under Pillar 2.

Page Number 90 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 10.3 SAMA may insist on a period of initial monitoring and live testing of a bank’s internal trading desk risk management model before it is used for the purposes of determining the bank’s market risk capital requirements. 10.4 The scope of trading portfolios that are eligible to use internal models to determine market risk capital requirements is determined based on a three-prong approach as follows: (1) The bank must satisfy SAMA that both the bank’s organisational infrastructure (including the definition and structure of trading desks) and its bank-wide internal risk management model meet qualitative evaluation criteria, as set out in [10.5] to [10.16]. (2) The bank must nominate individual trading desks, as defined in [4.1] to [4.6], for which the bank seeks model approval in order to use the internal models approach (IMA). (a) The bank must nominate trading desks that it intends to be in-scope for model approval and trading desks that are out-of-scope for the use of the IMA. The bank must specify in writing the basis for these nominations. (b) The bank must not nominate trading desks to be out-of-scope for model approval due to capital requirements for a particular trading desk determined using the standardised approach being lower than those determined using the IMA. (c) The bank must use the standardised approach to determine the market risk capital requirements for trading desks that are out-of-scope for model approval. The positions in these out-of-scope trading desks are to be combined with all other positions that are subject to the standardised approach in order to determine the bank’s standardised approach capital requirements. (d) Trading desks that the bank does not nominate for model approval at the time of model approval will be ineligible to use the IMA for a period of at least one year from the date of the latest internal model approval. (3) The bank must receive SAMA approval to use the IMA on individual trading desks. Following the identification of eligible trading desks, this step determines which trading desks will be in-scope to use the IMA and which risk factors within in-scope trading desks are eligible to be included in the bank’s internal expected shortfall (ES) models to determine market risk capital requirements as set out in [13].

Page Number 91 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (a) Each trading desk must satisfy profit and loss (P&L) attribution (PLA) tests on an ongoing basis to be eligible to use the IMA to determine market risk capital requirements. In order to conduct the PLA test, the bank must identify the set of risk factors to be used to determine its market risk capital requirements. (b) Each trading desk also must satisfy backtesting requirements on an ongoing basis to be eligible to use the IMA to determine market risk capital requirements as set out in [12.4] to [12.19]. (c) Banks must conduct PLA tests and backtesting on a quarterly basis to update the eligibility and trading desk classification in PLA for trading desks in-scope to use the IMA. (d) The market risk capital requirements for risk factors that satisfy the risk factor eligibility test as set out in [11.12] to [11.24] must be determined using ES models as specified in [13.1] to [13.15]. (e) The market risk capital requirements for risk factors that do not satisfy the risk factor eligibility test must be determined using stressed expected shortfall (SES) models as specified in [13.16] to [13.17] The model approval process requires an overall assessment of a bank’s bank-wide internal risk capital model. The term “bank-wide” is defined as pertaining to the group of trading desks that the bank nominates as in-scope in their application for the IMA. Securitisation positions are out of scope for IMA regulatory capital treatment, and as a result they are not taken into account for the model eligibility tests. This implies that banks are not allowed to include securitisations in trading desks for which they determine market risk capital requirements using the IMA. Securitisations must be included in trading desks for which capital requirements are determined using the standardised approach. Banks are allowed to also include hedging instruments in trading desks which include securitisations and are capitalised using the standardised approach. Qualitative standards 10.5 In order to use the IMA to determine market risk capital requirements, the bank must have market risk management systems that are conceptually sound and implemented with integrity. Accordingly, the bank must meet the qualitative criteria set out below on an ongoing basis. SAMA will assess that the bank has met the criteria before the bank is permitted to use the IMA. 10.6 The bank must have an independent risk control unit that is responsible for the design and implementation of the bank’s market risk management system. The risk control unit should produce and analyse daily reports on the output of the

Page Number 92 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 trading desk’s risk management model, including an evaluation of the relationship between measures of risk exposure and trading limits. This risk control unit must be independent of business trading units and should report directly to senior management of the bank. 10.7 The bank’s risk control unit must conduct regular backtesting and PLA assessments at the trading desk level. The bank must also conduct regular backtesting of its bank-wide internal models used for determining market risk capital requirements. 10.8 A distinct unit of the bank that is separate from the unit that designs and implements the internal models must conduct the initial and ongoing validation of all internal models used to determine market risk capital requirements. The model validation unit must validate all internal models used for purposes of the IMA on at least an annual basis. 10.9 The board of directors, relevant board committee and senior management of the bank must be actively involved in the risk control process and must devote appropriate resources to risk control as an essential aspect of the business. In this regard, the daily reports prepared by the independent risk control unit must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the bank’s overall risk exposure. 10.10 Internal models used to determine market risk capital requirements are likely to differ from those used by a bank in its day-to-day internal risk management functions. Nevertheless, the core design elements of both the market risk capital requirement model and the internal risk management model should be the same. (1) Valuation models that are a feature of both models should be similar. These valuation models must be an integral part of the internal identification, measurement, management and internal reporting of price risks within the bank’s trading desks. (2) Internal risk management models should, at a minimum, be used to assess the risk of the positions that are subject to market risk capital requirements, although they may assess a broader set of positions. (3) The construction of a trading desk risk management model must be based on the methodologies used in the bank’s internal risk management model with regard to risk factor identification, parameter estimation and proxy concepts and deviate only if this is appropriate due to regulatory requirements. A bank’s market risk capital requirement model and its internal risk management model should address an identical set of risk factors.

Page Number 93 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 10.11 A routine and rigorous programme of stress testing is required. The results of stress testing must be: (1) reviewed at least monthly by senior management; (2) used in the bank’s internal assessment of capital adequacy; and (3) reflected in the policies and limits set by the bank’s management and its board of directors. 10.12 Where stress tests reveal particular vulnerability to a given set of circumstances, the bank must take prompt action to mitigate those risks appropriately (eg by hedging against that outcome, reducing the size of the bank’s exposures or increasing capital). 10.13 The bank must maintain a protocol for compliance with a documented set of internal manuals, policies, controls and procedures concerning the operation of the internal market risk management model. The bank’s risk management model must be well documented. Such documentation may include a comprehensive risk management manual that describes the basic principles of the risk management model and that provides a detailed explanation of the empirical techniques used to measure market risk. 10.14 The bank must receive approval from SAMA prior to implementing any significant changes to its internal models used to determine market risk capital requirements. 10.15 The bank’s internal models for determining market risk capital requirements must address the full set of positions that are in the scope of application of the model. All models’ measurements of risk must be based on a sound theoretical basis, calculated correctly, and reported accurately. 10.16 The bank’s internal audit and validation functions or external auditor must conduct an independent review of the market risk measurement system on at least an annual basis. The scope of the independent review must include both the activities of the business trading units and the activities of the independent risk control unit. The independent review must be sufficiently detailed to determine which trading desks are impacted by any failings. At a minimum, the scope of the independent review must include the following: (1) the organisation of the risk control unit; (2) the adequacy of the documentation of the risk management model and process;

Page Number 94 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) the accuracy and appropriateness of market risk management models (including any significant changes); (4) the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources; (5) the approval process for risk pricing models and valuation systems used by the bank’s front- and back-office personnel; (6) the scope of market risks reflected in the trading desk risk management models; (7) the integrity of the management information system; (8) the accuracy and completeness of position data; (9) the accuracy and appropriateness of volatility and correlation assumptions; (10) the accuracy of valuation and risk transformation calculations; (11) the verification of trading desk risk management model accuracy through frequent backtesting and PLA assessments; and (12) the general alignment between the model to determine market risk capital requirements and the model the bank uses in its day-to-day internal management functions. Model validation standards 10.17 Banks must maintain a process to ensure that their internal models have been adequately validated by suitably qualified parties independent of the model development process to ensure that each model is conceptually sound and adequately reflects all material risks. Model validation must be conducted both when the model is initially developed and when any significant changes are made to the model. The bank must revalidate its models periodically, particularly when there have been significant structural changes in the market or changes to the composition of the bank’s portfolio that might lead to the models no longer being adequate. Model validation must include PLA and backtesting, and must, at a minimum, also include the following: (1) Tests to demonstrate that any assumptions made within internal models are appropriate and do not underestimate risk. This may include reviewing the appropriateness of assumptions of normal distributions and any pricing models.

Page Number 95 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) Further to the regulatory backtesting programmes, model validation must assess the hypothetical P&L (HPL) calculation methodology. (3) The bank must use hypothetical portfolios to ensure that internal models are able to account for particular structural features that may arise. For example, where the data history for a particular instrument does not meet the quantitative standards in [13.1] to [13.12] and the bank maps these positions to proxies, the bank must ensure that the proxies produce conservative results under relevant market scenarios, with sufficient consideration given to ensuring: (a) that material basis risks are adequately reflected (including mismatches between long and short positions by maturity or by issuer); and (b) that the models reflect concentration risk that may arise in an undiversified portfolio. External validation 10.18 The model validation conducted by external auditors and/or supervisory authorities of a bank’s internal model to determine market risk capital requirements should, at a minimum, include the following steps: (1) Verification that the internal validation processes described in [10.17] are operating in a satisfactory manner; (2) Confirmation that the formulae used in the calculation process, as well as for the pricing of options and other complex instruments, are validated by a qualified unit, which in all cases should be independent from the bank’s trading area; (3) Confirmation that the structure of internal models is adequate with respect to the bank’s activities and geographical coverage; (4) Review of the results of both the bank’s backtesting of its internal models (ie comparison of value-at-risk with actual P&L and HPL) and its PLA process to ensure that the models provide a reliable measure of potential losses over time. On request, a bank should make available to SAMA and/or to its external auditors the results as well as the underlying inputs to ES calculations and details of the PLA exercise; and (5) Confirmation that data flows and processes associated with the risk measurement system are transparent and accessible. On request and in accordance with procedures, the bank should provide SAMA and its external auditors access to the models’ specifications and parameters.

Page Number 96 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Stress testing 10.19 Banks that use the IMA for determining market risk capital requirements must have in place a rigorous and comprehensive stress testing programme both at the trading desk level and at the bank-wide level. 10.20 Banks’ stress scenarios must cover a range of factors that (i) can create extraordinary losses or gains in trading portfolios, or (ii) make the control of risk in those portfolios very difficult. These factors include low-probability events in all major types of risk, including the various components of market, credit and operational risks. A bank must design stress scenarios to assess the impact of such factors on positions that feature both linear and non-linear price characteristics (ie options and instruments that have option-like characteristics). 10.21 Banks’ stress tests should be of a quantitative and qualitative nature, incorporating both market risk and liquidity risk aspects of market disturbances. (1) Quantitative elements should identify plausible stress scenarios to which banks could be exposed. (2) Qualitatively, a bank’s stress testing programme should evaluate the capacity of the bank’s capital to absorb potential significant losses and identify steps the bank can take to reduce its risk and conserve capital. 10.22 Banks should routinely communicate results of stress testing to senior management and should periodically communicate those results to the bank’s board of directors. 10.23 Banks should combine the use of SAMA stress scenarios with stress tests developed by the bank itself to reflect its specific risk characteristics. Stress scenarios may include the following: (1) SAMA scenarios requiring no simulations by the bank. A bank should have information on the largest losses experienced during the reporting period and may be required to make this available for SAMA review. SAMA may compare this loss information to the level of capital requirements that would result from a bank’s internal measurement system. For example, the bank may be required to provide SAMA with an assessment of how many days of peak day losses would have been covered by a given ES estimate. (2) Scenarios requiring a simulation by the bank. Banks should subject their portfolios to a series of simulated stress scenarios and provide SAMA with the results. These scenarios could include testing the current portfolio against past periods of significant disturbance (eg the 1987 equity crash, the Exchange Rate Mechanism crises of 1992 and 1993, the increase in interest rates in the

Page Number 97 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 first quarter of 1994, the 1998 Russian financial crisis, the 2000 bursting of the technology stock bubble, the 2007–08 subprime mortgage crisis, or the 2011–12 Euro zone crisis) incorporating both the significant price movements and the sharp reduction in liquidity associated with these events. A second type of scenario would evaluate the sensitivity of the bank’s market risk exposure to changes in the assumptions about volatilities and correlations. Applying this test would require an evaluation of the historical range of variation for volatilities and correlations and evaluation of the bank’s current positions against the extreme values of the historical range. Due consideration should be given to the sharp variation that at times has occurred in a matter of days in periods of significant market disturbance. For example, the above￾mentioned situations involved correlations within risk factors approaching the extreme values of 1 or –1 for several days at the height of the disturbance. (3) Bank-developed stress scenarios. In addition to the scenarios prescribed by SAMA under 10.23, a bank should also develop its own stress tests that it identifies as most adverse based on the characteristics of its portfolio (eg problems in a key region of the world combined with a sharp move in oil prices). A bank should provide SAMA with a description of the methodology used to identify and carry out the scenarios as well as with a description of the results derived from these scenarios. 11- Internal models approach: model requirements Specification of market risk factors 11.1 An important part of a bank’s trading desk internal risk management model is the specification of an appropriate set of market risk factors. Risk factors are the market rates and prices that affect the value of the bank’s trading positions. The risk factors contained in a trading desk risk management model must be sufficient to represent the risks inherent in the bank’s portfolio of on- and off-balance sheet trading positions. Although banks will have some discretion in specifying the risk factors for their internal models, the following requirements must be fulfilled. 11.2 A bank’s market risk capital requirement models should include all risk factors that are used for pricing. In the event a risk factor is incorporated in a pricing model but not in the trading desk risk management model, the bank must support this omission to the satisfaction of SAMA. 11.3 A bank’s market risk capital requirement model must include all risk factors that are specified in the standardised approach for the corresponding risk class, as set out in [6] to [8]. In the event a standardised approach risk factor is not included in the market risk capital requirement model, the bank must support this omission to the satisfaction of SAMA.

Page Number 98 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) For securitised products, banks are prohibited from using internal models to determine market risk capital requirements. Banks must use the standardised approach to determine the market risk capital requirements for securitised products as set out in [3.11]. Accordingly, a bank’s market risk capital requirement model should not specify risk factors for securitisations as defined in [7.10] to [7.11]. 11.4 A bank’s market risk capital requirement model and any stress scenarios calculated for non- modellable risk factors must address non-linearities for options and other relevant products (eg mortgage-backed securities), as well as correlation risk and relevant basis risks (eg basis risks between credit default swaps and bonds). 11.5 A bank may use proxies for which there is an appropriate track record for their representation of a position (eg an equity index used as a proxy for a position in an individual stock). In the event a bank uses proxies, the bank must support their use to the satisfaction of SAMA. 11.6 For general interest rate risk, a bank must use a set of risk factors that corresponds to the interest rates associated with each currency in which the bank has interest rate sensitive on- or off- balance sheet trading positions. (1) The trading desk risk management model must model the yield curve using one of a number of generally accepted approaches (eg estimating forward rates of zero coupon yields). (2) The yield curve must be divided into maturity segments in order to capture variation in the volatility of rates along the yield curve. (3) For material exposures to interest rate movements in the major currencies and markets, banks must model the yield curve using a minimum of six risk factors. (4) The number of risk factors used ultimately should be driven by the nature of the bank’s trading strategies. A bank with a portfolio of various types of securities across many points of the yield curve and that engages in complex arbitrage strategies would require the use of a greater number of risk factors than a bank with less complex portfolios. 11.7 The trading desk risk management model must incorporate separate risk factors to capture credit spread risk (eg between bonds and swaps). A variety of approaches may be used to reflect the credit spread risk arising from less-than-perfectly correlated movements between government and other fixed income instruments, such as specifying a completely separate yield curve for non- government fixed

Page Number 99 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 income instruments (eg swaps or municipal securities) or estimating the spread over government rates at various points along the yield curve. 11.8 For exchange rate risk, the trading desk risk management model must incorporate risk factors that correspond to the individual foreign currencies in which the bank’s positions are denominated. Because the output of a bank’s risk measurement system will be expressed in the bank’s reporting currency, any net position denominated in a foreign currency will introduce foreign exchange risk. A bank must utilise risk factors that correspond to the exchange rate between the bank’s reporting currency and each foreign currency in which the bank has a significant exposure. 11.9 For equity risk, a bank must utilise risk factors that correspond to each of the equity markets in which the bank holds significant positions. (1) At a minimum, a bank must utilise risk factors that reflect market-wide movements in equity prices (eg a market index). Positions in individual securities or in sector indices may be expressed in beta-equivalents relative to a market-wide index. (2) A bank may utilise risk factors that correspond to various sectors of the overall equity market (eg industry sectors or cyclical and non-cyclical sectors). Positions in individual securities within each sector may be expressed in beta￾equivalents relative to a sector index. (3) A bank may also utilise risk factors that correspond to the volatility of individual equities. (4) The sophistication and nature of the modelling technique for a given market should correspond to the bank’s exposure to the overall market as well as the bank’s concentration in individual equities in that market. 11.10 For commodity risk, bank must utilise risk factors that correspond to each of the commodity markets in which the bank holds significant positions. (1) For banks with relatively limited positions in commodity-based instruments, the bank may utilise a straightforward specification of risk factors. Such a specification could entail utilising one risk factor for each commodity price to which the bank is exposed (including different risk factors for different geographies where relevant).

Page Number 100 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) For a bank with active trading in commodities, the bank’s model must account for variation in the convenience yield40 between derivatives positions such as forwards and swaps and cash positions in the commodity. 11.11 For the risks associated with equity investments in funds: (1) For funds that meet the criterion set out in 5.8(a) (ie funds with look￾through possibility), banks must consider the risks of the fund, and of any associated hedges, as if the fund’s positions were held directly by the bank (taking into account the bank’s share of the equity of the fund, and any leverage in the fund structure). The bank must assign these positions to the trading desk to which the fund is assigned. (2) For funds that do not meet the criterion set out in 5.8(a), but meet both the criteria set out in 5.8(b) (ie daily prices and knowledge of the mandate of the fund), banks must use the standardised approach to calculate capital requirements for the fund. Model eligibility of risk factors 11.12 A bank must determine which risk factors within its trading desks that have received approval to use the internal models approach as set out in [12] are eligible to be included in the bank’s internal expected shortfall (ES) model for regulatory capital requirements as set out in [13]. For a risk factor to be classified as modellable by a bank, a necessary condition is that it passes the risk factor eligibility test (RFET). This test requires identification of a sufficient number of real prices that are representative of the risk factor. Collateral reconciliations or valuations cannot be considered real prices to meet the RFET. A price will be considered real if it meets at least one of the following criteria: (1) It is a price at which the institution has conducted a transaction; (2) It is a verifiable price for an actual transaction between other arms-length parties; (3) It is a price obtained from a committed quote made by (i) the bank itself or (ii) another party. The committed quote must be collected and verified through a third-party vendor, a trading platform or an exchange; or

40 The convenience yield reflects the benefits from direct ownership of the physical commodity (eg the ability to profit from temporary market shortages). The convenience yield is affected both by market conditions and by factors such as physical storage costs.

Page Number 101 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (4) It is a price that is obtained from a third-party vendor, where: (a) the transaction or committed quote has been processed through the vendor; (b) the vendor agrees to provide evidence of the transaction or committed quote to SAMA upon request; or (c) the price meets any of the three criteria immediately listed in 11.12 to 11.12. As referenced in [11.12], a committed quote is a price from an arm’s length provider at which the provider of the quote must buy or sell the financial instrument. Orderly transactions and eligible committed quotes with a non-negligible volume, as compared to usual transaction sizes for the bank, reflective of normal market conditions can be generally accepted as valid. 11.13 To pass the RFET, a risk factor that a bank uses in an internal model must meet either of the following criteria on a quarterly basis. Any real price that is observed for a transaction should be counted as an observation for all of the risk factors for which it is representative. (1) The bank must identify for the risk factor at least 24 real price observations per year (measured over the period used to calibrate the current ES model, with no more than one real price observation per day to be included in this count).41,42 Moreover, over the previous 12 months there must be no 90-day period in which fewer than four real price observations are identified for the risk factor (with no more than one real price observation per day to be included in this count). The above criteria must be monitored on a monthly basis; or (2) The bank must identify for the risk factor at least 100 “real” price observations over the previous 12 months (with no more than one “real” price observation per day to be included in this count).

41 When a bank uses data for real price observations from an external source, and those observations are provided with a time lag (eg data provided for a particular day is only made available a number of weeks later), the period used for the RFET may differ from the period used to calibrate the current ES model. The difference in periods used for the RFET and calibration of the ES model should not be greater than one month, ie the banks could use, for each risk factor, a one-year time period finishing up to one month before the RFET assessment instead of the period used to calibrate the current ES model. 42 In particular, a bank may add modellable risk factors, and replace non-modellable risk factors by a basis between these additional modellable risk factors and these non- modellable risk factors. This basis will then be considered a non-modellable risk factor. A combination between modellable and non-modellable risk factors will be a non- modellable risk factor.

Page Number 102 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 11.14 In order for a risk factor to pass the RFET, a bank may also count real price observations based on information collected from a third-party vendor provided all of the following criteria are met: (1) The vendor communicates to the bank the number of corresponding real prices observed and the dates at which they have been observed. (2) The vendor provides, individually, a minimum necessary set of identifier information to enable banks to map real prices observed to risk factors. (3) The vendor is subject to an audit regarding the validity of its pricing information. The results and reports of this audit must be made available on request to SAMA and to banks as a precondition for the bank to be allowed to use real price observations collected by the third-party vendor. If the audit of a third-party vendor is not satisfactory to SAMA, SAMA may decide to prevent the bank from using data from this vendor. 43 11.15 A real price is representative for a risk factor of a bank where the bank is able to extract the value of the risk factor from the value of the real price. The bank must have policies and procedures that describe its mapping of real price observations to risk factors. The bank must provide sufficient information to SAMA in order to determine if the methodologies the bank uses are appropriate. Bucketing approach for the RFET 11.16 Where a risk factor is a point on a curve or a surface (and other higher dimensional objects such as cubes), in order to count real price observations for the RFET, banks may choose from the following bucketing approaches: (1) The own bucketing approach. Under this approach, the bank must define the buckets it will use and meet the following requirements: (a) Each bucket must include only one risk factor, and all risk factors must correspond to the risk factors that are part of the risk-theoretical profit and loss (RTPL) of the bank for the purpose of the profit and loss (P&L) attribution (PLA) test.44

43 In this case, the bank may be permitted to use real price observations from this vendor for other risk factors 44 The requirement to use the same buckets or segmentation of risk factors for the PLA test and the RFET recognises that there is a trade-off in determining buckets for an ES model. The use of more granular buckets may facilitate a trading desk’s success in meeting the requirements of the PLA test, but additional granularity may challenge a bank’s ability to source a sufficient number of real observed prices per bucket to satisfy the RFET. Banks should consider this trade-off when designing their ES models.

Page Number 103 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (b) The buckets must be non-overlapping. (2) The regulatory bucketing approach. Under this approach, the bank must use the following set of standard buckets as set out in Table 1. (a) For interest rate, foreign exchange and commodity risk factors with one maturity dimension (excluding implied volatilities) (t, where t is measured in years), the buckets in row (A) below must be used. (b) For interest rate, foreign exchange and commodity risk factors with several maturity dimensions (excluding implied volatilities) (t, where t is measured in years), the buckets in row (B) below must be used. (c) Credit spread and equity risk factors with one or several maturity dimensions (excluding implied volatilities) (t, where t is measured in years), the buckets in row (C) below must be used. (d) For any risk factors with one or several strike dimensions (delta, δ; ie the probability that an option is “in the money” at maturity), the buckets in row (D) below must be used.45 (e) For expiry and strike dimensions of implied volatility risk factors (excluding those of interest rate swaptions), only the buckets in rows (C) and (D) below must be used. (f) For maturity, expiry and strike dimensions of implied volatility risk factors from interest rate swaptions, only the buckets in row (B), (C) and (D) below must be used. 11.17 Banks may count all real price observations allocated to a bucket to assess whether it passes the RFET for any risk factors that belong to the bucket. A real price

45 For options markets where alternative definitions of moneyness are standard, banks shall convert the regulatory delta buckets to the market-standard convention using their own approved pricing models.

Page Number 104 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 observation must be allocated to a bucket for which it is representative of any risk factors that belong to the bucket. 11.18 As debt instruments mature, real price observations for those products that have been identified within the prior 12 months are usually still counted in the maturity bucket to which they were initially allocated per [11.17]. When banks no longer need to model a credit spread risk factor belonging to a given maturity bucket, banks are allowed to re-allocate the real price observations of this bucket to the adjacent (shorter) maturity bucket.46 A real price observation may only be counted in a single maturity bucket for the purposes of the RFET. 11.19 Where a bank uses a parametric function to represent a curve/surface and defines the function’s parameters as the risk factors in its risk measurement system, the RFET must be passed at the level of the market data used to calibrate the function’s parameters and not be passed directly at the level of these risk factor parameters (due to the fact that real price observations may not exist that are directly representative of these risk factors). 11.20 A bank may use systematic credit or equity risk factors within its models that are designed to capture market-wide movements for a given economy, region or sector, but not the idiosyncratic risk of a specific issuer (the idiosyncratic risk of a specific issuer would be a non-modellable risk factor (NMRF) unless there are sufficient real price observations of that issuer). Real price observations of market indices or instruments of individual issuers may be considered representative for a systematic risk factor as long as they share the same attributes as the systematic risk factor. 11.21 In addition to the approach set out in [11.20], where systematic risk factors of credit or equity risk factors include a maturity dimension (eg a credit spread curve), one of the bucketing approaches set out above must be used for this maturity dimension to count “real” price observations for the RFET. 11.22 Once a risk factor has passed the RFET, the bank should choose the most appropriate data to calibrate its model. The data used for calibration of the model does not need to be the same data used to pass the RFET. 11.23 Once a risk factor has passed the RFET, the bank must demonstrate that the data used to calibrate its ES model are appropriate based on the principles contained in

46 For example, if a bond with an original maturity of four years, had a real price observation on its issuance date eight months ago, banks can opt to allocate the real price observation to the bucket associated with a maturity between 1.5 and 3.5 years instead of to the bucket associated with a maturity between 3.5 and 7.5 years to which it would normally be allocated.

Page Number 105 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 [11.25] to [11.26]. Where a bank has not met these principles to the satisfaction of SAMA for a particular risk factor, SAMA may choose to deem the data unsuitable for use to calibrate the model and, in such case, the risk factor must be excluded from the ES model and subject to capital requirements as an NMRF. 11.24 There may, on very rare occasions, be a valid reason why a significant number of modellable risk factors across different banks may become non-modellable due to a widespread reduction in trading activities (for instance, during periods of significant cross-border financial market stress affecting several banks or when financial markets are subjected to a major regime shift). One possible SAMA response in this instance could be to consider as modellable a risk factor that no longer passes the RFET. However, such a response should not facilitate a decrease in capital requirements. SAMA will only pursue such a response under the most extraordinary, systemic circumstances. Principles for the modellability of risk factors that pass the RFET 11.25 Banks use many different types of models to determine the risks resulting from trading positions. The data requirements for each model may be different. For any given model, banks may use different sources or types of data for the model’s risk factors. Banks must not rely solely on the number of observations of real prices to determine whether a risk factor is modellable. The accuracy of the source of the risk factor real price observation must also be considered. 11.26 In addition to the requirements specified in [11.12] to [11.23], banks must apply the principles below to determine whether a risk factor that passed the RFET can be modelled using the ES model or should be subject to capital requirements as an NMRF. Banks are required to demonstrate to SAMA that these principles are being followed. SAMA may determine risk factors to be non-modellable in the event these principles are not applied. (1) Principle one. The data used may include combinations of modellable risk factors. Banks often price instruments as a combination of risk factors. Generally, risk factors derived solely from a combination of modellable risk factors are modellable. For example, risk factors derived through multifactor beta models for which inputs and calibrations are based solely on modellable risk factors, can be classified as modellable and can be included within the ES model. A risk factor derived from a combination of modellable risk factors that are mapped to distinct buckets of a given curve/surface is modellable only if this risk factor also passes the RFET. (a) Interpolation based on combinations of modellable risk factors should be consistent with mappings used for PLA testing (to determine the RTPL) and should not be based on alternative, and potentially broader, bucketing approaches. Likewise, banks may compress risk factors into

Page Number 106 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 a smaller dimension of orthogonal risk factors (eg principal components) and/or derive parameters from observations of modellable risk factors, such as in models of stochastic implied volatility, without the parameters being directly observable in the market. (b) Subject to the approval of SAMA, banks may extrapolate up to a reasonable distance from the closest modellable risk factor. The extrapolation should not rely solely on the closest modellable risk factor but on more than one modellable risk factor. In the event that a bank uses extrapolation, the extrapolation must be considered in the determination of the RTPL. (2) Principle two. The data used must allow the model to pick up both idiosyncratic and general market risk. General market risk is the tendency of an instrument’s value to change with the change in the value of the broader market, as represented by an appropriate index or indices. Idiosyncratic risk is the risk associated with a particular issuance, including default provisions, maturity and seniority. The data must allow both components of market risk to be captured in any market risk model used to determine capital requirements. If the data used in the model do not reflect either idiosyncratic or general market risk, the bank must apply an NMRF charge for those aspects that are not adequately captured in its model. (3) Principle three. The data used must allow the model to reflect volatility and correlation of the risk positions. Banks must ensure that they do not understate the volatility of an asset (eg by using inappropriate averaging of data or proxies). Further, banks must ensure that they accurately reflect the correlation of asset prices, rates across yield curves and/or volatilities within volatility surfaces. Different data sources can provide dramatically different volatility and correlation estimates for asset prices. The bank should choose data sources so as to ensure that (i) the data are representative of real price observations; (ii) price volatility is not understated by the choice of data; and (iii)correlations are reasonable approximations of correlations among real price observations. Furthermore, any transformations must not understate the volatility arising from risk factors and must accurately reflect the correlations arising from risk factors used in the bank’s ES model. (4) Principle four. The data used must be reflective of prices observed and/or quoted in the market. Where data used are not derived from real price observations, the bank must demonstrate that the data used are reasonably representative of real price observations. To that end, the bank must periodically reconcile price data used in a risk model with front office and back office prices. Just as the back office serves to check the validity of the

Page Number 107 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 front office price, risk model prices should be included in the comparison. The comparison of front or back office prices with risk prices should consist of comparisons of risk prices with real price observations, but front office and back office prices can be used where real price observations are not widely available. Banks must document their approaches to deriving risk factors from market prices. (5) Principle five. The data used must be updated at a sufficient frequency. A market risk model may require large amounts of data, and it can be challenging to update such large data sets frequently. Banks should strive to update their model data as often as possible to account for frequent turnover of positions in the trading portfolio and changing market conditions. Banks should update data at a minimum on a monthly basis, but preferably daily. Additionally, banks should have a workflow process for updating the sources of data. Furthermore, where the bank uses regressions to estimate risk factor parameters, these must be re-estimated on a regular basis, generally no less frequently than every two weeks. Calibration of pricing models to current market prices must also be sufficiently frequent, ideally no less frequent than the calibration of front office pricing models. Where appropriate, banks should have clear policies for backfilling and/or gap-filling missing data. (6) Principle six. The data used to determine stressed expected shortfall (ESR,S) must be reflective of market prices observed and/or quoted in the period of stress. The data for the ESR,S model should be sourced directly from the historical period whenever possible. There are cases where the characteristics of current instruments in the market differ from those in the stress period. Nevertheless, banks must empirically justify any instances where the market prices used for the stress period are different from the market prices actually observed during that period. Further, in cases where instruments that are currently traded did not exist during a period of significant financial stress, banks must demonstrate that the prices used match changes in prices or spreads of similar instruments during the stress period. (a) In cases where banks do not sufficiently justify the use of current market data for products whose characteristics have changed since the stress period, the bank must omit the risk factor for the stressed period and meet the requirement of 13.5(b) that the reduced set of risk factors explain 75% of the fully specified ES model. Moreover, if name-specific risk factors are used to calculate the ES in the actual period and these names were not available in the stressed period, there is a presumption that the idiosyncratic part of these risk factors are not in the reduced set of risk factors. Exposures for risk factors that are included in the current set but not in the reduced set need to be mapped

Page Number 108 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 to the most suitable risk factor of the reduced set for the purposes of calculating ES measures in the stressed period. (7) Principle seven. The use of proxies must be limited, and proxies must have sufficiently similar characteristics to the transactions they represent. Proxies must be appropriate for the region, quality and type of instrument they are intended to represent. SAMA will assess whether methods for combining risk factors are conceptually and empirically sound. (a) For example, the use of indices in a multifactor model must capture the correlated risk of the assets represented by the indices, and the remaining idiosyncratic risk must be demonstrably uncorrelated across different issuers. A multifactor model must have significant explanatory power for the price movements of assets and must provide an assessment of the uncertainty in the final outcome due to the use of a proxy. The coefficients (betas) of a multifactor model must be empirically based and must not be determined based on judgment. Instances where coefficients are set by judgment generally should be considered as NMRFs. (b) If risk factors are represented by proxy data in the current period ES model, the proxy data representation of the risk factor – not the risk factor itself – must be used in the RTPL unless the bank has identified the basis between the proxy and the actual risk factor and properly capitalised the basis either by including the basis in the ES model (if the risk factor is a modellable) or capturing the basis as a NMRF. If the capital requirement for the basis is properly determined, then the bank can choose to include in the RTPL either: (i) the proxy risk factor and the basis; or (ii) the actual risk factor itself. 12- Internal models approach: backtesting and P&L attribution test requirements 12.1 As set out in [10.4], a bank that intends to use the internal models approach (IMA) to determine market risk capital requirements for a trading desk must conduct and successfully pass backtesting at the bank-wide level and both the backtesting and profit and loss (P&L) attribution (PLA) test at the trading desk level as identified in 10.4. 12.2 For a bank to remain eligible to use the IMA to determine market risk capital requirements, a minimum of 10% of the bank’s aggregated market risk capital requirement must be based on positions held in trading desks that qualify for use of the bank’s internal models for market risk capital requirements by satisfying

Page Number 109 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 the backtesting and PLA test as set out in this chapter. This 10% criterion must be assessed by the bank on a quarterly basis when calculating the aggregate capital requirement for market risk according to [13.43]. 12.3 The implementation of the backtesting programme and the PLA test must begin on the date that the internal models capital requirement becomes effective. (1) For SAMA approval of a model, the bank must provide a one-year backtesting and PLA test report to confirm the quality of the model. (2) SAMA may require backtesting and PLA test results prior to that date. (3) SAMA will determine any necessary response to backtesting results based on the number of exceptions over the course of 12 months (ie 250 trading days) generated by the bank’s model. (a) Based on the assessment on the significance of exceptions, SAMA may initiate a dialogue with the bank to determine if there is a problem with a bank’s model. (b) In the most serious cases, SAMA will impose an additional increase in a bank’s capital requirement or disallow use of the model. Backtesting requirements 12.4 Backtesting requirements compare the value-at-risk (VaR) measure calibrated to a one-day holding period against each of the actual P&L (APL) and hypothetical P&L (HPL) over the prior 12 months. Specific requirements to be applied at the bank-wide level and trading desk level are set out below. 12.5 Backtesting of the bank-wide risk model must be based on a VaR measure calibrated at a 99th percentile confidence level. (1) An exception or an outlier occurs when either the actual loss or the hypothetical loss of the bank-wide trading book registered in a day of the backtesting period exceeds the corresponding daily VaR measure given by the model. As per [16.8], exceptions for actual losses are counted separately from exceptions for hypothetical losses; the overall number of exceptions is the greater of these two amounts. (2) In the event either the P&L or the daily VaR measure is not available or impossible to compute, it will count as an outlier. 12.6 In the event an outlier can be shown by the bank to relate to a non-modellable risk factor, and the capital requirement for that non-modellable risk factor exceeds the

Page Number 110 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 actual or hypothetical loss for that day, it may be disregarded for the purpose of the overall backtesting process if SAMA is notified accordingly and does not object to this treatment. In these cases, a bank must document the history of the movement of the value of the relevant non-modellable risk factor and have supporting evidence that the non-modellable risk factor has caused the relevant loss. If the backtesting exception at a desk-level test is being driven by a non-modellable risk factor that receives an SES capital requirement that is in excess of the maximum of the APL loss or HPL loss for that day, it is permitted to be disregarded for the purposes of the desk￾level backtesting. The bank must be able to calculate a non-modellable risk factor capital requirement for the specific desk and not only for the respective risk factor across all desks. For example, if the P&L for a desk is SAR –1.5 million and VaR is SAR 1 million, a non￾modellable risk factor capital requirement (at desk level) of EUR 0.8 million would not be sufficient to disregard an exception for the purpose of desk-level backtesting. The non￾modellable risk factor capital requirement attributed to the standalone desk level (without VaR) must be greater than the loss of SAR 1.5 million in order to disregard an exception for the purpose of desk-level backtesting. 12.7 The scope of the portfolio subject to bank-wide backtesting should be updated quarterly based on the results of the latest trading desk-level backtesting, risk factor eligibility test and PLA tests. 12.8 The framework for SAMA interpretation of backtesting results for the bank-wide capital model encompasses a range of possible responses, depending on the strength of the signal generated from the backtesting. These responses are classified into three backtesting zones, distinguished by colours into a hierarchy of responses. (1) Green zone. This corresponds to results that do not themselves suggest a problem with the quality or accuracy of a bank’s model. (2) Amber zone. This encompasses results that do raise questions in this regard, for which such a conclusion is not definitive. (3) Red zone. This indicates a result that almost certainly indicates a problem with a bank’s risk model. 12.9 These zones are defined according to the number of exceptions generated in the backtesting programme considering statistical errors as explained in [16.9] to [16.21]. Table 1 sets out boundaries for these zones and the presumptive SAMA response for each backtesting outcome, based on a sample of 250 observations.

Page Number 111 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 12.10 The backtesting green zone generally would not initiate a SAMA increase in capital requirements for backtesting (ie no backtesting add-on would apply). 12.11 Outcomes in the backtesting amber zone could result from either accurate or inaccurate models. However, they are generally deemed more likely for inaccurate models than for accurate models. Within the backtesting amber zone, SAMA will impose a higher capital requirement in the form of a backtesting add-on. The number of exceptions should generally inform the size of any backtesting add-on, as set out in Table 1 of [12.9]. 12.12 A bank must also document all of the exceptions generated from its ongoing backtesting programme, including an explanation for each exception. 12.13 A bank may also implement backtesting for confidence intervals other than the 99th percentile, or may perform other statistical tests not set out in this standard. 12.14 Besides a higher capital requirement for any outcomes that place the bank in the backtesting amber zone, in the case of severe problems with the basic integrity of the model, SAMA may consider whether to disallow the bank’s use of the model for market risk capital requirement purposes altogether. 12.15 If a bank’s model falls into the backtesting red zone, SAMA will automatically increase the multiplication factor applicable to the bank’s model or may disallow use of the model. Backtesting at the trading desk level 12.16 The performance of a trading desk’s risk management model will be tested through daily backtesting.

Page Number 112 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 12.17 The backtesting assessment is considered to be complementary to the PLA assessment when determining the eligibility of a trading desk for the IMA. 12.18 At the trading desk level, backtesting must compare each desk’s one-day VaR measure (calibrated to the most recent 12 months’ data, equally weighted) at both the 97.5th percentile and the 99th percentile, using at least one year of current observations of the desk’s one-day P&L. (1) An exception or an outlier occurs when either the actual or hypothetical loss of the trading desk registered in a day of the backtesting period exceeds the corresponding daily VaR measure determined by the bank’s model. Exceptions for actual losses are counted separately from exceptions for hypothetical losses; the overall number of exceptions is the greater of these two amounts. (2) In the event either the P&L or the risk measure is not available or impossible to compute, it will count as an outlier. Volatility scaling of returns for VaR calculation at the discretion of the bank that results in a shorter observation period being used is not allowed. A bank may scale up the volatility of all observations for a selected (group of) risk factor(s) to reflect a recent stress period. The bank may use this scaled data to calculate future VaR and expected shortfall estimates only after ex ante notification of such a scaling to SAMA. 12.19 If any given trading desk experiences either more than 12 exceptions at the 99th percentile or 30 exceptions at the 97.5th percentile in the most recent 12-month period, the capital requirement for all of the positions in the trading desk must be determined using the standardised approach.47 PLA test requirements 12.20 The PLA test compares daily risk-theoretical P&L (RTPL) with the daily HPL for each trading desk. It intends to: (1) measure the materiality of simplifications in a banks’ internal models used for determining market risk capital requirements driven by missing risk factors and differences in the way positions are valued compared with their front office systems; and

47 Desks with exposure to issuer default risk must pass a two-stage approval process. First, the market risk model must pass backtesting and PLA. Conditional on approval of the market risk model, the desk may then apply for approval to model default risk. Desks that fail either test must be capitalised under the standardised approach.

Page Number 113 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) prevent banks from using their internal models for the purposes of capital requirements when such simplifications are considered material. 12.21 The PLA test must be performed on a standalone basis for each trading desk in scope for use of the IMA. Definition of profits and losses used for the PLA test and backtesting 12.22 The RTPL is the daily trading desk-level P&L that is produced by the valuation engine of the trading desk’s risk management model. (1) The trading desk’s risk management model must include all risk factors that are included in the bank’s expected shortfall (ES) model with SAMA parameters and any risk factors deemed not modellable by SAMA, and which are therefore not included in the ES model for calculating the respective regulatory capital requirement, but are included in non-modellable risk factors. (2) The RTPL must not take into account any risk factors that the bank does not include in its trading desk’s risk management model. 12.23 Movements in all risk factors contained in the trading desk’s risk management model should be included, even if the forecasting component of the internal model uses data that incorporates additional residual risk. For example, a bank using a multifactor beta-based index model to capture event risk might include alternative data in the calibration of the residual component to reflect potential events not observed in the name-specific historical time series. The fact that the name is a risk factor in the model, albeit modelled in a multifactor model environment, means that, for the purposes of the PLA test, the bank would include the actual return of the name in the RTPL (and in the HPL) and receive recognition for the risk factor coverage of the model. 12.24 The PLA test compares a trading desk’s RTPL with its HPL. The HPL used for the PLA test should be identical to the HPL used for backtesting purposes. This comparison is performed to determine whether the risk factors included and the valuation engines used in the trading desk’s risk management model capture the material drivers of the bank’s P&L by determining if there is a significant degree of association between the two P&L measures observed over a suitable time period. The RTPL can differ from the HPL for a number of reasons. However, a trading desk risk management model should provide a reasonably accurate assessment of the risks of a trading desk to be deemed eligible for the internal models-based approach. 12.25 The HPL must be calculated by revaluing the positions held at the end of the previous day using the market data of the present day (ie using static positions).

Page Number 114 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 As HPL measures changes in portfolio value that would occur when end-of-day positions remain unchanged, it must not take into account intraday trading nor new or modified deals, in contrast to the APL. Both APL and HPL include foreign denominated positions and commodities included in the banking book. 12.26 Fees and commissions must be excluded from both APL and HPL as well as valuation adjustments for which separate regulatory capital approaches have been otherwise specified as part of the rules (eg credit valuation adjustment and its associated eligible hedges) and valuation adjustments that are deducted from Common Equity Tier 1 (eg the impact on the debt valuation adjustment component of the fair value of financial instruments must be excluded from these P&Ls). 12.27 Any other market risk-related valuation adjustments, irrespective of the frequency by which they are updated, must be included in the APL while only valuation adjustments updated daily must be included in the HPL, unless the bank has received specific agreement to exclude them from SAMA. Smoothing of valuation adjustments that are not calculated daily is not allowed. P&L due to the passage of time should be included in the APL and should be treated consistently in both HPL and RTPL. 48 12.28 Valuation adjustments that the bank is unable to calculate at the trading desk level (eg because they are assessed in terms of the bank’s overall positions/risks or because of other constraints around the assessment process) are not required to be included in the HPL and APL for backtesting at the trading desk level, but should be included for bank-wide backtesting. To the satisfaction of SAMA, the bank must provide support for valuation adjustments that are not computed at a trading desk level. 12.29 Both APL and HPL must be computed based on the same pricing models (eg same pricing functions, pricing configurations, model parametrisation, market data and systems) as the ones used to produce the reported daily P&L. PLA test data input alignment 12.30 For the sole purpose of the PLA assessment, banks are allowed to align RTPL input data for its risk factors with the data used in HPL if these alignments are documented, justified to SAMA and the requirements set out below are fulfilled: (1) Banks must demonstrate that HPL input data can be appropriately used for RTPL purposes, and that no risk factor differences or valuation engine

48 Time effects can include various elements such as: the sensitivity to time, or theta effect (ie using mathematical terminology, the first-order derivative of the price relative to the time) and carry or costs of funding.

Page Number 115 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 differences are omitted when transforming HPL input data into a format which can be applied to the risk factors used in RTPL calculation. (2) Any adjustment of RTPL input data must be properly documented, validated and justified to SAMA. (3) Banks must have procedures in place to identify changes with regard to the adjustments of RTPL input data. Banks must notify SAMA of any such changes. (4) Banks must provide assessments on the effect these input data alignments would have on the RTPL and the PLA test. To do so, banks must compare RTPL based on HPL-aligned market data with the RTPL based on market data without alignment. This comparison must be performed when designing or changing the input data alignment process and upon the request of SAMA. 12.31 Adjustments to RTPL input data will be allowed when the input data for a given risk factor that is included in both the RTPL and the HPL differs due to different providers of market data sources or time fixing of market data sources, or transformations of market data into input data suitable for the risk factors of the underlying pricing models. These adjustments can be done either: (1) by direct replacement of the RTPL input data (eg par rate tenor x, provider a) with the HPL input data (eg par rate tenor x, provider b); or (2) by using the HPL input data (eg par rate tenor x, provider b) as a basis to calculate the risk factor data needed in the RTPL/ES model (eg zero rate tenor x). In the event trading desks of a bank operate in different time zones compared to the location of the bank’s risk control department, data for risk modelling could be retrieved at different snapshot times compared to the data on which the desks’ front office P&L is based. Banks are permitted to align the snapshot time used for the calculation of the RTPL of a desk to the snapshot time used for the derivation of its HPL. 12.32 If the HPL uses market data in a different manner to RTPL to calculate risk parameters that are essential to the valuation engine, these differences must be reflected in the PLA test and as a result in the calculation of HPL and RTPL. In this regard, HPL and RTPL are allowed to use the same market data only as a basis, but must use their respective methods (which can differ) to calculate the respective valuation engine parameters. This would be the case, for example, where market data are transformed as part of the valuation process used to calculate RTPL. In that instance, banks may align market data between RTPL and HPL pre-transformation but not post- transformation.

Page Number 116 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 12.33 Banks are not permitted to align HPL input data for risk factors with input data used in RTPL. Adjustments to RTPL or HPL to address residual operational noise are not permitted. Residual operational noise arises from computing HPL and RTPL in two different systems at two different points in time. It may originate from transitioning large portions of data across systems, and potential data aggregations may result in minor reconciliation gaps below tolerance levels for intervention; or from small differences in static/reference data and configuration. PLA test metrics 12.34 The PLA requirements are based on two test metrics: (1) the Spearman correlation metric to assess the correlation between RTPL and HPL; and (2) the Kolmogorov-Smirnov (KS) test metric to assess similarity of the distributions of RTPL and HPL. 12.35 To calculate each test metric for a trading desk, the bank must use the time series of the most recent 250 trading days of observations of RTPL and HPL. Process for determining the Spearman correlation metric 12.36 For a time series of HPL, banks must produce a corresponding time series of ranks based on the size of the P&L (𝑅HP𝐿). That is, the lowest value in the HPL time series receives a rank of 1, the next lowest value receives a rank of 2 and so on. 12.37 Similarly, for a time series of RTPL, banks must produce a corresponding time series of ranks based on size (𝑅𝑅TP𝐿). 12.38 Banks must calculate the Spearman correlation coefficient of the two time series of rank values of 𝑅𝑅TP𝐿 and 𝑅HP𝐿 based on size using the following formula, where 𝜎𝑅𝐻PL and 𝜎𝑅𝑅𝑇PL are the standard deviations of 𝑅𝑅TP𝐿 and 𝑅HP𝐿. Process for determining Kolmogorov-Smirnov test metrics 12.39 The bank must calculate the empirical cumulative distribution function of RTPL. For any value of RTPL, the empirical cumulative distribution is the product of 0.004 and the number of RTPL observations that are less than or equal to the specified RTPL.

Page Number 117 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 12.40 The bank must calculate the empirical cumulative distribution function of HPL. For any value of HPL, the empirical cumulative distribution is the product of 0.004 and number of HPL observations that are less than or equal to the specified HPL. 12.41 The KS test metric is the largest absolute difference observed between these two empirical cumulative distribution functions at any P&L value. PLA test metrics evaluation 12.42 Based on the outcome of the metrics, a trading desk is allocated to a PLA test red zone, an amber zone or a green zone as set out in Table 2. (1) A trading desk is in the PLA test green zone if both (a) the correlation metric is above 0.80; and (b) the KS distributional test metric is below 0.09 (p-value = 0.264). (2) A trading desk is in the PLA test red zone if the correlation metric is less than 0.7 or if the KS distributional test metric is above 0.12 (p-value = 0.055). (3) A trading desk is in the PLA amber zone if it is allocated neither to the green zone nor to the red zone. 12.43 If a trading desk is in the PLA test red zone, it is ineligible to use the IMA to determine market risk capital requirements and must be use the standardised approach. (1) Risk exposures held by these ineligible trading desks must be included with the out-of- scope trading desks for purposes of determining capital requirement per the standardised approach. (2) A trading desk deemed ineligible to use the IMA must remain out-of-scope to use the IMA until: (a) the trading desk produces outcomes in the PLA test green zone; and (b) the trading desk has satisfied the backtesting exceptions requirements over the past 12 months.

Page Number 118 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 12.44 If a trading desk is in the PLA test amber zone, it is not considered an out-of-scope trading desk for use of the IMA. (1) If a trading desk is in the PLA test amber zone, it cannot return to the PLA test green zone until: (a) the trading desk produces outcomes in the PLA test green zone; and (b) the trading desk has satisfied its backtesting exceptions requirements over the prior 12 months. (2) Trading desks in the PLA test amber zone are subject to a capital surcharge as specified in [13.43] Treatment for exceptional situations 12.45 There may, on very rare occasions, be a valid reason why a series of accurate trading desk level- models across different banks will produce many backtesting exceptions or inadequately track the P&L produced by the front office pricing model (for instance, during periods of significant cross-border financial market stress affecting several banks or when financial markets are subjected to a major regime shift). One possible SAMA response in this instance would be to permit the relevant trading desks to continue to use the IMA but require each trading desk’s model to take account of the regime shift or significant market stress as quickly as practicable while maintaining the integrity of its procedures for updating the model. SAMA will only pursue such a response under the most extraordinary, systemic circumstances. 13- Internal models approach: capital requirements calculation The internal models approach is based on the use Expected Shortfall (ES) techniques. Calculation of expected shortfall 13.1 Banks will have flexibility in devising the precise nature of their expected shortfall (ES) models, but the following minimum standards will apply for the purpose of calculating market risk capital requirements. Banks subject to SAMA approval can apply stricter standards. The IMA does not require all products to be simulated on full revaluation. Simplifications (eg sensitivities-based valuation) may be used provided SAMA agrees that the method used is adequate for the instruments covered.

Page Number 119 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 13.2 ES must be computed on a daily basis for the bank-wide internal models to determine market risk capital requirements. ES must also be computed on a daily basis for each trading desk that uses the internal models approach (IMA). 13.3 In calculating ES, a bank must use a 97.5th percentile, one-tailed confidence level. 13.4 In calculating ES, the liquidity horizons described in [13.12] must be reflected by scaling an ES calculated on a base horizon. The ES for a liquidity horizon must be calculated from an ES at a base liquidity horizon of 10 days with scaling applied to this base horizon result as expressed below, where: (1) ES is the regulatory liquidity-adjusted ES; (2) T is the length of the base horizon, ie 10 days; (3) EST(P) is the ES at horizon T of a portfolio with positions P = (pi) with respect to shocks to all risk factors that the positions P are exposed to; (4) EST(P, j) is the ES at horizon T of a portfolio with positions P = (pi) with respect to shocks for each position pi in the subset of risk factors Q(pi , j), with all other risk factors held constant; (5) the ES at horizon T, EST(P) must be calculated for changes in the risk factors, and EST(P, j) must be calculated for changes in the relevant subset Q(pi , j) of risk factors, over the time interval T without scaling from a shorter horizon; (6) Q(pi , j)j is the subset of risk factors for which liquidity horizons, as specified in [13.12], for the desk where pi is booked are at least as long as LHj according to the table below. For example, Q(pi,4) is the set of risk factors with a 60-day horizon and a 120-day liquidity horizon. Note that Q(pi , j) is a subset of Q(pi , j–1); (7) the time series of changes in risk factors over the base time interval T may be determined by overlapping observations; and (8) LHj is the liquidity horizon j, with lengths in the following table:

Page Number 120 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 13.5 The ES measure must be calibrated to a period of stress. (1) Specifically, the ES measure must replicate an ES outcome that would be generated on the bank’s current portfolio if the relevant risk factors were experiencing a period of stress. This is a joint assessment across all relevant risk factors, which will capture stressed correlation measures. (2) This calibration is to be based on an indirect approach using a reduced set of risk factors. Banks must specify a reduced set of risk factors that are relevant for their portfolio and for which there is a sufficiently long history of observations. (a) This reduced set of risk factors is subject to SAMA approval and must meet the data quality requirements for a modellable risk factor as outlined in [11.12] to [11.24]. (b) The identified reduced set of risk factors must be able to explain a minimum of 75% of the variation of the full ES model (ie the ES of the reduced set of risk factors should be at least equal to 75% of the fully specified ES model on average measured over the preceding 12- week period). The indicator that must be maximised for the identification of the stressed period is the aggregate capital requirement for modellable risk factors (IMCC) as per [13.15], it has to be maximised for the modellable risk factors, which implies that ESr,s is maximised, as noted in [13.7]. The reduced set of risk factors must be able to explain a minimum of 75% of the variation of the full ES model at the group level for the aggregate of all desks with IMA model approval. 13.6 The ES for market risk capital purposes is therefore expressed as follows, where: (1) The ES for the portfolio using the above reduced set of risk factors (𝐸S𝑅,S), is calculated based on the most severe 12-month period of stress available over the observation horizon.

Page Number 121 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) 𝐸S𝑅,S is then scaled up by the ratio of (i) the current ES using the full set of risk factors to (ii) the current ES measure using the reduced set of factors. For the purpose of this calculation, this ratio is floored at 1. (a) ESF,C is the ES measure based on the current (most recent) 12-month observation period with the full set of risk factors; and (b) ESR,C is the ES measure based on the current period with a reduced set of risk factors. 13.7 For measures based on stressed observations (ESR,S), banks must identify the 12- month period of stress over the observation horizon in which the portfolio experiences the largest loss. The observation horizon for determining the most stressful 12 months must, at a minimum, span back to and include 2007. Observations within this period must be equally weighted. Banks must update their 12-month stressed periods at least quarterly, or whenever there are material changes in the risk factors in the portfolio. Whenever a bank updates its 12-month stressed periods it must also update the reduced set of risk factors (as the basis for the calculations of ER,C and ER,S) accordingly. 13.8 For measures based on current observations (ESF,C), banks must update their data sets no less frequently than once every three months and must also reassess data sets whenever market prices are subject to material changes. (1) This updating process must be flexible enough to allow for more frequent updates. (2) SAMA may also require a bank to calculate its ES using a shorter observation period if, in SAMA’s judgement; this is justified by a significant upsurge in price volatility. In this case, however, the period should be no shorter than six months. 13.9 No particular type of ES model is prescribed. Provided that each model used captures all the material risks run by the bank, as confirmed through profit and loss (P&L) attribution (PLA) tests and backtesting, and conforms to each of the requirements set out above and below, SAMA may permit banks to use models based on either historical simulation, Monte Carlo simulation, or other appropriate analytical methods. 13.10 Banks will have discretion to recognise empirical correlations within broad regulatory risk factor classes (interest rate risk, equity risk, foreign exchange risk, commodity risk and credit risk, including related options volatilities in each risk

Page Number 122 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 factor category). Empirical correlations across broad risk factor categories will be constrained by SAMA aggregation requirements, as described in [13.14] to [13.15], and must be calculated and used in a manner consistent with the applicable liquidity horizons, clearly documented and able to be explained to SAMA on request. 13.11 Banks’ models must accurately capture the risks associated with options within each of the broad risk categories. The following criteria apply to the measurement of options risk: (1) Banks’ models must capture the non-linear price characteristics of options positions. (2) Banks’ risk measurement systems must have a set of risk factors that captures the volatilities of the rates and prices underlying option positions, ie vega risk. Banks with relatively large and/or complex options portfolios must have detailed specifications of the relevant volatilities. Banks must model the volatility surface across both strike price and vertex (ie tenor). 13.12 As set out in [13.4], a scaled ES must be calculated based on the liquidity horizon n defined below. n is calculated per the following conditions: (1) Banks must map each risk factor on to one of the risk factor categories shown below using consistent and clearly documented procedures. (2) The mapping of risk factors must be: (a) set out in writing; (b) validated by the bank’s risk management; (c) made available to SAMA; and (d) subject to internal audit. (3) n is determined for each broad category of risk factor as set out in Table 2. However, on a desk-by-desk basis, n can be increased relative to the values in the table below (ie the liquidity horizon specified below can be treated as a floor). Where n is increased, the increased horizon must be 20, 40, 60 or 120 days and the rationale must be documented and be subject to SAMA approval. Furthermore, liquidity horizons should be capped at the maturity of the related instrument.

Page Number 123 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Liquidity horizon n by risk factor Table 2 Risk factor category n Risk factor category n Interest rate: specified currencies - EUR, USD, GBP, AUD, JPY, SEK, CAD and domestic currency of a bank 10 Equity price (small cap): volatility 60 Interest rate: unspecified currencies 20 Equity: other types 60 Interest rate: volatility 60 Foreign exchange (FX) rate: specified currency pairs49 10 Interest rate: other types 60 FX rate: currency pairs 20 Credit spread: sovereign (investment grade, or IG) 20 FX: volatility 40 Credit spread: sovereign (high yield, or HY) 40 FX: other types 40 Credit spread: corporate (IG) 40 Energy and carbon emissions trading price 20 Credit spread: corporate (HY) 60 Precious metals and non-ferrous metals price 20 Credit spread: volatility 120 Other commodities price 60 Credit spread: other types 120 Energy and carbon emissions trading price: volatility 60 Precious metals and non-ferrous metals price: volatility 60 Equity price (large cap) 10 Other commodities price: volatility 120 Equity price (small cap) 20 Commodity: other types 120 Equity price (large cap): volatility 20 The liquidity horizon for equity large cap repo and dividend risk factors is 20 days. All other equity repo and dividend risk factors are subject to a liquidity horizon of 60 days. For mono-currency and cross-currency basis risk, the liquidity horizons of 10 days and 20 days for interest rate-specified currencies and unspecified currencies, respectively, applied The liquidity horizon for inflation risk factors should be consistent with the liquidity horizons for interest rate risk factors for a given currency. If the maturity of the instrument is shorter than the respective liquidity horizon of the risk factor as prescribed in [13.12], the next longer liquidity horizon length (out of the lengths of 10, 20, 40, 60 or 120 days as set out in the paragraph) compared with the maturity of the instrument itself must be used. For example, although the liquidity horizon for interest rate

49 SAR/USD USD/EUR, USD/JPY, USD/GBP, USD/AUD, USD/CAD, USD/CHF, USD/MXN, USD/CNY, USD/NZD, USD/RUB, USD/HKD, USD/SGD, USD/TRY, USD/KRW, USD/SEK, USD/ZAR, USD/INR, USD/NOK, USD/BRL, EUR/JPY, EUR/GBP, EUR/CHF and JPY/AUD. Currency pairs forming first-order crosses across these specified currency pairs are also subject to the same liquidity horizon.

Page Number 124 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 volatility is prescribed as 60 days, if an instrument matures in 30 days, a 40-day liquidity horizon would apply for the instrument’s interest rate volatility. To determine the liquidity horizon of multi-sector credit and equity indices, the respective liquidity horizons of the underlying instruments must be used. A weighted average of liquidity horizons of the instruments contained in the index must be determined by multiplying the liquidity horizon of each individual instrument by its weight in the index (ie the weight used to construct the index) and summing across all instruments. The liquidity horizon of the index is the shortest liquidity horizon (out of 10, 20, 40, 60 and 120 days) that is equal to or longer than the weighted average liquidity horizon. For example, if the weighted average liquidity horizon is 12 days, the liquidity horizon of the index would be 20 days. Calculation of capital requirement for modellable risk factors 13.13 For those trading desks that are permitted to use the IMA, all risk factors that are deemed to be modellable must be included in the bank’s internal, bank-wide ES model. The bank must calculate its internally modelled capital requirement at the bank-wide level using this model, with no SAMA constraints on cross-risk class correlations (IMCC(C)). Banks design their own models for use under the IMA. As a result, they may exclude risk factors from IMA models as long as SAMA does not conclude that the risk factor must be capitalised by either ES or SES. Moreover, at a minimum, the risk factors defined in [11.1] to [11.11] need to be covered in the IMA. If a risk factor is capitalised by neither ES nor SES, it is to be excluded from the calculation of risk-theoretical P&L. 13.14 The bank must calculate a series of partial ES capital requirements (ie all other risk factors must be held constant) for the range of broad regulatory risk classes (interest rate risk, equity risk, foreign exchange risk, commodity risk and credit spread risk). These partial, non-diversifiable (constrained) ES values (IMCC(Ci)) will then be summed to provide an aggregated risk class ES capital requirement. 13.15 The aggregate capital requirement for modellable risk factors (IMCC) is based on the weighted average of the constrained and unconstrained ES capital requirements, where: (1) The stress period used in the risk class level ESR,S,i should be the same as that used to calculate the portfolio-wide ESR,S. (2) Rho (ρ) is the relative weight assigned to the firm’s internal model. The value of ρ is 0.5 (3) B stands for broad regulatory risk classes as set out in [13.14].

Page Number 125 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 The formula specified in [13.15], 𝐼M𝐶C = (𝐼M(𝐶) + (1 − 𝜌)(∑ 𝐵 𝑖=1 𝐼M𝐶𝐶(𝐶𝑖)), can be rewritten as 𝐼M𝐶𝐶 = 𝜌(𝐼M𝐶𝐶(𝐶)) + (1 − 𝜌) ( IMCC(C )) with IMCC(C) = While ESR,S, ESF,C and ESR,C must be calculated daily, it is generally acceptable that the ratio of undiversified IMCC(C) to diversified IMCC(C), , may be calculated on a weekly basis. By defining 𝜔 as 𝜔 = 𝜌 + (1 − 𝜌) ∙ the formula for the calculation of IMCC can be rearranged, leading to the following expression of IMCC: 𝐼M𝐶𝐶 = 𝜔 ∙ (𝐼M(𝐶)). Hence, IMCC can be calculated as a multiple of IMCC(C), where IMCC(C) is calculated daily and the multiplier 𝜔 is updated weekly. Banks must have procedures and controls in place to ensure that the weekly calculation of the “undiversified IMCC(C) to diversified IMCC(C)” ratio does not lead to a systematic underestimation of risks relative to daily calculation. Banks must be in a position to switch to daily calculation upon SAMA direction. Calculation of capital requirement for non-modellable risk factors 13.16 Capital requirements for each non-modellable risk factor (NMRF) are to be determined using a stress scenario that is calibrated to be at least as prudent as the ES calibration used for modelled risks (ie a loss calibrated to a 97.5% confidence threshold over a period of stress). In determining that period of stress, a bank must determine a common 12-month period of stress across all NMRFs in the same risk class. Subject to SAMA approval, a bank may be permitted to calculate stress scenario capital requirements at the bucket level (using the same buckets that the bank uses to disprove modellability, per [11.16]) for risk factors that belong to curves, surfaces or cubes (ie a single stress scenario capital requirement for all the NMRFs that belong to the same bucket). (1) For each NMRF, the liquidity horizon of the stress scenario must be the greater of the liquidity horizon assigned to the risk factor in [13.12] and 20 days. SAMAmay require a higher liquidity horizon. (2) For NMRFs arising from idiosyncratic credit spread risk, banks may apply a common 12- month stress period. Likewise, for NMRFs arising from

Page Number 126 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 idiosyncratic equity risk arising from spot, futures and forward prices, equity repo rates, dividends and volatilities, banks may apply a common 12-month stress scenario. Additionally, a zero correlation assumption may be used when aggregating gains and losses provided the bank conducts analysis to demonstrate to SAMA that this is appropriate.50Correlation or diversification effects between other non-idiosyncratic NMRFs are recognised through the formula set out in [13.17]. (3) In the event that a bank cannot provide a stress scenario which is acceptable for SAMA, the bank will have to use the maximum possible loss as the stress scenario. 13.17 The aggregate regulatory capital measure for I (non-modellable idiosyncratic credit spread risk factors that have been demonstrated to be appropriate to aggregate with zero correlation), J (non-modellable idiosyncratic equity risk factors that have been demonstrated to be appropriate to aggregate with zero correlation) and the remaining K (risk factors in model-eligible trading desks that are non-modellable (SES)) is calculated as follows, where: (1) ISESNM,i is the stress scenario capital requirement for idiosyncratic credit spread non- modellable risk i from the I risk factors aggregated with zero correlation; (2) ISES NM,j is the stress scenario capital requirement for idiosyncratic equity non-modellable risk j from the J risk factors aggregated with zero correlation; (3) SESNM,k is the stress scenario capital requirement for non-modellable risk k from K risk factors; and (4) Rho (𝜌) is equal to 0.6.

50 The tests are generally done on the residuals of panel regressions where the dependent variable is the change in issuer spread while the independent variables can be either a change in a market factor or a dummy variable for sector and/or region. The assumption is that the data on the names used to estimate the model suitably proxies the names in the portfolio and the idiosyncratic residual component captures the multifactor-name basis. If the model is missing systematic explanatory factors or the data suffers from measurement error, then the residuals would exhibit heteroscedasticity (which can be tested via White, Breuche Pagan tests etc) and/or serial correlation (which can be tested with Durbin Watson, Lagrange multiplier (LM) tests etc) and/or cross-sectional correlation (clustering).

Page Number 127 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Calculation of default risk capital requirement 13.18 Banks must have a separate internal model to measure the default risk of trading book positions. The general criteria in [10.1] to [10.4] and the qualitative standards in [10.5] to [10.16] also apply to the default risk model. 13.19 Default risk is the risk of direct loss due to an obligor’s default as well as the potential for indirect losses that may arise from a default event. 13.20 Default risk must be measured using a value-at-risk (VaR) model. (1) Banks must use a default simulation model with two types of systematic risk factors. (2) Default correlations must be based on credit spreads or on listed equity prices. Correlations must be based on data covering a period of 10 years that includes a period of stress as defined in [13.5] and based on a one-year liquidity horizon. (3) Banks must have clear policies and procedures that describe the correlation calibration process, documenting in particular in which cases credit spreads or equity prices are used. (4) Banks have the discretion to apply a minimum liquidity horizon of 60 days to the determination of default risk capital (DRC) requirement for equity sub￾portfolios. (5) The VaR calculation must be conducted weekly and be based on a one-year time horizon at a one-tail, 99.9 percentile confidence level. Banks are permitted to calibrate correlations to liquidity horizons of 60 days in the case that a separate calculation is performed for equity sub-portfolios and these desks deal predominately in equity exposures. In the case of a desk with both equity and bond exposures, for which a joint calculation for default risk of equities and bonds needs to be performed, the correlations need to be calibrated to a liquidity horizon of one year. In this case, a bank is permitted to consistently use a 60-day probability of default (PD) for equities and a one-year PD for bonds. 13.20 states: “Default correlations must be based on credit spreads or on listed equity prices.” No additional data sources (eg rating time series) are permitted 13.20 specifies that banks must use a default simulation model with two types of systematic risk factors. To meet this condition, the model always have two random variables that correspond to the systematic risk factors. Systematic risk in a DRC requirement model must be accounted for via multiple systematic factors of two different types. The random

Page Number 128 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 variable that determines whether an obligor defaults must be an obligor-specific function of the systematic factors of both types and of an idiosyncratic factor. For example, in a Merton￾type model, obligor i defaults when its asset return X falls below an obligor-specific threshold that determines the obligor’s probability of default. Systematic risk can be described via M systematic regional factors Yj region (𝑗 = 1, ... , M) and 𝑁 systematic industry factors Yj industry (𝑗= 1, ... , 𝑁). For each obligor i, region factor loadings Bi,j region and industry factor loadings Bi,j industry that describe the sensitivity of the obligor’s asset return to each systematic factor need to be chosen. There must be at least one non-zero factor loading for the region type and at least one non-zero factor loading for the industry type. The asset return of obligor i can be represented as X𝑖 =∑ 𝑀 𝑗=1 Bi,j region ∙ Yj region +∑ 𝑁 𝑗=1 Bi,j industry ∙ Yj industry +𝛾𝑖 ∙𝜀𝑖 , where 𝜀𝑖 is the idiosyncratic risk factor and 𝛾𝑖 is the idiosyncratic factor loading. Banks are permitted to use a 60-day liquidity horizon for all equity positions but are permitted to use a longer liquidity horizon where appropriate. 13.21 All positions subject to market risk capital requirements that have default risk as defined in [13.19], with the exception of those positions subject to the standardised approach, are subject to the DRC requirement model. (1) Sovereign exposures (including those denominated in the sovereign’s domestic currency), equity positions and defaulted debt positions must be included in the model. (2) For equity positions, the default of an issuer must be modelled as resulting in the equity price dropping to zero. 13.22 The DRC requirement model capital requirement is the greater of: (1) the average of the DRC requirement model measures over the previous 12 weeks; or (2) the most recent DRC requirement model measure. 13.23 A bank must assume constant positions over the one-year horizon, or 60 days in the context of designated equity sub-portfolios. The concept of constant positions has changed in the market risk framework because the capital horizon is now meant to always be synonymous with the new definition of liquidity horizon and no new positions are added when positions expire during the capital horizon. For securities with a maturity under one year, a constant position can be maintained within the liquidity horizon but, any maturity of a long or short position must be accounted for when the ability to maintain a constant position within the liquidity horizon cannot be contractually assured.

Page Number 129 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 13.24 Default risk must be measured for each obligor. (1) Probabilities of default (PDs) implied from market prices are not acceptable unless they are corrected to obtain an objective probability of default.51 (2) PDs are subject to a floor of 0.03%. 13.25 A bank’s model may reflect netting of long and short exposures to the same obligor. If such exposures span different instruments with exposure to the same obligor, the effect of the netting must account for different losses in the different instruments (eg differences in seniority). 13.26 The basis risk between long and short exposures of different obligors must be modelled explicitly. The potential for offsetting default risk among long and short exposures across different obligors must be included through the modelling of defaults. The pre-netting of positions before input into the model other than as described in [13.25] is not allowed. 13.27 The DRC requirement model must recognise the impact of correlations between defaults among obligors, including the effect on correlations of periods of stress as described below. (1) These correlations must be based on objective data and not chosen in an opportunistic way where a higher correlation is used for portfolios with a mix of long and short positions and a low correlation used for portfolios with long only exposures. (2) A bank must validate that its modelling approach for these correlations is appropriate for its portfolio, including the choice and weights of its systematic risk factors. A bank must document its modelling approach and the period of time used to calibrate the model. (3) These correlations must be measured over a liquidity horizon of one year. (4) These correlations must be calibrated over a period of at least 10 years. (5) Banks must reflect all significant basis risks in recognising these correlations, including, for example, maturity mismatches, internal or external ratings, vintage etc. 13.28 The bank’s model must capture any material mismatch between a position and its hedge. With respect to default risk within the one-year capital horizon, the model

51 Market-implied PDs are not acceptable.

Page Number 130 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 must account for the risk in the timing of defaults to capture the relative risk from the maturity mismatch of long and short positions of less than one-year maturity. 13.29 The bank’s model must reflect the effect of issuer and market concentrations, as well as concentrations that can arise within and across product classes during stressed conditions. 13.30 As part of this DRC requirement model, the bank must calculate, for each and every position subjected to the model, an incremental loss amount relative to the current valuation that the bank would incur in the event that the obligor of the position defaults. 13.31 Loss estimates must reflect the economic cycle; for example, the model must incorporate the dependence of the recovery on the systemic risk factors. 13.32 The bank’s model must reflect the non-linear impact of options and other positions with material non-linear behaviour with respect to default. In the case of equity derivatives positions with multiple underlyings, simplified modelling approaches (for example modelling approaches that rely solely on individual jump-to-default sensitivities to estimate losses when multiple underlyings default) may be applied (subject to SAMAapproval). The simplified treatment applies only to equity derivatives. 13.33 Default risk must be assessed from the perspective of the incremental loss from default in excess of the mark-to-market losses already taken into account in the current valuation. 13.34 Owing to the high confidence standard and long capital horizon of the DRC requirement, robust direct validation of the DRC model through standard backtesting methods at the 99.9%/one-year soundness standard will not be possible. (1) Accordingly, validation of a DRC model necessarily must rely more heavily on indirect methods including but not limited to stress tests, sensitivity analyses and scenario analyses, to assess its qualitative and quantitative reasonableness, particularly with regard to the model’s treatment of concentrations. (2) Given the nature of the DRC soundness standard, such tests must not be limited to the range of events experienced historically. (3) The validation of a DRC model represents an ongoing process in which supervisors and firms jointly determine the exact set of validation procedures to be employed.

Page Number 131 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 13.35 Banks should strive to develop relevant internal modelling benchmarks to assess the overall accuracy of their DRC models. 13.36 Due to the unique relationship between credit spread and default risk, banks must seek SAMA approval for each trading desk with exposure to these risks, both for credit spread risk and default risk. Trading desks which do not receive SAMA approval will be deemed ineligible for internal modelling standards and be subject to the standardised capital framework. 13.37 Where a bank has approved PD estimates as part of the internal ratings-based (IRB) approach, this data must be used. Where such estimates do not exist, or SAMA determines that they are not sufficiently robust, PDs must be computed using a methodology consistent with the IRB methodology and satisfy the following conditions. (1) Risk-neutral PDs should not be used as estimates of observed (historical) PDs. (2) PDs must be measured based on historical default data including both formal default events and price declines equivalent to default losses. Where possible, this data should be based on publicly traded securities over a complete economic cycle. The minimum historical observation period for calibration purposes is five years. (3) PDs must be estimated based on historical data of default frequency over a one-year period. The PD may also be calculated on a theoretical basis (eg geometric scaling) provided that the bank is able to demonstrate that such theoretical derivations are in line with historical default experience. (4) PDs provided by external sources may also be used by banks, provided they can be shown to be relevant for the bank’s portfolio. 13.38 Where a bank has approved loss-given-default (LGD)52 estimates as part of the IRB approach, this data must be used. Where such estimates do not exist, or SAMA determines that they are not sufficiently robust, LGDs must be computed using a methodology consistent with the IRB methodology and satisfy the following conditions. (1) LGDs must be determined from a market perspective, based on a position’s current market value less the position’s expected market value subsequent to default. The LGD should reflect the type and seniority of the position and cannot be less than zero.

52 LGD should be interpreted in this context as 1 – recovery rate.

Page Number 132 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) LGDs must be based on an amount of historical data that is sufficient to derive robust, accurate estimates. (3) LGDs provided by external sources may also be used by institutions, provided they can be shown to be relevant for the bank’s portfolio. 13.39 Banks must establish a hierarchy ranking their preferred sources for PDs and LGDs, in order to avoid the cherry-picking of parameters. Calculation of capital requirement for model-ineligible trading desks 13.40 The regulatory capital requirement associated with trading desks that are either out-of-scope for model approval or that have been deemed ineligible to use an internal model (Cu) is to be calculated by aggregating all such risks and applying the standardised approach. Aggregation of capital requirement 13.41 The aggregate (non-DRC) capital requirement for those trading desks approved and eligible for the IMA (ie trading desks that pass the backtesting requirements and that have been assigned to the PLA test green zone or amber zone (CA) in [12.43] to [12.45]) is equal to the maximum of the most recent observation and a weighted average of the previous 60 days scaled by a multiplier and is calculated as follows where SES is the aggregate regulatory capital measure for the risk factors in model-eligible trading desks that are non-modellable. 13.42 The multiplication factor mc is fixed at 1.5 unless it is set at a higher level by SAMA to reflect the addition of a qualitative add on and/or a backtesting add-on per the following considerations. (1) Banks must add to this factor a “plus” directly related to the ex-post performance of the model, thereby introducing a built-in positive incentive to maintain the predictive quality of the model. (2) For the backtesting add-on, the plus will range from 0 to 0.5 based on the outcome of the backtesting of the bank’s daily VaR at the 99th percentile based on current observations on the full set of risk factors (VaRFC). (3) If the backtesting results are satisfactory and the bank meets all of the qualitative standards set out in [10.5] to [10.16], the plus factor could be zero. [12] presents in detail the approach to be applied for backtesting and the plus factor.

Page Number 133 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (4) The backtesting add-on factor is determined based on the maximum of the exceptions generated by the backtesting results against actual P&L (APL) and hypothetical P&L (HPL) as described [12]. 13.43 The aggregate capital requirement for market risk (𝐴𝐶𝑅total) is equal to the aggregate capital requirement for approved and eligible trading desks (IMAG,A = 𝐶A + DRC) plus the standardised approach capital requirement for trading desks that are either out-of-scope for model approval or that have been deemed ineligible to use the internal models approach (Cu). If at least one eligible trading desk is in the PLA test amber zone, a capital surcharge is added. The impact of the capital surcharge is limited by the formula: 13.44 For the purposes of calculating the capital requirement, the risk factor eligibility test, the PLA test and the trading desk-level backtesting are applied on a quarterly basis to update the modellability of risk factors and desk classification to the PLA test green zone, amber zone, or red zone. In addition, the stressed period and the reduced set of risk factors (ER,C and ER,S) must be updated on a quarterly basis. The reference dates to perform the tests and to update the stress period and selection of the reduced set of risk factors should be consistent. Banks must reflect updates to the stressed period and to the reduced set of risk factors as well as the test results in calculating capital requirements in a timely manner. The averages of the previous 60 days (IMCC, SES) and or respectively 12 weeks (DRC) have only to be calculated at the end of the quarter for the purpose of calculating the capital requirement. 13.45 The capital surcharge is calculated as the difference between the aggregated standardised capital charges (SAG,A) and the aggregated internal models-based capital charges (IMAG,A = CA + DRC) multiplied by a factor k. To determine the aggregated capital charges, positions in all of the trading desks in the PLA green zone or amber zone are taken into account. The capital surcharge is floored at zero. In the formula below: (1) k = 0.5× (2) S𝐴𝑖 denotes the standardised capital requirement for all the positions of trading desk “i”; (3) i ∈ 𝐴 denotes the indices of all the approved trading desks in the amber zone; and (4) i ∈ 𝐺, 𝐴 denotes the indices of all the approved trading desks in the green zone or amber zone.

Page Number 134 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 13.46 The risk-weighted assets for market risk under the IMA are determined by multiplying the capital requirements calculated as set out in this chapter by 12.5. 14- Simplified standardised approach Risk-weighted assets and capital requirements 14.1 The risk-weighted assets for market risk under the simplified standardised approach are determined by multiplying the capital requirements calculated as set out in this chapter by 12.5. (1) [14.3] to [14.73] deal with interest rate, equity, foreign exchange (FX) and commodities risk. (2) [14.74] to [14.86] set out a number of possible methods for measuring the price risk in options of all kinds. (3) The capital requirement under the simplified standardised approach will be the measures of risk obtained from [14.2] to [14.86], summed arithmetically. 14.2 The capital requirement arising from the simplified standardised approach is the simple sum of the recalibrated capital requirements arising from each of the four risk classes – namely interest rate risk, equity risk, FX risk and commodity risk as detailed in the formula below, where: (1) 𝐶𝑅𝐼𝑅𝑅 = capital requirement under [14.3] to [14.40] (interest rate risk), plus additional requirements for option risks from debt instruments (non-delta risks) under [14.74] to [14.86] (treatment of options); (2) 𝐶𝑅EQ = capital requirement under [14.41] to [14.52] (equity risk), plus additional requirements for option risks from equity instruments (non-delta risks) under [14.74] to [14.86] (treatment of options); (3) 𝐶𝑅FX = capital requirement under [14.53] to [14.62] (FX risk), plus additional requirements for option risks from foreign exchange instruments (non-delta risks) under [14.74] to [14.86] (treatment of options); (4) 𝐶𝑅COMM = capital requirement under [14.63] to [14.73] (commodities risk), plus additional requirements for option risks from commodities instruments (non-delta risks) under [14.74] to [14.86] (treatment of options); (5) 𝐶F𝐼𝑅𝑅 = Scaling factor of 1.30; (6) 𝐶FEQ = Scaling factor of 3.50;

Page Number 135 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (7) 𝐶FCOMM = Scaling factor of 1.90; and (8) 𝐶FFX = Scaling factor of 1.20. Interest rate risk 14.3 This section sets out the simplified standard approach for measuring the risk of holding or taking positions in debt securities and other interest rate related instruments in the trading book. The instruments covered include all fixed-rate and floating-rate debt securities and instruments that behave like them, including non-convertible preference shares.53 Convertible bonds, ie debt issues or preference shares that are convertible, at a stated price, into common shares of the issuer, will be treated as debt securities if they trade like debt securities and as equities if they trade like equities. The basis for dealing with derivative products is considered in [14.31] to [14.40]. 14.4 The minimum capital requirement is expressed in terms of two separately calculated amounts, one applying to the “specific risk” of each security, whether it is a short or a long position, and the other to the interest rate risk in the portfolio (termed “general market risk”) where long and short positions in different securities or instruments can be offset. Specific risk 14.5 The capital requirement for specific risk is designed to protect against an adverse movement in the price of an individual security owing to factors related to the individual issuer. In measuring the risk, offsetting will be restricted to matched positions in the identical issue (including positions in derivatives). Even if the issuer is the same, no offsetting will be permitted between different issues since differences in coupon rates, liquidity, call features, etc mean that prices may diverge in the short run. Netting is only allowed under limited circumstances for interest rate specific risk as explained in [14.5]: “offsetting will be restricted to matched positions in the identical issue (including positions in derivatives). Even if the issuer is the same, no offsetting will be permitted between different issues since differences in coupon rates, liquidity, call features, etc means that prices may diverge in the short run.” In addition, partial offsetting is allowed in two other sets of circumstances. One set of circumstances is described in [14.21] and

53 Traded mortgage securities and mortgage derivative products possess unique characteristics because of the risk of prepayment. Accordingly, for the time being, no common treatment will apply to these securities, which will be dealt with SAMA at aleates stage. A security that is the subject of a repurchase or securities lending agreement will be treated as if it were still owned by the lender of the security, ie it will be treated in the same manner as other securities positions.

Page Number 136 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 concerns nth-to-default basked products. The other set of circumstances described in [14.16] to [14.18] pertains to offsetting between a credit derivative (whether total return swap or credit default swap) and the underlying exposure (ie cash position). Although this treatment applies generally in a one-for-one fashion, it is possible that multiple instruments could combine to create a hedge that would be eligible for consideration for partial offsetting. SAMA recognise that, in the case of multiple instruments comprising one side of the position, necessary conditions (ie the value of two legs moving in opposite directions, key contractual features of the credit derivative, identical reference obligations and currency/maturity mismatches) will be extremely difficult to meet, in practice. 14.6 The Specific risk capital requirements for “government” and “other” categories will be as follows: 14.7 The government category will include all forms of government54 paper including bonds, treasury bills and other short-term instruments, but SAMA will reserve the right to apply a specific risk capital requirement to securities issued by certain foreign governments, especially to securities denominated in a currency other than that of the issuing government. 14.8 When the government paper is denominated in the domestic currency and funded by the bank in the same currency, at SAMA later stage discretion a lower specific risk capital requirement may be applied.

54 Including, , local and regional governments subject to a zero credit risk weight in the credit risk framework.

Page Number 137 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 14.9 The qualifying category includes securities issued by public sector entities and multilateral development banks, plus other securities that are: (1) rated investment grade (IG)55 by at least two credit rating agencies specified by SAMA; or (2) rated IG by one rating agency and not less than IG by any other rating agency specified by SAMA (subject to SAMA and Capital Market Authority “CMA”); or (3) subject to SAMA approval, unrated, but deemed to be of comparable investment quality by the reporting bank, and the issuer has securities listed on a recognised stock exchange. 14.10 SAMA will be responsible for monitoring the application of these qualifying criteria, particularly in relation to the last criterion where the initial classification is essentially left to the reporting banks. SAMA will also have discretion to include within the qualifying category debt securities issued by banks in countries which have implemented this framework, subject to the express understanding that SAMA undertake prompt remedial action if a bank fails to meet the capital standards set forth in this framework. Similarly, SAMA will have discretion to include within the qualifying category debt securities issued by securities firms that are subject to equivalent rules. 14.11 Furthermore, the qualifying category shall include securities issued by institutions that are deemed to be equivalent to IG quality and subject to SAMA regulatory arrangements comparable to those under this framework. 14.12 Unrated securities may be included in the qualifying category when they are subject to SAMA approval, unrated, but deemed to be of comparable investment quality by the reporting bank, and the issuer has securities listed on a recognised stock exchange. This will remain unchanged for banks using the simplified standardised approach. For banks using the internal ratings-based (IRB) approach for a portfolio, unrated securities can be included in the qualifying category if both of the following conditions are met:

55 For example, IG include rated Baa or higher by Moody’s and BBB or higher by Standard and Poor’s.

Page Number 138 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) the securities are rated equivalent56 to IG under the reporting bank’s internal rating system, which SAMA has confirmed complies with the requirements for an IRB approach; and (2) the issuer has securities listed on a recognised stock exchange. 14.13 However, since this may in certain cases considerably underestimate the specific risk for debt instruments which have a high yield to redemption relative to government debt securities, SAMA will have the discretion: (1) to apply a higher specific risk charge to such instruments; and/or (2) to disallow offsetting for the purposes of defining the extent of general market risk between such instruments and any other debt instruments. 14.14 The specific risk capital requirement of securitisation positions as defined in a 18.1 to 18.6 of SAMA Minimum Capital Requirements for Credit Risk that are held in the trading book is to be calculated according to the revised method for such positions in the banking book as set out in revisions to the securitisation framework. A bank shall calculate the specific risk capital requirement applicable to each net securitisation position by dividing the risk weight calculated as if it were held in the banking book by 12.5. 14.15 Banks may limit the capital requirement for an individual position in a credit derivative or securitisation instrument to the maximum possible loss. For a short risk position this limit could be calculated as a change in value due to the underlying names immediately becoming default risk-free. For a long risk position, the maximum possible loss could be calculated as the change in value in the event that all the underlying names were to default with zero recoveries. The maximum possible loss must be calculated for each individual position. When a bank buys credit protection for an asset-backed security (ABS) tranche and (due to netting rules) the bank is treated as having a net short position, the simplified standardised capital requirement for the net short position is often determined by the max potential loss. This is particularly true when the underlying ABS tranche has been severely downgraded and written down. In particular, banks note that if the underlying ABS continues to deteriorate, the overall capital requirement progressively increases and is dominated by the charge against the short side of the hedged position. Some examples (without and with off-set) illustrate how the Max Loss principle should apply.

56 Equivalent means the debt security has a one-year probability of default (PD) equal to or less than the one year PD implied by the long-run average one-year PD of a security rated IG or better by a qualifying rating agency.

Page Number 139 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Max loss without offset: Suppose the bank has net long and net short positions that reference similar, but not the same, underlying assets. In other words the bank hedges an A-rated mezzanine residential mortgage-backed security (RMBS) tranche (notional = USD 100) with a credit default swap (CDS) on a similar but different A-rated mezzanine RMBS (also having notional = USD 100). Suppose the RMBS tranche owned by the bank is now rated C, and has value of USD 15. Also assume that the value of the CDS on the different RMBS has a current value of USD 80. Further, suppose that the current value of the RMBS underlying this CDS is USD 20 and is also rated C. Finally, suppose that the CDS would be valued at USD –2 if the underlying RMBS tranche were to recover unexpectedly and become risk-free. The correct treatment is as follows: min (USD 15, USD 15) (long leg) + min (USD 20, USD 82) (short leg) = USD 35. No off-set would be permissible in this example, because the same underlying asset has not been hedged. The capital requirement should, therefore, be calculated by summing the charges against the long and short legs. The maximum loss principle would apply to each individual position. Please note that the market value of the underlying has been applied in determining the exposure value of the CDS. Max loss with offset: Suppose the bank hedges an A-rated mezzanine RMBS tranche with a CDS referencing the same RMBS having notional of USD 100. Suppose the RMBS tranche is now rated C, and has value USD 15, while the current value of the CDS is USD 85. Suppose that the value of the CDS would equal USD –2 if the RMBS tranche were to recover unexpectedly and become risk-free. In this example, if the CDS exactly matched the RMBS in tenor, then offsetting could potentially apply. In that instance, the capital requirement should equal 20% of max{min(USD 15, USD 15), min(USD 15, USD 87)} = USD 3. If the tenors were not matched (ie maturity mismatch), then the capital requirement should equal max{min(USD 15, USD 15), min(USD 15, USD 87)} = USD 15. Please note that the maximum loss principle cannot be applied on a portfolio basis. 14.16 Full allowance will be recognised for positions hedged by credit derivatives when the values of two legs (ie long and short) always move in the opposite direction and broadly to the same extent. This would be the case in the following situations,

Page Number 140 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 in which cases no specific risk capital requirement applies to both sides of the position: (1) the two legs consist of completely identical instruments; or (2) a long cash position (or credit derivative) is hedged by a total rate of return swap (or vice versa) and there is an exact match between the reference obligation and the underlying exposure (ie the cash position).57 According to [14.16] to [14.18], the offsetting treatment is applied to a cash position that is hedged by a credit derivative or a credit derivative that is hedged by another credit derivative, assuming there is an exact match in terms of the reference obligations. The illustration of the treatment would be as following: [14.16] to [14.18], are applicable not only when the underlying position being hedged is a cash position, but also when the position being hedged is a credit default swap (CDS) or other credit derivative. They also apply regardless of whether the cash positions or reference obligations of the credit derivative are single-name or securitisation exposures. For example, when a long cash position is hedged using a CDS, the 80% offset treatment of [14.17] (the partial allowance treatment of [14.18]) generally applies when the reference obligation of the CDS is the cash instrument being hedged and the currencies and remaining maturities of the two positions are (are not) identical. Similarly, when a purchased CDS is hedged with a sold CDS, the 80% offset treatment (the partial allowance treatment) generally applies when both the long and short CDSs have the same reference obligations and the currencies and remaining maturities of the long and short CDSs are (are not) identical. The full allowance (100% offset) treatment generally applies only when there is zero basis risk between the instrument being hedged and the hedging instrument, such as when a cash position is hedged with a total rate of return swap referencing the same cash instrument and there is no currency mismatch, or when a purchased CDS position is hedged by selling a CDS with identical terms in all respects, including reference obligation, currency, maturity, documentation clauses (eg credit payout events, methods for determining payouts for credit events, etc), and structure of fixed and variable payments over time. It is worth noting that the conditions under which partial or full offsetting of risk positions that are subject to interest rate specific risk are narrowly defined. In practice, offsets between securitisation positions and credit derivatives are unlikely to be recognised in most cases due to the explicit requirements in [14.16] to [14.18] on reference names etc. 14.17 An 80% offset will be recognised when the value of two legs (ie long and short) always moves in the opposite direction but not broadly to the same extent. This

57 The maturity of the swap itself may be different from that of the underlying exposure.

Page Number 141 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 would be the case when a long cash position (or credit derivative) is hedged by a credit default swap (CDS) or a credit-linked note (or vice versa) and there is an exact match in terms of the reference obligation, the maturity of both the reference obligation and the credit derivative, and the currency of the underlying exposure. In addition, key features of the credit derivative contract (eg credit event definitions, settlement mechanisms) should not cause the price movement of the credit derivative to materially deviate from the price movements of the cash position. To the extent that the transaction transfers risk (ie taking account of restrictive payout provisions such as fixed payouts and materiality thresholds), an 80% specific risk offset will be applied to the side of the transaction with the higher capital requirement, while the specific risk requirement on the other side will be zero. 14.18 Partial allowance will be recognised when the value of the two legs (ie long and short) usually moves in the opposite direction. This would be the case in the following situations: (1) The position is captured in 14.16, but there is an asset mismatch between the reference obligation and the underlying exposure. Nonetheless, the position meets the requirements in [CRE22.86]. (2) The position is captured in 14.16 or [14.17] but there is a currency or maturity mismatch58 between the credit protection and the underlying asset. (3) The position is captured in [14.17] but there is an asset mismatch between the cash position (or credit derivative) and the credit derivative hedge. However, the underlying asset is included in the (deliverable) obligations in the credit derivative documentation. 14.19 In each of these cases in [14.16] to [14.18], the following rule applies. Rather than adding the specific risk capital requirements for each side of the transaction (ie the credit protection and the underlying asset) only the higher of the two capital requirements will apply. 14.20 In cases not captured in [14.16] to [14.18], a specific risk capital requirement will be assessed against both sides of the position. 14.21 An nth-to-default credit derivative is a contract where the payoff is based on the nth asset to default in a basket of underlying reference instruments. Once the nth default occurs the transaction terminates and is settled.

58 Currency mismatches should feed into the normal reporting of FX risk.

Page Number 142 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) The capital requirement for specific risk for a first-to-default credit derivative is the lesser of: (a) the sum of the specific risk capital requirements for the individual reference credit instruments in the basket; and (b) the maximum possible credit event payment under the contract. (2) Where a bank has a risk position in one of the reference credit instruments underlying a first-to-default credit derivative and this credit derivative hedges the bank’s risk position, the bank is allowed to reduce, with respect to the hedged amount, both the capital requirement for specific risk for the reference credit instrument and that part of the capital requirement for specific risk for the credit derivative that relates to this particular reference credit instrument. Where a bank has multiple risk positions in reference credit instruments underlying a first-to-default credit derivative, this offset is allowed only for that underlying reference credit instrument having the lowest specific risk capital requirement. (3) The capital requirement for specific risk for an nth-to-default credit derivative with n greater than one is the lesser of: (a) the sum of the specific risk capital requirements for the individual reference credit instruments in the basket but disregarding the (n-1) obligations with the lowest specific risk capital requirements; and (b) the maximum possible credit event payment under the contract. For nth-to- default credit derivatives with n greater than 1, no offset of the capital requirement for specific risk with any underlying reference credit instrument is allowed. (4) If a first or other nth-to-default credit derivative is externally rated, then the protection seller must calculate the specific risk capital requirement using the rating of the derivative and apply the respective securitisation risk weights as specified in [14.14], as applicable. (5) The capital requirement against each net nth-to-default credit derivative position applies irrespective of whether the bank has a long or short position, ie obtains or provides protection. The framework mentions only tranches and nth-to-default products explicitly, but not nth to n+m-th-to-default products (eg the value depends on the default of the 5th, 6th, 7th and 8th default in a pool; only in specific cases such as the same nominal for all underlyings can this product be represented by, for example, a 5% to 8% tranche). The nth to n+m-th-to-

Page Number 143 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 default products are covered in the framework, such products are to be decomposed into individual nth-to-default products and the rules for nth-to-default products in [14.21] apply. In the example cited above, the capital requirement for a basket default swap covering defaults five to eight would be calculated as the sum of the capital requirements for a 5th￾to-default swap, a 6th-to-default swap, a 7th-to-default swap and an 8th-to-default swap. 14.22 A bank must determine the specific risk capital requirement for the correlation trading portfolio (CTP) as follows: (1) The bank computes: (a) the total specific risk capital requirements that would apply just to the net long positions from the net long correlation trading exposures combined; and (b) the total specific risk capital requirements that would apply just to the net short positions from the net short correlation trading exposures combined. (2) The larger of these total amounts is then the specific risk capital requirement for the CTP. The approach of taking the larger of the specific risk capital requirements for net long positions and the specific risk capital requirement for net short positions are not applied to leveraged securitisation positions or option products on securitisation positions. Leveraged securitisation positions and option products on securitisation positions are securitisation positions. They are not admissible for the CTP. The capital requirements for specific risk will be determined as the sum of the capital requirements for specific risk against net long and net short positions. General market risk 14.23 The capital requirements for general market risk are designed to capture the risk of loss arising from changes in market interest rates. A choice between two principal methods of measuring the risk is permitted – a maturity method and a duration method. In each method, the capital requirement is the sum of four components: (1) the net short or long position in the whole trading book; (2) a small proportion of the matched positions in each time band (the “vertical disallowance”);

Page Number 144 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) a larger proportion of the matched positions across different time bands (the “horizontal disallowance”); and (4) a net charge for positions in options, where appropriate (see [14.84] and [14.85]). 14.24 Separate maturity ladders should be used for each currency and capital requirements should be calculated for each currency separately and then summed with no offsetting between positions of the opposite sign. In the case of those currencies in which business is insignificant, separate maturity ladders for each currency are not required. Rather, the bank may construct a single maturity ladder and slot, within each appropriate time band, the net long or short position for each currency. However, these individual net positions are to be summed within each time band, irrespective of whether they are long or short positions, to produce a gross position figure. 14.25 In the maturity method (see [14.29] for the duration method), long or short positions in debt securities and other sources of interest rate exposures including derivative instruments, are slotted into a maturity ladder comprising 13 time bands (or 15 time bands in the case of low coupon instruments). Fixed rate instruments should be allocated according to the residual term to maturity and floating-rate instruments according to the residual term to the next repricing date. Opposite positions of the same amount in the same issues (but not different issues by the same issuer), whether actual or notional, can be omitted from the interest rate maturity framework, as well as closely matched swaps, forwards, futures and forward rate agreements (FRAs) which meet the conditions set out in [14.35] and [14.36] below. 14.26 The first step in the calculation is to weight the positions in each time band by a factor designed to reflect the price sensitivity of those positions to assumed changes in interest rates. The weights for each time band are set out in Table 4. Zero-coupon bonds and deep-discount bonds (defined as bonds with a coupon of less than 3%) should be slotted according to the time bands set out in the second column of Table 4.

Page Number 145 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 14.27 The next step in the calculation is to offset the weighted longs and shorts in each time band, resulting in a single short or long position for each band. Since, however, each band would include different instruments and different maturities, a 10% capital requirement to reflect basis risk and gap risk will be levied on the smaller of the offsetting positions, be it long or short. Thus, if the sum of the weighted longs in a time band is USD 100 million and the sum of the weighted shorts USD 90 million, the so-called vertical disallowance for that time band would be 10% of USD 90 million (ie USD 9 million). 14.28 The result of the above calculations is to produce two sets of weighted positions, the net long or short positions in each time band (USD 10 million long in the example above) and the vertical disallowances, which have no sign. (1) In addition, however, banks will be allowed to conduct two rounds of horizontal offsetting: (a) first between the net positions in each of three zones, where zone 1 is set as zero to one year, zone 2 is set as one year to four years, and zone 3 is set as four years and over (however, for coupons less than 3%, zone 2 is set as one year to 3.6 years and zone 3 is set as 3.6 years and over); and (b) subsequently between the net positions in the three different zones.

Page Number 146 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) The offsetting will be subject to a scale of disallowances expressed as a fraction of the matched positions, as set out in Table 5. The weighted long and short positions in each of three zones may be offset, subject to the matched portion attracting a disallowance factor that is part of the capital requirement. The residual net position in each zone may be carried over and offset against opposite positions in other zones, subject to a second set of disallowance factors. Horizontal disallowances Table 5 Zones59 Time band57 Within the zone Between adjacent zones Between zones 1 and 3 Zone 1 0-1 month 1-3 months 3-6 months 6-12 months 40% 40% 40% 100% Zone 2 1-2 years 2-3 years 3-4 years 4-5 years 30% Zone 3 5-7 years 7-10 years 10-15 years 15-20 years Over 20 years 30% 14.29 Under the alternative duration method, banks with the necessary capability may, with SAMA’ consent, use a more accurate method of measuring all of their general market risk by calculating the price sensitivity of each position separately. Banks must elect and use the method on a continuous basis (unless a change in method is approved by SAMA) and will be subject to SAMA monitoring of the systems used. The mechanics of this method are as follows:

59 The zones for coupons less than 3% are 0 to 1 year, 1 to 3.6 years, and 3.6 years and over.

Page Number 147 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (1) First calculate the price sensitivity of each instrument in terms of a change in interest rates of between 0.6 and 1.0 percentage points depending on the maturity of the instrument (see Table 6); (2) Slot the resulting sensitivity measures into a duration-based ladder with the 15 time bands set out in Table 6; (3) Subject long and short positions in each time band to a 5% vertical disallowance designed to capture basis risk; and (4) Carry forward the net positions in each time band for horizontal offsetting subject to the disallowances set out in Table 5 above. 14.30 In the case of residual currencies (see [14.24] above) the gross positions in each time band will be subject to either the risk weightings set out in [14.26], if positions are reported using the maturity method, or the assumed change in yield set out in [14.29], if positions are reported using the duration method, with no further offsets. Interest rate derivatives 14.31 The measurement system should include all interest-rate derivatives and off￾balance sheet instruments in the trading book which react to changes in interest rates (eg FRAs, other forward contracts, bond futures, interest rate and cross￾currency swaps and forward foreign exchange positions). Options can be treated in a variety of ways as described in [14.74] to [14.86]. A summary of the rules for dealing with interest rate derivatives is set out in [14.40]. 14.32 The derivatives should be converted into positions in the relevant underlying and become subject to specific and general market risk charges as described above. In

Page Number 148 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 order to calculate the standard formula described above, the amounts reported should be the market value of the principal amount of the underlying or of the notional underlying resulting from the Prudent Valuation Guidance. 14.33 Futures and forward contracts (including FRAs) are treated as a combination of a long and a short position in a notional government security. The maturity of a future or an FRA will be the period until delivery or exercise of the contract, plus – where applicable – the life of the underlying instrument. For example, a long position in a June three-month interest rate future (taken in April) is to be reported as a long position in a government security with a five-month maturity and a short position in a government security with a two-month maturity. Where a range of deliverable instruments may be delivered to fulfil the contract, the bank has flexibility to elect which deliverable security goes into the maturity or duration ladder but should take account of any conversion factor defined by the exchange. In the case of a future on a corporate bond index, positions will be included at the market value of the notional underlying portfolio of securities. 14.34 Swaps will be treated as two notional positions in government securities with relevant maturities. For example, an interest rate swap under which a bank is receiving floating rate interest and paying fixed will be treated as a long position in a floating rate instrument of maturity equivalent to the period until the next interest fixing and a short position in a fixed-rate instrument of 14.35 Banks may exclude from the interest rate maturity framework altogether (for both specific and general market risk) long and short positions (both actual and notional) in identical instruments with exactly the same issuer, coupon, currency and maturity. A matched position in a future or forward and its corresponding underlying may also be fully offset60 and thus excluded from the calculation. When the future or the forward comprises a range of deliverable instruments offsetting of positions in the future or forward contract and its underlying is only permissible in cases where there is a readily identifiable underlying security that is most profitable for the trader with a short position to deliver. The price of this security, sometimes called the “cheapest-to- deliver”, and the price of the future or forward contract should, in such cases, move in close alignment. No offsetting will be allowed between positions in different currencies; the separate legs of cross-currency swaps or forward FX deals are to be treated as notional positions in the relevant instruments and included in the appropriate calculation for each currency.

60 The leg representing the time to expiry of the future should, however, be reported.

Page Number 149 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 14.36 In addition, opposite positions in the same category of instruments61 can in certain circumstances be regarded as matched and allowed to offset fully. To qualify for this treatment, the positions must relate to the same underlying instruments, be of the same nominal value and be denominated in the same currency.62 In addition: (1) for futures: offsetting positions in the notional or underlying instruments to which the futures contract relates must be for identical products and mature within seven days of each other; (2) for swaps and FRAs: the reference rate (for floating rate positions) must be identical and the coupon closely matched (ie within 15 basis points); and (3) for swaps, FRAs and forwards: the next interest fixing date or, for fixed coupon positions or forwards, the residual maturity must correspond within the following limits: (a) less than one month hence: same day; (b) between one month and one year hence: within seven days; and (c) over one year hence: within 30 days. 14.37 Banks with large swap books may use alternative formulae for these swaps to calculate the positions to be included in the maturity or duration ladder. One method would be to first convert the payments required by the swap into their present values. For that purpose, each payment should be discounted using zero coupon yields, and a single net figure for the present value of the cash flows entered into the appropriate time band using procedures that apply to zero- (or low-) coupon bonds; these figures should be slotted into the general market risk framework as set out above. An alternative method would be to calculate the sensitivity of the net present value implied by the change in yield used in the maturity or duration method and allocate these sensitivities into the time bands set out in [14.26] or [14.29]. Other methods which produce similar results could also be used. Such alternative treatments will, however, only be allowed if: (1) SAMA is fully satisfied with the accuracy of the systems being used; (2) the positions calculated fully reflect the sensitivity of the cash flows to interest rate changes and are entered into the appropriate time bands; and

61 This includes the delta-equivalent value of options. The delta equivalent of the legs arising out of the treatment of caps and floors as set out in [14.78] can also be offset against each other under the rules laid down in this paragraph. 62 The separate legs of different swaps may also be matched subject to the same conditions.

Page Number 150 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) the positions are denominated in the same currency. 14.38 Interest rate and currency swaps, FRAs, forward FX contracts and interest rate futures will not be subject to a specific risk charge. This exemption also applies to futures on an interest rate index (eg London Interbank Offer Rate, or LIBOR). However, in the case of futures contracts where the underlying is a debt security, or an index representing a basket of debt securities, a specific risk charge will apply according to the credit risk of the issuer as set out in [14.5] to [14.21]. 14.39 General market risk applies to positions in all derivative products in the same manner as for cash positions, subject only to an exemption for fully or very closely matched positions in identical instruments as defined in [paragraphs 718(xiii) and 718(xiv) / [14.35] and [14.36]. The various categories of instruments should be slotted into the maturity ladder and treated according to the rules identified earlier. 14.40 Table 7 presents a summary of the regulatory treatment for interest rate derivatives, for market risk purposes.

Page Number 151 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Summary of treatment of interest rate derivatives Table 7 Instrument Specific risk charge63 General market risk charge Exchanged-traded future Government debt security Yes64 Yes, as two positions Corporate debt security Yes Yes, as two positions Index on interest rates (eg LIBOR) No Yes, as two positions Over-the-counter (OTC) forward Government debt security Yes63 Yes, as two positions Corporate debt security Yes Yes, as two positions Index on interest rates No Yes, as two positions FRAs, swaps No Yes, as two positions Forward FX No Yes, as one position in each currency Options Either Government debt security Yes63 (a) carve out together with the associated hedging positions: simplified approach; scenario analysis; internal models Corporate debt security Yes (b) general market risk charge according to the delta-plus method (gamma and vega should receive separate capital requirements) Index on interest rates No FRAs, swaps No Equity risk 14.41 This section sets out a minimum capital standard to cover the risk of holding or taking positions in equities in the trading book. It applies to long and short positions in all instruments that exhibit market behaviour similar to equities, but not to non-convertible preference shares (which are covered by the interest rate risk requirements described in [14.3] to [14.40]). Long and short positions in the same issue may be reported on a net basis. The instruments covered include common stocks (whether voting or non-voting), convertible securities that behave like equities, and commitments to buy or sell equity securities. The treatment of

63 This is the specific risk charge relating to the issuer of the instrument. Under the credit risk rules, a separate capital requirement for the counterparty credit risk applies. 64 The specific risk capital requirement only applies to government debt securities that are rated below AA– (see [14.6] and [14.7]).

Page Number 152 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 derivative products, stock indices and index arbitrage is described in [14.44] to [14.52] below. Specific and general market risks 14.42 As with debt securities, the minimum capital standard for equities is expressed in terms of two separately calculated capital requirements for the specific risk of holding a long or short position in an individual equity and for the general market risk of holding a long or short position in the market as a whole. Specific risk is defined as the bank’s gross equity positions (ie the sum of all long equity positions and of all short equity positions) and general market risk as the difference between the sum of the longs and the sum of the shorts (ie the overall net position in an equity market).The long or short position in the market must be calculated on a market-by-market basis, ie a separate calculation has to be carried out for each national market in which the bank holds equities. 14.43 The capital requirement for specific risk and for general market risk will each be 8%. Equity derivatives 14.44 Except for options, which are dealt with in [14.74] to [14.86], equity derivatives and off- balance sheet positions that are affected by changes in equity prices should be included in the measurement system.65 This includes futures and swaps on both individual equities and on stock indices. The derivatives are to be converted into positions in the relevant underlying. The treatment of equity derivatives is summarised in [14.52] below. 14.45 In order to calculate the standard formula for specific and general market risk, positions in derivatives should be converted into notional equity positions: (1) Futures and forward contracts relating to individual equities should in principle be reported at current market prices. (2) Futures relating to stock indices should be reported as the marked-to-market value of the notional underlying equity portfolio.

65 Where equities are part of a forward contract, a future or an option (quantity of equities to be received or to be delivered), any interest rate or foreign currency exposure from the other leg of the contract should be reported as set out in [14.3] to [14.40] and [14.53] to [14.62].

Page Number 153 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (3) Equity swaps are to be treated as two notional positions.66 (4) Equity options and stock index options should be either carved out together with the associated underlyings or be incorporated in the measure of general market risk described in this section according to the delta-plus method. 14.46 Matched positions in each identical equity or stock index in each market may be fully offset, resulting in a single net short or long position to which the specific and general market risk charges will apply. For example, a future in a given equity may be offset against an opposite cash position in the same equity.67 14.47 Besides general market risk, a further capital requirement of 2% will apply to the net long or short position in an index contract comprising a diversified portfolio of equities. This capital requirement is intended to cover factors such as execution risk. SAMA will take care to ensure that this 2% risk weight applies only to well￾diversified indices and not, for example, to sectoral indices. 14.48 In the case of the futures-related arbitrage strategies described below, the additional 2% capital requirement described above (set out in [14.47]) may be applied to only one index with the opposite position exempt from a capital requirement. The strategies are: (1) when the bank takes an opposite position in exactly the same index at different dates or in different market centres; and (2) when the bank has an opposite position in contracts at the same date in different but similar indices, subject to SAMA oversight that the two indices contain sufficient common components to justify offsetting. 14.49 Where a bank engages in a deliberate arbitrage strategy, in which a futures contract on a broadly based index matches a basket of stocks, it will be allowed to carve out both positions from the simplified standardised approach on condition that: (1) the trade has been deliberately entered into and separately controlled; and

66 For example, an equity swap in which a bank is receiving an amount based on the change in value of one particular equity or stock index and paying a different index will be treated as a long position in the former and a short position in the latter. Where one of the legs involves receiving/paying a fixed or floating interest rate, that exposure should be slotted into the appropriate repricing time band for interest rate related instruments as set out in [14.3] to [14.40]. The stock index should be covered by the equity treatment. 67 The interest rate risk arising out of the future, however, should be reported as set out in [14.3] to [14.40].

Page Number 154 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) the composition of the basket of stocks represents at least 90% of the index when broken down into its notional components. 14.50 In such a case as set out in [14.49] the minimum capital requirement will be 4% (ie 2% of the gross value of the positions on each side) to reflect divergence and execution risks. This applies even if all of the stocks comprising the index are held in identical proportions. Any excess value of the stocks comprising the basket over the value of the futures contract or excess value of the futures contract over the value of the basket is to be treated as an open long or short position. 14.51 If a bank takes a position in depository receipts against an opposite position in the underlying equity or identical equities in different markets, it may offset the position (ie bear no capital requirement) but only on condition that any costs on conversion are fully taken into account.68 14.52 Table 8 summarises the regulatory treatment of equity derivatives for market risk purposes. Summary of treatment of equity derivatives Table 8 Instrument Specific risk69 General market risk Exchanged-traded or OTC future Individual equity Yes Yes, as underlying Index 2% Yes, as underlying Options Either Individual equity Yes (a) carve out together with the associated hedging positions: simplified approach; scenario analysis; internal models Index 2% (b) general market risk charge according to the delta-plus method (gamma and vega should receive separate capital requirements)

68 Any FX risk arising out of these positions has to be reported as set out in [14.53] to [14.67]. 69 This is the specific risk charge relating to the issuer of the instrument. Under the credit risk rules], a separate capital requirement for the counterparty credit risk applies.

Page Number 155 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Foreign exchange risk 14.53 This section sets out the simplified standardised approach for measuring the risk of holding or taking positions in foreign currencies, including gold.70 14.54 Two processes are needed to calculate the capital requirement for FX risk. (1) The first is to measure the exposure in a single currency position as set out in [14.55] to [14.58]. (2) The second is to measure the risks inherent in a bank’s mix of long and short positions in different currencies as set out in [14.59] to [14.62]. Measuring the exposure in a single currency 14.55 The bank’s net open position in each currency should be calculated by summing: (1) the net spot position (ie all asset items less all liability items, including accrued interest, denominated in the currency in question); (2) the net forward position (ie all amounts to be received less all amounts to be paid under forward FX transactions, including currency futures and the principal on currency swaps not included in the spot position); (3) guarantees (and similar instruments) that are certain to be called and are likely to be irrecoverable; (4) net future income/expenses not yet accrued but already fully hedged (at the discretion of the reporting bank); (5) any other item representing a profit or loss in foreign currencies (depending on particular accounting conventions in different countries); and (6) the net delta-based equivalent of the total book of foreign currency options.71 14.56 Positions in composite currencies need to be separately reported but, for measuring banks’ open positions, may be either treated as a currency in their own

70 Gold is to be dealt with as an FX position rather than a commodity because its volatility is more in line with foreign currencies and banks manage it in a similar manner to foreign currencies. 71 Subject to a separately calculated capital requirement for gamma and vega as described in [14.77] to [14.80]; alternatively, options and their associated underlyings are subject to one of the other methods described in [14.74] to [14.86].

Page Number 156 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 right or split into their component parts on a consistent basis. Positions in gold should be measured in the same manner as described in [14.68]. 72 14.57 Interest, other income and expenses should be treated as follows. Interest accrued (ie earned but not yet received) should be included as a position. Accrued expenses should also be included. Unearned but expected future interest and anticipated expenses may be excluded unless the amounts are certain and banks have taken the opportunity to hedge them. If banks include future income/expenses they should do so on a consistent basis, and not be permitted to select only those expected future flows which reduce their position. 14.58 Forward currency and gold positions should be measured as follows: Forward currency and gold positions will normally be valued at current spot market exchange rates. Using forward exchange rates would be inappropriate since it would result in the measured positions reflecting current interest rate differentials to some extent. However, banks that base their normal management accounting on net present values are expected to use the net present values of each position, discounted using current interest rates and valued at current spot rates, for measuring their forward currency and gold positions. Measuring the foreign exchange risk in a portfolio of foreign currency positions and gold 14.59 For measuring the FX risk in a portfolio of foreign currency positions and gold as set out in 14.54, a bank that is not approved to use internal models by SAMA must use a shorthand method which treats all currencies equally. 14.60 Under the shorthand method, the nominal amount (or net present value) of the net position in each foreign currency and in gold is converted at spot rates into the reporting currency.73 The overall net open position is measured by aggregating: (1) the sum of the net short positions or the sum of the net long positions, whichever is the greater;74 plus (2) the net position (short or long) in gold, regardless of sign.

72 Where gold is part of a forward contract (quantity of gold to be received or to be delivered), any interest rate or foreign currency exposure from the other leg of the contract should be reported as set out in [14.3] to [14.40] and 14.55] above. 73 Where the bank is assessing its FX risk on a consolidated basis, it may be technically impractical in the case of some marginal operations to include the currency positions of a foreign branch or subsidiary of the bank. In such cases, the internal limit in each currency may be used as a proxy for the positions. Provided there is adequate ex post monitoring of actual positions against such limits, the limits should be added, without regard to sign, to the net open position in each currency. 74 An alternative calculation, which produces an identical result, is to include the reporting currency as a residual and to take the sum of all the short (or long) positions.

Page Number 157 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 14.61 The capital requirement will be 8% of the overall net open position (see example in Table 9). In particular, the capital requirement would be 8% of the higher of either the net long currency positions or the net short currency positions (ie 300) and of the net position in gold (35) = 335 x 8% = 26.8. 14.62 A bank of which business in foreign currency is insignificant and which does not take FX positions for its own account may, at the discretion of SAMA, be exempted from capital requirements on these positions provided that: (1) its foreign currency business, defined as the greater of the sum of its gross long positions and the sum of its gross short positions in all foreign currencies, does not exceed 100% of eligible capital as defined in Regulatory Capital for Basel III in Finalized Guidance Document Concerning the Implementation of Basel III issued by SAMA in 19 December 2012 and any subsequent regulatory adjustments; and (2) its overall net open position as defined in [14.60] above does not exceed 2% of its eligible capital as defined in Regulatory Capital for Basel III in Finalized Guidance Document Concerning the Implementation of Basel III issued by SAMA in 19 December 2012 and any subsequent regulatory adjustments . Commodities risk 14.63 This section sets out the simplified standardised approach for measuring the risk of holding or taking positions in commodities, including precious metals, but excluding gold (which is treated as a foreign currency according to the methodology set out in [14.53] to [14.62] above). A commodity is defined as a physical product which is or can be traded on a secondary market, eg agricultural products, minerals (including oil) and precious metals. 14.64 The price risk in commodities is often more complex and volatile than that associated with currencies and interest rates. Commodity markets may also be less liquid than those for interest rates and currencies and, as a result, changes in supply and demand can have a more dramatic effect on price and volatility.75 These

75 Banks need also to guard against the risk that arises when the short position falls due before the long position. Owing to a shortage of liquidity in some markets, it might be difficult to close the short position and the bank might be squeezed by the market.

Page Number 158 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 market characteristics can make price transparency and the effective hedging of commodities risk more difficult. 14.65 The risks associated with commodities include the following risks: (1) For spot or physical trading, the directional risk arising from a change in the spot price is the most important risk. (2) However, banks using portfolio strategies involving forward and derivative contracts are exposed to a variety of additional risks, which may well be larger than the risk of a change in spot prices. These include: (a) basis risk (the risk that the relationship between the prices of similar commodities alters through time); (b) interest rate risk (the risk of a change in the cost of carry for forward positions and options); and (c) forward gap risk (the risk that the forward price may change for reasons other than a change in interest rates). (3) In addition, banks may face counterparty credit risk on over-the-counter derivatives, but this is captured by one of the methods set out in 5 to 9 and 11 of SAMA Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) (4) The funding of commodities positions may well open a bank to interest rate or FX exposure and if that is so the relevant positions should be included in the measures of interest rate and FX risk described in [14.3] to [14.40] and [14.53] to [14.62], respectively.76 14.66 There are two alternatives for measuring commodities position risk under the simplified standardised approach that are described in [14.68] to [14.73] below. Commodities risk can also be measured, using either (i) the maturity ladder approach, which is a measurement system that captures forward gap and interest rate risk separately by basing the methodology on seven time bands as set out in [14.68] to [14.71] below or (ii) the simplified approach, which is a very simple framework as set out in [14.72] and [14.73] below. Both the maturity ladder

76 Where a commodity is part of a forward contract (quantity of commodities to be received or to be delivered), any interest rate or foreign currency exposure from the other leg of the contract should be reported as set out in [14.3] to 14.40] and [14.53] to [14.62]. Positions which are purely stock financing (ie a physical stock has been sold forward and the cost of funding has been locked in until the date of the forward sale) may be omitted from the commodities risk calculation although they will be subject to interest rate and counterparty risk requirements.

Page Number 159 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 approach and the simplified approach are appropriate only for banks that, in relative terms, conduct only a limited amount of commodities business. 14.67 For the maturity ladder approach and the simplified approach, long and short positions in each commodity may be reported on a net basis for the purposes of calculating open positions. However, positions in different commodities will, as a general rule, not be offsettable in this fashion. Nevertheless, SAMA will have discretion to permit netting between different subcategories77 of the same commodity in cases where the subcategories are deliverable against each other. They can also be considered as offsettable if they are close substitutes against each other and a minimum correlation of 0.9 between the price movements can be clearly established over a minimum period of one year. However, a bank wishing to base its calculation of capital requirements for commodities on correlations would have to satisfy SAMA of the accuracy of the method that has been chosen and obtain its prior approval. Maturity ladder approach 14.68 In calculating the capital requirements under the maturity ladder approach, banks will first have to express each commodity position (spot plus forward) in terms of the standard unit of measurement (barrels, kilos, grams etc). The net position in each commodity will then be converted at current spot rates into the national currency. 14.69 Secondly, in order to capture forward gap and interest rate risk within a time band (which, together, are sometimes referred to as curvature/spread risk), matched long and short positions in each time band will carry a capital requirement. The methodology is similar to that used for interest rate related instruments as set out in [14.3] to [14.40]. Positions in the separate commodities (expressed in terms of the standard unit of measurement) will first be entered into a maturity ladder while physical stocks should be allocated to the first time band. A separate maturity ladder will be used for each commodity as defined in [14.67] above.78 For each time band as set out in Table 10, the sum of short and long positions that are matched will be multiplied first by the spot price for the commodity, and then by the spread rate of 1.5%.

77 Commodities can be grouped into clans, families, subgroups and individual commodities. For example, a clan might be Energy Commodities, within which Hydro-Carbons are a family with Crude Oil being a subgroup and West Texas Intermediate, Arabian Light and Brent being individual commodities. 78 For markets that have daily delivery dates, any contracts maturing within 10 days of one another may be offset.

Page Number 160 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 14.70 The residual net positions from nearer time bands may then be carried forward to offset exposures in time bands that are further out. However, recognising that such hedging of positions among different time bands is imprecise, a surcharge equal to 0.6% of the net position carried forward will be added in respect of each time band that the net position is carried forward. The capital requirement for each matched amount created by carrying net positions forward will be calculated as in [14.69] above. At the end of this process, a bank will have either only long or only short positions, to which a capital requirement of 15% will apply. 14.71 All commodity derivatives and off-balance sheet positions that are affected by changes in commodity prices should be included in this measurement framework. This includes commodity futures, commodity swaps, and options where the “delta-plus” method79 is used (see [14.77] to [14.80] below). In order to calculate the risk, commodity derivatives should be converted into notional commodities positions and assigned to maturities as follows: (1) Futures and forward contracts relating to individual commodities should be incorporated as notional amounts of the standard unit of measurement (barrels, kilos, grams etc) and should be assigned a maturity with reference to expiry date. (2) Commodity swaps where one leg is a fixed price and the other the current market price should be incorporated as a series of positions equal to the notional amount of the contract, with one position corresponding with each payment on the swap and slotted into the maturity ladder accordingly. The positions would be long positions if the bank is paying fixed and receiving

79 For banks using other approaches to measure options risk, all options and the associated underlyings should be excluded from both the maturity ladder approach and the simplified approach.

Page Number 161 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 floating, and short positions if the bank is receiving fixed and paying floating.80 (3) Commodity swaps where the legs are in different commodities are to be incorporated in the relevant maturity ladder. No offsetting will be allowed in this regard except where the commodities belong to the same subcategory as defined in [14.67] above. Simplified approach 14.72 In calculating the capital requirement for directional risk under the simplified approach, the same procedure will be adopted as in the maturity ladder approach described above (see [14.68] and [14.71]. Once again, all commodity derivatives and off-balance sheet positions that are affected by changes in commodity prices should be included. The capital requirement will equal 15% of the net position, long or short, in each commodity. 14.73 In order to protect the bank against basis risk, interest rate risk and forward gap risk under the simplified approach, the capital requirement for each commodity as described in [14.68] and [14.71] above will be subject to an additional capital requirement equivalent to 3% of the bank’s gross positions, long plus short, in that particular commodity. In valuing the gross positions in commodity derivatives for this purpose, banks should use the current spot price. Treatment of options 14.74 In recognition of the wide diversity of banks’ activities in options and the difficulties of measuring price risk for options, two alternative approaches will be permissible at the discretion of SAMA under the simplified standardised approach. (1) Those banks which solely use purchased options81 can use the simplified approach described in [14.76] below]; (2) Those banks which also write options are expected to use the delta-plus method or scenario approach which are the intermediate approaches as set out in [14.77] to [14.86]. The more significant its trading activity is, the more the bank will be expected to use a sophisticated approach, and a bank with highly

80 If one of the legs involves receiving/paying a fixed or floating interest rate, that exposure should be slotted into the appropriate repricing maturity band in the maturity ladder covering interest rate related instruments. 81 Unless all their written option positions are hedged by perfectly matched long positions in exactly the same options, in which case no capital requirement for market risk is required.

Page Number 162 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 significant trading activity is expected to use the standardised approach or the internal models approach as set out in [6] to [9] or [10] to [13]. 14.75 In the simplified approach for options, the positions for the options and the associated underlying, cash or forward, are not subject to the standardised methodology but rather are carved-out and subject to separately calculated capital requirements that incorporate both general market risk and specific risk. The risk numbers thus generated are then added to the capital requirements for the relevant category, ie interest rate related instruments, equities, FX and commodities as described in [14.3] to [14.73]. The delta-plus method uses the sensitivity parameters or Greek letters associated with options to measure their market risk and capital requirements. Under this method, the delta-equivalent position of each option becomes part of the simplified standardised approach set out in [14.3] to [14.73] with the delta- equivalent amount subject to the applicable general market risk charges. Separate capital requirements are then applied to the gamma and vega risks of the option positions. The scenario approach uses simulation techniques to calculate changes in the value of an options portfolio for changes in the level and volatility of its associated underlyings. Under this approach, the general market risk charge is determined by the scenario grid (ie the specified combination of underlying and volatility changes) that produces the largest loss. For the delta-plus method and the scenario approach, the specific risk capital requirements are determined separately by multiplying the delta-equivalent of each option by the specific risk weights set out in [14.3] to [14.52]. Simplified approach 14.76 Banks that handle a limited range of purchased options can use the simplified approach set out in Table 11 for particular trades. As an example of how the calculation would work, if a holder of 100 shares currently valued at USD 10 each holds an equivalent put option with a strike price of USD 11, the capital requirement would be: USD 1,000 x 16% (ie 8% specific plus 8% general market risk) = USD 160, less the amount the option is in the money (USD 11 - USD 10) x 100 = USD 100, ie the capital requirement would be USD 60. A similar methodology applies for options whose underlying is a foreign currency, an interest rate related instrument or a commodity.

Page Number 163 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Simplified approach: capital requirements Table 11 Position Treatment Long cash and long put or short cash and long call The capital requirement will be the market value of the underlying security82 multiplied by the sum of specific and general market risk charges83 for the underlying less the amount the option is in the money (if any) bounded at zero84 Long call or long put The capital requirement will be the lesser of: (i) the market value of the underlying security multiplied by the sum of specific and general market risk charges82 for the underlying and (ii) the market value of the option85 Delta-plus method 14.77 Banks that write options will be allowed to include delta-weighted options positions within the simplified standardised approach set out in [14.3] to [14.73]. Such options should be reported as a position equal to the market value of the underlying multiplied by the delta. However, since delta does not sufficiently cover the risks associated with options positions, banks will also be required to measure gamma (which measures the rate of change of delta) and vega (which measures the sensitivity of the value of an option with respect to a change in volatility) sensitivities in order to calculate the total capital requirement. These sensitivities will be calculated according to an approved exchange model or to the bank’s proprietary options pricing model subject to oversight by SAMA. 86 14.78 Delta-weighted positions with debt securities or interest rates as the underlying will be slotted into the interest rate time bands, as set out in [14.3] to [14.40], under the following procedure. A two-legged approach should be used as for other

82 In some cases such as FX, it may be unclear which side is the underlying security; this should be taken to be the asset that would be received if the option were exercised. In addition, the nominal value should be used for items where the market value of the underlying instrument could be zero, eg caps and floors, swaptions etc. 83 Some options (eg where the underlying is an interest rate, a currency or a commodity) bear no specific risk but specific risk will be present in the case of options on certain interest rate related instruments (eg options on a corporate debt security or corporate bond index; see [14.3] to [14.40] for the relevant capital requirements) and for options on equities and stock indices (see [14.41] to [14.52]). The charge under this measure for currency options will be 8% and for options on commodities 15%. 84 For options with a residual maturity of more than six months, the strike price should be compared with the forward, not current, price. A bank unable to do this must take the in the money amount to be zero. 85 Where the position does not fall within the trading book (ie options on certain FX or commodities positions not belonging to the trading book), it may be acceptable to use the book value instead. 86 SAMA may wish to require banks doing business in certain classes of exotic options (eg barriers, digitals) or in options at the money that are close to expiry to use either the scenario approach or the internal models alternative, both of which can accommodate more detailed revaluation approaches.

Page Number 164 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 derivatives, requiring one entry at the time the underlying contract takes effect and a second at the time the underlying contract matures. For instance, a bought call option on a June three-month interest-rate future will in April be considered, on the basis of its delta-equivalent value, to be a long position with a five-month maturity and a short position with a two-month maturity.87The written option will be similarly slotted as a long position with a two-month maturity and a short position with a five-month maturity. Floating rate instruments with caps or floors will be treated as a combination of floating rate securities and a series of European￾style options. For example, the holder of a three-year floating rate bond indexed to six month LIBOR with a cap of 15% will treat it as: (1) a debt security that reprices in six months; and (2) a series of five written call options on an FRA with a reference rate of 15%, each with a negative sign at the time the underlying FRA takes effect and a positive sign at the time the underlying FRA matures.88 14.79 The capital requirement for options with equities as the underlying will also be based on the delta-weighted positions that will be incorporated in the measure of equity risk described in [14.41] to [14.52]. For purposes of this calculation each national market is to be treated as a separate underlying. The capital requirement for options on FX and gold positions will be based on the method for FX rate risk as set out in [14.53] to [14.62]. For delta risk, the net delta-based equivalent of the foreign currency and gold options will be incorporated into the measurement of the exposure for the respective currency (or gold) position. The capital requirement for options on commodities will be based on the simplified or the maturity ladder approach for commodities risk as set out in [14.63] to [14.73]. The delta-weighted positions will be incorporated in one of the measures described in that section. 14.80 In addition to the above capital requirements arising from delta risk, there are further capital requirements for gamma and vega risk. Banks using the delta-plus method will be required to calculate the gamma and vega for each option position (including hedge positions) separately. The capital requirements should be calculated in the following way: (1) For each individual option a gamma impact should be calculated according to a Taylor series expansion as follows, where VU is the variation of the underlying of the option.

87 A two-month call option on a bond future where delivery of the bond takes place in September would be considered in April as being long the bond and short a five-month deposit, both positions being delta-weighted. 88 The rules applying to closely matched positions set out in [14.36] will also apply in this respect.

Page Number 165 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (2) VU is calculated as follows: (a) For interest rate options if the underlying is a bond, the market value of the underlying should be multiplied by the risk weights set out in [14.26]. An equivalent calculation should be carried out where the underlying is an interest rate, again based on the assumed changes in the corresponding yield in [14.26]. (b) For options on equities and equity indices: the market value of the underlying should be multiplied by 8%.89 (c) For FX and gold options: the market value of the underlying should be multiplied by 8%. (d) For options on commodities: the market value of the underlying should be multiplied by 15%. (3) For the purpose of this calculation the following positions should be treated as the same underlying: (a) for interest rates,90 each time band as set out in [paragraph 718(iv) / [14.26]; 91 (b) for equities and stock indices, each national market; (c) for foreign currencies and gold, each currency pair and gold; and (d) for commodities, each individual commodity as defined in [14.67]. (4) Each option on the same underlying will have a gamma impact that is either positive or negative. These individual gamma impacts will be summed, resulting in a net gamma impact for each underlying that is either positive or negative. Only those net gamma impacts that are negative will be included in the capital requirement calculation.

89 The basic rules set out here for interest rate and equity options do not attempt to capture specific risk when calculating gamma capital requirements. However, SAMA may wish to require specific banks to do so. 90 Positions have to be slotted into separate maturity ladders by currency. 91 Banks using the duration method should use the time bands as set out in [14.29].

Page Number 166 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 (5) The total gamma risk capital requirement will be the sum of the absolute value of the net negative gamma impacts as calculated above. (6) For volatility risk, banks will be required to calculate the capital requirements by multiplying the sum of the vega risks for all options on the same underlying, as defined above, by a proportional shift in volatility of ± 25%. (7) The total capital requirement for vega risk will be the sum of the absolute value of the individual capital requirements that have been calculated for vega risk. Scenario approach 14.81 More sophisticated banks may opt to base the market risk capital requirement for options portfolios and associated hedging positions on scenario matrix analysis. This will be accomplished by specifying a fixed range of changes in the option portfolio’s risk factors and calculating changes in the value of the option portfolio at various points along this grid. For the purpose of calculating the capital requirement, the bank will revalue the option portfolio using matrices for simultaneous changes in the option’s underlying rate or price and in the volatility of that rate or price. A different matrix will be set up for each individual underlying as defined in [14.80] above. As an alternative, at the discretion of SAMA, banks that are significant traders in options will for interest rate options be permitted to base the calculation on a minimum of six sets of time bands. When using this method, not more than three of the time bands as defined in [14.26] and [14.29] should be combined into any one set. 14.82 The options and related hedging positions will be evaluated over a specified range above and below the current value of the underlying. The range for interest rates is consistent with the assumed changes in yield in [14.26]. Those banks using the alternative method for interest rate options set out in [14.81] above should use, for each set of time bands, the highest of the assumed changes in yield applicable to the group to which the time bands belong.92 The other ranges are ± 8% for equities,93 ± 8% for FX and gold, and ± 15% for commodities. For all risk categories, at least seven observations (including the current observation) should be used to divide the range into equally spaced intervals. 14.83 The second dimension of the matrix entails a change in the volatility of the underlying rate or price. A single change in the volatility of the underlying rate or

92 If, for example, the time bands 3 to 4 years, 4 to 5 years and 5 to 7 years are combined the highest assumed change in yield of these three bands would be 0.75. 93 The basic rules set out here for interest rate and equity options do not attempt to capture specific risk when calculating gamma capital requirements. However, SAMA may wish to require specific banks to do so.

Page Number 167 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 price equal to a shift in volatility of + 25% and - 25% is expected to be sufficient in most cases. As circumstances warrant, however, SAMA may choose to require that a different change in volatility be used and/or that intermediate points on the grid be calculated. 14.84 After calculating the matrix, each cell contains the net profit or loss of the option and the underlying hedge instrument. The capital requirement for each underlying will then be calculated as the largest loss contained in the matrix. 14.85 The application of the scenario analysis by any specific bank will be subject to SAMA consent, particularly as regards the precise way that the analysis is constructed. Banks’ use of scenario analysis as part of the simplified standardised approach will also be subject to validation by SAMA, and to those of the qualitative standards for internal models as set out in [10]. 14.86 Besides the options risks mentioned above, SAMA is conscious of the other risks also associated with options, eg rho (rate of change of the value of the option with respect to the interest rate) and theta (rate of change of the value of the option with respect to time). While not proposing a measurement system for those risks at present, it expects banks undertaking significant options business at the very least to monitor such risks closely. Additionally, banks will be permitted to incorporate rho into their capital calculations for interest rate risk, if they wish to do so. 15- Transitional arrangements for Profit and loss (P&L) attribution (PLA) 15.1 Banks are required to conduct the profit and loss (P&L) attribution (PLA) test beginning 1 January 2023 as set out in [12.3]. The outcomes of the PLA test will be used for Pillar 2 purposes beginning 1 January 2023. The Pillar 1 capital requirement consequences of assignment to the PLA test amber zone or PLA test red zone, as set out in [12.43], [12.44] and [13.43], will apply beginning 1 January 2023. 16- Guidance on use of the internal models approach Trading desk-level backtesting 16.1 An additional consideration in specifying the appropriate risk measures and trading outcomes for profit and loss (P&L) attribution test and backtesting arises because the internally modelled risk measurement is generally based on the sensitivity of a static portfolio to instantaneous price shocks. That is, end-of-day trading positions are input into the risk measurement model, which assesses the possible change in the value of this static portfolio due to price and rate movements over the assumed holding period. 16.2 While this is straightforward in theory, in practice it complicates the issue of backtesting. For instance, it is often argued that neither expected shortfall nor

Page Number 168 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 value-at-risk measures can be compared against actual trading outcomes, since the actual outcomes will reflect changes in portfolio composition during the holding period. According to this view, the inclusion of fee income together with trading gains and losses resulting from changes in the composition of the portfolio should not be included in the definition of the trading outcome because they do not relate to the risk inherent in the static portfolio that was assumed in constructing the value-at- risk measure. 16.3 This argument is persuasive with regard to the use of risk measures based on price shocks calibrated to longer holding periods. That is, comparing the liquidity￾adjusted time horizon 99th percentile risk measures from the internal models capital requirement with actual liquidity- adjusted time horizon trading outcomes would probably not be a meaningful exercise. In particular, in any given multi￾day period, significant changes in portfolio composition relative to the initial positions are common at major trading institutions. For this reason, the backtesting framework described here involves the use of risk measures calibrated to a one￾day holding period. Other than the restrictions mentioned in this paper, the test would be based on how banks model risk internally. 16.4 Given the use of one-day risk measures, it is appropriate to employ one-day trading outcomes as the benchmark to use in the backtesting programme. The same concerns about “contamination” of the trading outcomes discussed above continue to be relevant, however, even for one-day trading outcomes. That is, there is a concern that the overall one-day trading outcome is not a suitable point of comparison, because it reflects the effects of intraday trading, possibly including fee income that is booked in connection with the sale of new products. 16.5 On the one hand, intraday trading will tend to increase the volatility of trading outcomes and may result in cases where the overall trading outcome exceeds the risk measure. This event clearly does not imply a problem with the methods used to calculate the risk measure; rather, it is simply outside the scope of what the measure is intended to capture. On the other hand, including fee income may similarly distort the backtest, but in the other direction, since fee income often has annuity-like characteristics. Since this fee income is not typically included in the calculation of the risk measure, problems with the risk measurement model could be masked by including fee income in the definition of the trading outcome used for backtesting purposes. 16.6 To the extent that backtesting programmes are viewed purely as a statistical test of the integrity of the calculation of the risk measures, it is appropriate to employ a definition of daily trading outcome that allows for an uncontaminated test. To meet this standard, banks must have the capability to perform the tests based on the hypothetical changes in portfolio value that would occur were end-of-day positions to remain unchanged.

Page Number 169 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 16.7 Backtesting using actual daily P&Ls is also a useful exercise since it can uncover cases where the risk measures are not accurately capturing trading volatility in spite of being calculated with integrity. 16.8 For these reasons, the Committee requires banks to develop the capability to perform these tests using both hypothetical and actual trading outcomes. In combination, the two approaches are likely to provide a strong understanding of the relation between calculated risk measures and trading outcomes. The total number of backtesting exceptions for the purpose of the thresholds in [12.9] must be calculated as the maximum of the exceptions generated under hypothetical or actual trading outcomes. Bank-wide backtesting Statistical considerations in defining the backtesting zones 16.9 To place the definitions of three zones of the bank-wide backtesting in proper perspective, however, it is useful to examine the probabilities of obtaining various numbers of exceptions under different assumptions about the accuracy of a bank’s risk measurement model. 16.10 Three zones have been delineated and their boundaries chosen in order to balance two types of statistical error: (1) the possibility that an accurate risk model would be classified as inaccurate on the basis of its backtesting result, and (2) the possibility that an inaccurate model would not be classified that way based on its backtesting result. 16.11 Table 1 reports the probabilities of obtaining a particular number of exceptions from a sample of 250 independent observations under several assumptions about the actual percentage of outcomes that the model captures (ie these are binomial probabilities). For example, the left- hand portion of Table 1 sets out probabilities associated with an accurate model (that is, a true coverage level of 99%). Under these assumptions, the column labelled “exact” reports that exactly five exceptions can be expected in 6.7% of the samples.

Page Number 170 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Notes to Table 1: The table reports both exact probabilities of obtaining a certain number of exceptions from a sample of 250 independent observations under several assumptions about the true level of coverage, as well as type 1 or type 2 error probabilities derived from these exact probabilities. The left-hand portion of the table pertains to the case where the model is accurate and its true level of coverage is 99%. Thus, the probability of any given observation being an exception is 1% (100% – 99% = 1%). The column labelled "exact" reports the probability of obtaining exactly the number of exceptions shown under this assumption in a sample of 250 independent observations. The column labelled "type 1" reports the probability that using a given number of exceptions as the cut-off for rejecting a model will imply erroneous rejection of an accurate model using a sample of 250 independent observations. For example, if the cut-off level is set at five or more exceptions, the type 1 column reports the probability of falsely rejecting an accurate model with 250 independent observations is 10.8%. The right-hand portion of the table pertains to models that are inaccurate. In particular, the table concentrates of four specific inaccurate models, namely models whose true levels of coverage are 98%, 97%, 96% and 95% respectively. For each inaccurate model, the exact column reports the probability of obtaining exactly the number of exceptions shown under this assumption in a sample of 250 independent observations. The type 2 columns report the

Page Number 171 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 probability that using a given number of exceptions as the cut-off for rejecting a model will imply erroneous acceptance of an inaccurate model with the assumed level of coverage using a sample of 250 independent observations. For example, if the cut-off level is set at five or more exceptions, the type 2 column for an assumed coverage level of 97% reports the probability of falsely accepting a model with only 97% coverage with 250 independent observations is 12.8%. 16.12 The right-hand portion of the table reports probabilities associated with several possible inaccurate models, namely models whose true levels of coverage are 98%, 97%, 96%, and 95%, respectively. Thus, the column labelled “exact” under an assumed coverage level of 97% shows that five exceptions would then be expected in 10.9% of the samples. 16.13 Table 1 also reports several important error probabilities. For the assumption that the model covers 99% of outcomes (the desired level of coverage), the table reports the probability that selecting a given number of exceptions as a threshold for rejecting the accuracy of the model will result in an erroneous rejection of an accurate model (type 1 error). For example, if the threshold is set as low as one exception, then accurate models will be rejected fully 91.9% of the time, because they will escape rejection only in the 8.1% of cases where they generate zero exceptions. As the threshold number of exceptions is increased, the probability of making this type of error declines. 16.14 Under the assumptions that the model’s true level of coverage is not 99%, the table reports the probability that selecting a given number of exceptions as a threshold for rejecting the accuracy of the model will result in an erroneous acceptance of a model with the assumed (inaccurate) level of coverage (type 2 error). For example, if the model’s actual level of coverage is 97%, and the threshold for rejection is set at seven or more exceptions, the table indicates that this model would be erroneously accepted 37.5% of the time. 16.15 The results in Table 1 also demonstrate some of the statistical limitations of backtesting. In particular, there is no threshold number of exceptions that yields both a low probability of erroneously rejecting an accurate model and a low probability of erroneously accepting all of the relevant inaccurate models. It is for this reason that the Committee has rejected an approach that contains only a single threshold. 16.16 Given these limitations, the Committee has classified outcomes for the backtesting of the bank- wide model into three categories. In the first category, the test results are consistent with an accurate model, and the possibility of erroneously accepting an inaccurate model is low (ie backtesting ”green zone”). At the other extreme, the test results are extremely unlikely to have resulted from an accurate model, and the probability of erroneously rejecting an accurate model on this basis is remote (ie backtesting ”red zone”). In between these two cases, however, is a zone

Page Number 172 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 where the backtesting results could be consistent with either accurate or inaccurate models, and SAMA encourage a bank to present additional information about its model before taking action (ie backtesting ”amber zone”). 16.17 Table 2 sets out the Committee’s agreed boundaries for these zones and the presumptive SAMA response for each backtesting outcome, based on a sample of 250 observations. For other sample sizes, the boundaries should be deduced by calculating the binomial probabilities associated with true coverage of 99%, as in Table 1. The backtesting amber zone begins at the point such that the probability of obtaining that number or fewer exceptions equals or exceeds 95%. Table 2 reports these cumulative probabilities for each number of exceptions. For 250 observations, it can be seen that five or fewer exceptions will be obtained 95.88% of the time when the true level of coverage is 99%. Thus, the backtesting amber zone begins at five exceptions. Similarly, the beginning of the backtesting red zone is defined as the point such that the probability of obtaining that number or fewer exceptions equals or exceeds 99.99%. Table 2 shows that for a sample of 250 observations and a true coverage level of 99%, this occurs with 10 exceptions. Notes to Table 2: The table defines the backtesting green, amber and red zones that SAMA will use to assess backtesting results in conjunction with the internal models approach to market risk capital requirements. The boundaries shown in the table are based on a sample of 250 observations. For other sample sizes, the amber zone begins at the point where the cumulative probability equals or exceeds 95%, and the red zone begins at the point where the cumulative probability equals or exceeds 99.99%. The cumulative probability is simply the probability of obtaining a given number or fewer exceptions in a sample of 250 observations when the true coverage level is 99%. For

Page Number 173 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 example, the cumulative probability shown for four exceptions is the probability of obtaining between zero and four exceptions. Note that these cumulative probabilities and the type 1 error probabilities reported in Table 1 do not sum to one because the cumulative probability for a given number of exceptions includes the possibility of obtaining exactly that number of exceptions, as does the type 1 error probability. Thus, the sum of these two probabilities exceeds one by the amount of the probability of obtaining exactly that number of exceptions. 16.18 The backtesting green zone needs little explanation. Since a model that truly provides 99% coverage would be quite likely to produce as many as four exceptions in a sample of 250 outcomes, there is little reason for concern raised by backtesting results that fall in this range. This is reinforced by the results in Table 1, which indicate that accepting outcomes in this range leads to only a small chance of erroneously accepting an inaccurate model. 16.19 The range from five to nine exceptions constitutes the backtesting amber zone. Outcomes in this range are plausible for both accurate and inaccurate models, although Table 1 suggests that they are generally more likely for inaccurate models than for accurate models. Moreover, the results in Table 1 indicate that the presumption that the model is inaccurate should grow as the number of exceptions increases in the range from five to nine. 16.20 Table 2 sets out the Committee’s agreed guidelines for increases in the multiplication factor applicable to the internal models capital requirement, resulting from backtesting results in the backtesting amber zone. 16.21 These particular values reflect the general idea that the increase in the multiplication factor should be sufficient to return the model to a 99th percentile standard. For example, five exceptions in a sample of 250 imply only 98% coverage. Thus, the increase in the multiplication factor should be sufficient to transform a model with 98% coverage into one with 99% coverage. Needless to say, precise calculations of this sort require additional statistical assumptions that are not likely to hold in all cases. For example, if the distribution of trading outcomes is assumed to be normal, then the ratio of the 99th percentile to the 98th percentile is approximately 1.14, and the increase needed in the multiplication factor is therefore approximately 1.13 for a multiplier of 1. If the actual distribution is not normal, but instead has “fat tails”, then larger increases may be required to reach the 99th percentile standard. The concern about fat tails was also an important factor in the choice of the specific increments set out in Table 2.

Page Number 174 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 Examples of the application of the principles for risk factor modellability 16.22 Although SAMA may use discretion regarding the types of evidence required of banks to provide risk factor modellability, the following are examples of the types of evidence that banks may be required to provide. (1) Regression diagnostics for multi-factor beta models. In addition to showing that indices or other regressors are appropriate for the region, asset class and credit quality (if applicable) of an instrument, banks must be prepared to demonstrate that the coefficients used in multi-factor models are adequate to capture both general market risk and idiosyncratic risk. If the bank assumes that the residuals from the multi-factor model are uncorrelated with each other, the bank should be prepared to demonstrate that the modellable residuals are uncorrelated. Further, the factors in the multi-factor model must be appropriate for the region and asset class of the instrument and must explain the general market risk of the instrument. This must be demonstrated through goodness-of-fit statistics (eg an adjusted-R2 coefficient) and other diagnostics on the coefficients. Most importantly, where the estimated coefficients are not used (ie the parameters are judgment-based), the bank must describe how the coefficients are chosen and why they cannot be estimated, and demonstrate that the choice does not underestimate risk. In general, risk factors are not considered modellable in cases where parameters are set by judgment. (2) Recovery of price from risk factors. The bank must periodically demonstrate and document that the risk factors used in its risk model can be fed into front office pricing models and recover the actual prices of the assets. If the recovered prices substantially deviate from the actual prices, this can indicate a problem with prices used to derive the risk factors and call into question the validity of data inputs for risk purposes. In such cases, SAMA may determine that the risk factor is non-modellable. (3) Risk pricing is periodically reconciled with front office and back office prices. While banks are free to use price data from external sources, these external prices should periodically be reconciled with internal prices (from both front office and back office) to ensure they do not deviate substantially, and that they are not consistently biased in any fashion. Results of these reconciliations should be made available to SAMA, including statistics on the differences of the risk price from front office and back office prices. It is standard practice for banks to conduct reconciliation of front office and back office prices; the risk prices must be included as part of the reconciliation of the front office and whenever there is a potential for discrepancy. If the discrepancy is large, SAMA may determine that the risk factor is non-modellable. (4) Risk factor backtesting. Banks must periodically demonstrate the appropriateness of their modelling methodology by comparing the risk factor

Page Number 175 of 175 Issue Date December 2022 Minimum Capital Requirements for Version Market Risk 1.1 returns forecast produced by the risk management model with actual returns produced by front office prices. Alternatively, a bank could backtest hypothetical portfolios that are substantively dependent on key risk factors (or combinations thereof). This risk factor backtesting is intended to confirm that risk factors accurately reflect the volatility and correlations of the instruments in the risk model. Hypothetical backtesting can be effective in identifying whether risk factors in question adequately reflect volatility and correlations when the portfolio of instruments is chosen to highlight specific products. (5) Risk factors generated from parameterised models. For options, implied volatility surfaces are often built using a parameterised model based on single￾name underlyings and/or option index RPOs and/or market quotes. Liquid options at moneyness, tenor and option expiry points may be used to calibrate level, volatility, drift and correlation parameters for a single-name or benchmark volatility surface. Once these parameters are set, they are derived risk factors in their own right that must be updated and recalibrated periodically as new data arrive and trades occur. In the event that these risk factors are used to proxy for other single-name option surface points, there must be an additional- basis non-modellable risk factor overlay for any potential deviations. 17- SAMA Reporting Requirements 17.1 Banks are required to report the RWAs for Market Risk and capital charge on a quarterly basis using SAMA’s Q17 reporting template. The report must be submitted to SAMA within 30 days after the end of each quarter. 17.2 SAMA would expect banks with significant trading book exposures to have the ability to calculate and report the RWA and capital requirement on a more frequent basis such as on a daily or monthly basis, as needed. 18- Implementation Timeline: 18.1 This requirements will be effective on 01 January 2023.

Page Number 1 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Saudi Central Bank (SAMA) Minimum Capital Requirements for Operational Risk December 2022

Page Number 2 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Contents

1. Introduction..................................................................................................................................................... 3
2. Scope of Application....................................................................................................................................... 3
3. Definitions…………………………………………………………………………………………………….3
4. Implementation Timeline............................................................................................................................... 4
5. SAMA Reporting Requirements ................................................................................................................... 5
6. Disclosure......................................................................................................................................................... 5 7.Policy Requirements........................................................................................................................................ 5 7.1 The Standardized Approach................................................................................................................... 5 7.2 The Business Indicator........................................................................................................................... 6 7.3 The Internal Loss Multiplier.................................................................................................................. 7 7.4 Minimum standards for the use of loss data under the standardized approach ..................................... 8 8.General criteria on loss data identification, collection and treatment........................................................ 8 9.Specific criteria on loss data identification, collection and treatment ...................................................... 10 9.1 Building of the standardized approach loss data set............................................................................ 10 9.2 Gross loss, net loss, and recovery definitions....................................................................................... 10
7. Exclusion of losses from the Loss Componen .......................................................................................... 11
8. Exclusions of divested activities from the Business Indicator................................................................. 12
9. Inclusion of losses and BI items related to mergers and acquisitions .................................................... 12
10. Application of the standardized approach within a group...................................................................... 12 Annexure 1: Definition of Business Indicator components........................................................................... 14 Annexure 2: Detailed loss event type classification........................................................................................ 17

Page Number 3 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Minimum Capital Requirements for Operational Risk

1. Introduction: Basel Committee on Banking Supervision issued a document on Basel III: Finalizing post-crisis reforms in December 2017. Which includes the revised standardized approach as the sole approach for calculating operational risk capital requirements. A key objective of the revisions is to reduce excessive variability of risk-weighted assets (RWAs) whereby enhancing the resilience and soundness of Saudi Arabia’s banking system. This updated framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. This Framework supersedes any conflicting requirements in previous circulars in this regard; )SAMA Detailed Guidance Document regarding the Basel II framework issued via circular no. BCS290 dated 12 June 2006(.
2. Scope of Application: 2.1 This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 2.2This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators.
3. Definitions: The following terms and phrases used in this document shall have the corresponding meanings unless otherwise stated: Operational risk the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk but excludes strategic and reputational risk.

Page Number 4 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. The standardized approach methodology components (1) the Business Indicator (BI) a financial-statement-based proxy for operational risk; (2) the Business Indicator Component (BIC) calculated by multiplying the BI by a set of regulatory determined marginal coefficients or percentages; and (3) the Internal Loss Multiplier (ILM) a scaling factor that is based on a bank’s average historical losses and the BIC. Gross loss a loss before recoveries of any type. Net loss the loss after taking into account the impact of recoveries. Recovery an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party1 . 4. Implementation Timeline: This framework will be effective on 01 January 2023.

1 Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.

Page Number 5 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 5. SAMA Reporting Requirements: SAMA expects all Banks to report the operational risk weighted assets (RWAs) and capital charge, using SAMA’s Q17 reporting template, within 30 days after the end of each quarter. 6. Disclosure: In addition to the disclosure requirements under Pillar 3, all banks with a BI greater than SAR 4.46 billion, or which use internal loss data in the calculation of Operational Risk Capital (ORC), are required to disclose their annual loss data for each of the ten years in the ILM calculation window. Loss data is required to be reported on both a gross basis and after recoveries and loss exclusions. All banks are required to disclose each of the BI sub-items for each of the three years of the BI component calculation window. 7. Policy Requirements: 7.1 The Standardized Approach: The Banks must calculate minimum ORC requirements based on the Standardized Approach by multiplying the BIC and the ILM: ORC = BIC x ILM Where- (a)Business Indicator Component (BIC) is calculated as the sum of: (i) 12% of the Bank’s BI; (ii) if the Bank’s BI exceeds SAR 4.46 billion, 3% of the amount by which the BI exceeds SAR 4.46 billion; and (iii) if the Bank’s BI exceeds SAR 133.8 billion, 3% of the amount by which the BI exceeds SAR 133.8 billion; 2 BI is elaborated in section 7.2

2 For example, given a BI of SAR 140 billion, BIC = (SAR 140 billion x 12%) + [(SAR 140 billion – SAR 4.46 billion) x 3%] + [(SAR 140 billion – SAR 133.8 billion) x 3%] = (SAR 140 billion x 12%) + (135.54 billion x 3%) + (6.2) x 3%) = SAR 21.05 billion.

Page Number 6 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 (b)Internal Loss Multiplier (ILM) is calculated as follow: The explanation of ILM is given in section 7.3 Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC. 7.2 The Business Indicator: The Business Indicator (BI) comprises of three components: the interest, leases and dividend component (ILDC); the services component (SC), and the financial component (FC). The BI is calculated as follow: BI = ILDC + SC + FC ILDC, SC and FC are calculated by the following formula: Where: A bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2. (Abs) is the absolute value of the terms within the brackets. The absolute value of net items must be calculated first for each financial year, and the average of the past three consecutive financial years must be calculated based on the absolute value of net items for each financial year.

Page Number 7 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 The definitions for each of the components of the BI are provided in Annexure 1. 7.3 The Internal Loss Multiplier: 7.3.1 A bank’s internal operational risk loss experience affects the calculation of operational risk capital through the Internal Loss Multiplier (ILM). The ILM is defined as below, where the Loss Component (LC) is equal to 15 times average annual operational risk losses incurred over the previous 10 years: 7.3.2 The ILM is equal to one where the Loss Component (LC) and Business Indicator Component (BIC) are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, a bank with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, a bank with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology. 7.3.3 The calculation of average losses in the Loss Component must be based on 10 years of high-quality annual loss data. As part of the transition to the standardized approach, banks that do not have 10 years of high-quality loss data may use a minimum of five years of data to calculate the Loss Component, however, the term for transition will require SAMA’s approval. Banks that do not have five years of high-quality loss data must calculate the capital requirement based solely on the BI Component. Further, those Banks that do not have high-quality annual loss data for 5 years are required to approach SAMA to seek approval either to use loss data for the period less than five years or use ILM greater than 1 or as advised by SAMA. 7.3.4 The Banks with a BI less than or equal to SAR 4.46 billion must set the ILM equal to 1 in the calculation of ORC requirement (that is, calculate ORC based solely on the BIC), unless the Bank has obtained the SAMA’s written approval to calculate the ILM in accordance with paragraph 7.3.1 for the calculation of ORC. SAMA will not grant such approval unless the Bank meets all the criteria set out in sections 8 to 12.

Page Number 8 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 7.4 Minimum standards for the use of loss data under the standardized approach: 7.4.1 The Banks with a BI greater than SAR 4.46 billion are required to use loss data as a direct input into the operational risk capital calculations. Banks, which do not meet the loss data standards, as mentioned in section 6 to 10 of this document, are required to hold capital that is at a minimum equal to 100% of the BIC. In such cases, SAMA may require the bank to apply an ILM which is greater than 1. The exclusion of internal loss data due to non-compliance with the loss data standards, and the application of any resulting multipliers, must be publicly disclosed in Pillar 3. 7.4.2 The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the bank’s operational loss exposure. The qualitative requirements for loss data collection are outlined in sections 8 and 9. 8. General criteria on loss data identification, collection and treatment: The proper identification, collection and treatment of internal loss data are essential prerequisites to capital calculation under the standardized approach. The general criteria for the use of the LC are as follows: a) Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period. When the bank first moves to the standardized approach, a five-year observation period is acceptable on an exceptional basis when good-quality data are unavailable for more than five years. b) Internal loss data are most relevant when clearly linked to a bank’s current business activities, technological processes and risk management procedures. Therefore, a bank must have documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. c) For risk management purposes, and to assist in supervisory validation and/or review, SAMA will request a bank to map its historical internal loss data into the relevant Level 1 supervisory categories as defined in annexure 2 and to provide this data to SAMA. The bank must document criteria for allocating losses to the specified event types.

Page Number 9 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 d) A bank’s internal loss data must be comprehensive and capture all material activities and exposures from all appropriate subsystems and geographic locations. The minimum threshold for including a loss event in the data collection and calculation of average annual losses is set at SAR 44,600 for the purpose of the calculation of average annual losses, SAMA may increase the threshold to SAR 446,000 for the banks where the BI is greater than SAR 4.46 billion). e) A side from information on gross loss amounts, the bank must collect information about the reference dates of operational risk events, including the date when the event happened or first began (“date of occurrence”), where available; the date on which the bank became aware of the event (“date of discovery”); and the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognized in the bank’s profit and loss (P&L) accounts (“date of accounting”). In addition, the bank must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event.3 The level of detail of any descriptive information should be commensurate with the size of the gross loss amount. f) Operational loss events related to credit risk and that are accounted for in credit risk RWAs should not be included in the loss data set. Operational loss events that relate to credit risk, but are not accounted for in credit risk RWAs should be included in the loss data set. g) Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework and will therefore be subject to the standardized approach for operational risk. h) Banks’ Internal Audit function must conduct independently review of the comprehensiveness and accuracy of the loss data at least on annul basis and submit the report to the Audit Committee.

3 Tax effects (eg reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of the standardized approach for operational risk.

Page Number 10 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 9. Specific criteria on loss data identification, collection and treatment: 9.1 Building of the standardized approach loss data set: In order to build an acceptable loss data set from the available internal data, a bank must develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses. 9.2 Gross loss, net loss, and recovery definitions: 9.2.1 Banks must be able to identify the gross loss amounts, non-insurance recoveries, and insurance recoveries for all operational loss events. Banks should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the bank receives payment. Receivables do not count as recoveries. Verification of payments received to net losses must be provided to SAMA upon request. 9.2.2 The following items must be included in the gross loss computation of the loss data set: a) Direct charges, including impairments and settlements, to the bank’s P&L accounts and write-downs due to the operational risk event; b) Costs incurred as a consequence of the event including external expenses with a direct link to the operational risk event (e.g. legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event; c) Provisions or reserves accounted for in the P&L against the potential operational loss impact; d) Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L (“pending losses”).4 Material pending losses should be

4 For instance, the impact of some events (e.g. legal events, damage to physical assets) may be known and clearly identifiable before these events are recognized through the establishment of a reserve. Moreover, the way this reserve is established (e.g. the date of discovery) can vary across banks.

Page Number 11 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 included in the loss data set within a time period commensurate with the size and age of the pending item; and e) Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods (timing losses”).5 Material “timing losses” should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period and give rise to legal risk. 9.2.3 The following items should be excluded from the gross loss computation of the loss data set: a) Costs of general maintenance contracts on property, plant or equipment; b) Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and c) Insurance premiums. 9.2.4 Banks must use the date of accounting for building the loss data set. The bank must use a date no later than the date of accounting for including losses related to legal events in the loss data set. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L. 9.2.5 Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment. 10.Exclusion of losses from the Loss Component: 10.1 Banks must obtain SAMA’s approval to exclude certain operational loss events when they are no longer relevant to the bank’s operational risk profile. The exclusion of internal loss events should be rare and supported by strong justification. In evaluating

5 Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of an institution’s financial accounts (e.g. revenue overstatement, accounting errors and mark-to￾market errors). While these events do not represent a true financial impact on the institution (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the institution’s financial statements.

Page Number 12 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 the relevance of operational loss events to the bank’s risk profile, SAMA will consider whether the cause of the loss event could occur in other areas of the bank’s operations. Taking settled legal exposures and divested businesses as examples, SAMA expects the bank’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products. 10.2 The total loss amount and number of exclusions must be disclosed under Pillar 3 with appropriate narratives, including total loss amount and number of exclusions. 10.3 The Banks will exclude losses where a loss event should be greater than 5% of the bank’s average losses. In addition, losses can only be excluded after being included in a bank’s operational risk loss database for a minimum period of three years. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period. 11.Exclusions of divested activities from the Business Indicator: Banks must obtain SAMA’s approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed under Pillar 3. 12.Inclusion of losses and BI items related to mergers and acquisitions: 12.1 The scope of losses and BI items used to calculate the operational risk capital requirements must include acquired businesses and merged entities over the period prior to the acquisition/merger that is relevant to the calculation of the standardized approach (ten years for losses and three years for BI). 12.2 Losses and BI items from merged entities or acquired businesses should be included in the calculation of ORC immediately after the merger/acquisition, and should be reported in the first update of the bank’s total risk-weighted assets that comes after the merger/acquisition. 13. Application of the standardized approach within a group: 13.1 At the consolidated level, the standardized approach calculations use fully consolidated BI figures, which net all the intragroup income and expenses. The calculations at a sub-consolidated level use BI figures for the banks consolidated at that

Page Number 13 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 particular sub-level. The calculations at the subsidiary level use the BI figures from the subsidiary. 13.2 Similar to bank holding companies, when BI figures for sub-consolidated or subsidiary banks where BI is more than SAR4.46 billion, these banks are required to use loss experience in the standardized approach calculations. A sub-consolidated bank or a subsidiary bank uses only the losses it has incurred in the standardized approach calculations (and does not include losses incurred by other parts of the bank holding company). 13.3 In case, a subsidiary of a bank have BI more than SAR 4.46 billion does not meet the qualitative standards for the use of the Loss Component, this subsidiary must calculate the standardized approach capital requirements by applying 100% of the BI Component. In such cases SAMA may require the bank to apply an ILM which is greater than 1.

Page Number 14 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Annexure 1: Definition of Business Indicator components Business Indicator definitions BI Component Profit and loss or balance sheet items Description Typical sub-items Interest, lease and dividend Interest income Interest income from all financial assets and other interest income (includes interest income from financial and operating leases and profits from leased assets) • Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets, financial leases and operational leases • Interest income from hedge accounting derivatives • Other interest income • Profits from leased assets Interest expenses Interest expenses from all financial liabilities and other interest expenses (includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets) • Interest expenses from deposits, debt securities issued, financial leases, and operating leases • Interest expenses from hedge accounting derivatives • Other interest expenses • Losses from leased assets • Depreciation and impairment of operating leased assets Interest earning assets (balance sheet item) Total gross outstanding loans, advances, interest bearing securities (including government bonds), and lease assets measured at the end of each financial year Dividend income Dividend income from investments in stocks and funds not consolidated in the bank’s financial statements, including dividend income from non-consolidated subsidiaries, associates and joint ventures. Fee and commission income Income received from providing advice and services. Includes income received by the bank as an outsourcer of financial services. Fee and commission income from: • Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers) • Clearing and settlement; Asset management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitizations; Loan commitments and guarantees given; and foreign transactions

Page Number 15 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Services Fee and commission expenses Expenses paid for receiving advice and services. Includes outsourcing fees paid by the bank for the supply of financial services, but not outsourcing fees paid for the supply of non￾financial services (eg logistical, IT, human resources) Fee and commission expenses from: • Clearing and settlement; Custody; Servicing of securitizations; Loan commitments and guarantees received; and Foreign transactions Other operating income Income from ordinary banking operations not included in other BI items but of similar nature (income from operating leases should be excluded) • Rental income from investment properties • Gains from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37) Other operating expenses Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events (expenses from operating leases should be excluded) • Losses from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (IFRS 5.37) • Losses incurred as a consequence of operational loss events (eg fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years • Expenses related to establishing provisions/reserves for operational loss events Financial Net profit (loss) on the trading book • Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences Net profit (loss) on the banking book • Net profit/loss on financial assets and liabilities measured at fair value through profit and loss • Realized gains/losses on financial assets and liabilities not measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortized cost) • Net profit/loss from hedge accounting • Net profit/loss from exchange differences

Page Number 16 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 The following Profit and loss items do not contribute to any of the items of the BI:  Income and expenses from insurance or reinsurance businesses  Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased  Administrative expenses, including staff expenses, outsourcing fees paid for the supply of non-financial services (e.g. logistical, IT, human resources), and other administrative expenses (e.g. IT, utilities, telephone, travel, office supplies, postage)  Recovery of administrative expenses including recovery of payments on behalf of customers (e.g. taxes debited to customers)  Expenses of premises and fixed assets (except when these expenses result from operational loss events)  Depreciation/amortization of tangible and intangible assets (except depreciation related to operating lease assets, which should be included in financial and operating lease expenses)  Provisions/reversal of provisions (e.g. on pensions, commitments and guarantees given) except for provisions related to operational loss events  Expenses due to share capital repayable on demand  Impairment/reversal of impairment (e.g. on financial assets, non-financial assets, investments in subsidiaries, joint ventures and associates)  Changes in goodwill recognized in profit or loss  Corporate income tax (tax based on profits including current tax and deferred).

Page Number 17 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Annexure 2: Detailed loss event type classification Detailed loss event type classification Event-type category (Level 1) Definition Categories (Level 2) Activity examples (Level 3) Internal Fraud. Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party. Unauthorized Activity Transactions not reported (intentional). Trans type unauthorized (with monetary loss). Mismarking of position (intentional). Theft and Fraud Fraud / credit fraud / worthless deposits. Theft / extortion / embezzlement / robbery. Misappropriation of assets. Malicious destruction of assets. Forgery. Check kiting. Smuggling. Account take-over / impersonation. Tax non-compliance / evasion (willful). Bribes / kickbacks. Insider trading (not on firm’s account). External Fraud. Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law by a third party. Theft and Fraud Theft/ Robbery. Forgery. Check kiting. Systems Security Hacking damage. Theft of information (with monetary loss). Employment Practices and Workplace Safety. Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events. Employee Relations Compensation, benefit, termination issues. Organized labor activity. Safe Environment General liability (slips and falls, etc.). Employee health & safety rules events. Workers compensation. Diversity and Discrimination All discrimination types. Clients, Products and Business Practices. Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, Disclosure, and Fiduciary Fiduciary breaches / guideline violations. Suitability / disclosure issues (know-your-customer, etc.). Retail consumer disclosure violations. Breach of privacy. Aggressive sales. Account churning. Misuse of confidential information. Lender Liability.

Page Number 18 of 18 Minimum Capital Requirements for Operational Version Issuance Date Risk 2.1 December 2022 Improper Business or Market Practices Antitrust. Improper trade / market practices. Market manipulation. Insider trading (on firm’s account). Unlicensed activity. Money laundering. Product Flaws Product defects (unauthorized, etc.). Model Error. Selection, Sponsorship, and Exposure Failure to investigate client per guidelines. Exceeding client exposure limits. Advisory Activity Disputes over performance of advisory activities. Damage to Physical Assets. Losses arising from loss or damage to physical assets from natural disaster or other events. Disasters and Other Events Natural disaster losses. Human losses from external sources (terrorism, vandalism). Business Disruption and System Failures. Losses arising from disruption of business or system failures. Systems Hardware. Software. Telecommunications. Utility outage / disruptions. Execution, Delivery, and Process Management. Losses from failed transaction processing or process management, from relations with trade counterparties and vendors. Transaction Capture, Execution, and Maintenance Miscommunication. Data entry, maintenance or loading error. Missed deadline or responsibility. Model / system miss-operation. Accounting error / entity attribution error. Other task miss-performance. Delivery failure. Collateral management failure. Reference Data Maintenance. Monitoring and Reporting Failed mandatory reporting obligation. Inaccurate external report (loss incurred). Customer Intake and Documentation Client permissions / disclaimers missing. Legal documents missing / incomplete. Customer/Client Account Management Unapproved access given to accounts. Incorrect client records (loss incurred). Negligent loss or damage of client assets. Trade Counterparties Non-client counterparty miss-performance. Miscellaneous non-client counterparty disputes. Vendors and Suppliers Outsourcing. Vendor disputes.

Saudi Central Bank (SAMA) Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) December 2022

Page Number 2 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Contents Counterparty credit risk explanation............................................................................... 12 Scope of counterparty credit risk charge......................................................................... 14 Methods to calculate counterparty credit risk exposure.................................................. 15 Methods to calculate CCR risk-weighted assets.............................................................. 17 Exemptions....................................................................................................................... 18 Minimum haircut floors for securities financing transactions (SFTs)............................. 18 Overview and scope.......................................................................................................... 18 Replacement Cost and Net Independent Collateral Amount............................................ 19 Multiplier (recognition of excess collateral and negative mark-to-market)..................... 24 Approval to adopt an internal models method to estimate EAD...................................... 48 Exposure amount or EAD under the internal models method.......................................... 49 Maturity.............................................................................................................................52 Margin agreements........................................................................................................... 53 Scope of application......................................................................................................... 69 Central Counterparties.................................................................................................... 70 Exposures to Qualifying CCPs: trade exposures............................................................. 71 Exposures to non-qualifying CCPs............................................................................. .... 81 Scope................................................................................................................................ 82 Haircut floors................................................................................................................... 83 Credit Valuation Adjustment (CVA) overview................................................................. 86 Basic approach for credit valuation adjustment risk....................................................... 89 Standardized approach for credit valuation adjustment risk........................................... 96 Regulatory CVA calculations........................................................................................... 97 Calculations................................................................................................................... 103 12. The application of the (SA-CCR) to sample portfolios.......................................... 123 13. The effect of standard margin agreements on the calculation of replacement cost with SA-CCR............................................................................................................................. 142

1. Introduction................................................................................................................... 3
2. Scope of Application..................................................................................................... 3
3. Definitions...................................................................................................................... 4
4. Implementation Timeline and SAMA Reporting Requirements............................. 12
5. Counterparty credit risk overview............................................................................. 12
6. Standardized approach to counterparty credit risk................................................. 18
7. Internal models method for counterparty credit risk............................................... 48
8. Capital requirements for bank exposures to central counterparties...................... 69
9. Counterparty credit risk in the trading book........................................................... 81
10. Minimum haircut floors for securities financing transactions................................ 82
11. Credit Valuation Adjustment (CVA) Framework.................................................... 86 Application Guidance....................................................................................................... 123

Page Number 3 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Minimum Capital Requirements for Counterparty Credit Risk and Credit Valuation Adjustment

1. Introduction The Basel III framework on Counterparty Credit Risk includes a comprehensive, non-modelled approach for measuring counterparty credit risk arising from derivative contracts, Securities Financing transaction (SFT) and cash transactions in securities, foreign exchange and commodities. With the continued growth of the derivative market and banks’ increasing use of financial instruments and structured products for yield enhancement and/or risk management purposes, it is essential for them to have the necessary systems and expertise for managing any CCR associated with those activities. This Framework covers both Counterparty Default Risk as well as the Credit Valuation Adjustment (CVA) to calculate the risk of losses arising from the changes in the value of the CVA in response to the changes in the counterparty credit spreads and market risk factors that drive prices of derivative transactions and SFTs. Banks that are below the CVA materiality threshold may opt not to calculate its CVA capital requirements. A bank must regularly review and update its materiality assessment to reflect any significant changes in materiality. This framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. This Framework supersedes any conflicting requirements in previous circulars in this regard (GDBC-371000101120, GDBC-410382700000, and GDBC￾361000021954).
2. Scope of Application 2.1. This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 2.2. This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators.

Page Number 4 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 3. Definitions General Terms Counterparty credit risk (CCR) The risk that the counterparty to a transaction could default before the final settlement of the transaction's cash flows. An economic loss would occur if the transactions or portfolio of transactions with the counterparty has a positive economic value at the time of default. Unlike a firm's exposure to credit risk through a loan, where the exposure to credit risk is unilateral and only the lending bank faces the risk of loss, CCR creates a bilateral risk of loss: the market value of the transaction can be positive or negative to either counterparty to the transaction. The market value is uncertain and can vary over time with the movement of underlying market factors. A central counterparty (CCP) A clearing house that interposes itself between counterparties to contracts traded in one or more financial markets, becoming the buyer to every seller and the seller to every buyer and thereby ensuring the future performance of open contracts. A CCP becomes counterparty to trades with market participants through novation, an open offer system, or another legally binding arrangement. For the purposes of the capital framework, a CCP is a financial institution. A qualifying central counterparty (QCCP) An entity that is licensed to operate as a CCP (including a license granted by way of confirming an exemption), and is permitted by the appropriate regulator/overseer Capital Market Authority (CMA) to operate as such with respect to the products offered. This is subject to the provision that the CCP is based and prudentially supervised in a jurisdiction where the relevant regulator/overseer has established. (Saudi Arabia) and publicly indicated that it applies to the CCP on an ongoing basis, domestic rules and regulations

Page Number 5 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 that are consistent with the Principles for Financial Market Infrastructures issued by the Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions. 4.1. 1) Where the CCP is in a jurisdiction that does not have a CCP regulator applying the Principles to the CCP, then SAMA may make the determination of whether the CCP meets this definition. 4.2. 2) In addition, for a CCP to be considered a QCCP, the requirements of 8.37 must be met to permit each clearing member bank to calculate its capital requirement for its default fund exposures. A clearing member 4.3. A member of, or a direct participant in, a CCP that is entitled to enter into a transaction with the CCP, regardless of whether it enters into trades with a CCP for its own hedging, investment or speculative purposes or whether it also enters into trades as a financial intermediary between the CCP and other market participants. For the purposes of the CCR standard, where a CCP has a link to a second CCP, that second CCP is to be treated as a clearing member of the first CCP. Whether the second CCP's collateral contribution to the first CCP is treated as initial margin or a default fund contribution will depend upon the legal arrangement between the CCPs. SAMA should be consulted to determine the treatment of this initial margin and default fund contributions. A client is a party to a transaction with a CCP through either a clearing member acting as a financial intermediary, or a clearing member guaranteeing the performance of the client to the CCP.

Page Number 6 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 A multi-level client structure One in which banks can centrally clear as indirect clients; that is, when clearing services are provided to the bank by an institution which is not a direct clearing member, but is itself a client of a clearing member or another clearing client. For exposures between clients and clients of clients, we use the term higher level client for the institution providing clearing services; and the term lower level client for the institution clearing through that client. Initial margin A clearing member's or client's funded collateral posted to the CCP to mitigate the potential future exposure (PFE) of the CCP to the clearing member arising from the possible future change in the value of their transactions. For the purposes of the calculation of counterparty credit risk capital requirements, initial margin does not include contributions to a CCP for mutualized loss sharing arrangements (i.e. in case a CCP uses initial margin to mutualize losses among the clearing members, it will be treated as a default fund exposure). Initial margin includes collateral deposited by a clearing member or client in excess of the minimum amount required, provided the CCP or clearing member may, in appropriate cases, prevent the clearing member or client from withdrawing such excess collateral. Variation margin A clearing member's or client's funded collateral posted on a daily or intraday basis to a CCP based upon price movements of their transactions. Trade exposures As (in Chapter 8 of this framework), includes the current and potential future exposure of a clearing member or a client to a CCP arising from over-the-counter derivatives, exchange traded derivatives transactions or securities financing transactions, as well as initial margin. For the purposes of this definition, the current exposure of a

Page Number 7 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 clearing member includes the variation margin due to the clearing member but not yet received. Default funds Also known as clearing deposits or guaranty fund contributions (or any other names), are clearing members' funded or unfunded contributions towards, or underwriting of, a CCP's mutualized loss sharing arrangements. The description given by a CCP to its mutualized loss sharing arrangements is not determinative of their status as a default fund; rather, the substance of such arrangements will govern their status. Offsetting transaction The transaction leg between the clearing member and the CCP when the clearing member acts on behalf of a client (e.g. when a clearing member clears or novates a client's trade). Transaction types Long settlement transactions Transactions where a counterparty undertakes to deliver a security, a commodity, or a foreign exchange amount against cash, other financial instruments, or commodities, or vice versa, at a settlement or delivery date that is contractually specified as more than the lower of the market standard for this particular instrument and five business days after the date on which the bank enters into the transaction. Securities financing transactions (SFTs) Transactions such as repurchase agreements, reverse repurchase agreements, security lending and borrowing, and margin lending transactions, where the value of the transactions depends on market valuations and the transactions are often subject to margin agreements. Margin lending transactions Transactions in which a bank extends credit in connection with the purchase, sale, carrying or trading of securities. Margin lending transactions do not include other loans that

Page Number 8 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 happen to be secured by securities collateral. Generally, in margin lending transactions, the loan amount is collateralized by securities whose value is greater than the amount of the loan. 4.4. Netting sets, hedging sets, and related terms Netting set A group of transactions with a single counterparty that are subject to a legally enforceable bilateral netting arrangement and for which netting is recognized for regulatory capital purposes under the provisions of 6.9 and 6.10 that are applicable to the group of transactions, this framework text on credit risk mitigation techniques in credit risk mitigation techniques for exposures risk-weighted under the standardized approach of Basel III: Finalizing post-crisis reforms, or the cross product netting rules set out in 7.61 to 7.71. Each transaction that is not subject to a legally enforceable bilateral netting arrangement that is recognized for regulatory capital purposes should be interpreted as its own netting set for the purpose of these rules. Hedging set A set of transactions within a single netting set within which full or partial offsetting is recognized for the purpose of calculating the PFE add-on of the Standardized Approach for counterparty credit risk. Margin agreement A contractual agreement or provisions to an agreement under which one counterparty must supply variation margin to a second counterparty when an exposure of that second counterparty to the first counterparty exceeds a specified level. Margin threshold The largest amount of an exposure that remains outstanding until one party has the right to call for variation margin.

Page Number 9 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Margin period of risk The time period from the last exchange of collateral covering a netting set of transactions with a defaulting counterparty until that counterparty is closed out and the resulting market risk is re-hedged. Effective maturity Under the Internal Models Method for a netting set with maturity greater than one year is the ratio of the sum of expected exposure over the life of the transactions in a netting set discounted at the risk-free rate of return divided by the sum of expected exposure over one year in a netting set discounted at the risk-free rate. This effective maturity may be adjusted to reflect rollover risk by replacing expected exposure with effective expected exposure for forecasting horizons under one year. The formula is given in 7.20. Cross-product netting Refers to the inclusion of transactions of different product categories within the same netting set pursuant to the cross￾product netting rules set out in in Chapter 7 of this framework. Distributions Distribution of market values The forecast of the probability distribution of net market values of transactions within a netting set for some future date (the forecasting horizon) given the realized market value of those transactions up to the present time. Distribution of exposures The forecast of the probability distribution of market values that is generated by setting forecast instances of negative net market values equal to zero (this takes account of the fact that, when the bank owes the counterparty money, the bank does not have an exposure to the counterparty).

Page Number 10 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Risk-neutral distribution A distribution of market values or exposures at a future time period where the distribution is calculated using market implied values such as implied volatilities. Actual distribution A distribution of market values or exposures at a future time period where the distribution is calculated using historic or realized values such as volatilities calculated using past price or rate changes. 4.5. Exposure measures and adjustments Current exposure The larger of zero, or the current market value of a transaction or portfolio of transactions within a netting set with a counterparty that would be lost upon the immediate default of the counterparty, assuming no recovery on the value of those transactions in bankruptcy. Current exposure is often also called Replacement Cost. Peak exposure A high percentile (typically 95% or 99%) of the distribution of exposures at any particular future date before the maturity date of the longest transaction in the netting set. A peak exposure value is typically generated for many future dates up until the longest maturity date of transactions in the netting set. Expected exposure The mean (average) of the distribution of exposures at any particular future date before the longest-maturity transaction in the netting set matures. An expected exposure value is typically generated for many future dates up until the longest maturity date of transactions in the netting set. Effective expected exposure At a specific date is the maximum expected exposure that occurs at that date or any prior date. Alternatively, it may be defined for a specific date as the greater of the expected exposure at that date, or the effective exposure at the

Page Number 11 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 previous date. In effect, the Effective Expected Exposure is the Expected Exposure that is constrained to be non￾decreasing over time. Expected positive exposure (EPE) The weighted average over time of expected exposure where the weights are the proportion that an individual expected exposure represents of the entire time interval. When calculating the minimum capital requirement, the average is taken over the first year or, if all the contracts in the netting set mature before one year, over the time period of the longest-maturity contract in the netting set. Effective expected positive exposure (Effective EPE) The weighted average over time of effective expected exposure over the first year, or, if all the contracts in the netting set mature before one year, over the time period of the longest maturity contract in the netting set where the weights are the proportion that an individual expected exposure represents of the entire time interval. Credit valuation adjustment An adjustment to the mid-market valuation of the portfolio of trades with a counterparty. This adjustment reflects the market value of the credit risk due to any failure to perform on contractual agreements with a counterparty. This adjustment may reflect the market value of the credit risk of the counterparty or the market value of the credit risk of both the bank and the counterparty. 4.6. One-sided credit valuation adjustment A credit valuation adjustment that reflects the market value of the credit risk of the counterparty to the firm, but does not reflect the market value of the credit risk of the bank to the counterparty. 4.7. CVA Materiality Threshold The materiality threshold for CVA is where aggregate notional amount of non-centrally cleared derivatives is less than or equal to 446 billion SAR may opt not to calculate

Page Number 12 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 its CVA capital requirements using the SA-CVA or BA￾CVA and instead choose an alternative treatment. CCR-related risks 4.8. Rollover risk The amount by which expected positive exposure is understated when future transactions with a counterparty are expected to be conducted on an ongoing basis, but the additional exposure generated by those future transactions is not included in calculation of expected positive exposure. 4.9. General wrong￾way risk Arises when the probability of default of counterparties is positively correlated with general market risk factors. 4.10. Specific wrong￾way risk Arises when the exposure to a particular counterparty is positively correlated with the probability of default of the counterparty due to the nature of the transactions with the counterparty. 4. Implementation Timeline and SAMA Reporting Requirements 4.1. This framework will be effective on 01 January 2023. 4.2. SAMA expects all Banks to report the Counterparty credit risk (CCR) and Credit Valuation Adjustment (CVA) Risk-Weighted Assets (RWA) and capital charge using SAMA’s Q17 reporting template within 30 days after the end of each quarter. Minimum Capital Requirements for Counterparty Credit Risk (CCR) 5. Counterparty credit risk overview Counterparty credit risk explanation 5.1. Counterparty credit risk is defined in Chapter 3 of this framework. It is the risk that the counterparty to a transaction could default before the final settlement of the transaction in cases where there is a bilateral risk of loss. The bilateral risk of loss is the key concept on which the definition of counterparty credit risk is based and is explained further below.

Page Number 13 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 5.2. When a bank makes a loan to a borrower the credit risk exposure is unilateral. That is, the bank is exposed to the risk of loss arising from the default of the borrower, but the transaction does not expose the borrower to a risk of loss from the default of the bank. By contrast, some transactions give rise to a bilateral risk of loss and therefore give rise to a counterparty credit risk charge. For example: (1) A bank makes a loan to a borrower and receives collateral from the borrower.1 (a) The bank is exposed to the risk that the borrower defaults and the sale of the collateral is insufficient to cover the loss on the loan. (b)The borrower is exposed to the risk that the bank defaults and does not return the collateral. Even in cases where the customer has the legal right to offset the amount it owes on the loan in compensation for the lost collateral, the customer is still exposed to the risk of loss at the outset of the loan because the value of the loan may be less than the value of the collateral the time of default of the bank. (2) A bank borrows cash from a counterparty and posts collateral to the counterparty (or undertakes a transaction that is economically equivalent, such as the sale and repurchase (repo) of a security). (a) The bank is exposed to the risk that its counterparty defaults and does not return the collateral that the bank posted. (b)The counterparty is exposed to the risk that the bank defaults and the amount the counterparty raises from the sale of the collateral that the bank posted is insufficient to cover the loss on the counterparty’s loan to the bank. (1) A bank borrows a security from a counterparty and posts cash to the counterparty as collateral (or undertakes a transaction that is economically equivalent, such as a reverse repo). (a) The bank is exposed to the risk that its counterparty defaults and does not return the cash that the bank posted as collateral. (b)The counterparty is exposed to the risk that the bank defaults and the cash that the bank posted as collateral is insufficient to cover the loss of the security that the bank borrowed.

1 The bilateral risk of loss in this example arises because the bank receives, i.e. takes possession of, the collateral as part of the transaction. By contrast, collateralized loans where the collateral is not exchanged prior to default, do not give rise to a bilateral risk of loss; for example a corporate or retail loan secured on a property of the borrower where the bank may only take possession of the property when the borrower defaults does not give rise to counterparty credit risk.

Page Number 14 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) A bank enters a derivatives transaction with a counterparty (e.g. it enters a swap transaction or purchases an option). The value of the transaction can vary over time with the movement of underlying market factors.2 (a) The bank is exposed to the risk that the counterparty defaults when the derivative has a positive value for the bank. (b)The counterparty is exposed to the risk that the bank defaults when the derivative has a positive value for the counterparty. Scope of counterparty credit risk charge 5.3. Banks must calculate a counterparty credit risk charge for all exposures that give rise to counterparty credit risk, with the exception of those transactions listed in 5.15 below. The categories of transaction that give rise to counterparty credit risk are: (1) Over-the-counter (OTC) derivatives (2) Exchange-traded derivatives (3) Long settlement transactions (4) Securities financing transactions 5.4. The transactions listed in 5.3 above generally exhibit the following abstract characteristics: (1) The transactions generate a current exposure or market value. (2) The transactions have an associated random future market value based on market variables. (3) The transactions generate an exchange of payments or an exchange of a financial instrument (including commodities) against payment. (4) The transactions are undertaken with an identified counterparty against which a unique probability of default can be determined. 5.5. Other common characteristics of the transactions listed in 5.3 include the following:

2 The counterparty credit risk rules capture the risk of loss to the bank from the default of the derivative counterparty. The risk of gains or losses on the changing market value of the derivative is captured by the market risk framework. The market risk framework captures the risk that the bank will suffer a loss as a result of market movements in underlying risk factors referenced by the derivative (e.g. interest rates for an interest rate swap); however, it also captures the risk of losses that can result from the derivative declining in value due to a deterioration in the creditworthiness of the derivative counterparty. The latter risk is the credit valuation adjustment risk set out in Chapter 11 of this Framework.

Page Number 15 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1) Collateral may be used to mitigate risk exposure and is inherent in the nature of some transactions. (2) Short-term financing may be a primary objective in that the transactions mostly consist of an exchange of one asset for another (cash or securities) for a relatively short period of time, usually for the business purpose of financing. The two sides of the transactions are not the result of separate decisions but form an indivisible whole to accomplish a defined objective. (1) Netting may be used to mitigate the risk. (2) Positions are frequently valued (most commonly on a daily basis), according to market variables. (3) Remargining may be employed. Methods to calculate counterparty credit risk exposure 5.6. For the transaction types listed in 5.3 above, banks must calculate their counterparty credit risk exposure, or exposure at default (EAD),3 using one of the methods set out in 5.7 to 5.8 below. The methods vary according to the type of the transaction, the counterparty to the transaction, and whether the bank has received SAMA approval to use the method (if such approval is required). 5.7. For exposures that are not cleared through a central counterparty (CCP) the following methods must be used to calculate the counterparty credit risk exposure: (1) Standardized approach for measuring counterparty credit risk exposures (SACCR), which is set out in Chapter 6 of this framework. This method is to be used for exposures arising from OTC derivatives, exchange-traded derivatives and long settlement transactions. This method must be used if the bank does not have approval to use the internal models method (IMM). (2) The simple approach or comprehensive approach to the recognition of collateral, which are both set out in the credit risk mitigation chapter of the standardized approach to credit risk (see Chapter 9 on the mitigation techniques for exposures risk-weighted under the standardized approach of the Minimum Capital Requirements for Credit Risk). These methods are to be used for

3 The terms “exposure” and “EAD” are used interchangeable in the counterparty credit risk chapters of the credit risk standard. This reflects the fact that the amounts calculated under the counterparty credit risk rules must typically be used as either the “exposure” within the standardized approach to credit risk, or the EAD within the internal ratings-based (IRB) approach to credit risk, as described in 5.12.

Page Number 16 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 securities financing transactions (SFTs) and must be used if the bank does not have approval to use the IMM. (3) The value-at-risk (VaR) models approach, which is set out in paragraphs 73-76 of Chapter 9 of the Minimum Capital Requirements for Credit Risk. For banks applying the IRB approach to credit risk, the VaR models approach may be used to calculate EAD for SFTs, subject to SAMA approval, as an alternative to the method set out in (2) above. (4) The IMM, which is set out in Chapter 7 of this framework. This method may be used, subject to SAMA approval, as an alternative to the methods to calculate counterparty credit risk exposures set out in (1) and (2) above (for all of the exposures referenced in those bullets). 5.8. For exposures that are cleared through a CCP, banks must apply the method set out Chapter 8 of this framework. This method covers: (1) the exposures of a bank to a CCPs when the bank is a clearing member of the CCP; (2) the exposures of a bank to its clients, when the bank is a clearing members and act as an intermediary between the client and the CCP; and (3) the exposures of a bank to a clearing member of a CCP, when the bank is a client of the clearing member and the clearing member is acting as an intermediary between the bank and the CCP. 5.9. Exposures to central counterparties arising from the settlement of cash transactions (equities, fixed income, spot foreign exchange and spot commodities), are excluded from the requirements of Chapter 8 of this framework. They are instead subject to the requirements of chapter 25 of the Minimum Capital Requirements for Credit Risk. 5.10. Under the methods outlined above, the exposure amount or EAD for a given counterparty is equal to the sum of the exposure amounts or EADs calculated for each netting set with that counterparty, subject to the exception outlined in 5.11 below. 5.11. The exposure or EAD for a given OTC derivative counterparty is defined as the greater of zero and the difference between the sum of EADs across all netting sets with the counterparty and the credit valuation adjustment (CVA) for that counterparty which has already been recognized by the bank as an incurred write￾down (i.e. a CVA loss). This CVA loss is calculated without taking into account any offsetting debit valuation adjustments, which have been deducted from

Page Number 17 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 capital under the Regulatory Adjustments or “Filter” chapter of Section A of SAMA's Final Guidance Document Concerning Implementation of Capital Reforms Under Basel III Framework4 . This reduction of EAD by incurred CVA losses does not apply to the determination of the CVA risk capital requirement. Methods to calculate CCR risk-weighted assets 5.12. After banks have calculated their counterparty credit risk exposures, or EAD, according to the methods outlined above, they must apply the standardized approach to credit risk, the IRB approach to credit risk, or, in the case of the exposures to CCPs, the capital requirements set out in Chapter 8 of this framework. For counterparties to which the bank applies the standardized approach, the counterparty credit risk exposure amount will be risk weighted according to the relevant risk weight of the counterparty. For counterparties to which the bank applies the IRB approach, the counterparty credit risk exposure amount defines the EAD that is used within the IRB approach to determine risk￾weighted assets (RWA) and expected loss amounts. 5.13. For IRB exposures, the risk weights applied to OTC derivative exposures should be calculated with the full maturity adjustment (as defined in paragraph 6 of chapter 11 of the Minimum Capital Requirements for Credit Risk) capped at 1 for each netting set for which the bank calculates CVA capital under either the basic approach (BA-CVA) or the standardized approach (SA-CVA), as provided in 11.12. 5.14. For banks that have SAMA approval to use IMM, RWA for credit risk must be calculated as the higher of: (1) the sum of RWA calculated using Internal Models Method (IMM) with current parameter calibrations; and (2) the sum of RWA calculated using IMM with stressed parameter calibrations.

4 SAMA circulars would be Circular No.: 341000015689, which I will be referencing in CCR Framework. (https://www.sama.gov.sa/enUS/Laws/Documents/3.%20SAMA%20Basel%20III%20Program/2. %20SAMAs%20Final%20Guidance%20document%20on%20Capital%20Reforms%20under%20 Basel%20III.pdf). Section A: Final Guidance Document

Page Number 18 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Exemptions 5.15. As an exception to the requirements of 5.3 above, banks are not required to calculate a counterparty credit risk charge for the following types of transactions (i.e. the exposure amount or EAD for counterparty credit risk for the transaction will be zero): (1) Credit derivative protection purchased by the bank against a banking book exposure, or against a counterparty credit risk exposure. In such cases, the bank will determine its capital requirement for the hedged exposure according to the criteria and general rules for the recognition of credit derivatives within the standardized approach or IRB approach to credit risk (i.e. substitution approach). (2) Sold credit default swaps in the banking book where they are treated in the framework as a guarantee provided by the bank and subject to a credit risk charge for the full notional amount. Minimum haircut floors for securities financing transactions (SFTs) 5.16. Chapter 10 of this framework specifies the treatment of certain non-centrally cleared SFTs with certain counterparties (in-scope SFTs). The requirements are applicable to banks in jurisdictions that are permitted to conduct in-scope SFTs below the minimum haircut floors specified within Chapter 10 of this framework. 6. Standardized approach to counterparty credit risk Overview and scope 6.1. The Standardized Approach for Counterparty Credit Risk (SA-CCR) applies to over the-counter (OTC) derivatives, exchange-traded derivatives and long settlement transactions.5 Banks that do not have approval to apply the internal model method (IMM) for the relevant transactions must use SA-CCR, as set out in this chapter. 6.2. EAD is to be calculated separately for each netting set (as set out in 4.14 , each transaction that is not subject to a legally enforceable bilateral netting arrangement that is recognized for regulatory capital purposes should be

5 See chapter 12 and Chapter 13 of this framework for illustrative examples of the application of the SA-CCR to sample portfolios

Page Number 19 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 interpreted as its own netting set).6 It is determined using the following formula, where: (1) alpha = 1.4 (2) RC = the replacement cost calculated according to 6.5 to 6.21 (3) PFE = the amount for potential future exposure calculated according to 6.22 to 6.79 𝐸𝐴𝐷 = 𝑎𝑙𝑝ℎ𝑎 ∗ (𝑅𝐶 + 𝑃𝐹𝐸) 6.3. For credit derivatives where the bank is the protection seller and that are outside netting and margin agreements, the EAD may be capped to the amount of unpaid premia. Banks have the option to remove such credit derivatives from their legal netting sets and treat them as individual unmargined transactions in order to apply the cap. 6.4. The replacement cost (RC) and the potential future exposure (PFE) components are calculated differently for margined and unmargined netting sets. Margined netting sets are netting sets covered by a margin agreement under which the bank’s counterparty has to post variation margin; all other netting sets, including those covered by a one-way margin agreement where only the bank posts variation margin, are treated as unmargined for the purposes of the SA-CCR. The EAD for a margined netting set is capped at the EAD of the same netting set calculated on an unmargined basis. Replacement Cost and Net Independent Collateral Amount 6.5. For unmargined transactions, the RC intends to capture the loss that would occur if a counterparty were to default and were closed out of its transactions immediately. The PFE add-on represents a potential conservative increase in exposure over a one-year time horizon from the present date (i.e. the calculation date). 6.6. For margined trades, the RC intends to capture the loss that would occur if a counterparty were to default at the present or at a future time, assuming that the closeout and replacement of transactions occur instantaneously. However, there may be a period (the margin period of risk) between the last exchange of collateral before default and replacement of the trades in the market. The PFE add-on represents the potential change in value of the trades during this time period.

6 The EAD can be set to zero only for sold options that are outside netting and margin agreements.

Page Number 20 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.7. In both cases, the haircut applicable to noncash collateral in the replacement cost formulation represents the potential change in value of the collateral during the appropriate time period (one year for unmargined trades and the margin period of risk for margined trades). 6.8. Replacement cost is calculated at the netting set level, whereas PFE add-ons are calculated for each asset class within a given netting set and then aggregated (see 6.26 to 6.79 below). 6.9. For capital adequacy purposes, banks may net transactions (e.g. when determining the RC component of a netting set) subject to novation under which any obligation between a bank and its counterparty to deliver a given currency on a given value date is automatically amalgamated with all other obligations for the same currency and value date, legally substituting one single amount for the previous gross obligations. Banks may also net transactions subject to any legally valid form of bilateral netting not covered in the preceding sentence, including other forms of novation. In every such case where netting is applied, a bank must satisfy SAMA that it has: (1) A netting contract with the counterparty or other agreement which creates a single legal obligation, covering all included transactions, such that the bank would have either a claim to receive or obligation to pay only the net sum of the positive and negative mark-to-market values of included individual transactions in the event a counterparty fails to perform due to any of the following: default, bankruptcy, liquidation or similar circumstances.7 (2) Written and reasoned legal reviews that, in the event of a legal challenge, the relevant courts and administrative authorities would find the bank’s exposure to be such a net amount under: (3) The law of the jurisdiction in which the counterparty is chartered and, if the foreign branch of a counterparty is involved, then also under the law of the jurisdiction in which the branch is located; (a) The law that governs the individual transactions; and (b)The law that governs any contract or agreement necessary to effect the netting.

7 The netting contract must not contain any clause which, in the event of default of a counterparty, permits a non-defaulting counterparty to make limited payments only, or no payments at all, to the estate of the defaulting party, even if the defaulting party is a net creditor.

Page Number 21 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (4) Procedures in place to ensure that the legal characteristics of netting arrangements are kept under review in light of the possible changes in relevant law. 6.10. SAMA, after consultation when necessary with other relevant supervisors, must be satisfied that the netting is enforceable under the laws of each of the relevant jurisdictions. Thus, if any of these supervisors is dissatisfied about enforceability under its laws, the netting contract or agreement will not meet this condition and neither counterparty could obtain supervisory benefit. 6.11. There are two formulations of replacement cost depending on whether the trades with a counterparty are margined or unmargined. The margined formulation could apply both to bilateral transactions and to central clearing relationships. The formulation also addresses the various arrangements that a bank may have to post and/or receive collateral that may be referred to as initial margin. Formulation for unmargined transactions 6.12. For unmargined transactions, RC is defined as the greater of: (i) the current market value of the derivative contracts less net haircut collateral held by the bank (if any), and (ii) zero. This is consistent with the use of replacement cost as the measure of current exposure, meaning that when the bank owes the counterparty money it has no exposure to the counterparty if it can instantly replace its trades and sell collateral at current market prices.8 The formula for RC is as follows, where: (1) V is the value of the derivative transactions in the netting set (2) C is the haircut value of net collateral held, which is calculated in accordance with the net independent collateral amount (NICA) methodology defined in 6.19. 9

8 The haircut applicable in the replacement cost calculation for unmargined trades should follow the formula in paragraphs 62 of chapter 9 of the Minimum Capital Requirements for Credit Risk. In applying the formula, banks must use the maturity of the longest transaction in the netting set as the value for N , capped at 250 days, in order to R scale haircuts for unmargined trades, which is capped at 100%. 9 As set out in 6.4, netting sets that include a one-way margin agreement in favor of the bank’s counterparty (i.e. the bank posts, but does not receive variation margin) are treated as unmargined for the purposes of SA-CCR. For such netting sets, C also includes, with a negative sign, the variation margin amount posted by the bank to the counterparty.

Page Number 22 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑅𝐶 = max{𝑉 − 𝐶; 0} 6.13. For the purpose of 6.12 above, the value of non-cash collateral posted by the bank to its counterparty is increased and the value of the non-cash collateral received by the bank from its counterparty is decreased using haircuts (which are the same as those that apply to repo-style transactions) for the time periods described in 6.7above. 6.14. The formulation set out in 6.12 above, does not permit the replacement cost, which represents today’s exposure to the counterparty, to be less than zero. However, banks sometimes hold excess collateral (even in the absence of a margin agreement) or have out-of-the-money trades which can further protect the bank from the increase of the exposure. As discussed in 6.23 to 6.25 below, the SA-CCR allows such over-collateralization and negative mark-to market value to reduce PFE, but they are not permitted to reduce replacement cost. Formulation for margined transactions 6.15. The RC formula for margined transactions builds on the RC formula for unmargined transactions. It also employs concepts used in standard margining agreements, as discussed more fully below. 6.16. The RC for margined transactions in the SA-CCR is defined as the greatest exposure that would not trigger a call for VM, taking into account the mechanics of collateral exchanges in margining agreements.10 Such mechanics include, for example, “Threshold”, “Minimum Transfer Amount” and “Independent Amount” in the standard industry documentation,11 which are factored into a call for VM.12 A defined, generic formulation has been created to reflect the variety of margining approaches used and those being considered by supervisors internationally.

10 See chapter 12 and Chapter 13 of this framework for illustrative examples of the effect of standard margin agreements on the SA-CCR formulation. 11 For example, the 1992 (Multicurrency-Cross Border) Master Agreement and the 2002 Master Agreement published by the International Swaps & Derivatives Association, Inc. (ISDA Master Agreement). The ISDA Master Agreement includes the ISDA Credit Support Annexes: the 1994 Credit Support Annex (Security Interest – New York Law), or, as applicable, the 1995 Credit Support Annex (Transfer – English Law) and the 1995 Credit Support Deed (Security Interest – English Law). 12 For example, in the ISDA Master Agreement, the term “Credit Support Amount”, or the overall amount of collateral that must be delivered between the parties, is defined as the greater of the Secured Party’s Exposure plus the aggregate of all Independent Amounts applicable to the Pledgor minus all Independent Amounts applicable to the Secured Party, minus the Pledgor’s Threshold and zero.

Page Number 23 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Incorporating NICA into replacement cost 6.17. One objective of the SA-CCR is to reflect the effect of margining agreements and the associated exchange of collateral in the calculation of CCR exposures. The following paragraphs address how the exchange of collateral is incorporated into the SA-CCR. 6.18. To avoid confusion surrounding the use of terms initial margin and independent amount which are used in various contexts and sometimes interchangeably, the term independent collateral amount (ICA) is introduced. ICA represents: (i) collateral (other than VM) posted by the counterparty that the bank may seize upon default of the counterparty, the amount of which does not change in response to the value of the transactions it secures and/or (ii) the Independent Amount (IA) parameter as defined in standard industry documentation. ICA can change in response to factors such as the value of the collateral or a change in the number of transactions in the netting set. 6.19. Because both a bank and its counterparty may be required to post ICA, it is necessary to introduce a companion term, net independent collateral amount (NICA), to describe the amount of collateral that a bank may use to offset its exposure on the default of the counterparty. NICA does not include collateral that a bank has posted to a segregated, bankruptcy remote account, which presumably would be returned upon the bankruptcy of the counterparty. That is, NICA represents any collateral (segregated or unsegregated) posted by the counterparty less the unsegregated collateral posted by the bank. With respect to IA, NICA takes into account the differential of IA required for the bank minus IA required for the counterparty. 6.20. For margined trades, the replacement cost is calculated using the following formula, where: (1) V and C are defined as in the unmargined formulation, except that C now includes the net variation margin amount, where the amount received by the bank is accounted with a positive sign and the amount posted by the bank is accounted with a negative sign (2) TH is the positive threshold before the counterparty must send the bank collateral (3) MTA is the minimum transfer amount applicable to the counterparty

Page Number 24 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑅𝐶 = max{𝑉 − 𝐶; 𝑇𝐻 + 𝑀𝑇𝐴 − 𝑁𝐼𝐶𝐴; 0} 6.21. TH + MTA – NICA represents the largest exposure that would not trigger a VM call and it contains levels of collateral that need always to be maintained. For example, without initial margin or IA, the greatest exposure that would not trigger a variation margin call is the threshold plus any minimum transfer amount. In the adapted formulation, NICA is subtracted from TH + MTA. This makes the calculation more accurate by fully reflecting both the actual level of exposure that would not trigger a margin call and the effect of collateral held and /or posted by a bank. The calculation is floored at zero, recognizing that the bank may hold NICA in excess of TH + MTA, which could otherwise result in a negative replacement cost. PFE add-on for each netting set 6.22. The PFE add-on consists of: (i) an aggregate add-on component; and (ii) a multiplier that allows for the recognition of excess collateral or negative mark-to-market value for the transactions within the netting set. The formula for PFE is as follows, where: (1) AddOnaggregate is the aggregate add-on component (see 6.27 below) (2) multiplier is defined as a function of three inputs: V, C and AddOnaggregate 𝑃𝐹𝐸 = 𝑚𝑢𝑙𝑡𝑖𝑝𝑙𝑖𝑒𝑟 ∗ AddOnaggregate Multiplier (recognition of excess collateral and negative mark-to-market) 6.23. As a general principle, over-collateralization should reduce capital requirements for counterparty credit risk. In fact, many banks hold excess collateral (i.e. collateral greater than the net market value of the derivatives contracts) precisely to offset potential increases in exposure represented by the add-on. As discussed in 6.12 and 6.20, collateral may reduce the replacement cost component of the exposure under the SA-CCR. The PFE component also reflects the risk-reducing property of excess collateral. 6.24. Banks should apply a multiplier to the PFE component that decreases as excess collateral increases, without reaching zero (the multiplier is floored at 5% of the PFE add-on). When the collateral held is less than the net market value of the derivative contracts (“under-collateralization”), the current replacement cost is positive and the multiplier is equal to one (i.e. the PFE component is equal to the

Page Number 25 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 full value of the aggregate add-on). Where the collateral held is greater than the net market value of the derivative contracts (“over-collateralization”), the current replacement cost is zero and the multiplier is less than one (i.e. the PFE component is less than the full value of the aggregate add-on). 6.25. This multiplier will also be activated when the current value of the derivative transactions is negative. This is because out-of-the-money transactions do not currently represent an exposure and have less chance to go in-the-money. The formula for the multiplier is as follows, where: (1) exp(…) is the exponential function (2) Floor is 5% (3) V is the value of the derivative transactions in the netting set (4) C is the haircut value of net collateral held 𝑚𝑢𝑙𝑡𝑖𝑝𝑙𝑖𝑒𝑟 = 𝑚𝑖𝑛 {1; 𝐹𝑙𝑜𝑜𝑟 + (1 − 𝐹𝑙𝑜𝑜𝑟) ∗ 𝑒𝑥𝑝 ( 𝑉 − 𝐶 2 ∗ (1 − 𝐹𝑙𝑜𝑜𝑟) ∗ 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒)} Aggregate add-on and asset classes 6.26. To calculate the aggregate add-on, banks must calculate add-ons for each asset class within the netting set. The SA-CCR uses the following five asset classes: (1) Interest rate derivatives (2) Foreign exchange derivatives (3) Credit derivatives (4) Equity derivatives. (5) Commodity derivatives 6.27. Diversification benefits across asset classes are not recognized. Instead, the respective add-ons for each asset class are simply aggregated using the following formula (where the sum is across the asset classes): 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 = ∑ 𝐴𝑑𝑑𝑂𝑛𝑎𝑠𝑠𝑒𝑡𝑐𝑙𝑎𝑠𝑠 𝑎𝑠𝑠𝑒𝑡𝑐𝑙𝑎𝑠𝑠 Allocation of derivative transactions to one or more asset classes 6.28. The designation of a derivative transaction to an asset class is to be made on the basis of its primary risk driver. Most derivative transactions have one primary

Page Number 26 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 risk driver, defined by its reference underlying instrument (e.g. an interest rate curve for an interest rate swap, a reference entity for a credit default swap, a foreign exchange rate for a foreign exchange (FX) call option, etc.). When this primary risk driver is clearly identifiable, the transaction will fall into one of the asset classes described above. 6.29. For more complex trades that may have more than one risk driver (e.g. multi￾asset or hybrid derivatives), banks must take sensitivities and volatility of the underlying into account for determining the primary risk driver 6.30. SAMA may also require more complex trades to be allocated to more than one asset class, resulting in the same position being included in multiple classes. In this case, for each asset class to which the position is allocated, banks must determine appropriately the sign and delta adjustment of the relevant risk driver (the role of delta adjustments in SA-CCR is outlined further in 6.32 below). General steps for calculating the PFE add-on for each asset class 6.31. For each transaction, the primary risk factor or factors need to be determined and attributed to one or more of the five asset classes: interest rate, foreign exchange, credit, equity or commodity. The add-on for each asset class is calculated using asset-class-specific formulas.13 6.32. Although the formulas for the asset class add-ons vary between asset classes, they all use the following general steps: (6) The effective notional (D) must be calculated for each derivative (i.e. each individual trade) in the netting set. The effective notional is a measure of the sensitivity of the trade to movements in underlying risk factors (i.e. interest rates, exchange rates, credit spreads, equity prices and commodity prices). The effective notional is calculated as the product of the following parameters (i.e. D = d * MF

• δ): (a) The adjusted notional (d). The adjusted notional is a measure of the size of the trade. For derivatives in the foreign exchange asset class this

13 The formulas for calculating the asset class add-ons represent stylized Effective EPE calculations under the assumption that all trades in the asset class have zero current mark-to-market value (i.e. they are at-the-money).

Page Number 27 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 is simply the notional value of the foreign currency leg of the derivative contract, converted to the Saudi Riyal (SAR). For derivatives in the equity and commodity asset classes, it is simply the current price of the relevant share or unit of commodity multiplied by the number of shares /units that the derivative references. For derivatives in the interest rate and credit asset classes, the notional amount is adjusted by a measure of the duration of the instrument to account for the fact that the value of instruments with longer durations are more sensitive to movements in underlying risk factors (i.e. interest rates and credit spreads). (b)The maturity factor (MF). The maturity factor is a parameter that takes account of the time period over which the potential future exposure is calculated. The calculation of the maturity factor varies depending on whether the netting set is margined or unmargined. (c) The supervisory delta (δ). The supervisory delta is used to ensure that the effective notional take into account the direction of the trade, i.e. whether the trade is long or short, by having a positive or negative sign. It is also takes into account whether the trade has a non-linear relationship with the underlying risk factor (which is the case for options and collateralized debt obligation tranches). (7)A supervisory factor (SF) is identified for each individual trade in the netting set. The supervisory factor is the supervisory specified change in value of the underlying risk factor on which the potential future exposure calculation is based, which has been calibrated to take into account the volatility of underlying risk factors. (8)The trades within each asset class are separated into supervisory specified hedging sets. The purpose of the hedging sets is to group together trades within the netting set where long and short positions should be permitted to offset each other in the calculation of potential future exposure. (9)Aggregation formulas are applied to aggregate the effective notionals and supervisory factors across all trades within each hedging set and finally at the asset-class level to give the asset class level add-on. The method of aggregation varies between asset classes and for credit, equity and commodity derivatives it also involves the application of supervisory correlation parameters to capture diversification of trades and basis risk. Time period parameters: 𝑀𝑖 , 𝐸𝑖 , 𝑆𝑖 𝑎𝑛𝑑 𝑇𝑖

Page Number 28 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.33. There are four time period parameters that are used in the SA-CCR (all expressed in years): (1)For all asset classes, the maturity 𝑀𝑖 of a contract is the time period (starting today) until the latest day when the contract may still be active. This time period appears in the maturity factor defined in 6.51 to 6.56 that scales down the adjusted notionals for unmargined trades for all asset classes. If a derivative contract has another derivative contract as its underlying (for example, a swaption) and may be physically exercised into the underlying contract (i.e. a bank would assume a position in the underlying contract in the event of exercise), then maturity of the contract is the time period until the final settlement date of the underlying derivative contract. (2)For interest rate and credit derivatives, 𝑆𝑖 is the period of time (starting today) until start of the time period referenced by an interest rate or credit contract. If the derivative references the value of another interest rate or credit instrument (e.g. swaption or bond option), the time period must be determined on the basis of the underlying instrument. 𝑆𝑖 appears in the definition of supervisory duration defined in 6.36. (3)For interest rate and credit derivatives, 𝐸𝑖 is the period of time (starting today) until the end of the time period referenced by an interest rate or credit contract. If the derivative references the value of another interest rate or credit instrument (e.g. swaption or bond option), the time period must be determined on the basis of the underlying instrument. 𝐸𝑖 appears in the definition of supervisory duration defined in 6.36. In addition, 𝐸𝑖 is used for allocating derivatives in the interest rate asset class to maturity buckets, which are used in the calculation of the asset class add-on (see 6.60(3)). (4)For options in all asset classes, 𝑇𝑖 is the time period (starting today) until the latest contractual exercise date as referenced by the contract. This period shall be used for the determination of the option’s supervisory delta in 6.40 to 6.43. 6.34. Table 1 includes example transactions and provides each transaction’s related maturity 𝑀𝑖 , start date 𝑆𝑖 and end date 𝐸𝑖 . In addition, the option delta in 6.40 to 6.43 depends on the latest contractual exercise date 𝑇𝑖 (not separately shown in the table). Table 1: Example transactions and related (maturity 𝑀𝑖 , start date 𝑆𝑖 and end date 𝐸𝑖 )

Page Number 29 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Instrument 𝑴𝒊 𝑺𝒊 𝑬𝒊 Interest rate or credit default swap maturing in 10 years 10 years 0 10 years 10-year interest rate swap, forward starting in 5 years 15 years 5 years 15 years Forward rate agreement for time period starting in 6 months and ending in 12 months 1 year 0.5 year 1 years Cash-settled European swaption referencing 5- year interest rate swap with exercise date in 6 months 0.5 year 0.5 year 5.5 year Physically-settled European swaption referencing 5-year interest rate swap with exercise date in 6 months 5.5 years 0.5 year 5.5 years 10-year Bermudan swaption with annual exercise dates 10 years 1 year 10 years Interest rate cap or floor specified for semi￾annual interest rate with maturity 5 years 5 years 0 5 years Option on a bond maturing in 5 years with the latest exercise date in 1 year 1 year 1 year 5 years 3-month Eurodollar futures that matures in 1 year 1 year 1 year 1.25 years Futures on 20-year treasury bond that matures in 2 years 2 years 2 years 22 years 6-month option on 2-year futures on 20-year treasury bond 2 years 2 years 22 years Trade-level adjusted notional (for trade i): 𝑑𝑖 6.35. The adjusted notionals are defined at the trade level and take into account both the size of a position and its maturity dependency, if any. 6.36. For interest rate and credit derivatives, the trade-level adjusted notional is the product of the trade notional amount, converted to the Saudi Riyal (SAR), and the supervisory duration SD, which is given by the formula below (i.e.𝑑𝑖 =

Page Number 30 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑛𝑜𝑡𝑖𝑜𝑛𝑎𝑙 ∗ 𝑆𝐷𝑖 ). The calculated value of 𝑆𝐷𝑖 is floored at ten business days.14 If the start date has occurred (e.g. an ongoing interest rate swap), 𝑆𝑖 must be set to zero. 𝑆𝐷𝑖 = exp(−0.05 ∗ 𝑆𝑖 ) − exp(−0.05 ∗ 𝐸𝑖) 0.05 6.37. For foreign exchange derivatives, the adjusted notional is defined as the notional of the foreign currency leg of the contract, converted to the Saudi Riyal (SAR). If both legs of a foreign exchange derivative are denominated in currencies other than the Saudi Riyal (SAR), the notional amount of each leg is converted to the Saudi Riyal (SAR) and the leg with the larger Saudi Riyal (SAR) value is the adjusted notional amount. 6.38. For equity and commodity derivatives, the adjusted notional is defined as the product of the current price of one unit of the stock or commodity (e.g. a share of equity or barrel of oil) and the number of units referenced by the trade. 6.39. In many cases the trade notional amount is stated clearly and fixed until maturity. When this is not the case, banks must use the following rules to determine the trade notional amount. (1)Where the notional is a formula of market values, the bank must enter the current market values to determine the trade notional amount. (2)For all interest rate and credit derivatives with variable notional amounts specified in the contract (such as amortizing and accreting swaps), banks must use the average notional over the remaining life of the derivative as the trade notional amount. The average should be calculated as “time weighted”. The averaging described in this paragraph does not cover transactions where the notional varies due to price changes (typically, FX, equity and commodity derivatives). (3)Leveraged swaps must be converted to the notional of the equivalent unleveraged swap, that is, where all rates in a swap are multiplied by a factor, the stated notional must be multiplied by the factor on the interest rates to determine the trade notional amount.

14 Note there is a distinction between the time period of the underlying transaction and the remaining maturity of the derivative contract. For example, a European interest rate swaption with expiry of 1 year and the term of the underlying swap of 5 years has S = 1 year and E = 6 i years.

Page Number 31 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (4)For a derivative contract with multiple exchanges of principal, the notional is multiplied by the number of exchanges of principal in the derivative contract to determine the trade notional amount. (5)For a derivative contract that is structured such that on specified dates any outstanding exposure is settled and the terms are reset so that the fair value of the contract is zero, the remaining maturity equals the time until the next reset date. Supervisory delta adjustment 6.40. The supervisory delta adjustment (𝛿𝑖 ) parameters are also defined at the trade i level and are applied to the adjusted notional amounts to reflect the direction of the transaction and its non-linearity.15 6.41. The delta adjustments for all instruments that are not options and are not collateralized debt obligation (CDO) tranches are as set out in the table below:16 𝛿𝑖 Long in the primary risk factor Short in the primary risk factor Instruments that are not options or CDO tranches +1 -1 6.42. The delta adjustments for options are set out in the table below, where: (1)The following are parameters that banks must determine appropriately: (a) 𝑃𝑖 : Underlying price (spot, forward, average, etc.) (b)𝐾𝑖 : Strike price (c) 𝑇𝑖 : Latest contractual exercise date of the option (2)The supervisory volatility 𝜎𝑖 an option is specified on the basis of supervisory factor applicable to the trade (see Table 2 in 6.75). (3)The symbol Φ represents the standard normal cumulative distribution function. 𝛿𝑖 Bought Sold

15 Whenever appropriate, the forward (rather than spot) value of the underlying in the supervisory delta adjustments formula should be used in order to account for the risk-free rate as well as for possible cash flows prior to the option expiry (such as dividends). 16 “Long in the primary risk factor” means that the market value of the instrument increases when the value of the primary risk factor increases. “Short in the primary risk factor” means that the market value of the instrument decreases when the value of the primary risk factor increases.

Page Number 32 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Call Option +Φ ( 𝐼𝑛(𝑃𝑖/𝐾𝑖 ) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) −Φ ( 𝐼𝑛(𝑃𝑖/𝐾𝑖 ) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) Put Option −Φ ( 𝐼𝑛(𝑃𝑖/𝐾𝑖 ) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) +Φ ( 𝐼𝑛(𝑃𝑖/𝐾𝑖 ) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) Delta (𝛿) Bought Sold Call Option +Φ ( 𝐼𝑛((𝑃𝑖 + 𝜆𝑖 )/(𝐾𝑖 + 𝜆𝑖 )) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) −Φ ( 𝐼𝑛((𝑃𝑖 + 𝜆𝑖 )/(𝐾𝑖 + 𝜆𝑖 )) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) Put Option −𝛷 (− 𝐼𝑛((𝑃𝑖 + 𝜆𝑖 )/(𝐾𝑖 + 𝜆𝑖 )) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) +Φ (− 𝐼𝑛((𝑃𝑖 + 𝜆𝑖 )/(𝐾𝑖 + 𝜆𝑖 )) + 0.5 ∗ 𝜎𝑖 2 ∗ 𝑇𝑖 𝜎𝑖 ∗ √𝑇𝑖 ) 6.43. The delta adjustments for CDO tranches17 are set out in the table below, where the following are parameters that banks must determine appropriately: (1)𝐴𝑖 : Attachment point of the CDO tranche (2)𝐷𝑖 : Detachment point of the CDO tranche 𝛿𝑖 Purchased (long protection) Sold (Short protection) CDO tranche s + 15 (1 + 14 ∗ 𝐴𝑖 ) ∗ (1 + 14 ∗ 𝐷𝑖 ) − 15 (1 + 14 ∗ 𝐴𝑖 ) ∗ (1 + 14 ∗ 𝐷𝑖 ) Effective notional for options 6.44. For single-payment options the effective notional (i.e. 𝐷 = 𝑑 ∗ 𝑀𝐹 ∗ 𝛿) is calculated using the following specifications:

17 First-to-default, second-to-default and subsequent-to-default credit derivative transactions should be treated as CDO tranches under SACCR. For an nth-to-default transaction on a pool of m reference names, banks must use an attachment point of A=(n–1)/m and a detachment point of D=n/m in order to calculate the supervisory delta formula set out 6.43.

Page Number 33 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)For European, Asian, American and Bermudan put and call options, the supervisory delta must be calculated using the simplified Black-Scholes formula referenced in 6.42. In the case of Asian options, the underlying price must be set equal to the current value of the average used in the payoff. In the case of American and Bermudan options, the latest allowed exercise date must be used as the exercise date 𝑇𝑖 in the formula. (2)For Bermudan swaptions, the start date 𝑆𝑖 must be equal to the earliest allowed exercise date, while the end date 𝐸𝑖 must be equal to the end date of the underlying swap. (3)For digital options, the payoff of each digital option (bought or sold) with strike 𝐾𝑖 must be approximated via the “collar” combination of bought and sold European options of the same type (call or put), with the strikes set equal to 0.95∙𝑘𝑖 and 1.05∙𝑘𝑖 . The size of the position in the collar components must be such that the digital payoff is reproduced exactly outside the region between the two strikes. The effective notional is then computed for the bought and sold European components of the collar separately, using the option formulae for the supervisory delta referenced in 6.42 (the exercise date 𝑇𝑖and the current value of the underlying 𝑃𝑖 of the digital option must be used). The absolute value of the digital-option effective notional must be capped by the ratio of the digital payoff to the relevant supervisory factor. (4)If a trade’s payoff can be represented as a combination of European option payoffs (e.g. collar, butterfly/calendar spread, straddle, strangle), each European option component must be treated as a separate trade. 6.45. For the purposes of effective notional calculations, multiple-payment options may be represented as a combination of single-payment options. In particular, interest rate caps/floors may be represented as the portfolio of individual caplets /floorlets, each of which is a European option on the floating interest rate over a specific coupon period. For each caplet/floorlet, 𝑆𝑖and 𝑇𝑖are the time periods starting from the current date to the start of the coupon period, while 𝐸𝑖 is the time period starting from the current date to the end of the coupon period. 6.46. In the case of options (e.g. interest rate caps/floors that may be represented as the portfolio of individual caplets/floorlets), banks may decompose those products in a manner consistent with 6.45. Banks may not decompose linear products (e.g. ordinary interest rate swaps). Supervisory factors: 𝑆𝐹𝑖

Page Number 34 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.47. Supervisory factors (𝑆𝐹𝑖 ) are used, together with aggregation formulas, to convert effective notional amounts into the add-on for each hedging set.18 The way in which supervisory factors are used within the aggregation formulas varies between asset classes. The supervisory factors are listed in Table 2 under 6.75. Hedging sets 6.48. The hedging sets in the different asset classes are defined as follows, except for those described in 6.49 and 6.50: (1)Interest rate derivatives consist of a separate hedging set for each currency. (2)FX derivatives consist of a separate hedging set for each currency pair. (3)Credit derivatives consist of a single hedging set. (4)Equity derivatives consist of a single hedging set. (5)Commodity derivatives consist of four hedging sets defined for broad categories of commodity derivatives: energy, metals, agricultural and other commodities. 6.49. Derivatives that reference the basis between two risk factors and are denominated in a single currency19 (basis transactions) must be treated within separate hedging sets within the corresponding asset class. There is a separate hedging set20 for each pair of risk factors (i.e. for each specific basis). Examples of specific bases include three-month Libor versus six-month Libor, three-month Libor versus three-month T-Bill, one-month Libor versus overnight indexed swap rate, Brent Crude oil versus Henry Hub gas. For hedging sets consisting of basis transactions, the supervisory factor applicable to a given asset class must be multiplied by one￾half. 6.50. Derivatives that reference the volatility of a risk factor (volatility transactions) must be treated within separate hedging sets within the corresponding asset class. Volatility hedging sets must follow the same hedging set construction outlined in 6.48 (for example, all equity volatility transactions form a single hedging set). Examples of volatility transactions include variance and volatility swaps, options on realized or implied volatility. For hedging sets consisting of volatility

18 Each factor has been calibrated to result in an add-on that reflects the Effective EPE of a single at￾the-money linear trade of unit notional and one-year maturity. This includes the estimate of realized volatilities assumed by supervisors for each underlying asset class. 19 Derivatives with two floating legs that are denominated in different currencies (such as cross￾currency swaps) are not subject to this treatment; rather, they should be treated as non-basis foreign exchange contracts. 20 Within this hedging set, long and short positions are determined with respect to the basis.

Page Number 35 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 transactions, the supervisory factor applicable to a given asset class must be multiplied by a factor of five.21 Maturity factors 6.51. The minimum time risk horizon for an unmargined transaction is the lesser of one year and the remaining maturity of the derivative contract, floored at ten business days.22 Therefore, the calculation of the effective notional for an unmargined transaction includes the following maturity factor, where 𝑀𝑖 is the remaining maturity of transaction i, floored at 10 business days: 𝑀𝐹𝑖 (𝑢𝑛𝑚𝑎𝑟𝑔𝑖𝑛𝑒𝑑) = √ min{𝑀𝑖 ; 1𝑦𝑒𝑎𝑟} 1 𝑦𝑒𝑎𝑟 6.52. The maturity parameter (𝑀𝑖 ) is expressed in years but is subject to a floor of 10 business days. Banks should use standard market convention to convert business days into years, and vice versa. For example, 250 business days in a year, which results in a floor of 10/250 years for𝑀𝑖 . 6.53. For margined transactions, the maturity factor is calculated using the margin period of risk (MPOR), subject to specified floors. That is, banks must first estimate the margin period of risk (as defined in 4.17) for each of their netting sets. They must then use the higher of their estimated margin period of risk and the relevant floor in the calculation of the maturity factor (6.55). The floors for the margin period of risk are as follows: (1)Ten business days for non-centrally-cleared transactions subject to daily margin agreements. (2)The sum of nine business days plus the re-margining period for non-centrally cleared transactions that are not subject daily margin agreements. (3)The relevant floors for centrally cleared transactions are prescribed in the capital requirements for bank exposures to central counterparties (see in Chapter 8 of this framework).

21 For equity and commodity volatility transactions, the underlying volatility or variance referenced by the transaction should replace the unit price and contractual notional should replace the number of units. 22 For example, remaining maturity for a one-month option on a 10-year Treasury bond is the one￾month to expiration date of the derivative contract. However, the end date of the transaction is the 10- year remaining maturity on the Treasury bond.

Page Number 36 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.54. The following are exceptions to the floors on the minimum margin period of risk set out in 6.53 above: (1)For netting sets consisting of more than 5000 transactions that are not with a central counterparty the floor on the margin period of risk is 20 business days. (2)For netting sets containing one or more trades involving either illiquid collateral, or an OTC derivative that cannot be easily replaced, the floor on the margin period of risk is 20 business days. For these purposes, "Illiquid collateral" and "OTC derivatives that cannot be easily replaced" must be determined in the context of stressed market conditions and will be characterized by the absence of continuously active markets where a counterparty would, within two or fewer days, obtain multiple price quotations that would not move the market or represent a price reflecting a market discount (in the case of collateral) or premium (in the case of an OTC derivative). Examples of situations where trades are deemed illiquid for this purpose include, but are not limited to, trades that are not marked daily and trades that are subject to specific accounting treatment for valuation purposes (e.g. OTC derivatives transactions referencing securities whose fair value is determined by models with inputs that are not observed in the market). (3)If a bank has experienced more than two margin call disputes on a particular netting set over the previous two quarters that have lasted longer than the applicable margin period of risk (before consideration of this provision), then the bank must reflect this history appropriately by doubling the applicable supervisory floor on the margin period of risk for that netting set for the subsequent two quarters. (4)In the case of non-centrally cleared derivatives that are subject to the requirements under Margin requirements, 6.55(3) applies only to variation margin call disputes. 6.55. The calculation of the effective notional for a margined transaction includes the following maturity factor, where 𝑀𝑃𝑂𝑅𝑖 is the margin period of risk appropriate for the margin agreement containing the transaction i (subject to the floors set out in 6.53 and 6.54 above). 𝑀𝐹𝑖 (𝑚𝑎𝑟𝑔𝑖𝑛𝑒𝑑) = 3 2 √ 𝑀𝑃𝑂𝑅𝑖 1𝑦𝑒𝑎𝑟 6.56. The margin period of risk (𝑀𝑃𝑂𝑅𝑖 ) is often expressed in days, but the calculation of the maturity factor for margined netting sets references 1 year in the

Page Number 37 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 denominator. Banks should use standard market convention to convert business days into years, and vice versa. For example, 1 year can be converted into 250 business days in the denominator of the MF formula if MPOR is expressed in business days. Alternatively, the MPOR expressed in business days can be converted into years by dividing it by 250. Supervisory correlation parameters 6.57. The supervisory correlation parameters (𝜌𝑖 ) only apply to the PFE add-on calculation for equity, credit and commodity derivatives, and are set out in Table 2 under 6.75. For these asset classes, the supervisory correlation parameters are derived from a single-factor model and specify the weight between systematic and idiosyncratic components. This weight determines the degree of offset between individual trades, recognizing that imperfect hedges provide some, but not perfect, offset. Supervisory correlation parameters do not apply to interest rate and foreign exchange derivatives. Asset class level add-ons 6.58. As set out in 6.27, the aggregate add-on for a netting set (𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒) is calculated as the sum of the add-ons calculated for each asset class within the netting set. The sections that follow set out the calculation of the add-on for each asset class. Add-on for interest rate derivatives 6.59. The calculation of the add-on for the interest rate derivative asset class captures the risk of interest rate derivatives of different maturities being imperfectly correlated. It does this by allocating trades to maturity buckets, in which full offsetting of long and short positions is permitted, and by using an aggregation formula that only permits limited offsetting between maturity buckets. This allocation of derivatives to maturity buckets and the process of aggregation (steps 3 to 5 below) are only used in the interest rate derivative asset class. 6.60. The add-on for the interest rate derivative asset class (𝐴𝑑𝑑𝑂𝑛𝐼𝑅) within a netting set is calculated using the following steps: (1)Step 1: Calculate the effective notional for each trade in the netting set that is in the interest rate derivative asset class. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d);

Page Number 38 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (ii) the supervisory delta adjustment of the trade (𝛿); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖 is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 , where each term is as defined in 6.35 to 6.56. (2)Step 2: Allocate the trades in the interest rate derivative [including inflation derivatives] asset class to hedging sets. In the interest rate derivative asset class the hedging sets consist of all the derivatives that reference the same currency. (3)Step 3: Within each hedging set allocate each of the trades to the following three maturity buckets: less than one year (bucket 1), between one and five years (bucket 2) and more than five years (bucket 3). (4)Step 4: Calculate the effective notional of each maturity bucket by adding together all the trade level effective notionals calculated in step 1 of the trades within the maturity bucket. Let 𝐷 𝐵1 , 𝐷 𝐵1 and 𝐷 𝐵1 be the effective notionals of buckets 1, 2 and 3 respectively. (5)Step 5: Calculate the effective notional of the hedging set (𝐸𝑁𝐻𝑆) by using either of the two following aggregation formulas (the latter is to be used if the bank chooses not to recognize offsets between long and short positions across maturity buckets): 𝑂𝑓𝑓𝑠𝑒𝑡 𝑓𝑜𝑟𝑚𝑢𝑙𝑎: 𝐸𝑁𝐻𝑆 = [(𝐷 𝐵1 ) 2 + (𝐷 𝐵2 ) 2 + (𝐷 𝐵3 ) 2 + 1.4 ∗ 𝐷 𝐵1 ∗ 𝐷 𝐵2 + 1.4 ∗ 𝐷 𝐵2 ∗ 𝐷 𝐵3 + 0.6 ∗ 𝐷 𝐵1 ∗ 𝐷 𝐵3 ] 1 2 𝑁𝑜 𝑜𝑓𝑓𝑠𝑒𝑡 𝑓𝑜𝑟𝑚𝑢𝑙𝑎: 𝐸𝑁𝐻𝑆 = |𝐷 𝐵1 | + |𝐷 𝐵2 | + |𝐷 𝐵3 | (6)Step 6: Calculate the hedging set level add-on (𝐴𝑑𝑑𝑂𝑛𝐻𝑆) by multiplying the effective notional of the hedging set (𝐸𝑁𝐻𝑆) by the prescribed supervisory factor (𝑆𝐹𝐻𝑆). The prescribed supervisory factor in the interest rate asset class is set at 0.5%, which means that 𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = 𝐸𝑁𝐻𝑆 ∗ 0.005. (7)Step 7: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐼𝑅 ) by adding together all of the hedging set level add-ons calculated in step 6: 𝐴𝑑𝑑𝑂𝑛𝐼𝑅 = ∑𝐴𝑑𝑑𝑂𝑛𝐻𝑆 𝐻𝑆 Add-on for foreign exchange derivatives 6.61. The steps to calculate the add-on for the foreign exchange derivative asset class are similar to the steps for the interest rate derivative asset class, except that there is no allocation of trades to maturity buckets (which means that there is full

Page Number 39 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 offsetting of long and short positions within the hedging sets of the foreign exchange derivative asset class). 6.62. The add-on for the foreign exchange derivative asset class (𝐴𝑑𝑑𝑂𝑛𝐹𝑋) within a netting set is calculated using the following steps: (1)Step 1: Calculate the effective notional for each trade in the netting set that is in the foreign exchange derivative asset class. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (𝛿); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖 is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 , where each term is as defined in 6.35 to 6.56. (2)Step 2: Allocate the trades in the foreign exchange derivative asset class to hedging sets. In the foreign exchange derivative asset class the hedging sets consist of all the derivatives that reference the same currency pair. (3)Step 3: Calculate the effective notional of each hedging set (𝐸𝑁𝐻𝑆) by adding together the trade level effective notionals calculated in step 1. (4)Step 4: Calculate the hedging set level add-on (𝐴𝑑𝑑𝑂𝑛𝐻𝑆) by multiplying the HS absolute value of the effective notional of the hedging set (𝐸𝑁𝐻𝑆 ) by the HS prescribed supervisory factor (𝑆𝐹𝐻𝑆). The prescribed supervisory factor in the HS foreign exchange derivative asset class is set at 4%, which means that 𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = |𝐸𝑁𝐻𝑆| ∗ 0.04. (5)Step 5: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐹𝑋) by adding together all of the hedging set level add-ons calculated in step 5: 𝐴𝑑𝑑𝑂𝑛𝐹𝑋 = ∑𝐴𝑑𝑑𝑂𝑛𝐻𝑠 𝐻𝑆 Add-on for credit derivatives 6.63. The calculation of the add-on for the credit derivative asset class only gives full recognition of the offsetting of long and short positions for derivatives that reference the same entity (e.g. the same corporate issuer of bonds). Partial offsetting is recognized between derivatives that reference different entities in step 4 below. The formula used in step 4 is explained further in 6.65 to 6.67. 6.64. The add-on for the credit derivative asset class (𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑒𝑑𝑖𝑡) within a netting set is calculated using the following steps:

Page Number 40 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)Step 1: Calculate the effective notional for each trade in the netting set that is in the credit derivative asset class. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (𝛿); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖 is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 , where each term is as defined in 6.35 to 6.56. (2)Step 2: Calculate the combined effective notional for all derivatives that reference the same entity. Each separate credit index that is referenced by derivatives in the credit derivative asset class should be treated as a separate entity. The combined effective notional of the entity (𝐸𝑁𝑒𝑛𝑡𝑖𝑡𝑦) is calculated by adding together the trade level effective notionals calculated in step 1 that reference that entity. (3)Step 3: Calculate the add-on for each entity (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) by multiplying the entity combined effective notional for that entity calculated in step 2 by the supervisory factor that is specified for that entity (𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦). The supervisory entity factors vary according to the credit rating of the entity in the case of single name derivatives, and whether the index is considered investment grade or non-investment grade in the case of derivatives that reference an index. The supervisory factors are set out in Table 2 in 6.75. (4)Step 4: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑒𝑑𝑖𝑡) by using the formula that follows. In the formula the summations are across all entities referenced by the derivatives, 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦is the add-on amount calculated entity in step 3 for each entity referenced by the derivatives and ρ is the entity supervisory prescribed correlation factor corresponding to the entity. As set out in Table 2 in 6.75, the correlation factor is 50% for single entities and 80% for indices. 𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑒𝑑𝑖𝑡 = [( ∑ 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 𝑒𝑛𝑡𝑖𝑡𝑦 ∗ 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2

• ∑ (1 − (𝜌𝑒𝑛𝑡𝑖𝑡𝑦) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2 𝑒𝑛𝑡𝑖𝑡𝑦 ] 1 2 6.65. The formula to recognize partial offsetting in 6.64(4) above, is a single-factor model, which divides the risk of the credit derivative asset class into a systematic

Page Number 41 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 component and an idiosyncratic component. The entity-level add-ons are allowed to offset each other fully in the systematic component; whereas, there is no offsetting benefit in the idiosyncratic component. These two components are weighted by a correlation factor which determines the degree of offsetting / hedging benefit within the credit derivatives asset class. The higher the correlation factor, the higher the importance of the systematic component, hence the higher the degree of offsetting benefits. 6.66. It should be noted that a higher or lower correlation does not necessarily mean a higher or lower capital requirement. For portfolios consisting of long and short credit positions, a high correlation factor would reduce the charge. For portfolios consisting exclusively of long positions (or short positions), a higher correlation factor would increase the charge. If most of the risk consists of systematic risk, then individual reference entities would be highly correlated and long and short positions should offset each other. If, however, most of the risk is idiosyncratic to a reference entity, then individual long and short positions would not be effective hedges for each other. 6.67. The use of a single hedging set for credit derivatives implies that credit derivatives from different industries and regions are equally able to offset the systematic component of an exposure, although they would not be able to offset the idiosyncratic portion. This approach recognizes that meaningful distinctions between industries and/or regions are complex and difficult to analyze for global conglomerates. Add-on for equity derivatives 6.68. The calculation of the add-on for the equity derivative asset class is very similar to the calculation of the add-on for the credit derivative asset class. It only gives full recognition of the offsetting of long and short positions for derivatives that reference the same entity (e.g. the same corporate issuer of shares). Partial offsetting is recognized between derivatives that reference different entities in step 4 below. 6.69. The add-on for the equity derivative asset class (𝐴𝑑𝑑𝑂𝑛𝐸𝑞𝑢𝑖𝑡𝑦) within a netting set is calculated using the following steps:

Page Number 42 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)Step 1: Calculate the effective notional for each trade in the netting set that is in the equity derivative asset class. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (𝛿); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖 is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 , where each term is as defined in 6.35 to 6.56. (2)Step 2: Calculate the combined effective notional for all derivatives that reference the same entity. Each separate equity index that is referenced by derivatives in the equity derivative asset class should be treated as a separate entity. The combined effective notional of the entity (𝐸𝑁𝑒𝑛𝑡𝑖𝑡𝑦 ) is calculated entity by adding together the trade level effective notionals calculated in step 1 that reference that entity. (3)Step 3: Calculate the add-on for each entity (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) by multiplying the entity combined effective notional for that entity calculated in step 2 by the supervisory factor that is specified for that entity (𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦). The supervisory entity factors are set out in Table 2 in 6.75 and vary according to whether the entity is a single name (𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦 = 32%) or an index (𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦 = 20%). (4)Step 4: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐸𝑞𝑢𝑖𝑡𝑦) by using the formula that follows. In the formula the summations are across all entities referenced by the derivatives, 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 is the add-on amount calculated entity in step 3 for each entity referenced by the derivatives and 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 is the entity supervisory prescribed correlation factor corresponding to the entity. As set out in Table 2 in 6.75, the correlation factor is 50% for single entities and 80% for indices. 𝐴𝑑𝑑𝑂𝑛𝐸𝑞𝑢𝑖𝑡𝑦 = [( ∑ 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 ∗ 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 𝑒𝑛𝑡𝑖𝑡𝑦 ) 2

• ∑ (1 − (𝜌𝑒𝑛𝑡𝑖𝑡𝑦) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2 𝑒𝑛𝑡𝑖𝑡𝑦 ] 1 2

Page Number 43 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.70. The supervisory factors for equity derivatives were calibrated based on estimates of the market volatility of equity indices, with the application of a conservative beta factor23 to translate this estimate into an estimate of individual volatilities. 6.71. Banks are not permitted to make any modelling assumptions in the calculation of the PFE add-ons, including estimating individual volatilities or taking publicly available estimates of beta. This is a pragmatic approach to ensure a consistent implementation across jurisdictions but also to keep the add-on calculation relatively simple and prudent. Therefore, bank must only use the two values of supervisory factors that are defined for equity derivatives, one for single entities and one for indices. Add-on for commodity derivatives 6.72. The calculation of the add-on for the commodity derivative asset class is similar to the calculation of the add-on for the credit and equity derivative asset classes. It recognizes the full offsetting of long and short positions for derivatives that reference the same type of underlying commodity. It also allows partial offsetting between derivatives that reference different types of commodity, however, this partial offsetting is only permitted within each of the four hedging sets of the commodity derivative asset class, where the different commodity types are more likely to demonstrate some stable, meaningful joint dynamics. Offsetting between hedging sets is not recognized (e.g., a forward contract on crude oil cannot hedge a forward contract on corn). 6.73. The add-on for the commodity derivative asset class (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦) within a netting set is calculated using the following steps: (1)Step 1: Calculate the effective notional for each trade in the netting set that is in the commodity derivative asset class. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (𝛿); and

23 The beta of an individual equity measures the volatility of the stock relative to a broad market index. A value of beta greater than one means the individual equity is more volatile than the index. The greater the beta is, the more volatile the stock. The beta is calculated by running a linear regression of the stock on the broad index.

Page Number 44 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖 is calculated as 𝐷𝑖 − 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 , where each term is as defined in 6.35 to 6.56. (2)Step 2: Allocate the trades in commodity derivative asset class to hedging sets. In the commodity derivative asset class there are four hedging sets consisting of derivatives that reference: energy, metals, agriculture and other commodities. (3)Step 3: Calculate the combined effective notional for all derivatives with each hedging set that reference the same commodity type (e.g. all derivative that reference copper within the metals hedging set). The combined effective notional of the commodity type (𝐸𝑁𝐶𝑜𝑚𝑇𝑦𝑜𝑒) is calculated by adding ComType together the trade level effective notionals calculated in step 1 that reference that commodity type. (4)Step 4: Calculate the add-on for each commodity type (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒) within each hedging set by multiplying the combined effective notional for that commodity calculated in step 3 by the supervisory factor that is specified for that commodity type (𝑆𝐹𝐶𝑜𝑚𝑇𝑦𝑝𝑒). The supervisory factors are ComType set out in Table 2 in 6.75 and are set at 40% for electricity derivatives and 18% for derivatives that reference all other types of commodities. (5)Step 5: Calculate the add-on for each of the four commodity hedging sets (𝐴𝑑𝑑𝑂𝑛𝐻𝑆) by using the formula that follows. In the formula the summations are across all commodity types within the hedging set, 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒 is the add-on amount ComType calculated in step 4 for each commodity type and 𝜌𝐶𝑜𝑚𝑇𝑦𝑜𝑒 is the supervisory ComType prescribed correlation factor corresponding to the commodity type. As set out in Table 2 in 6.75, the correlation factor is set at 40% for all commodity types. 𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = [( ∑ 𝜌𝐶𝑜𝑚𝑇𝑦𝑝𝑒 𝐶𝑜𝑚𝑇𝑦𝑝𝑒 ∗ 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒) 2

• ∑ (1 − (𝜌𝐶𝑜𝑚𝑇𝑦𝑝𝑒) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒) 2 𝐶𝑜𝑚𝑇𝑦𝑝𝑒 ] 1 2 (6)Step 6: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦) by adding together all of the hedging set level add-ons calculated in step 5: 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦 = ∑𝐴𝑑𝑑𝑂𝑛𝐻𝑆 𝐻𝑆

Page Number 45 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 6.74. Regarding the calculation steps above, defining individual commodity types is operationally difficult. In fact, it is impossible to fully specify all relevant distinctions between commodity types so that all basis risk is captured. For example crude oil could be a commodity type within the energy hedging set, but in certain cases this definition could omit a substantial basis risk between different types of crude oil (West Texas Intermediate, Brent, Saudi Light, etc.) Also, the four commodity type hedging sets have been defined without regard to characteristics such as location and quality. For example, the energy hedging set contains commodity types such as crude oil, electricity, natural gas and coal. SAMA may require banks to use more refined definitions of commodities when they are significantly exposed to the basis risk of different products within those commodity types. Supervisory specified parameters 6.75. Table 2 includes the supervisory factors, correlations and supervisory option volatility add-ons for each asset class and subclass. Table 2: Summary table of supervisory parameters Asset Class Subclass Supervisory factor Correlation Supervisory option volatility Interest rate 0.50% N/A 50% Foreign exchange 4.0% N/A 15% Credit, Single Name AAA AA A BBB BB B CCC 0.38% 0.38% 0.42% 0.54% 1.06% 1,6% 6.0% 50% 50% 50% 50% 50% 50% 50% 100% 100% 100% 100% 100% 100% 100%

Page Number 46 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Credit, Index IG SG 0.38% 1.06% 80% 80% 80% 80% Equity, Single Name 32% 50% 120% Equity, Index 20% 80% 75% Commodity Electricity Oil/Gas Metals Agricultural Other 40% 18% 18% 18% 18% 40% 40% 40% 40% 40% 150% 70% 70% 70% 70% 6.76. For a hedging set consisting of basis transactions, the supervisory factor applicable to its relevant asset class must be multiplied by one-half. For a hedging set consisting of volatility transactions, the supervisory factor applicable to its relevant asset class must be multiplied by a factor of five. Treatment of multiple margin agreements and multiple netting sets 6.77. If multiple margin agreements apply to a single netting set, the netting set must be divided into sub-netting sets that align with their respective margin agreement. This treatment applies to both RC and PFE components. 6.78. If a single margin agreement applies to several netting sets, special treatment is necessary because it is problematic to allocate the common collateral to individual netting sets. The replacement cost at any given time is determined by the sum of two terms. The first term is equal to the unmargined current exposure of the bank to the counterparty aggregated across all netting sets within the margin agreement reduced by the positive current net collateral (i.e. collateral is subtracted only when the bank is a net holder of collateral). The second term is non-zero only when the bank is a net poster of collateral: it is equal to the current net posted collateral (if there is any) reduced by the unmargined current exposure

Page Number 47 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 of the counterparty to the bank aggregated across all netting sets within the margin agreement. Net collateral available to the bank should include both VM and NICA. Mathematically, RC for the entire margin agreement is calculated as follows, where: (1)where the summation NS 𝜖 MA is across the netting sets covered by the margin agreement (hence the notation) (2)V is the current mark-to-market value of the netting set NS and 𝐶𝑀𝐴 is the cash equivalent value of all currently available collateral under the margin agreement 𝑅𝐶𝑀𝐴 = 𝑚𝑎𝑥 { ∑ 𝑚𝑎𝑥{𝑉𝑁𝑆; 0} − 𝑚𝑎𝑥{𝐶𝑀𝐴; 0}; 0 𝑁𝑆𝜖𝑀𝐴 }

• 𝑚𝑎𝑥 { ∑ 𝑚𝑖𝑛{𝑉𝑁𝑆; 0} − 𝑚𝑖𝑛{𝐶𝑀𝐴; 0}; 0 𝑁𝑆𝜖𝑀𝐴 } 6.79. Where a single margin agreement applies to several netting sets as described in 6.78 above, collateral will be exchanged based on mark-to-market values that are netted across all transactions covered under the margin agreement, irrespective of netting sets. That is, collateral exchanged on a net basis may not be sufficient to cover PFE. In this situation, therefore, the PFE add-on must be calculated according to the unmargined methodology. Netting set-level PFEs are then aggregated using the following formula, where is the 𝑃𝐹𝐸𝑁𝑆 (𝑢𝑛𝑚𝑎𝑟𝑔𝑖𝑛𝑒𝑑) addon for the netting set NS calculated according to the unmargined requirements: 𝑃𝐹𝐸𝑀𝐴 = ∑ 𝑃𝐹𝐸𝑁𝑆 (𝑢𝑛𝑚𝑎𝑟𝑔𝑖𝑛𝑒𝑑) 𝑁𝑆𝜖𝑀𝐴 Treatment of collateral taken outside of netting sets 6.80. Eligible collateral which is taken outside a netting set, but is available to a bank to offset losses due to counterparty default on one netting set only, should be treated as an independent collateral amount associated with the netting set and used within the calculation of replacement cost under 6.12 when the netting set is unmargined and under 6.20 when the netting set is margined. Eligible collateral which is taken outside a netting set, and is available to a bank to offset losses due to counterparty default on more than one netting set, should be treated as collateral taken under a margin agreement applicable to multiple netting sets, in which case the treatment under 6.78 and 6.79 applies. If eligible collateral is available to offset losses on non-derivatives exposures as well as exposures

Page Number 48 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 determined using the SA-CCR, only that portion of the collateral assigned to the derivatives may be used to reduce the derivatives exposure. 7. Internal models method for counterparty credit risk Approval to adopt an internal models method to estimate EAD 7.1. A bank that wishes to adopt an internal models method to measure exposure or exposure at default (EAD) for regulatory capital purposes must seek SAMA approval. The internal models method is available both for banks that adopt the internal ratings-based approach to credit risk and for banks for which the standardized approach to credit risk applies to all of their credit risk exposures. The bank must meet all of the requirements given in 7.6 to 7.60 and must apply the method to all of its exposures that are subject to counterparty credit risk, except for long settlement transactions. 7.2. A bank may also choose to adopt an internal models method to measure counterparty credit risk (CCR) for regulatory capital purposes for its exposures or EAD to only over-the-counter (OTC) derivatives, to only securities financing transactions (SFTs), or to both, subject to the appropriate recognition of netting specified in 7.61 to 7.71. The bank must apply the method to all relevant exposures within that category, except for those that are immaterial in size and risk. During the initial implementation of the internal models method, a bank may use the Standardized Approach for counterparty credit risk for a portion of its business. The bank must submit a plan to SAMA to bring all material exposures for that category of transactions under the internal models method. 7.3. For all OTC derivative transactions and for all long settlement transactions for which a bank has not received approval from SAMA to use the internal models method, the bank must use the standardized approach to counterparty credit risk (SA-CCR, in Chapter 6 of this framework). 7.4. Exposures or EAD arising from long settlement transactions can be determined using either of the methods identified in this framework regardless of the methods chosen for treating OTC derivatives and SFTs. In computing capital requirements for long settlement transactions banks that hold permission to use the internal ratings-based approach may opt to apply the risk weights under this Framework’s

Page Number 49 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 standardized approach for credit risk on a permanent basis and irrespective to the materiality of such positions. 7.5. After adoption of the internal models method, the bank must comply with the above requirements on a permanent basis. Only under exceptional circumstances or for immaterial exposures can a bank revert to the standardized approach for counterparty credit risk for all or part of its exposure. The bank must demonstrate that reversion to a less sophisticated method does not lead to an arbitrage of the regulatory capital rules. Exposure amount or EAD under the internal models method 7.6. CCR exposure or EAD is measured at the level of the netting set as defined in Chapter 4 of this framework and 7.61 to 7.71 of this framework. A qualifying internal model for measuring counterparty credit exposure must specify the forecasting distribution for changes in the market value of the netting set attributable to changes in market variables, such as interest rates, foreign exchange rates, etc. The model then computes the bank’s CCR exposure for the netting set at each future date given the changes in the market variables. For margined counterparties, the model may also capture future collateral movements. Banks may include eligible financial collateral as defined in 9.37 of the Minimum Capital Requirements for Credit Risk and 9.2 of this framework in their forecasting distributions for changes in the market value of the netting set, if the quantitative, qualitative and data requirements for internal models method are met for the collateral. 7.7. Banks that use the internal models method must calculate credit RWA as the higher of two amounts, one based on current parameter estimates and one based on stressed parameter estimates. Specifically, to determine the default risk capital requirement for counterparty credit risk, banks must use the greater of the portfolio-level capital requirement (not including the credit valuation adjustment, or CVA, charge in Chapter 11 of this Framework) based on Effective expected positive exposure (EPE) using current market data and the portfolio level capital requirement based on Effective EPE using a stress calibration.24 The stress calibration should be a single consistent stress calibration for the whole portfolio of counterparties. The greater of Effective EPE using current market data and the

24 Effective expected positive exposure (EPE) using current market data to be compared with Effective EPE using a stress calibration on annual basis during ICAAP

Page Number 50 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 stress calibration should not be applied on a counterparty by counterparty basis, but on a total portfolio level. 7.8. To the extent that a bank recognizes collateral in EAD via current exposure, a bank would not be permitted to recognize the benefits in its estimates of loss given-default (LGD). As a result, the bank would be required to use an LGD of an otherwise similar uncollateralized facility. In other words, the bank would be required to use an LGD that does not include collateral that is already included in EAD. 7.9. Under the internal models method, the bank need not employ a single model. Although the following text describes an internal model as a simulation model, no particular form of model is required. Analytical models are acceptable so long as they are subject to supervisory review, meet all of the requirements set forth in this section and are applied to all material exposures subject to a CCR-related capital requirement as noted above, with the exception of long settlement transactions, which are treated separately, and with the exception of those exposures that are immaterial in size and risk. 7.10. Expected exposure or peak exposure measures should be calculated based on a distribution of exposures that accounts for the possible non-normality of the distribution of exposures, including the existence of leptokurtosis (“fat tails”), where appropriate. 7.11. When using an internal model, exposure amount or EAD is calculated as the product of alpha times Effective EPE, as specified below (except for counterparties that have been identified as having explicit specific wrong way risk – see 7.48) : 𝐸𝐴𝐷 = 𝛼 × 𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝑃𝐸 (Equation 1) 7.12. Effective EPE is computed by estimating expected exposure (𝐸𝐸𝑡 ) as the average t exposure at future date t, where the average is taken across possible future values of relevant market risk factors, such as interest rates, foreign exchange rates, etc. The internal model estimates EE at a series of future dates 𝑡1 , 𝑡2 , 𝑡3 …25

25 In theory, the expectations should be taken with respect to the actual probability distribution of future exposure and not the risk-neutral one. Supervisors recognize that practical considerations may make it more feasible to use the risk-neutral one. As a result, supervisors will not mandate which kind of forecasting distribution to employ.

Page Number 51 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Specifically, “Effective EE” is computed recursively using the following formula, where the current date is denoted as 𝑡0 and Effective 𝐸𝐸𝑡0 equals current exposure: 𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝐸𝑡𝑘 = max(𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝐸𝑡𝑘−1 , 𝐸𝐸𝑡𝑘 (Equation 2) 7.13. In this regard, “Effective EPE” is the average Effective EE during the first year of future exposure. If all contracts in the netting set mature before one year, EPE is the average of expected exposure until all contracts in the netting set mature. Effective EPE is computed as a weighted average of Effective EE, using the following formula where the weights ∆𝑡𝑘 = 𝑡𝑘 − 𝑡𝑘−1 allows for the case when future exposure is calculated at dates that are not equally spaced over time: 𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝑃𝐸 = ∑ 𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝐸𝑡𝑘 × ∆𝑡𝑘 min(1𝑦𝑒𝑎𝑟,𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦) 𝑘=1 (Equation 3) 7.14. Alpha (𝛼) is set equal to 1.4. 7.15. SAMA may require a higher alpha based on a bank’s CCR exposures. Factors that may require a higher alpha include the low granularity of counterparties; particularly high exposures to general wrong-way risk; particularly high correlation of market values across counterparties; and other institution specific characteristics of CCR exposures. Own estimates for alpha 7.16. Banks should seek approval from SAMA to compute internal estimates of alpha subject to a floor of 1.2, where alpha equals the ratio of economic capital from a full simulation of counterparty exposure across counterparties (numerator) and economic capital based on EPE (denominator), assuming they meet certain operating requirements. Eligible banks must meet all the operating requirements for internal estimates of EPE and must demonstrate that their internal estimates of alpha capture in the numerator the material sources of stochastic dependency of distributions of market values of transactions or of portfolios of transactions across counterparties (e.g. the correlation of defaults across counterparties and between market risk and default). 7.17. In the denominator, EPE must be used as if it were a fixed outstanding loan amount.

Page Number 52 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.18. To this end, banks must ensure that the numerator and denominator of alpha are computed in a consistent fashion with respect to the modelling methodology, parameter specifications and portfolio composition. The approach used must be based on the bank’s internal economic capital approach, be well-documented and be subject to independent validation. In addition, banks must review their estimates on at least a quarterly basis, and more frequently when the composition of the portfolio varies over time. Banks must assess the model risk and inform SAMA of any significant variation in estimates of alpha that arises from the possibility for mis-specification in the models used for the numerator, especially where convexity is present. 7.19. Where appropriate, volatilities and correlations of market risk factors used in the joint simulation of market and credit risk should be conditioned on the credit risk factor to reflect potential increases in volatility or correlation in an economic downturn. Internal estimates of alpha should take account of the granularity of exposures. Maturity 7.20. If the original maturity of the longest-dated contract contained in the set is greater than one year, the formula for effective maturity (M) in 12.42 of the Minimum Capital Requirements for Credit Risk is replaced with formula that follows, where 𝑑𝑓𝐾 is the risk-free discount factor for future time period 𝑡𝐾 and the remaining symbols are defined above. Similar to the treatment under corporate exposures, M has a cap of five years.26 𝑀 = ∑ (𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝐸𝑘 × ∆𝑡𝑘 × 𝑑𝑓𝑘) 𝑡𝑘≤1𝑦𝑒𝑎𝑟 𝑘=1 + ∑ (𝐸𝐸𝑘 × ∆𝑡𝑘 × 𝑑𝑓𝑘) 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦 𝑡𝑘>1𝑦𝑒𝑎𝑟 ∑ (𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒𝐸𝐸𝑘 × ∆𝑡𝑘 × 𝑑𝑓𝑘) 𝑡𝑘≤1𝑦𝑒𝑎𝑟 𝑘=1 7.21. For netting sets in which all contracts have an original maturity of less than one year, the formula for effective maturity (M) i in 12.42 of the Minimum Capital Requirements for Credit Risk is unchanged and a floor of one year

26 Conceptually, M equals the effective credit duration of the counterparty exposure. A bank that uses an internal model to calculate a one-sided credit valuation adjustment (CVA) can use the effective credit duration estimated by such a model in place of the above formula with prior approval of SAMA.

Page Number 53 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 applies, with the exception of short-term exposures as described in paragraphs in 12.45 to 12.48 of the Minimum Capital Requirements for Credit Risk. Margin agreements 7.22. If the netting set is subject to a margin agreement and the internal model captures the effects of margining when estimating EE, the model’s EE measure may be used directly in (Equation 2) in 7.12. Such models are noticeably more complicated than models of EPE for unmargined counterparties. 7.23. An EPE model must also include transaction-specific information in order to capture the effects of margining. It must take into account both the current amount of margin and margin that would be passed between counterparties in the future. Such a model must account for the nature of margin agreements (unilateral or bilateral), the frequency of margin calls, the margin period of risk, the thresholds of unmargined exposure the bank is willing to accept, and the minimum transfer amount. Such a model must either model the mark-to-market change in the value of collateral posted or apply this Framework’s rules for collateral. 7.24. For transactions subject to daily re-margining and mark-to-market valuation, a supervisory floor of five business days for netting sets consisting only of repo style transactions, and 10 business days for all other netting sets is imposed on the margin period of risk used for the purpose of modelling EAD with margin agreements. In the following cases a higher supervisory floor is imposed: (1)For all netting sets where the number of trades exceeds 5000 at any point during a quarter, a supervisory floor of 20 business days is imposed for the margin period of risk for the following quarter. (2)For netting sets containing one or more trades involving either illiquid collateral, or an OTC derivative that cannot be easily replaced, a supervisory floor of 20 business days is imposed for the margin period of risk. For these purposes, "Illiquid collateral" and "OTC derivatives that cannot be easily replaced" must be determined in the context of stressed market conditions and will be characterized by the absence of continuously active markets where a counterparty would, within two or fewer days, obtain multiple price quotations that would not move the market or represent a price reflecting a market discount (in the case of collateral) or premium (in the case of an OTC derivative). Examples of situations where trades are deemed illiquid for this purpose include, but are not limited to, trades that are not marked daily and

Page Number 54 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 trades that are subject to specific accounting treatment for valuation purposes (e.g. OTC derivatives or repo-style transactions referencing securities whose fair value is determined by models with inputs that are not observed in the market). (3)In addition, a bank must consider whether trades or securities it holds as collateral are concentrated in a particular counterparty and if that counterparty exited the market precipitously whether the bank would be able to replace its trades. 7.25. If a bank has experienced more than two margin call disputes on a particular netting set over the previous two quarters that have lasted longer than the applicable margin period of risk (before consideration of this provision), then the bank must reflect this history appropriately by using a margin period of risk that is at least double the supervisory floor for that netting set for the subsequent two quarters. 7.26. For re-margining with a periodicity of N-days the margin period of risk should be at least equal to the supervisory floor, F, plus the N days minus one day. That is: 𝑀𝑎𝑟𝑔𝑖𝑛 𝑃𝑒𝑟𝑖𝑜𝑑 𝑜𝑓 𝑅𝑖𝑠𝑘 = 𝐹 + 𝑁 − 1 7.27. Banks using the internal models method must not capture the effect of a reduction of EAD due to any clause in a collateral agreement that requires receipt of collateral when counterparty credit quality deteriorates. Model validation 7.28. The extent to which banks meet the qualitative criteria may influence the level at which SAMA will set the multiplication factor referred to in 7.14 (Alpha) above. Only those banks in full compliance with the qualitative criteria will be eligible for application of the minimum multiplication factor. The qualitative criteria include: (1)The bank must conduct a regular program of backtesting, i.e. an ex-post comparison of the risk measures generated by the model against realized risk measures, as well as comparing hypothetical changes based on static positions with realized measures. “Risk measures” in this context, refers not only to Effective EPE, the risk measure used to derive regulatory capital, but also to the other risk measures used in the calculation of Effective EPE such as the exposure distribution at a series of future dates, the positive exposure

Page Number 55 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 distribution at a series of future dates, the market risk factors used to derive those exposures and the values of the constituent trades of a portfolio. (2)The bank must carry out an initial validation and an on-going periodic review of its IMM model and the risk measures generated by it. The validation and review must be independent of the model developers. (3)The board of directors and senior management should be actively involved in the risk control process and must regard credit and counterparty credit risk control as an essential aspect of the business to which significant resources need to be devoted. In this regard, the daily reports prepared by the independent risk control unit must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the bank’s overall risk exposure. (4)The bank’s internal risk measurement exposure model must be closely integrated into the day-to-day risk management process of the bank. Its output should accordingly be an integral part of the process of planning, monitoring and controlling the bank’s counterparty credit risk profile. (5)The risk measurement system should be used in conjunction with internal trading and exposure limits. In this regard, exposure limits should be related to the bank’s risk measurement model in a manner that is consistent over time and that is well understood by traders, the credit function and senior management. (6)Banks should have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operation of the risk measurement system. The bank’s risk measurement system must be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure counterparty credit risk. (7)An independent review of the risk measurement system should be carried out regularly in the bank’s own internal auditing process. This review should include both the activities of the business trading units and of the independent risk control unit. A review of the overall risk management process should take place at regular intervals (ideally no less than once a year) and should specifically address, at a minimum: (a) The adequacy of the documentation of the risk management system and process; (b)The organization of the risk control unit;

Page Number 56 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (c) The integration of counterparty credit risk measures into daily risk management; (d)The approval process for counterparty credit risk models used in the calculation of counterparty credit risk used by front office and back office personnel; (e) The validation of any significant change in the risk measurement process; (f) The scope of counterparty credit risks captured by the risk measurement model; (g)The integrity of the management information system; (h)The accuracy and completeness of position data; (i) The verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources; (j) The accuracy and appropriateness of volatility and correlation assumptions; (k)The accuracy of valuation and risk transformation calculations; and (l) The verification of the model’s accuracy as described below in 7.29 to 7.33. (8)The on-going validation of counterparty credit risk models, including backtesting, must be reviewed periodically by a level of management with sufficient authority to decide the course of action that will be taken to address weaknesses in the models. 7.29. Banks must document the process for initial and on-going validation of their IMM model to a level of detail that would enable a third party to recreate the analysis. Banks must also document the calculation of the risk measures generated by the models to a level of detail that would allow a third party to recreate the risk measures. This documentation must set out the frequency with which backtesting analysis and any other on-going validation will be conducted, how the validation is conducted with respect to dataflows and portfolios and the analyses that are used. 7.30. Banks must define criteria with which to assess their EPE models and the models that input into the calculation of EPE and have a written policy in place that describes the process by which unacceptable performance will be determined and remedied.

Page Number 57 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.31. Banks must define how representative counterparty portfolios are constructed for the purposes of validating an EPE model and its risk measures. 7.32. When validating EPE models and its risk measures that produce forecast distributions, validation must assess more than a single statistic of the model distribution. 7.33. As part of the initial and on-going validation of an IMM model and its risk measures, the following requirements must be met: (1)A bank must carry out backtesting using historical data on movements in market risk factors prior to SAMA approval. Backtesting must consider a number of distinct prediction time horizons out to at least one year, over a range of various start (initialization) dates and covering a wide range of market conditions. (2)Banks must backtest the performance of their EPE model and the model’s relevant risk measures as well as the market risk factor predictions that support EPE. For collateralized trades, the prediction time horizons considered must include those reflecting typical margin periods of risk applied in collateralized/margined trading, and must include long time horizons of at least 1 year. (3)The pricing models used to calculate counterparty credit risk exposure for a given scenario of future shocks to market risk factors must be tested as part of the initial and on-going model validation process. These pricing models may be different from those used to calculate Market Risk over a short horizon. Pricing models for options must account for the nonlinearity of option value with respect to market risk factors. (4)An EPE model must capture transaction specific information in order to aggregate exposures at the level of the netting set. Banks must verify that transactions are assigned to the appropriate netting set within the model. (5)Static, historical backtesting on representative counterparty portfolios must be a part of the validation process. At regular intervals as directed by SAMA, a bank must conduct such backtesting on a number of representative counterparty portfolios. The representative portfolios must be chosen based on their sensitivity to the material risk factors and correlations to which the bank is exposed. In addition, IMM banks need to conduct backtesting that is designed to test the key assumptions of the EPE model and the relevant risk

Page Number 58 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 measures, e.g. the modelled relationship between tenors of the same risk factor, and the modelled relationships between risk factors. (6)Significant differences between realized exposures and the forecast distribution could indicate a problem with the model or the underlying data that SAMA would require the bank to correct. Under such circumstances, SAMA may require additional capital to be held while the problem is being solved. (7)The performance of EPE models and its risk measures must be subject to good backtesting practice. The backtesting program must be capable of identifying poor performance in an EPE model’s risk measures. (8)Banks must validate their EPE models and all relevant risk measures out to time horizons commensurate with the maturity of trades for which exposure is calculated using an internal models method. (9)The pricing models used to calculate counterparty exposure must be regularly tested against appropriate independent benchmarks as part of the on-going model validation process. (10) The on-going validation of a bank’s EPE model and the relevant risk measures include an assessment of recent performance. (11) The frequency with which the parameters of an EPE model are updated needs to be assessed as part of the validation process. (12) Under the IMM, a measure that is more conservative than the metric used to calculate regulatory EAD for every counterparty, may be used in place of alpha times Effective EPE with the prior approval of SAMA. The degree of relative conservatism will be assessed upon initial SAMA approval and at the regular supervisory reviews of the EPE models. The bank must validate the conservatism regularly. (13) The on-going assessment of model performance needs to cover all counterparties for which the models are used. (14) The validation of IMM models must assess whether or not the bank level and netting set exposure calculations of EPE are appropriate. Operational requirements for EPE models 7.34. In order to be eligible to adopt an internal model for estimating EPE arising from CCR for regulatory capital purposes, a bank must meet the following operational requirements. These include meeting the requirements related to the qualifying standards on CCR Management, a use test, stress testing, identification of wrongway risk, and internal controls.

Page Number 59 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Qualifying standards on CCR Management 7.35. The bank must satisfy SAMA that, in addition to meeting the operational requirements identified in 7.36 to 7.60 below, it adheres to sound practices for CCR management, including those specified in Counterparty credit risks section of the Credit Risk chapter of the Supervisory Review Process in the Basel Framework. Use test 7.36. The distribution of exposures generated by the internal model used to calculate effective EPE must be closely integrated into the day-to-day CCR management process of the bank. For example, the bank could use the peak exposure from the distributions for counterparty credit limits or expected positive exposure for its internal allocation of capital. The internal model’s output must accordingly play an essential role in the credit approval, counterparty credit risk management, internal capital allocations, and corporate governance of banks that seek approval to apply such models for capital adequacy purposes. Models and estimates designed and implemented exclusively to qualify for the internal models method (IMM) are not acceptable. 7.37. A bank must have a credible track record in the use of internal models that generate a distribution of exposures to CCR. Thus, the bank must demonstrate that it has been using an internal model to calculate the distributions of exposures upon which the EPE calculation is based that meets broadly the minimum requirements for at least one year prior to SAMA approval. 7.38. Banks employing the internal models method must have an independent control unit that is responsible for the design and implementation of the bank’s CCR management system, including the initial and on-going validation of the internal model. This unit must control input data integrity and produce and analyze daily reports on the output of the bank’s risk measurement model, including an evaluation of the relationship between measures of CCR risk exposure and credit and trading limits. This unit must be independent from business credit and trading units; it must be adequately staffed; it must report directly to senior management of the bank. The work of this unit should be closely integrated into the day-to￾day credit risk management process of the bank. Its output should accordingly be an integral part of the process of planning, monitoring and controlling the bank’s credit and overall risk profile.

Page Number 60 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.39. Banks applying the internal models method must have a collateral management unit that is responsible for calculating and making margin calls, managing margin call disputes and reporting levels of independent amounts, initial margins and variation margins accurately on a daily basis. This unit must control the integrity of the data used to make margin calls, and ensure that it is consistent and reconciled regularly with all relevant sources of data within the bank. This unit must also track the extent of reuse of collateral (both cash and non-cash) and the rights that the bank gives away to its respective counterparties for the collateral that it posts. These internal reports must indicate the categories of collateral assets that are reused, and the terms of such reuse including instrument, credit quality and maturity. The unit must also track concentration to individual collateral asset classes accepted by the banks. Senior management must allocate sufficient resources to this unit for its systems to have an appropriate level of operational performance, as measured by the timeliness and accuracy of outgoing calls and response time to incoming calls. Senior management must ensure that this unit is adequately staffed to process calls and disputes in a timely manner even under severe market crisis, and to enable the bank to limit its number of large disputes caused by trade volumes. 7.40. The bank’s collateral management unit must produce and maintain appropriate collateral management information that is reported on a regular basis to senior management. Such internal reporting should include information on the type of collateral (both cash and non-cash) received and posted, as well as the size, aging and cause for margin call disputes. This internal reporting should also reflect trends in these figures. 7.41. A bank employing the internal models method must ensure that its cash management policies account simultaneously for the liquidity risks of potential incoming margin calls in the context of exchanges of variation margin or other margin types, such as initial or independent margin, under adverse market shocks, potential incoming calls for the return of excess collateral posted by counterparties, and calls resulting from a potential downgrade of its own public rating. The bank must ensure that the nature and horizon of collateral reuse is consistent with its liquidity needs and does not jeopardize its ability to post or return collateral in a timely manner. 7.42. The internal model used to generate the distribution of exposures must be part of a counterparty risk management framework that includes the identification,

Page Number 61 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 measurement, management, approval and internal reporting of counterparty risk.27 This Framework must include the measurement of usage of credit lines (aggregating counterparty exposures with other credit exposures) and economic capital allocation. In addition to EPE (a measure of future exposure), a bank must measure and manage current exposures. Where appropriate, the bank must measure current exposure gross and net of collateral held. The use test is satisfied if a bank uses other counterparty risk measures, such as peak exposure or potential future exposure (PFE), based on the distribution of exposures generated by the same model to compute EPE. 7.43. A bank is not required to estimate or report EE daily, but to meet the use test it must have the systems capability to estimate EE daily, if necessary, unless it demonstrates to SAMA that its exposures to CCR warrant some less frequent calculation. It must choose a time profile of forecasting horizons that adequately reflects the time structure of future cash flows and maturity of the contracts. For example, a bank may compute EE on a daily basis for the first ten days, once a week out to one month, once a month out to eighteen months, once a quarter out to five years and beyond five years in a manner that is consistent with the materiality and composition of the exposure. 7.44. Exposure must be measured out to the life of all contracts in the netting set (not just to the one year horizon), monitored and controlled. The bank must have procedures in place to identify and control the risks for counterparties where exposure rises beyond the one-year horizon. Moreover, the forecasted increase in exposure must be an input into the bank’s internal economic capital model. Stress testing 7.45. A bank must have in place sound stress testing processes for use in the assessment of capital adequacy. These stress measures must be compared against the measure of EPE and considered by the bank as part of its internal capital adequacy assessment process. Stress testing must also involve identifying possible events or future changes in economic conditions that could have unfavorable effects on a bank’s credit exposures and assessment of the bank’s ability to withstand such changes. Examples of scenarios that could be used are; (i) economic or industry downturns,

27 This section draws heavily on the Counterparty Risk Management Policy Group’s paper, Improving Counterparty Risk Management Practices (June 1999).

Page Number 62 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (ii) market-place events, or (iii) decreased liquidity conditions. 7.46. Banks must have a comprehensive stress testing program for counterparty credit risk. The stress testing program must include the following elements: (1)Banks must ensure complete trade capture and exposure aggregation across all forms of counterparty credit risk (not just OTC derivatives) at the counterparty-specific level in a sufficient time frame to conduct regular stress testing. (2)For all counterparties, banks should produce, at least monthly, exposure stress testing of principal market risk factors (e.g. interest rates, FX, equities, credit spreads, and commodity prices) in order to proactively identify, and when necessary, reduce outsized concentrations to specific directional sensitivities. (3)Banks should apply multifactor stress testing scenarios and assess material non-directional risks (i.e. yield curve exposure, basis risks, etc.) at least quarterly. Multiple-factor stress tests should, at a minimum, aim to address scenarios in which a) severe economic or market events have occurred; b) broad market liquidity has decreased significantly; and c) the market impact of liquidating positions of a large financial intermediary. These stress tests may be part of bank-wide stress testing. (4)Stressed market movements have an impact not only on counterparty exposures, but also on the credit quality of counterparties. At least quarterly, banks should conduct stress testing applying stressed conditions to the joint movement of exposures and counterparty creditworthiness. (5)Exposure stress testing (including single factor, multifactor and material non￾directional risks) and joint stressing of exposure and creditworthiness should be performed at the counterparty-specific, counterparty group (e.g. industry and region), and aggregate bank-wide CCR levels. (6)Stress tests results should be integrated into regular reporting to senior management. The analysis should capture the largest counterparty-level impacts across the portfolio, material concentrations within segments of the portfolio (within the same industry or region), and relevant portfolio and counterparty specific trends. (7)The severity of factor shocks should be consistent with the purpose of the stress test. When evaluating solvency under stress, factor shocks should be severe enough to capture historical extreme market environments and/or extreme but plausible stressed market conditions. The impact of such shocks

Page Number 63 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 on capital resources should be evaluated, as well as the impact on capital requirements and earnings. For the purpose of day-to-day portfolio monitoring, hedging, and management of concentrations, banks should also consider scenarios of lesser severity and higher probability. (8)Banks should consider reverse stress tests to identify extreme, but plausible, scenarios that could result in significant adverse outcomes. (9)Senior management must take a lead role in the integration of stress testing into the risk management framework and risk culture of the bank and ensure that the results are meaningful and proactively used to manage counterparty credit risk. At a minimum, the results of stress testing for significant exposures should be compared to guidelines that express the bank’s risk appetite and elevated for discussion and action when excessive or concentrated risks are present. Wrong-way risk 7.47. Banks must identify exposures that give rise to a greater degree of general wrong￾way risk. Stress testing and scenario analyses must be designed to identify risk factors that are positively correlated with counterparty credit worthiness. Such testing needs to address the possibility of severe shocks occurring when relationships between risk factors have changed. Banks should monitor general wrong way risk by product, by region, by industry, or by other categories that are germane to the business. Reports should be provided to senior management, the appropriate committee of the Board, or the delegated authority of the board on a regular basis that communicate wrong way risks and the steps that are being taken to manage that risk. 7.48. A bank is exposed to “specific wrong-way risk” if future exposure to a specific counterparty is highly correlated with the counterparty’s probability of default. For example, a company writing put options on its own stock creates wrong-way exposures for the buyer that is specific to the counterparty. A bank must have procedures in place to identify, monitor and control cases of specific wrong way risk, beginning at the inception of a trade and continuing through the life of the trade. To calculate the CCR capital requirement, the instruments for which there exists a legal connection between the counterparty and the underlying issuer, and for which specific wrong way risk has been identified, are not considered to be in the same netting set as other transactions with the counterparty. Furthermore, for single-name credit default swaps where there exists a legal connection between

Page Number 64 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 the counterparty and the underlying issuer, and where specific wrong way risk has been identified, EAD in respect of such swap counterparty exposure equals the full expected loss in the remaining fair value of the underlying instruments assuming the underlying issuer is in liquidation. The use of the full expected loss in remaining fair value of the underlying instrument allows the bank to recognize, in respect of such swap, the market value that has been lost already and any expected recoveries. Accordingly LGD for advanced or foundation IRB banks must be set to 100% for such swap transactions.28 For banks using the Standardized Approach, the risk weight to use is that of an unsecured transaction. For equity derivatives, bond options, securities financing transactions etc. referencing a single company where there exists a legal connection between the counterparty and the underlying company, and where specific wrong way risk has been identified, EAD equals the value of the transaction under the assumption of a jump-to-default of the underlying security. Inasmuch this makes re-use of possibly existing (market risk) calculations (for incremental risk charge) that already contain an LGD assumption, the LGD must be set to 100%. Integrity of modelling process 7.49. Other operational requirements focus on the internal controls needed to ensure the integrity of model inputs; specifically, the requirements address the transaction data, historical market data, frequency of calculation, and valuation models used in measuring EPE. 7.50. The internal model must reflect transaction terms and specifications in a timely, complete, and conservative fashion. Such terms include, but are not limited to, contract notional amounts, maturity, reference assets, collateral thresholds, margining arrangements, netting arrangements, etc. The terms and specifications must reside in a secure database that is subject to formal and periodic audit. The process for recognizing netting arrangements must require signoff by legal staff to verify the legal enforceability of netting and be input into the database by an independent unit. The transmission of transaction terms and specifications data to the internal model must also be subject to internal audit and formal reconciliation processes must be in place between the internal model and source

28 Note that the recoveries may also be possible on the underlying instrument beneath such swap. The capital requirements for such underlying exposure are to be calculated without reduction for the swap which introduces wrong way risk. Generally this means that such underlying exposure will receive the risk weight and capital treatment associated with an unsecured transaction (i.e. assuming such underlying exposure is an unsecured credit exposure).

Page Number 65 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 data systems to verify on an ongoing basis that transaction terms and specifications are being reflected in EPE correctly or at least conservatively. 7.51. When the Effective EPE model is calibrated using historic market data, the bank must employ current market data to compute current exposures and at least three years of historical data must be used to estimate parameters of the model. Alternatively, market implied data may be used to estimate parameters of the model. In all cases, the data must be updated quarterly or more frequently if market conditions warrant. To calculate the Effective EPE using a stress calibration, the bank must also calibrate Effective EPE using three years of data that include a period of stress to the credit default spreads of a bank’s counterparties or calibrate Effective EPE using market implied data from a suitable period of stress. The following process will be used to assess the adequacy of the stress calibration: (1)The bank must demonstrate, at least quarterly, that the stress period coincides with a period of increased credit default swaps (CDS)or other credit spreads – such as loan or corporate bond spreads – for a representative selection of the bank’s counterparties with traded credit spreads. In situations where the bank does not have adequate credit spread data for a counterparty, the bank should map each counterparty to specific credit spread data based on region, internal rating and business types. (2)The exposure model for all counterparties must use data, either historic or implied, that include the data from the stressed credit period, and must use such data in a manner consistent with the method used for the calibration of the Effective EPE model to current data. (3)To evaluate the effectiveness of its stress calibration for Effective EPE, the bank must create several benchmark portfolios that are vulnerable to the same main risk factors to which the bank is exposed. The exposure to these benchmark portfolios shall be calculated using: (a) current positions at current market prices, stressed volatilities, stressed correlations and other relevant stressed exposure model inputs from the 3-year stress period and (b) current positions at end of stress period market prices, stressed volatilities, stressed correlations and other relevant stressed exposure model inputs from the 3-year stress period. SAMA may adjust the stress calibration if the exposures of these benchmark portfolios deviate substantially.

Page Number 66 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.52. For a bank to recognize in its EAD calculations for OTC derivatives the effect of collateral other than cash of the same currency as the exposure itself, if it is not able to model collateral jointly with the exposure then it must use the standard supervisory haircuts of the comprehensive approach. 7.53. If the internal model includes the effect of collateral on changes in the market value of the netting set, the bank must model collateral other than cash of the same currency as the exposure itself jointly with the exposure in its EAD calculations for securities-financing transactions. 7.54. The EPE model (and modifications made to it) must be subject to an internal model validation process. The process must be clearly articulated in banks’ policies and procedures. The validation process must specify the kind of testing needed to ensure model integrity and identify conditions under which assumptions are violated and may result in an understatement of EPE. The validation process must include a review of the comprehensiveness of the EPE model, for example such as whether the EPE model covers all products that have a material contribution to counterparty risk exposures. 7.55. The use of an internal model to estimate EPE, and hence the exposure amount or EAD, of positions subject to a CCR capital requirement will be conditional upon the explicit approval of SAMA. SAMA and relevant supervisory authorities of banks that carry out material trading activities in multiple jurisdictions will work co-operatively to ensure an efficient approval process. 7.56. SAMA will require that banks seeking to make use of internal models to estimate EPE meet the requirements regarding, for example, the integrity of the risk management system, the skills of staff that will rely on such measures in operational areas and in control functions, the accuracy of models, and the rigour of internal controls over relevant internal processes. As an example, banks seeking to make use of an internal model to estimate EPE must demonstrate that they meet the general criteria for banks seeking to make use of internal models to assess market risk exposures, but in the context of assessing counterparty credit risk.29

29 See Chapter 10.1 to Chapter 10.4 of the Minimum Capital Requirements for Market Risk.

Page Number 67 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.57. The supervisory review process (SRP) standard of this framework provides general background and specific guidance to cover counterparty credit risks that may not be fully covered by the Pillar 1 process. 7.58. No particular form of model is required to qualify to make use of an internal model. Although this text describes an internal model as a simulation model, other forms of models, including analytic models, are acceptable subject to SAMA approval and review. Banks that seek recognition for the use of an internal model that is not based on simulations must demonstrate to SAMA that the model meets all operational requirements. 7.59. For a bank that qualifies to net transactions, (1)The bank must have internal procedures to verify that, prior to including a transaction in a netting set, (2)The transaction is covered by a legally enforceable netting contract that meets the applicable requirements of the standardized approach to counterparty credit risk (in Chapter 6 of this framework), chapter 9 of the Minimum Capital Requirements for Credit Risk, or the Cross Product Netting Rules set forth 7.61 to 7.71 below in this framework. 7.60. For a bank that makes use of collateral to mitigate its CCR, the bank must have internal procedures to verify that, prior to recognizing the effect of collateral in its calculations, the collateral meets the appropriate legal certainty standards as set out in chapter 9 of the Minimum Capital Requirements for Credit Risk. Cross-product netting rules 7.61. The Cross-Product Netting Rules apply specifically to netting across SFTs, or to netting across both SFTs and OTC derivatives, for purposes of regulatory capital computation under IMM. 7.62. Banks that receive approval to estimate their exposures to CCR using the internal models method may include within a netting set SFTs, or both SFTs and OTC derivatives subject to a legally valid form of bilateral netting that satisfies the following legal and operational criteria for a Cross-Product Netting Arrangement (as defined below). The bank must also have satisfied any prior approval or other procedural requirements that SAMA determines to implement for purposes of recognizing a Cross-Product Netting Arrangement.

Page Number 68 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Legal Criteria 7.63. The bank has executed a written, bilateral netting agreement with the counterparty that creates a single legal obligation, covering all included bilateral master agreements and transactions (“Cross-Product Netting Arrangement”), such that the bank would have either a claim to receive or obligation to pay only the net sum of the positive and negative (i) close-out values of any included individual master agreements and (ii) mark-to-market values of any included individual transactions (the “Cross-Product Net Amount”), in the event a counterparty fails to perform due to any of the following: default, bankruptcy, liquidation or similar circumstances. 7.64. The bank has written and reasoned legal opinions that conclude with a high degree of certainty that, in the event of a legal challenge, relevant courts or administrative authorities would find the bank’s exposure under the Cross Product Netting Arrangement to be the Cross-Product Net Amount under the laws of all relevant jurisdictions. In reaching this conclusion, legal opinions must address the validity and enforceability of the entire Cross-Product Netting Arrangement under its terms and the impact of the Cross-Product Netting Arrangement on the material provisions of any included bilateral master agreement. (1)The laws of “all relevant jurisdictions” are: (i) the law of the jurisdiction in which the counterparty is chartered and, if the foreign branch of a counterparty is involved, then also under the law of the jurisdiction in which the branch is located, (ii) the law that governs the individual transactions, and (iii) the law that governs any contract or agreement necessary to effect the netting. (2)A legal opinion must be generally recognized as such by the legal community in the bank’s home country or a memorandum of law that addresses all relevant issues in a reasoned manner. 7.65. The bank has internal procedures to verify that, prior to including a transaction in a netting set, the transaction is covered by legal opinions that meet the above criteria. 7.66. The bank undertakes to update legal opinions as necessary to ensure continuing enforceability of the Cross-Product Netting Arrangement in light of possible changes in relevant law.

Page Number 69 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 7.67. The Cross-Product Netting Arrangement does not include a walkaway clause. A walkaway clause is a provision which permits a non-defaulting counterparty to make only limited payments, or no payment at all, to the estate of the defaulter, even if the defaulter is a net creditor. 7.68. Each included bilateral master agreement and transaction included in the Cross Product Netting Arrangement satisfies applicable legal requirements for recognition of credit risk mitigation techniques in credit risk mitigation techniques in chapter 9 of the Minimum Capital Requirements for Credit Risk. 7.69. The bank maintains all required documentation in its files. Operational Criteria 7.70. SAMA is satisfied that the effects of a Cross-Product Netting Arrangement are factored into the bank’s measurement of a counterparty’s aggregate credit risk exposure and that the bank manages its counterparty credit risk on such basis. 7.71. Credit risk to each counterparty is aggregated to arrive at a single legal exposure across products covered by the Cross-Product Netting Arrangement. This aggregation must be factored into credit limit and economic capital processes. 8. Capital requirements for bank exposures to central counterparties Scope of application 8.1. This chapter applies to exposures to central counterparties arising from over-the counter (OTC) derivatives, exchange-traded derivatives transactions, securities financing transactions (SFTs) and long settlement transactions. Exposures arising from the settlement of cash transactions (equities, fixed income, spot foreign exchange and spot commodities) are not subject to this treatment.30 The settlement of cash transactions remains subject to the treatment described in chapter 25 of the Minimum Capital Requirements for Credit Risk. 8.2. When the clearing member-to-client leg of an exchange-traded derivatives transaction is conducted under a bilateral agreement, both the client bank and the

30 For contributions to prepaid default funds covering settlement-risk only products, the applicable risk weight is 0%.

Page Number 70 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 clearing member are to capitalize that transaction as an OTC derivative.31 This treatment also applies to transactions between lower-level clients and higher level clients in a multi-level client structure. Central Counterparties 8.3. Regardless of whether a central counterparty (CCP) is classified as a qualifying CCP (QCCP), a bank retains the responsibility to ensure that it maintains adequate capital for its exposures. Under Pillar 2, a bank should consider whether it might need to hold capital in excess of the minimum capital requirements if, for example: (1)its dealings with a CCP give rise to more risky exposures; (2)where, given the context of that bank’s dealings, it is unclear that the CCP meets the definition of a QCCP; or (3) an external assessment such as an International Monetary Fund Financial Sector Assessment Program (FSAP) has found material shortcomings in the CCP or the regulation of CCPs, and the CCP and/or the CCP regulator have not since publicly addressed the issues identified. 8.4. Where the bank is acting as a clearing member, the bank should assess through appropriate scenario analysis and stress testing whether the level of capital held against exposures to a CCP adequately addresses the inherent risks of those transactions. This assessment will include potential future or contingent exposures resulting from future drawings on default fund commitments, and/or from secondary commitments to take over or replace offsetting transactions from clients of another clearing member in case of this clearing member defaulting or becoming insolvent. 8.5. A bank must monitor and report to senior management, the appropriate committee of the Board, or the delegated authority of the board on a regular basis all of its exposures to CCPs, including exposures arising from trading through a CCP and exposures arising from CCP membership obligations such as default fund contributions. 8.6. Where a bank is clearing derivative, SFT and/or long settlement transactions through a QCCP as defined in Chapter 4 of this framework, then paragraphs 8.7 to 8.40 will apply. In the case of non-qualifying CCPs, paragraphs 8.41 and 8.42

31 For this purpose, the treatment in 8.12 would also apply.

Page Number 71 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 will apply. Within three months of a CCP ceasing to qualify as a QCCP, unless SAMA requires otherwise, the trades with a former QCCP may continue to be capitalized as though they are with a QCCP. After that time, the bank’s exposures with such a CCP must be capitalized according to paragraphs 8.41 and 8.42. Exposures to Qualifying CCPs: trade exposures Clearing member exposures to CCPs 8.7. Where a bank acts as a clearing member of a CCP for its own purposes, a risk weight of 2% must be applied to the bank’s trade exposure to the CCP in respect of OTC derivatives, exchange-traded derivative transactions, SFTs and long settlement transactions. Where the clearing member offers clearing services to clients, the 2% risk weight also applies to the clearing member’s trade exposure to the CCP that arises when the clearing member is obligated to reimburse the client for any losses suffered due to changes in the value of its transactions in the event that the CCP defaults. The risk weight applied to collateral posted to the CCP by the bank must be determined in accordance with paragraphs 8.18 to 8.23. 8.8. The exposure amount for a bank’s trade exposure is to be calculated in accordance with methods set out in the counterparty credit risk overview chapters of this framework (see paragraph 5.7), as consistently applied by the bank in the ordinary course of its business.32 In applying these methods: (1)Provided that the netting set does not contain illiquid collateral or exotic trades and provided there are no disputed trades, the 20-day floor for the margin period of risk (MPOR) established for netting sets where the number of trades exceeds 5000 does not apply. This floor is set out in 6.54(1) of the standardized approach for counterparty credit risk (SA￾CCR), 9.60 of the Minimum Capital Requirements for Credit Risk of comprehensive approach within the standardized approach to credit risk and 7.24(1) of the internal models method (IMM). (2)In all cases, a minimum MPOR of 10 days must be used for the calculation of trade exposures to CCPs for OTC derivatives.

32 Where the firm’s internal model permission does not specifically cover centrally cleared products, the IMM scope would have to be extended to cover these products (even where the non-centrally cleared versions are included in the permission). Usually, national supervisors have a well-defined model approval/change process by which IMM firms can extend the products covered within their IMM scope. The introduction of a centrally cleared version of a product within the existing IMM scope must be considered as part of such a model change process, as opposed to a natural extension.

Page Number 72 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (3)Where CCPs retain variation margin against certain trades (e.g. where CCPs collect and hold variation margin against positions in exchange-traded or OTC forwards), and the member collateral is not protected against the insolvency of the CCP, the minimum time risk horizon applied to banks’ trade exposures on those trades must be the lesser of one year and the remaining maturity of the transaction, with a floor of 10 business days. 8.9. The methods for calculating counterparty credit risk exposures (see 5.7), when applied to bilateral trading exposures (i.e. non-CCP counterparties), require banks to calculate exposures for each individual netting set. However, netting arrangements for CCPs are not as standardized as those for OTC netting agreements in the context of bilateral trading. As a consequence, paragraph 8.10 below makes certain adjustments to the methods for calculating counterparty credit risk exposure to permit netting under certain conditions for exposures to CCPs. 8.10. Where settlement is legally enforceable on a net basis in an event of default and regardless of whether the counterparty is insolvent or bankrupt, the total replacement cost of all contracts relevant to the trade exposure determination can be calculated as a net replacement cost if the applicable close-out netting sets meet the requirements set out in: (1)9.68 of the Minimum Capital Requirements for Credit Risk and, where applicable, also 9.69 of the Minimum Capital Requirements for Credit Risk. (2)6.9 and 6.10 of the SA-CCR in this framework in the case of derivative transactions. (3)7.61 to 7.71 of IMM in the case of cross-product netting. 8.11. To the extent that the rules referenced in 8.10 above include the term “master agreement” or the phrase “a netting contract with a counterparty or other agreement”, this terminology must be read as including any enforceable arrangement that provides legally enforceable rights of set-off. If the bank cannot demonstrate that netting agreements meet these requirements, each single transaction will be regarded as a netting set of its own for the calculation of trade exposure. Clearing member exposures to clients

Page Number 73 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 8.12. The clearing member will always capitalize its exposure (including potential credit valuation adjustment, or CVA, risk exposure) to clients as bilateral trades, irrespective of whether the clearing member guarantees the trade or acts as an intermediary between the client and the CCP. However, to recognize the shorter close-out period for cleared client transactions, clearing members can capitalize the exposure to their clients applying a margin period of risk of at least five days in IMM or SA-CCR. The reduced exposure at default (EAD) should also be used for the calculation of the CVA capital requirement. 8.13. If a clearing member collects collateral from a client for client cleared trades and this collateral is passed on to the CCP, the clearing member may recognize this collateral for both the CCP-clearing member leg and the clearing member-client leg of the client-cleared trade. Therefore, initial margin posted by clients to their clearing member mitigates the exposure the clearing member has against these clients. The same treatment applies, in an analogous fashion, to multi-level client structures (between a higher-level client and a lower-level client). Client exposures 8.14. Subject to the two conditions set out in 8.15 below being met, the treatment set out in 8.7 to 8.11 (i.e. the treatment of clearing member exposures to CCPs) also applies to the following: (1)A bank’s exposure to a clearing member where: (a) the bank is a client of the clearing member; and (b)the transactions arise as a result of the clearing member acting as a financial intermediary (i.e. the clearing member completes an offsetting transaction with a CCP). (2)A bank’s exposure to a CCP resulting from a transaction with the CCP where: (a) the bank is a client of a clearing member; and (b)the clearing member guarantees the performance the bank’s exposure to the CCP. (3)Exposures of lower-level clients to higher-level clients in a multi-level client structure, provided that for all client levels in-between the two conditions in 8.15 below are met. 8.15. The two conditions referenced in 8.14 above are: (1)The offsetting transactions are identified by the CCP as client transactions and collateral to support them is held by the CCP and/or the clearing member, as

Page Number 74 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 applicable, under arrangements that prevent any losses to the client due to: (a) the default or insolvency of the clearing member; (b) the default or insolvency of the clearing member’s other clients; and (c) the joint default or insolvency of the clearing member and any of its other clients. Regarding the condition set out in this paragraph: (a) Upon the insolvency of the clearing member, there must be no legal impediment (other than the need to obtain a court order to which the client is entitled) to the transfer of the collateral belonging to clients of a defaulting clearing member to the CCP, to one or more other surviving clearing members or to the client or the client’s nominee. SAMA should be consulted to determine whether this is achieved based on particular facts and SAMA will consult and communicate with other supervisors. (b)The client must have conducted a sufficient legal review (and undertake such further review as necessary to ensure continuing enforceability) and have a well founded basis to conclude that, in the event of legal challenge, the relevant courts and administrative authorities would find that such arrangements mentioned above would be legal, valid, binding and enforceable under the relevant laws of the relevant jurisdiction(s). (2)Relevant laws, regulation, rules, contractual, or administrative arrangements provide that the offsetting transactions with the defaulted or insolvent clearing member are highly likely to continue to be indirectly transacted through the CCP, or by the CCP, if the clearing member defaults or becomes insolvent. In such circumstances, the client positions and collateral with the CCP will be transferred at market value unless the client requests to close out the position at market value. Regarding the condition set out in this paragraph, if there is a clear precedent for transactions being ported at a CCP and industry intent for this practice to continue, then these factors must be considered when assessing if trades are highly likely to be ported. The fact that CCP documentation does not prohibit client trades from being ported is not sufficient to say they are highly likely to be ported. 8.16. Where a client is not protected from losses in the case that the clearing member and another client of the clearing member jointly default or become jointly insolvent, but all other conditions in the preceding paragraph are met, a risk weight of 4% will apply to the client's exposure to the clearing member, or to the higher-level client, respectively.

Page Number 75 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 8.17. Where the bank is a client of the clearing member and the requirements in 8.14 to 8.16 above are not met, the bank will capitalize its exposure (including potential CVA risk exposure) to the clearing member as a bilateral trade. Treatment of posted collateral 8.18. In all cases, any assets or collateral posted must, from the perspective of the bank posting such collateral, receive the risk weights that otherwise applies to such assets or collateral under the capital adequacy framework, regardless of the fact that such assets have been posted as collateral. That is, collateral posted must receive the banking book or trading book treatment it would receive if it had not been posted to the CCP. 8.19. In addition to the requirements of 8.18 above, the posted assets or collateral are subject to the counterparty credit risk requirements, regardless of whether they are in the banking or trading book. This includes the increase in the counterparty credit risk exposure due to the application of haircuts. The counterparty credit risk requirements arise where assets or collateral of a clearing member or client are posted with a CCP or a clearing member and are not held in a bankruptcy remote manner. In such cases, the bank posting such assets or collateral must recognize credit risk based upon the assets or collateral being exposed to risk of loss based on the creditworthiness of the entity holding such assets or collateral, as described further below. 8.20. Where such collateral is included in the definition of trade exposures (see Chapter 4 of this framework) and the entity holding the collateral is the CCP, the following risk weights apply where the assets or collateral is not held on a bankruptcy￾remote basis: (1)For banks that are clearing members a risk weight of 2% applies. (2)For banks that are clients of clearing members: (a) a 2% risk weight applies if the conditions established in 8.14 and 8.15 are met; or (b) a 4% risk weight applies if the conditions in 8.16 are met. 8.21. Where such collateral is included in the definition of trade exposures (see Chapter 4 of this framework), there is no capital requirement for counterparty credit risk exposure (i.e. the related risk weight or EAD is equal to zero) if the collateral is: (a) held by a custodian; and (b) bankruptcy remote from the CCP. Regarding this paragraph:

Page Number 76 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)All forms of collateral are included, such as: cash, securities, other pledged assets, and excess initial or variation margin, also called overcollateralization. (2)The word “custodian” may include a trustee, agent, pledgee, secured creditor or any other person that holds property in a way that does not give such person a beneficial interest in such property and will not result in such property being subject to legally-enforceable claims by such persons creditors, or to a court￾ordered stay of the return of such property, if such person becomes insolvent or bankrupt. 8.22. The relevant risk weight of the CCP will apply to assets or collateral posted by a bank that do not meet the definition of trade exposures (for example treating the exposure as a financial institution under standardized approach or internal ratings-based approach to credit risk). 8.23. Regarding the calculation of the exposure, or EAD, where banks use the SA-CCR to calculate exposures, collateral posted which is not held in a bankruptcy remote manner must be accounted for in the net independent collateral amount term in accordance with 6.17 to 6.21. For banks using IMM models, the alpha multiplier must be applied to the exposure on posted collateral. Default fund exposures 8.24. Where a default fund is shared between products or types of business with settlement risk only (e.g. equities and bonds) and products or types of business which give rise to counterparty credit risk i.e. OTC derivatives, exchange-traded derivatives, SFTs or long settlement transactions, all of the default fund contributions will receive the risk weight determined according to the formula and methodology set forth below, without apportioning to different classes or types of business or products. However, where the default fund contributions from clearing members are segregated by product types and only accessible for specific product types, the capital requirements for those default fund exposures determined according to the formulae and methodology set forth below must be calculated for each specific product giving rise to counterparty credit risk. In case the CCP’s prefunded own resources are shared among product types, the CCP will have to allocate those funds to each of the calculations, in proportion to the respective product specific EAD.

Page Number 77 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 8.25. Whenever a bank is required to capitalize for exposures arising from default fund contributions to a QCCP, clearing member banks will apply the following approach. 8.26. Clearing member banks will apply a risk weight to their default fund contributions determined according to a risk sensitive formula that considers (i) the size and quality of a qualifying CCP’s financial resources, (ii) the counterparty credit risk exposures of such CCP, and (iii) the application of such financial resources via the CCP’s loss-bearing waterfall, in the case of one or more clearing member defaults. The clearing member bank’s risk sensitive capital requirement for its default fund contribution (𝐾𝐶𝑀𝑖) must be calculated using the formulae and methodology set forth below. 8.27. The clearing member bank’s risk-sensitive capital requirement for its default fund contribution (𝐾𝐶𝑀𝑖) is calculated in two steps: (1)Calculate the hypothetical capital requirement of the CCP due to its counterparty credit risk exposures to all of its clearing members and their clients. (2)Calculate the capital requirement for the clearing member bank. Hypothetical capital requirement of the CCP 8.28. The first step in calculating the clearing member bank’s capital requirement for its default fund contribution (𝐾𝐶𝑀𝑖) is to calculate the hypothetical capital requirement of the CCP (𝐾𝐶𝐶𝑃) due to its counterparty credit risk exposures to all of its clearing members and their clients. 𝐾𝐶𝐶𝑃 is a hypothetical capital requirement for a CCP, calculated on a consistent basis for the sole purpose of determining the capitalization of clearing member default fund contributions; it does not represent the actual capital requirements for a CCP which may be determined by a CCP and its supervisor. 8.29. K is calculated using the following formula, where: CCP (1)RW is a risk weight of 20%33

33 The 20% risk weight is a minimum requirement. As with other parts of the capital adequacy framework, the national supervisor of a bank may increase the risk weight. An increase in such risk weight would be appropriate if, for example, the clearing members in a CCP are not highly rated. Any

Page Number 78 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) capital ratio is 8% (3)CM is the clearing member (4)EAD is the exposure amount of the CCP to clearing member ‘i’, relating to i the valuation at the end of the regulatory reporting date before the margin called on the final margin call of that day is exchanged. The exposure includes both: (a) the clearing member’s own transactions and client transactions guaranteed by the clearing member; and (b) all values of collateral held by the CCP (including the clearing member’s prefunded default fund contribution) against the transactions in (a). (5)The sum is over all clearing member accounts. 𝐾𝐶𝐶𝑃 = ∑𝐸𝐴𝐷𝑖 𝐶𝑀𝑖 ⋅ 𝑅𝑊 ⋅ 𝑐𝑎𝑝𝑖𝑡𝑎𝑙 𝑟𝑎𝑡𝑖𝑜 8.30. Where clearing members provide client clearing services, and client transactions and collateral are held in separate (individual or omnibus) sub-accounts to the clearing member’s proprietary business, each such client sub-account should enter the sum in 8.29 above separately, i.e. the member EAD in the formula above is then the sum of the client sub-account EADs and any house sub-account EAD. This will ensure that client collateral cannot be used to offset the CCP’s exposures to clearing members’ proprietary activity in the calculation of 𝐾𝐶𝐶𝑃. If any of these sub-accounts contains both derivatives and SFTs, the EAD of that sub￾account is the sum of the derivative EAD and the SFT EAD. 8.31. In the case that collateral is held against an account containing both SFTs and derivatives, the prefunded initial margin provided by the member or client must be allocated to the SFT and derivatives exposures in proportion to the respective product-specific EADs, calculated according to: (1)Chapter 9.67 to 9.71 of the Minimum Capital Requirements for Credit Risk; and (2)SA-CCR (see Chapter 6 of this framework) for derivatives, without including the effects of collateral. 8.32. If the default fund contributions of the member (𝐷𝐹𝑖 ) are not split with regard to i client and house sub-accounts, they must be allocated per sub-account according

such increase in risk weight is to be communicated by the affected banks to the person completing this calculation.

Page Number 79 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 to the respective fraction the initial margin of that sub-account has in relation to the total initial margin posted by or for the account of the clearing member. 8.33. For derivatives, 𝐸𝐴𝐷𝑖 is calculated as the bilateral trade exposure the CCP has i against the clearing member using the SA-CCR. In applying the SA-CCR: (1)A MPOR of 10 business days must be used to calculate the CCP’s potential future exposure to its clearing members on derivatives transactions (the 20 day floor on the MPOR for netting sets with more than 5000 trades does not apply). (2)All collateral held by a CCP to which that CCP has a legal claim in the event of the default of the member or client, including default fund contributions of that member (𝐷𝐹𝑖 ), is used to offset the CCP’s exposure to that member or i client, through inclusion in the PFE multiplier in accordance with 6.23 to 6.25. 8.34. For SFTs, 𝐸𝐴𝐷𝑖 is equal to max(𝐸𝐵𝑅𝑀𝑖 − 𝐼𝑀𝑖 − 𝐷𝐹𝑖 ; 0), where: (1)𝐸𝐵𝑅𝑀𝑖 denotes the exposure value to clearing member ‘i’ before risk mitigation under 9.68 to 9.72 of the Minimum Capital Requirements for Credit Risk; where, for the purposes of this calculation, variation margin that has been exchanged (before the margin called on the final margin call of that day) enters into the mark-to-market value of the transactions. (2)𝐼𝑀𝑖 is the initial margin collateral posted by the clearing member with the CCP. (3)𝐷𝐹𝑖 is the prefunded default fund contribution by the clearing member that will be applied upon such clearing member’s default, either along with or immediately following such member’s initial margin, to reduce the CCP loss. 8.35. As regards the calculation in this first step (i.e. 8.28 to 8.34): (1)Any haircuts to be applied for SFTs must be the standard supervisory haircuts set out in 9.44 of the Minimum Capital Requirements for Credit Risk. (2)The holding periods for SFT calculations in 9.60 to 9.63 of the Minimum Capital Requirements for Credit Risk. (3)The netting sets that are applicable to regulated clearing members are the same as those referred to in 8.10 and 8.11. For all other clearing members, they need to follow the netting rules as laid out by the CCP based upon notification of each of its clearing members. SAMA may demand more granular netting sets than laid out by the CCP. Capital requirement for each clearing member

Page Number 80 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 8.36. The second step in calculating the clearing member bank's capital requirement for its default fund contribution (𝐾𝐶𝑀𝑖) is to apply the following formula,34 where: (1)𝐾𝐶𝑀𝑖 is the capital requirement on the default fund contribution of clearing member bank i (2)𝐷𝐹𝐶𝑀𝑃𝑟𝑒𝑓 is the total prefunded default fund contributions from clearing members (3)𝐷𝐹𝐶𝐶𝑃 is the CCP's prefunded own resources (e.g. contributed capital, retained earnings, etc.), which are contributed to the default waterfall, where these are junior or pari passu to prefunded member contributions (4)𝐷𝐹𝑖 𝑝𝑟𝑒𝑓 is the prefunded default fund contributions provided by clearing member bank i 𝐾𝐶𝑀𝑖 = 𝑚𝑎𝑥 (𝐾𝐶𝐶𝑃 ⋅ ( 𝐷𝐹𝑖 𝑝𝑟𝑒𝑓 𝐷𝐹𝐶𝐶𝑃 + 𝐷𝐹𝐶𝑀 𝑝𝑟𝑒𝑓) ; 8% ∗ 2% ∗ 𝐷𝐹𝑖 𝑝𝑟𝑒𝑓) 8.37. The CCP, bank, CCP supervisor or other body with access to the required data, must make a calculation of 𝐾𝐶𝐶𝑃,𝐷𝐹𝐶𝑀𝑝𝑟𝑒𝑓,𝐷𝐹𝐶𝐶𝑃, in such a way to permit the supervisor of the CCP to oversee those calculations, and it must share sufficient information of the calculation results to permit each clearing member to calculate their capital requirement for the default fund and for SAMA to review and confirm such calculations. 8.38. 𝐾𝐶𝐶𝑃 must be calculated on a quarterly basis at a minimum; although SAMA may require more frequent calculations in case of material changes (such as the CCP clearing a new product). The CCP, bank, CCP supervisor or other body that did the calculations must make available to SAMA the sufficient aggregate information about the composition of the CCP’s exposures to clearing members and information provided to the clearing member for the purposes of the calculation of 𝐾𝐶𝐶𝑃, 𝐷𝐹𝐶𝑀𝑝𝑟𝑒𝑓,𝐷𝐹𝐶𝐶𝑃. Such information must be provided no less frequently than the SAMA would require for monitoring the risk of the clearing member. 8.39. 𝐾𝐶𝐶𝑃 and 𝐾𝐶𝑀𝑖 must be recalculated at least quarterly, and should also be recalculated when there are material changes to the number or exposure of cleared transactions or material changes to the financial resources of the CCP.

34 The formula puts a floor on the default fund exposure risk weight of 2%.

Page Number 81 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Cap with regard to QCCPs 8.40. Where the sum of a bank’s capital requirements for exposures to a QCCP due to its trade exposure and default fund contribution is higher than the total capital requirement that would be applied to those same exposures if the CCP were for a non-qualifying CCP, as outlined in 8.41 and 8.42 below, the latter total capital requirement shall be applied. Exposures to non-qualifying CCPs 8.41. Banks must apply the standardized approach for credit risk, according to the category of the counterparty, to their trade exposure to a non-qualifying CCP. 8.42. Banks must apply a risk weight of 1250% to their default fund contributions to a non-qualifying CCP. For the purposes of this paragraph, the default fund contributions of such banks will include both the funded and the unfunded contributions which are liable to be paid if the CCP so requires. Where there is a liability for unfunded contributions (i.e. unlimited binding commitments), the risk weight shall also be 1250%. Banks may, however, seek SAMA’s approval to apply a different risk weight for the unfunded contributions. 9. Counterparty credit risk in the trading book 9.1. Banks must calculate the counterparty credit risk charge for over-the-counter (OTC) derivatives, repo-style and other transactions booked in the trading book, separate from the capital requirement for market risk.35 The risk weights to be used in this calculation must be consistent with those used for calculating the capital requirements in the banking book. Thus, banks using the standardized approach in the banking book will use the standardized approach risk weights in the trading book and banks using the internal ratings-based (IRB) approach in the banking book will use the IRB risk weights in the trading book in a manner consistent with the IRB roll-out situation in the banking book as described in 10.44 to 10.51 of the Minimum Capital Requirements for Credit Risk. For counterparties included in portfolios where the IRB approach is being used the IRB risk weights will have to be applied.

35 The treatment for unsettled foreign exchange and securities trades is set forth in the Risk weight multiplier to certain exposures with currency mismatch of the individual exposures under standardized approach for credit risk of Basel III: Finalizing post-crisis reforms.

Page Number 82 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 9.2. In the trading book, for repo-style transactions, all instruments, which are included in the trading book, may be used as eligible collateral. Those instruments which fall outside the banking book definition of eligible collateral shall be subject to a haircut at the level applicable to non-main index equities listed on recognized exchanges (as noted in 9.44 of the Minimum Capital Requirements for Credit Risk). Where banks are using a value-at-risk approach to measuring exposure for securities financing transactions, they also may apply this approach in the trading book in accordance with h 9.48 to 9.49 of the Minimum Capital Requirements for Credit Risk and Chapter 5 of this framework. 9.3. The calculation of the counterparty credit risk charge for collateralized OTC derivative transactions is the same as the rules prescribed for such transactions booked in the banking book (see Chapter 5 of this framework). 9.4. The calculation of the counterparty charge for repo-style transactions will be conducted using the rules in Chapter 5 of this framework spelt out for such transactions booked in the banking book. The firm-size adjustment for small or medium-sized entities as set out in chapter 11.9 of the Minimum Capital requirements for Credit Risk shall also be applicable in the trading book. 10.Minimum haircut floors for securities financing transactions Scope 10.1. This chapter specifies the treatment of certain non-centrally cleared securities financing transactions (SFTs) with certain counterparties. The requirements are not applicable to banks in jurisdictions that are prohibited from conducting such transactions below the minimum haircut floors specified in 10.6 below. 10.2. The haircut floors found in 10.6 below apply to the following transactions: (1)Non-centrally cleared SFTs in which the financing (i.e. the lending of cash) against collateral other than government securities is provided to counterparties who are not supervised by a regulator that imposes prudential requirements consistent with international norms. (2)Collateral upgrade transactions with these same counterparties. A collateral upgrade transaction is when a bank lends a security to its counterparty and the counterparty pledges a lower-quality security as collateral, thus allowing the counterparty to exchange a lower-quality security for a higher quality security.

Page Number 83 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 For these transactions, the floors must be calculated according to the formula set out in 10.9 below. 10.3. SFTs with central banks are not subject to the haircut floors. 10.4. Cash-collateralized securities lending transactions are exempted from the haircut floors where: (1)Securities are lent (to the bank) at long maturities and the lender of securities reinvests or employs the cash at the same or shorter maturity, therefore not giving rise to material maturity or liquidity mismatch. (2)Securities are lent (to the bank) at call or at short maturities, giving rise to liquidity risk, only if the lender of the securities reinvests the cash collateral into a reinvestment fund or account subject to regulations or regulatory guidance meeting the minimum standards for reinvestment of cash collateral by securities lenders set out in Section 3.1 of the Policy Framework for Addressing Shadow Banking Risks in Securities Lending and Repos.36 For this purpose, banks may rely on representations by securities lenders that their reinvestment of cash collateral meets the minimum standards. 10.5. Banks that borrow (or lend) securities are exempted from the haircut floors on collateral upgrade transactions if the recipient of the securities that the bank has delivered as collateral (or lent) is either: (i) unable to re-use the securities (for example, because the securities have been provided under a pledge arrangement); or (ii) provides representations to the bank that they do not and will not re-use the securities. Haircut floors 10.6. These are the haircut floors for SFTs referred to above (herein referred to as “in￾scope SFTs”), expressed as percentages: Residual maturity of collateral Haircut Level Corporate and other issuers Securitized products ≤ 1 year debt securities, and floating rate notes 0.5% 1%

36 Financial Stability Board, Strengthening oversight and regulation of shadow banking, Policy framework for addressing shadow banking risks in securities lending and repos, 29 August 2013, www.fsb.org/wpcontent/uploads/r_130829b.pdf

Page Number 84 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1

1year, ≤ 5 years debt securities 1.5% 4% 5years, ≤ 10 years debt securities 3% 6% 10 years debt securities 4% 7% Main index equities 6% Other assets within the scope of the framework 10% 10.7. In-scope SFTs which do not meet the haircut floors must be treated as unsecured loans to the counterparties. 10.8. To determine whether the treatment in 10.7 applies to an in-scope SFT (or a netting set of SFTs in the case of portfolio-level haircuts), we must compare the collateral haircut H (real or calculated as per the rules below) and a haircut floor f (from 10.6 above or calculated as per the below rules). Single in-scope SFTs 10.9. For a single in-scope SFT not included in a netting set, the values of H and f are computed as: (1)For a single cash-lent-for-collateral SFT, H and f are known since H is simply defined by the amount of collateral received and f is given in 10.6. 37 For the purposes of this calculation, collateral that is called by either counterparty can be treated collateral received from the moment that it is called (i.e. the treatment is independent of the settlement period). (2)For a single collateral-for-collateral SFT, lending collateral A and receiving collateral B, the H is still be defined by the amount of collateral received but the effective floor of the transaction must integrate the floor of the two types

37 For example, consider an in-scope SFT where 100 cash is lent against 101 of a corporate debt security with a 12-year maturity, H is 1% [(101- 100)/100] and f is 4% (per 10.6). Therefore, the SFT in question would be subject to the treatment in 10.7.

Page Number 85 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 of collateral and can be computed using the following formula, which will be compared to the effective haircut of the transaction, i.e. (𝐶𝐵/𝐶𝐴)-1:38 𝑓 = [( 1 1 + 𝑓𝐴 ) ( 1 1 + 𝑓𝐵 ⁄ )] − 1 = 1 + 𝑓𝐵 1 + 𝑓𝐴 − 1 Netting set of SFTs 10.10. For a netting set of SFTs an effective "portfolio" floor of the transaction must be computed using the following formula,39 where: (1)𝐸𝑠 is the net position in each security (or cash) s that is net lent; (2)𝐶𝑡 the net position that is net borrowed; and (3)𝑓𝑠 and 𝑓𝑡 are the haircut floors for the securities that are net lent and net s t borrowed respectively. 𝑓𝑝𝑜𝑟𝑡𝑓𝑜𝑙𝑖𝑜 = [( ∑ ( 𝐸𝑠 1 + 𝑓𝑠 𝑠 ) ∑𝑠 𝐸𝑠 ) ( ∑ ( 𝐶𝑡 1 + 𝑓𝑡 𝑡 ) ∑𝑡 𝐶𝑡 ⁄ )] − 1 10.11. For a netting of SFTs, the portfolio does not breach the floor where: ∑ 𝐶𝑡 − ∑ 𝐸𝑠 ∑ 𝐸𝑠 ≥ 𝑓𝑝𝑜𝑟𝑡𝑓𝑜𝑙𝑖𝑜 10.12. If the portfolio haircut does breach the floor, then the netting set of SFTs is subject to the treatment in 10.7. This treatment should be applied to all trades for which the security received appears in the table in 10.6 and for which, within the netting set, the bank is also a net receiver in that security. For the purposes of this calculation, collateral that is called by either counterparty can be treated collateral received from the moment that it is called (i.e. the treatment is independent of the settlement period). 10.13. The following portfolio of trades gives an example of how this methodology works (it shows a portfolio that does not breach the floor):

38 For example, consider an in-scope SFT where 102 of a corporate debt security with a 10-year maturity is exchanged against 104 of equity, the effective haircut H of the transaction is 104/102 – 1 = 1.96% which has to be compared with the effective floor f of 1.06/1.03 – 1 =2.91%. Therefore, the SFT in question would be subject to the treatment in 10.7. 39 The formula calculates a weighted average floor of the portfolio.

Page Number 86 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Actual trades Cash Sovereign debt Collateral A Collateral B Floor (𝑓𝑠 ) 0% 0% 6% 10% Portfolio of trades 50 100 -400 250 𝐸𝑠 50 100 0 250 𝐶𝑡 0 0 400 0 𝑓𝑝𝑜𝑟𝑡𝑓𝑜𝑙𝑖𝑜 -0.00023 ∑ 𝐶𝑡 − ∑ 𝐸𝑠 ∑ 𝐸𝑠 0 Minimum Capital Requirements for Credit Valuation Adjustment (CVA) 11.Credit Valuation Adjustment (CVA) Framework Credit Valuation Adjustment (CVA) overview 11.1. The risk-weighted assets for Credit Value Adjustment risk are determined by multiplying the capital requirements calculated as set out in Chapter 11 of this Framework by 12.5. 11.2. In the context of this framework, CVA stands for Credit Valuation Adjustment specified at a counterparty level. CVA reflects the adjustment of default risk-free prices of derivatives and Securities Financing Transactions (SFTs) due to a potential default of the counterparty. 11.3. Unless explicitly specified otherwise, the term CVA in this framework means regulatory CVA. Regulatory CVA may differ from CVA used for accounting purposes as follows:

Page Number 87 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)regulatory CVA excludes the effect of the bank’s own default; and (2)several constraints reflecting best practice in accounting CVA are imposed on calculations of regulatory CVA. 11.4. CVA risk is defined as the risk of losses arising from changing CVA values in response to changes in counterparty credit spreads and market risk factors that drive prices of derivative transactions and SFTs. 11.5. The capital requirement for CVA risk must be calculated by all banks involved in covered transactions in both banking book and trading book. Covered transactions include: (1) all derivatives except those transacted directly with a qualified central counterparty and except those transactions meeting the conditions of 8.14 to 8.16 of this framework; and. (2)SFTs that are fair-valued by a bank for accounting purposes, if SAMA determines that the bank's CVA loss exposures arising from SFT transactions are material. In case the bank deems the exposures immaterial, the bank must justify its assessment to SAMA by providing relevant supporting documentation. (3)SFTs that are fair-valued for accounting purposes and for which a bank records zero for CVA reserves for accounting purposes are included in the scope of covered transactions. 11.6. The CVA risk capital requirement is calculated for a bank’s “CVA portfolio” on a standalone basis. The CVA portfolio includes CVA for a bank’s entire portfolio of covered transactions and eligible CVA hedges. 11.7. Two approaches are available for calculating CVA capital: the standardized approach (SA-CVA) and the basic approach (BA-CVA). Banks must use the BA￾CVA unless they receive approval from Saudi Central Bank (SAMA) to use the SA-CVA.40

11.8. Banks that have received approval of Saudi Central Bank (SAMA) to use the SA￾CVA may carve out from the SA-CVA calculations any number of netting sets. CVA capital for all carved out netting sets must be calculated using the BA-CVA.

40 Note that this is in contrast to the application of the market risk approaches set out in Chapter 3 of the Minimum Capital Requirements for Market Risk, where banks do not need SAMA approval to use the standardized approach.

Page Number 88 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 When applying the carve-out, a legal netting set may also be split into two synthetic netting sets, one containing the carved-out transactions subject to the BA-CVA and the other subject to the SA-CVA, subject to one or both of the following conditions: (1)the split is consistent with the treatment of the legal netting set used by the bank for calculating accounting CVA (e.g. where certain transactions are not processed by the front office/accounting exposure model); or (2)SAMA approval to use the SA-CVA is limited and does not cover all transactions within a legal netting set. 11.9. For banks that are below the materiality threshold where aggregate notional amount of non-centrally cleared derivatives is less than or equal to 446 billion SAR may opt not to calculate its CVA capital requirements using the SA-CVA or BA-CVA and instead choose an alternative treatment. (1)Subject to the above conditions and treatment, a. Banks may choose to set its CVA capital equal to 100% of the bank’s capital requirement for counterparty credit risk (CCR); b. Banks CVA hedges will not be recognized; and c. Banks must apply this treatment to the bank’s entire portfolio instead of the BA-CVA or the SA-CVA. (2)SAMA, however, may not allow banks to apply the above treatment if it determines that CVA risk resulting from the bank’s derivative positions materially contributes to the bank’s overall risk. 11.10. Eligibility criteria for CVA hedges are specified in11.17 to 11.19 for the BA￾CVA and in 11.37 to 11.39 for the SA-CVA. 11.11. CVA hedging instruments can be external (i.e. with an external counterparty) or internal (i.e. with one of the bank’s trading desks). (1) All external CVA hedges (including both eligible and ineligible external CVA hedges) that are covered transactions must be included in the CVA calculation for the counterparty to the hedge.

Page Number 89 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) All eligible external CVA hedges must be excluded from a bank’s market risk capital requirement calculations under Chapter 2 through Chapter 14 of the Minimum Capital Requirements for Market Risk. (3) Ineligible external CVA hedges are treated as trading book instruments and are capitalized under Chapter 2 through Chapter 14 of the Minimum Capital Requirements for Market Risk. (4) An internal CVA hedge involves two perfectly offsetting positions: one of the CVA desk and the opposite position of the trading desk. a) If an internal CVA hedge is ineligible, both positions belong to the trading book where they cancel each other, so there is no impact on either CVA portfolio or the trading book. b) If an internal CVA hedge is eligible, the CVA desk’s position is part of the CVA portfolio where it is capitalized as set out in this chapter, while the trading desk’s position is part of the trading book where it is capitalized as set out in Chapter 2 through Chapter 14 of the Minimum Capital Requirements for Market Risk. (5) If an internal CVA hedge involves an instrument that is subject to curvature risk, default risk charge or the residual risk add-on under the standardized approach as set out in Chapter 6 to Chapter 9 of the Minimum Capital Requirements for Market Risk, it can be eligible only if the trading desk that is the CVA desk’s internal counterparty executes a transaction with an external counterparty that exactly offsets the trading desk’s position with the CVA desk. 11.12. Banks that use the BA-CVA or the SA-CVA for calculating CVA capital requirements may cap the maturity adjustment factor at 1 for all netting sets contributing to CVA capital when they calculate CCR capital requirements under the Internal Ratings Based (IRB) approach. Basic approach for credit valuation adjustment risk 11.13. The BA-CVA calculations may be performed either via the reduced version or the full version. A bank under the BA-CVA approach can choose whether to implement the full version or the reduced version at its discretion. However, all banks using the BA-CVA must calculate the reduced version of BA-CVA capital

Page Number 90 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 requirements as the reduced BA-CVA is also part of the full BA-CVA capital calculations as a conservative means to limit hedging recognition. (1) The full version recognizes counterparty spread hedges and is intended for banks that hedge CVA risk. (2) The reduced version eliminates the element of hedging recognition from the full version. The reduced version is designed to simplify BA-CVA implementation for less sophisticated banks that do not hedge CVA. Reduced version of the BA-CVA (hedges are not recognized) 11.14. The capital requirement for CVA risk under the reduced version of the BA-CVA (𝐷𝑆𝐵𝐴−𝐶𝑉𝐴 × 𝐾𝑟𝑒𝑑𝑢𝑐𝑒𝑑, where the discount scalar 𝐷𝑆𝐵𝐴−𝐶𝑉𝐴 = 0.65) is calculated as follows (where the summations are taken over all counterparties that are within scope of the CVA charge), where: (1) 𝑆𝐶𝑉𝐴𝐶 is the CVA capital requirement that counterparty c would receive if considered on a stand-alone basis (referred to as “stand-alone CVA capital” below). See 11.15 for its calculation; (2) 𝜌 = 50%. It is supervisory correlation parameter. Its square, 𝜌 2 = 25% represents the correlation between credit spreads of any two counterparties.41 In the formula below, the effect of 𝑝 is to recognize the fact that the CVA risk to which a bank is exposed is less than the sum of the CVA risk for each counterparty, given that the credit spreads of counterparties are typically not perfectly correlated; and (3) The first term under the square root in the formula below aggregates the systematic components of CVA risk, and the second term under the square root aggregates the idiosyncratic components of CVA risk. 𝐾𝑟𝑒𝑑𝑢𝑐𝑒𝑑 = √(𝜌 ∙ ∑𝑆𝐶𝑉𝐴𝑐 𝑐 ) 2 + (1 − 𝜌 2) ∙ ∑𝑆𝐶𝑉𝐴𝑐 2 𝐶

41 One of the basic assumptions underlying the BA-CVA is that systematic credit spread risk is driven by a single factor. Under this assumption, 𝜌 can be interpreted as the correlation between the credit spread of a counterparty and the single credit spread systematic factor.

Page Number 91 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.15. The stand-alone CVA capital requirements for counterparty 𝑐 that are used in the formula in 11.14 (𝑆𝐶𝑉𝐴𝐶) is calculated as follows (where the summation is across all netting sets with the counterparty), where: (1) 𝑅𝑊𝑐 is the risk weight for counterparty c that reflects the volatility of its credit spread. These risk weights are based on a combination of sector and credit quality of the counterparty as prescribed in 11.16. (2) 𝑀𝑁𝑆 is the effective maturity for the netting set NS. For banks that have SAMA’s approval to use IMM, 𝑀𝑁𝑆 is calculated as per 7.20 and 7.21 of this framework, with the exception that the five year cap in 7.20 is not applied. For banks that do not have SAMA’s approval to use IMM, 𝑀𝑁𝑆 is calculated according to chapter 12.46 to 12.54 of the Minimum Capital Requirements for Credit Risk, with the exception that the five-year cap in chapter 12.46 of the Minimum Capital Requirements for Credit Risk is not applied. (3) 𝐸𝐴𝐷𝑁𝑆 is the exposure at default (EAD) of the netting set NS, calculated in the same way as the bank calculates it for minimum capital requirements for CCR. (4) 𝐷𝐹𝑁𝑆is a supervisory discount factor. It is 1 for banks using the IMM to calculate EAD, and is 1−𝑒 −0.05∙𝑀𝑁𝑆 0.05∙𝑀𝑁𝑆 for banks not using IMM.42 (5) ∝= 1.4. 43 𝑆𝐶𝑉𝐴𝑐 = 1 ∝ ∙ 𝑅𝑊𝑐 ∙ ∑𝑀𝑁𝑆 ∙ 𝐸𝐴𝐷𝑁𝑆 ∙ 𝐷𝐹𝑁𝑆 𝑁𝑆

42 DF is SAMA discount factor averaged over time between today and the netting set's effective maturity date. The interest rate used for discounting is set at 5%, hence 0.05 in the formula. The product of EAD and effective maturity in the BA-CVA formula is a proxy for the area under the discounted expected exposure profile of the netting set. The IMM definition of effective maturity already includes this discount factor, hence DF is set to 1 for IMM banks. Outside IMM, netting set effective maturity is defined as an average of actual trade maturities. This definition lacks discounting, so SAMA discount factor is added to compensate for this. 43 ∝ is the multiplier used to convert Effective Expected Positive Exposure (EEPE) to EAD in both SA￾CCR and IMM. Its role in the calculation, therefore, is to convert the EAD of the netting set (𝐸𝐴𝐷𝑁𝑆) back to EEPE.

Page Number 92 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.16. The supervisory risk weights (𝑅𝑊𝑐 ) are given in Table 1. Credit quality is specified as either investment grade (IG), high yield (HY), or not rated (NR). Where there are no external ratings or where external ratings are not recognized within a jurisdiction, banks may, subject to SAMA’s approval, map the internal rating to an external rating and assign a risk weight corresponding to either IG or HY. Otherwise, the risk weights corresponding to NR is to be applied. Table 1: Supervisory risk weights, 𝑅𝑊𝑐 Sector of counterparty Credit quality of counterparty IG HY and NR Sovereigns including central banks, multilateral development banks 0.5% 2.0% Local government, government-backed non￾financials, education and public administration 1.0% 4.0% Financials including government-backed financials 5.0% 12.0% Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 3.0% 7.0% Consumer goods and services, transportation and storage, administrative and support service activities 3.0% 8.5% Technology, telecommunications 2.0% 5.5% Health care, utilities, professional and technical activities 1.5% 5.0% Other sector 5.0% 12.0%

Page Number 93 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Full version of the BA-CVA (hedges are recognized) 11.17. As set out in 11.13(1) the full version of the BA-CVA recognizes the effect of counterparty credit spread hedges. Only transactions used for the purpose of mitigating the counterparty credit spread component of CVA risk, and managed as such, can be eligible hedges. 11.18. Only single-name credit default swaps (CDS), single-name contingent CDS and index CDS can be eligible CVA hedges. 11.19. Eligible single-name credit instruments must: (1) reference the counterparty directly; or (2) reference an entity legally related to the counterparty; where legally related refers to cases where the reference name and the counterparty are either a parent and its subsidiary or two subsidiaries of a common parent; or (3) reference an entity that belongs to the same sector and region as the counterparty. 11.20. Banks that intend to use the full version of BA-CVA must calculate the reduced version (𝐾𝑟𝑒𝑑𝑢𝑐𝑒𝑑) as well. Under the full version, capital requirement for CVA risk 𝐷𝑆𝐵𝐴−𝐶𝑉𝐴 × 𝐾𝑓𝑢𝑙𝑙 is calculated as follows, where 𝐷𝑆𝐵𝐴−𝐶𝑉𝐴 = 0.65, and 𝛽 = 0.25 is the SAMA supervisory parameter that is used to provide a floor that limits the extent to which hedging can reduce the capital requirements for CVA risk: 𝐾𝑓𝑢𝑙𝑙 = 𝛽 ∙ 𝐾𝑟𝑒𝑑𝑢𝑐𝑒𝑑 + (1 − 𝛽) ∙ 𝐾ℎ𝑒𝑑𝑔𝑒𝑑 11.21. The part of capital requirements that recognizes eligible hedges (𝐾ℎ𝑒𝑑𝑔𝑒𝑑) is calculated formulas follows (where the summations are taken over all counterparties c that are within scope of the CVA charge), where: (1) Both the stand-alone CVA capital (SCVAc ) and the correlation parameter (ρ) are defined in exactly the same way as for the reduced form calculation BA-CVA.

Page Number 94 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) 𝑆𝑁𝐻𝑐 is a quantity that gives recognition to the reduction in CVA risk of the counterparty c arising from the bank’s use of single-name hedges of credit spread risk. See 11.23 for its calculation. (3) IH is a quantity that gives recognition to the reduction in CVA risk across all counterparties arising from the bank’s use of index hedges. See 11.24 for its calculation. (4) 𝐻𝑀𝐴𝑐 is a quantity characterizing hedging misalignment, which is designed to limit the extent to which indirect hedges can reduce capital requirements given that they will not fully offset movements in a counterparty’s credit spread. That is, with indirect hedges present 𝐾ℎ𝑒𝑑𝑔𝑒𝑑cannot reach zero. See 11.25 for its calculation. 𝐾ℎ𝑒𝑑𝑔𝑒𝑑 = √(𝜌 ∙ ∑(𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) − 𝐼𝐻 𝑐 ) 2 + (1 − 𝜌 2) ∙ ∑(𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) 2 𝑐

• ∑𝐻𝑀𝐴𝑐 𝑐 11.22. The formula for 𝐾ℎ𝑒𝑑𝑔𝑒𝑑 in 11.21 comprises three main terms as below: (1)The first term (𝜌 ∙ ∑ (𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 𝑐 ) − 𝐼𝐻) 2 aggregates the systematic components of CVA risk arising from the bank’s counterparties, the single￾name hedges and the index hedges. (2)The second term (1 − 𝜌 2 ) ∙ ∑ (𝑆𝐶𝑉𝐴𝑐 − 𝑆𝑁𝐻𝑐 ) 2 𝑐 aggregates the idiosyncratic components of CVA risk arising from the bank’s counterparties and the single-name hedges. (3)The third term ∑𝑐 𝐻𝑀𝐴𝑐 aggregates the components of indirect hedges that are not aligned with counterparties’ credit spreads. 11.23. The quantity 𝑆𝑁𝐻𝑐 is calculated as follows (where the summation is across all single name hedges h that the bank has taken out to hedge the CVA risk of counterparty c), where: (1) 𝑟ℎ𝑐 is the supervisory prescribed correlation between the credit spread of counterparty c and the credit spread of a single-name hedge h of counterparty c. The value of 𝑟ℎ𝑐 is set out in the Table 2 of 11.26. It is set at 100% if the hedge directly references the counterparty c, and set at lower values if it does not.

Page Number 95 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) 𝑀ℎ 𝑆𝑁is the remaining maturity of single-name hedge h. (3) 𝐵ℎ 𝑆𝑁 is the notional of single-name hedge h. For single-name contingent credit default swaps (CDS), the notional is determined by the current market value of the reference portfolio or instrument. (4) 𝐷𝐹ℎ 𝑆𝑁 is the supervisory discount factor calculated as 1−𝑒 −0.05∙𝑀ℎ 𝑆𝑁 0.05∙𝑀ℎ 𝑆𝑁 . (5) 𝑅𝑊ℎ is the supervisory risk weight of single-name hedge h that reflects the volatility of the credit spread of the reference name of the hedging instrument. These risk weights are based on a combination of sector and credit quality of the reference name of the hedging instrument as prescribed in Table 1 of 11.16. 𝑆𝑁𝐻𝐶 = ∑𝑟ℎ𝑐 ℎ∈𝑐 ∙ 𝑅𝑊ℎ ∙ 𝑀ℎ 𝑆𝑁 ∙ 𝐵ℎ 𝑆𝑁 ∙ 𝐷𝐹ℎ 𝑆𝑁 11.24. The quantity IH is calculated as follows (where the summation is across all index hedges i that the bank has taken out to hedge CVA risk), where: (1)𝑀𝑖 𝑖𝑛𝑑is the remaining maturity of index hedge i. (2)𝐵𝑖 𝑖𝑛𝑑is the notional of the index hedge i. (3)𝐷𝐹𝑖 𝑖𝑛𝑑 is the supervisory discount factor calculated as 1−𝑒 −0.05∙𝑀𝑖 𝑖𝑛𝑑 0.05∙𝑀𝑖 𝑖𝑛𝑑 (4)𝑅𝑊𝑖 is the supervisory risk weight of the index hedge i. 𝑅𝑊𝑖 is taken from the Table 1 of 11.16 based on the sector and credit quality of the index constituents and adjusted as follows: (a) For an index where all index constituents belong to the same sector and are of the same credit quality, the relevant value in the Table 1 of 11.16 is multiplied by 0.7 to account for diversification of idiosyncratic risk within the index. (b)For an index spanning multiple sectors or with a mixture of investment grade constituents and other constituents, the name-weighted average of the risk weights from the Table 1 of 11.16 should be calculated and then multiplied by 0.7.

Page Number 96 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 I𝐻 = ∑𝑅𝑊𝑖 𝑖 ∙ 𝑀𝑖 𝑖𝑛𝑑 ∙ 𝐵𝑖 𝑖𝑛𝑑 ∙ 𝐷𝐹𝑖 𝑖𝑛𝑑 11.25. The quantity 𝐻𝑀𝐴𝑐 is calculated as follows(where the summation is across all single name hedges h that have been taken out to hedge the CVA risk of counterparty c), where 𝑟ℎ𝑐 , 𝑀ℎ 𝑆𝑁, 𝐵ℎ 𝑆𝑁, 𝐷𝐹ℎ 𝑆𝑁 and 𝑅𝑊ℎ have the same definitions as set out in 11.23. 𝐻𝑀𝐴𝑐 = ∑(1 − 𝑟ℎ𝑐 2 ℎ∈𝑐 ) ∙ (𝑅𝑊ℎ ∙ 𝑀ℎ 𝑆𝑁 ∙ 𝐵ℎ 𝑆𝑁 ∙ 𝐷𝐹ℎ 𝑆𝑁) 2 11.26. The supervisory prescribed correlations 𝑟ℎ𝑐between the credit spread of counterparty c and the credit spread of its single-name hedge h are set in Table 2 as follows: Table 2: Correlations between credit spread of counterparty and single-name hedge Single-name hedge h of counterparty c Value of rhc references counterparty c directly 100% has legal relation with counterparty c 80% shares sector and region with counterparty c 50% Standardized approach for credit valuation adjustment risk 11.27. The SA-CVA is an adaptation of the standardized approach for market risk set out in Chapter 6 to Chapter 9 of the Minimum Capital Requirements for Market Risk. The primary differences of the SA-CVA from the standardized approach for market risk are: (1) The SA-CVA features a reduced granularity of market risk factors; and (2) The SA-CVA does not include default risk and curvature risk. 11.28. Under the SA-CVA, capital requirements must be calculated and reported to SAMA at the same frequency as for the market risk standardized approach. In addition, banks using the SA-CVA must have the ability to produce SA-CVA

Page Number 97 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 capital requirement calculations at the request of SAMA and must accordingly provide the calculations. 11.29. The SA-CVA uses as inputs the sensitivities of regulatory CVA to counterparty credit spreads and market risk factors driving the values of covered transactions. Sensitivities must be computed by banks in accordance with the prudent valuation guidance set out in Basel Framework. 11.30. For a bank to be considered eligible for the use of SA-CVA by SAMA as set out in 11.7 of this framework, the bank must meet the following criteria at the minimum. (1) A bank must be able to model exposure and calculate, on at least a monthly basis, CVA and CVA sensitivities to the market risk factors specified in 11.54 to 11.77 in this framework. (2) A bank must have a CVA desk (or a similar dedicated function) responsible for risk management and hedging of CVA. Regulatory CVA calculations 11.31. A bank must calculate regulatory CVA for each counterparty with which it has at least one covered position for the purpose of the CVA risk capital requirements. 11.32. Regulatory CVA at a counterparty level must be calculated according to the following principles. A bank must demonstrate its compliance to the principles to SAMA. (1) Regulatory CVA must be calculated as the expectation of future losses resulting from default of the counterparty under the assumption that the bank itself is free from the default risk. In expressing the regulatory CVA, non-zero losses must have a positive sign. This is reflected in 11.52 where 𝑊𝑆𝑘 ℎ𝑑𝑔 must be subtracted from 𝑊𝑆𝑘 𝐶𝑉𝐴 . (2) The calculation must be based on at least the following three sets of inputs: a) term structure of market-implied probability of default (PD); b) market-consensus expected loss given default (ELGD); c) simulated paths of discounted future exposure.

Page Number 98 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (3) The term structure of market-implied PD must be estimated from credit spreads observed in the markets. For counterparties whose credit is not actively traded (i.e. illiquid counterparties), the market-implied PD must be estimated from proxy credit spreads estimated for these counterparties according to the following requirements: a) A bank must estimate the credit spread curves of illiquid counterparties from credit spreads observed in the markets of the counterparty’s liquid peers via an algorithm that discriminates on at least the following three variables: a measure of credit quality (e.g. rating), industry, and region. b) In certain cases, mapping an illiquid counterparty to a single liquid reference name can be allowed. A typical example would be mapping a municipality to its home country (i.e. setting the municipality credit spread equal to the sovereign credit spread plus a premium). A bank must justify to SAMA each case of mapping an illiquid counterparty to a single liquid reference name c) When no credit spreads of any of the counterparty’s peers is available due to the counterparty’s specific type (e.g. project finance, funds), a bank is allowed to use a more fundamental analysis of credit risk to proxy the spread of an illiquid counterparty. However, where historical PDs are used as part of this assessment, the resulting spread cannot be based on historical PD only – it must relate to credit markets. (4) The market-consensus ELGD value must be the same as the one used to calculate the risk-neutral PD from credit spreads unless the bank can demonstrate that the seniority of the exposure resulting from covered positions differs from the seniority of senior unsecured bonds. Collateral provided by the counterparty does not change the seniority of the exposure. (5) The simulated paths of discounted future exposure are produced by pricing all derivative transactions with the counterparty along simulated paths of relevant market risk factors and discounting the prices to today using risk-free interest rates along the path. (6) All market risk factors material for the transactions with a counterparty must be simulated as stochastic processes for an appropriate number of

Page Number 99 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 paths defined on an appropriate set of future time points extending to the maturity of the longest transaction. (7) For transactions with a significant level of dependence between exposure and the counterparty’s credit quality, this dependence should be taken into account. (8) For margined counterparties, collateral is permitted to be recognized as a risk mitigant under the following conditions: a) Collateral management requirements outlined in7.39 and 7.40 in this framework are satisfied. b) All documentation used in collateralized transactions must be binding on all parties and legally enforceable in all relevant jurisdictions. Banks must have conducted sufficient legal review to verify this and have a well founded legal basis to reach this conclusion, and undertake such further review as necessary to ensure continuing enforceability. (9) For margined counterparties, the simulated paths of discounted future exposure must capture the effects of margining collateral that is recognized as a risk mitigant along each exposure path. All the relevant contractual features such as the nature of the margin agreement (unilateral vs bilateral), the frequency of margin calls, the type of collateral, thresholds, independent amounts, initial margins and minimum transfer amounts must be appropriately captured by the exposure model. To determine collateral available to a bank at a given exposure measurement time point, the exposure model must assume that the counterparty will not post or return any collateral within a certain time period immediately prior to that time point. The assumed value of this time period, known as the margin period of risk (MPoR), cannot be less than SAMA’s supervisory floor. For SFTs and client cleared transactions as specified in 8.12 in this framework, the supervisory floor for the MPoR is equal to 4+N business days, where N is the re-margining period specified in the margin agreement (in particular, for margin agreements with daily or intra-daily exchange of margin, the minimum MPoR is 5 business days). For all other transactions, the supervisory floor for the MPoR is equal to 9+N business days.

Page Number 100 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.33. The simulated paths of discounted future exposure are obtained via the exposure models used by a bank for calculating front office/accounting CVA, adjusted (if needed) to meet the requirements imposed for regulatory CVA calculation. Model calibration process (with the exception of the MPoR), market and transaction data used for regulatory CVA calculation must be the same as the ones used for accounting CVA calculation. 11.34. The generation of market risk factor paths underlying the exposure models must satisfy and a bank must demonstrate to SAMA its compliance to the following requirements: (1) Drifts of risk factors must be consistent with a risk-neutral probability measure. Historical calibration of drifts is not allowed. (2) The volatilities and correlations of market risk factors must be calibrated to market data whenever sufficient data exist in a given market. Otherwise, historical calibration is permissible. (3) The distribution of modelled risk factors must account for the possible non-normality of the distribution of exposures, including the existence of leptokurtosis (“fat tails”), where appropriate. 11.35. Netting recognition is the same as in the accounting CVA calculations. In particular, netting uncertainty can be modelled. 11.36. A bank must satisfy and demonstrate to SAMA its compliance to the following requirements: (1) Exposure models used for calculating regulatory CVA must be part of a CVA risk management framework that includes the identification, measurement, management, approval and internal reporting of CVA risk. A bank must have a credible track record in using these exposure models for calculating CVA and CVA sensitivities to market risk factors. (2) Senior management should be actively involved in the risk control process and must regard CVA risk control as an essential aspect of the business to which significant resources need to be devoted. (3) A bank must have a process in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning

Page Number 101 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 the operation of the exposure system used for accounting CVA calculations. (4) A bank must have an independent control unit that is responsible for the effective initial and ongoing validation of the exposure models. This unit must be independent from business credit and trading units (including the CVA desk), must be adequately staffed and must report directly to senior management of the bank. (5) A bank must document the process for initial and ongoing validation of its exposure models to a level of detail that would enable a third party to understand how the models operate, their limitations, and their key assumptions; and recreate the analysis. This documentation must set out the minimum frequency with which ongoing validation will be conducted as well as other circumstances (such as a sudden change in market behavior) under which additional validation should be conducted. In addition, the documentation must describe how the validation is conducted with respect to data flows and portfolios, what analyses are used and how representative counterparty portfolios are constructed. (6) The pricing models used to calculate exposure for a given path of market risk factors must be tested against appropriate independent benchmarks for a wide range of market states as part of the initial and ongoing model validation process. Pricing models for options must account for the non￾linearity of option value with respect to market risk factors. (7) An independent review of the overall CVA risk management process should be carried out regularly in the bank’s own internal auditing process. This review should include both the activities of the CVA desk and of the independent risk control unit. (8) A bank must define criteria on which to assess the exposure models and their inputs and have a written policy in place to describe the process to assess the performance of exposure models and remedy unacceptable performance. (9) Exposure models must capture transaction-specific information in order to aggregate exposures at the level of the netting set. A bank must verify that transactions are assigned to the appropriate netting set within the model.

Page Number 102 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (10) Exposure models must reflect transaction terms and specifications in a timely, complete, and conservative fashion. The terms and specifications must reside in a secure database that is subject to formal and periodic audit. The transmission of transaction terms and specifications data to the exposure model must also be subject to internal audit, and formal reconciliation processes must be in place between the internal model and source data systems to verify on an ongoing basis that transaction terms and specifications are being reflected in the exposure system correctly or at least conservatively. (11) The current and historical market data must be acquired independently of the lines of business and be compliant with accounting. They must be fed into the exposure models in a timely and complete fashion, and maintained in a secure database subject to formal and periodic audit. A bank must also have a well-developed data integrity process to handle the data of erroneous and/or anomalous observations. In the case where an exposure model relies on proxy market data, a bank must set internal policies to identify suitable proxies and the bank must demonstrate empirically on an ongoing basis that the proxy provides a conservative representation of the underlying risk under adverse market conditions. Eligible hedges 11.37. Only whole transactions that are used for the purpose of mitigating CVA risk, and managed as such, can be eligible hedges. Transactions cannot be split into several effective transactions. 11.38. Eligible hedges can include: (1) instruments that hedge variability of the counterparty credit spread; and (2) instruments that hedge variability of the exposure component of CVA risk. 11.39. Instruments that are not eligible for the internal models approach for market risk under Chapter 10 to Chapter 13 of the Minimum Capital Requirements for Market Risk (e.g. tranched credit derivatives) cannot be eligible CVA hedges. Multiplier 11.40. Aggregated capital requirements can be scaled up by the multiplier 𝑚𝐶𝑉𝐴.

Page Number 103 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.41. The multiplier 𝑚𝐶𝑉𝐴is set at 1. SAMA may require a bank to use a higher value of 𝑚𝐶𝑉𝐴 if SAMA determines that the bank’s CVA model risk warrants it (e.g. if the level of model risk for the calculation of CVA sensitivities is too high or the dependence between the bank’s exposure to a counterparty and the counterparty’s credit quality is not appropriately taken into account in its CVA calculations). Calculations 11.42. The SA-CVA capital requirements are calculated as the sum of the capital requirements for delta and vega risks calculated for the entire CVA portfolio (including eligible hedges). 11.43. The capital requirements for delta risk are calculated as the simple sum of delta capital requirements calculated independently for the following six risk classes: (1) interest rate risk; (2) foreign exchange (FX) risk; (3) counterparty credit spread risk; (4) reference credit spread risk (i.e. credit spreads that drive the CVA exposure component); (5) equity risk; and (6) commodity risk. 11.44. If an instrument is deemed as an eligible hedge for credit spread delta risk, it must be assigned in its entirety (see 11.37 of this framework) either to the counterparty credit spread or to the reference credit spread risk class. Instruments must not be split between the two risk classes. 11.45. The capital requirements for vega risk are calculated as the simple sum of vega capital requirements calculated independently for the following five risk classes. There is no vega capital requirements for counterparty credit spread risk. (1) interest rate risk; (IR); (2) FX risk; (3) reference credit spread risk; (4) equity risk; and (5) commodity risk

Page Number 104 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.46. Delta and vega capital requirements are calculated in the same manner using the same procedures set out in 11.47 to 11.53 of this framework. 11.47. For each risk class, (i) the sensitivity of the aggregate CVA, 𝑠𝑘 𝐶𝑉𝐴, and (ii) the sensitivity of the market value of all eligible hedging instruments in the CVA portfolio, 𝑠𝑘 𝐻𝑑𝑔, to each risk factor k in the risk class are calculated. The sensitivities are defined as the ratio of the change of the value in question (i.e. (i) aggregate CVA or (ii) market value of all CVA hedges) caused by a small change of the risk factor’s current value to the size of the change. Specific definitions for each risk class are set out in 11.54 to 11.77of this framework. These definitions include specific values of changes or shifts in risk factors. However, a bank may use smaller values of risk factor shifts if doing so is consistent with internal risk management calculations. A bank may use AAD and similar computational techniques to calculate CVA sensitivities under the SA-CVA if doing so is consistent with the bank’s internal risk management calculations and the relevant validation standards described in the SA-CVA framework. 11.48. CVA sensitivities for vega risk are always material and must be calculated regardless of whether or not the portfolio includes options. When CVA sensitivities for vega risk are calculated, the volatility shift must apply to both types of volatilities that appear in exposure models: (1) volatilities used for generating risk factor paths; and (2) volatilities used for pricing options. 11.49. If a hedging instrument is an index, its sensitivities to all risk factors upon which the value of the index depends must be calculated. The index sensitivity to risk factor k must be calculated by applying the shift of risk factor k to all index constituents that depend on this risk factor and recalculating the changed value of the index. For example, to calculate delta sensitivity of S&P500 to large financial companies, a bank must apply the relevant shift to equity prices of all large financial companies that are constituents of S&P500 and re-compute the index. 11.50. For the following risk classes, a bank may choose to introduce a set of additional risk factors that directly correspond to qualified credit and equity indices. For delta risks, a credit or equity index is qualified if it satisfies liquidity and diversification conditions specified in Chapter 7.31 of the Minimum Capital Requirements for Market Risk; for vega risks, any credit or equity index is

Page Number 105 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 qualified. Under this option, a bank must calculate sensitivities of CVA and the eligible CVA hedges to the qualified index risk factors in addition to sensitivities to the non-index risk factors. Under this option, for a covered transaction or an eligible hedging instrument whose underlying is a qualified index, its contribution to sensitivities to the index constituents is replaced with its contribution to a single sensitivity to the underlying index. For example, for a portfolio consisting only of equity derivatives referencing only qualified equity indices, no calculation of CVA sensitivities to non-index equity risk factors is necessary. If more than 75% of constituents of a qualified index (taking into account the weightings of the constituents) are mapped to the same sector, the entire index must be mapped to that sector and treated as a single-name sensitivity in that bucket. In all other cases, the sensitivity must be mapped to the applicable index bucket. (1) counterparty credit spread risk; (2) reference credit spread risk; and (3) equity risk. 11.51. The weighted sensitivities 𝑊𝑆𝑘 𝐶𝑉𝐴 and 𝑊𝑆𝑘 𝐻𝑑𝑔 for each risk factor k are calculated by multiplying the net sensitivities 𝑆𝑘 𝐶𝑉𝐴and 𝑆𝑘 𝐻𝑑𝑔, respectively, by the corresponding risk weight 𝑅𝑊𝑘 (the risk weights applicable to each risk class are specified in 11.54 to 11.77 of this framework). 𝑊𝑆𝑘 𝐶𝑉𝐴 = 𝑅𝑊𝑘𝑠𝑘 𝐶𝑉𝐴 𝑊𝑆𝑘 𝐻𝑑𝑔 = 𝑅𝑊𝑘𝑠𝑘 𝐻𝑑𝑔 11.52. The net weighted sensitivity of the CVA portfolio 𝑆𝐾 to risk factor k is obtained by44:

44 Note that the formula in 11.52 is set out under the convention that the CVA is positive as specified in 11.32 (1). It intends to recognize the risk reducing effect of hedging. For example, when hedging the counterparty credit spread component of CVA risk for a specific counterparty by buying credit protection on the counterparty: if the counterparty’s credit spread widens, the CVA (expressed as a positive value) increases resulting in the positive CVA sensitivity to the counterparty credit spread. At the same time, as the value of the hedge from the bank’s perspective increases as well (as credit protection becomes more valuable), the sensitivity of the hedge is also positive. The positive weighted sensitivities of the CVA and its hedge offset each other using the formula with the minus sign. If CVA loss had been expressed as a negative value, the minus sign in 11.52 would have been replaced by a plus sign.

Page Number 106 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑊𝑆𝑘 = 𝑊𝑆𝐾 𝐶𝑉𝐴 − 𝑊𝑆𝑘 𝐻𝑑𝑔 11.53. For each risk class, the net sensitivities are aggregated as follows: (1)The weighted sensitivities must be aggregated into a capital requirement 𝐾𝑏 within each bucket b (the buckets and correlation parameters 𝜌𝐾𝑙 applicable to each risk class are specified in 11.54 to 11.77 of this framework), where R is the hedging disallowance parameter, set at 0.01, that prevents the possibility of recognizing perfect hedging of CVA risk. 𝐾𝑏 = √(∑𝑊𝑆𝑘 2 + ∑ ∑ 𝜌𝐾𝑙𝑊𝑆𝐾𝑊𝑆𝑙 𝑙∈𝑏,𝑙≠𝑘 𝑘∈𝑏 𝐾∈𝑏 ) + 𝑅 ⋅ ∑ ((𝑊𝑆𝐾 𝐻𝑑𝑔) 2 ) 𝐾∈𝑏 (2)Bucket-level capital requirements must then be aggregated across buckets within each risk class (the correlation parameters γbc applicable to each risk class are specified in 11.54 to 11.77 of this framework). Note that this equation differs from the corresponding aggregation equation for market risk capital requirements in Chapter 7.4 of the Minimum Capital Requirements for Market Risk, including the multiplier 𝑚𝐶𝑉𝐴. 𝐾 = 𝑚𝐶𝑉𝐴√∑𝐾𝑏 2 𝑏 +∑∑𝛾𝑏𝑐𝑆𝑏𝑆𝑐 𝑏 𝑏≠𝑐 (3)In calculating K in above (2), S is defined as the sum of the weighted b sensitivities WS for all risk factors k within bucket b, floored by -K and k b capped by K , and the S is defined in the same way for all risk factors k in b c bucket c: 𝑆𝑏 = 𝑚𝑎𝑥 {−𝐾𝑏; 𝑚𝑖𝑛 (∑𝑊𝑆𝐾;𝐾𝑏 𝐾∈𝑏 )} 𝑆𝑐 = 𝑚𝑎𝑥 {−𝐾𝑐 ; 𝑚𝑖𝑛 (∑𝑊𝑆𝐾;𝐾𝑐 𝐾∈𝑐 )} Interest rates buckets, risk factors, sensitivities, risk weights and correlations 11.54. For interest rate delta and vega risks, buckets must be set per individual currencies.

Page Number 107 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.55. For interest rate delta and vega risks, cross-bucket correlation 𝛾𝑏𝑐 is set at 0.5 for all currency pairs. 11.56. The interest rate delta risk factors for a bank’s reporting currency and for the following currencies USD, EUR, GBP, AUD, CAD, SEK or JPY: (1) The interest rate delta risk factors are the absolute changes of the inflation rate and of the risk-free yields for the following five tenors: 1 year, 2 years, 5 years, 10 years and 30 years. (2) The sensitivities to the abovementioned risk-free yields are measured by changing the risk-free yield for a given tenor for all curves in a given currency by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. The sensitivity to the inflation rate is obtained by changing the inflation rate by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. (3) The risk weights 𝑅𝑊𝑘 are set as follows: Table 3: Risk weight for interest rate risk (specified currencies) Risk factor 1 year 2 years 5 years 10 years 30 years Inflation Risk weight 1.11% 0.93% 0.74% 0.74% 0.74% 1.11% (4) The correlations between pairs of risk factors 𝜌𝑘𝑙 are set as follows: Table 4: Correlations for interest rate risk factors (specified currencies) 1 year 2 years 5 years 10 years 30 years Inflation 1 year 100% 91% 72% 55% 31% 40%

Page Number 108 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 2 years 100% 87% 72% 45% 40% 5 years 100% 91% 68% 40% 10 years 100% 83% 40% 30 years 100% 40% Inflation 100% 11.57. The interest rate delta risk factors for other currencies not specified in 11.56 of this framework: (1) The interest rate risk factors are the absolute change of the inflation rate and the parallel shift of the entire risk-free yield curve for a given currency. (2) The sensitivity to the yield curve is measured by applying a parallel shift to all risk-free yield curves in a given currency by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. The sensitivity to the inflation rate is obtained by changing the inflation rate by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. (3) The risk weights for both the risk-free yield curve and the inflation rate 𝑅𝑊𝑘 are set at 1.85%. (4) The correlations between the risk-free yield curve and the inflation rate 𝜌𝐾𝑙 are set at 40%. 11.58. The interest rate vega risk factors for all currencies: (1) The interest rate vega risk factors are a simultaneous relative change of all volatilities for the inflation rate and a simultaneous relative change of all interest rate volatilities for a given currency. (2) The sensitivity to (i) the interest rate volatilities or (ii) inflation rate volatilities is measured by respectively applying a simultaneous shift to (i)

Page Number 109 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 all interest rate volatilities or (ii) inflation rate volatilities by 1% relative to their current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) The risk weights for both the interest rate volatilities and the inflation rate volatilities 𝑅𝑊𝑘 are set to 100%. (4) Correlations between the interest rate volatilities and the inflation rate volatilities 𝜌𝑘𝑙 are set at 40%. Foreign exchange buckets, risk factors, sensitivities, risk weights and correlations 11.59. For FX delta and vega risks, buckets must be set per individual currencies except for a bank’s own reporting currency. 11.60. For FX delta and vega risks, the cross-bucket correlation 𝛾𝑏𝑐 is set at 06. for all currency pairs. 11.61. The FX delta risk factors for all currencies: (1)The single FX delta risk factor is defined as the relative change of the FX spot rate between a given currency and a bank’s reporting currency, where the FX spot rate is the current market price of one unit of another currency expressed in the units of the bank’s reporting currency. (2)Sensitivities to FX spot rates are measured by shifting the exchange rate between the bank’s reporting currency and another currency (i.e. the value of one unit of another currency expressed in units of the reporting currency) by 1% relative to its current value and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. For transactions that reference an exchange rate between a pair of non-reporting currencies, the sensitivities to the FX spot rates between the bank’s reporting currency and each of the referenced non-reporting currencies must be measured.45 (3)The risk weights for all exchange rates between the bank’s reporting currency and another currency are set at 11%.

45 For example, if a SAR-reporting bank holds an instrument that references the USD-GBP exchange rate, the bank must measure CVA sensitivity both to the SAR-GBP exchange rate and to the SAR￾USD exchange rate.

Page Number 110 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 11.62. The FX vega risk factors for all currency: (1) The single FX vega risk factor is a simultaneous relative change of all volatilities for an exchange rate between a bank’s reporting currency and another given currency. (2) The sensitivities to the FX volatilities are measured by simultaneously shifting all volatilities for a given exchange rate between the bank’s reporting currency and another currency by 1% relative to their current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. For transactions that reference an exchange rate between a pair of non-reporting currencies, the volatilities of the FX spot rates between the bank’s reporting currency and each of the referenced non-reporting currencies must be measured. (3) The risk weights for FX volatilities 𝑅𝑊𝑘 are set to 100%. Counterparty credit spread buckets, risk factors, sensitivities, risk weights and correlations 11.63. Counterparty credit spread risk is not subject to vega risk capital requirements. Buckets for delta risk are set as follows: (1) Buckets 1 to 7 are defined for factors that are not qualified indices as set out in 11.50 of this framework; (2) Bucket 8 is set for the optional treatment of qualified indices. Under the optional treatment, only instruments that reference qualified indices can be assigned to bucket 8, while all single-name and all non-qualified index hedges must be assigned to buckets 1 to 7 for calculations of CVA sensitivities and sensitivities. For any instrument referencing an index assigned to buckets 1 to 7, the look-through approach must be used (i.e., sensitivity of the hedge to each index constituent must be calculated). Table 5: Buckets for counterparty credit spread delta risk Bucket number Sector

Page Number 111 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 1 a) Sovereigns including central banks, multilateral development banks b) Local government, government-backed non-financials, education and public administration 2 Financials including government-backed financials 3 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 4 Consumer goods and services, transportation and storage, administrative and support service activities 5 Technology, telecommunications 6 Health care, utilities, professional and technical activities 7 Other sector 8 Qualified Indices 11.64. For counterparty credit spread delta risk, cross-bucket correlations 𝛾𝑏𝑐 are set as follows: Table 6: Cross-bucket correlations for counterparty credit spread delta risk Bucket 1 2 3 4 5 6 7 8 1 100% 10% 20% 25% 20% 15% 0% 45% 2 100% 5% 15% 20% 5% 0% 45% 3 100% 20% 25% 5% 0% 45% 4 100% 25% 5% 0% 45%

Page Number 112 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 5 100% 5% 0% 45% 6 100% 0% 45% 7 100% 0% 8 100% 11.65. The counterparty credit spread delta risk factors for a given bucket: (1) The counterparty credit spread delta risk factors are absolute shifts of credit spreads of individual entities (counterparties and reference names for counterparty credit spread hedges) and qualified indices (if the optional treatment is chosen) for the following tenors: 0.5 years, 1 year, 3 years, 5 years and 10 years. (2) For each entity and each tenor point, the sensitivities are measured by shifting the relevant credit spread by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. (3) The risk weights 𝑅𝑊𝑘 are set as follows the depending on the entity’s bucket, where IG, HY, and NR represent “investment grade”, “high yield” and “not rated” as specified for the BA-CVA in 11.16 of this framework. The same risk weight for a given bucket and given credit quality applies to all tenors. Table 7: Risk weights for counterparty credit spread delta risk Bucket 1 a) 1 b) 2 3 4 5 6 7 8 IG names 0.5% 1.0% 5.0% 3.0% 3.0% 2.0% 1.5% 5.0% 1.5% HY and NR names 2.0% 4.0% 12.0% 7.0% 8.5% 5.5% 5.0% 12.0% 5.0%

Page Number 113 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (4) For buckets 1 to 7, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 is calculated as follows, where: a) 𝜌𝑡𝑒𝑛𝑜𝑟 is equal to 100% if the two tenors are the same and 90% otherwise; b) 𝜌𝑛𝑎𝑚𝑒 is equal to 100% if the two names are the same, 90% if the two names are distinct, but legally related and 50% otherwise; c) 𝜌𝑞𝑢𝑎𝑙𝑖𝑡𝑦 is equal to 100% if the credit quality of the two names is the same (i.e. IG and IG or HY/NR and HY/NR) and 80% otherwise. 𝜌𝑘𝑙 = 𝜌𝑡𝑒𝑛𝑜𝑟 ∙ 𝜌𝑛𝑎𝑚𝑒 ∙ 𝜌𝑞𝑢𝑎𝑙𝑖𝑡𝑦 (5) For bucket 8, the correlation parameter 𝜌𝑘𝑙 between two weighted sensitivities 𝑊𝑆𝑘 and 𝑊𝑆𝑙 is calculated as follows, where a) 𝜌𝑡𝑒𝑛𝑜𝑟 is equal to 100% if the two tenors are the same and 90% otherwise; b) 𝜌𝑛𝑎𝑚𝑒 is equal to 100% if the two indices are the same and of the same series, 90% if the two indices are the same, but of distinct series, and 80% otherwise; c) 𝜌𝑞𝑢𝑎𝑙𝑖𝑡𝑦 is equal to 100% if the credit quality of the two indices is the same (ie IG and IG or HY and HY) and 80% otherwise. 𝜌𝑘𝑙 = 𝜌𝑡𝑒𝑛𝑜𝑟 ∙ 𝜌𝑛𝑎𝑚𝑒 ∙ 𝜌𝑞𝑢𝑎𝑙𝑖𝑡𝑦 Reference credit spread buckets, risk factors, sensitivities, risk weights and correlations 11.66. Reference credit spread risk is subject to both delta and vega risk capital requirements. Buckets for delta and vega risks are set as follows, where IG, HY and NR represent “investment grade”, “high yield” and “not rated” as specified for the BA-CVA in 11.16 of this framework: Table 8: Buckets for reference credit spread risk Bucket number Credit quality Sector 1 IG Sovereigns including central banks, multilateral development banks

Page Number 114 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 2 Local government, government-backed non-financials, education and public administration 3 Financials including government-backed financials 4 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 5 Consumer goods and services, transportation and storage, administrative and support service activities 6 Technology, telecommunications 7 Health care, utilities, professional and technical activities 8 (HY) and NR Sovereigns including central banks, multilateral development banks 9 Local government, government-backed non-financials, education and public administration 10 Financials including government-backed financials 11 Basic materials, energy, industrials, agriculture, manufacturing, mining and quarrying 12 Consumer goods and services, transportation and storage, administrative and support service activities 13 Technology, telecommunications 14 Health care, utilities, professional and technical activities 15 (Not applicable) Other sector 16 IG Qualified Indices

Page Number 115 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 17 HY Qualified Indices 11.67. For reference credit spread delta and Vega risks, cross-bucket correlations 𝛾𝑏𝑐 are set as follows: (1) The cross-bucket correlations 𝛾𝑏𝑐between buckets of the same credit quality (ie either IG or HY/NR) are set as follows: Table 9: Cross-bucket correlations for reference credit spread risk Bucket 1/8 2/9 3/10 4/11 5/12 6/13 7/14 15 16 17 1/8 100% 75% 10% 20% 25% 20% 15% 0% 45% 45% 2/9 100% 5% 15% 20% 15% 10% 0% 45% 45% 3/10 100% 5% 15% 20% 5% 0% 45% 45% 4/11 100% 20% 25% 5% 0% 45% 45% 5/12 100% 25% 5% 0% 45% 45% 6/13 100% 5% 0% 45% 45% 7/14 100% 0% 45% 45% 15 100% 0% 0% 16 100% 75% 17 100%

Page Number 116 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (2) For cross-bucket correlations 𝛾𝑏𝑐between buckets 1 to 14 of different credit quality (i.e. IG and HY/NR), the correlations 𝛾𝑏𝑐specified in 11.67 of this framework (1) are divided by 2. 11.68. Reference credit spread delta risk factors for a given bucket: (1) The single reference credit spread delta risk factor is a simultaneous absolute shift of the credit spreads of all tenors for all reference names in the bucket. (2) The sensitivity to reference credit spread delta risk is measured by simultaneously shifting the credit spreads of all tenors for all reference names in the bucket by 1 basis point (0.0001 in absolute terms) and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.0001. (3) The risk weights 𝑅𝑊𝑘 are set as follows depending on the reference name’s bucket: Table 10: Risk weights for reference credit spread delta risk IG bucket 1 2 3 4 5 6 7 8 9 Risk weight 0.5% 1.0% 5.0% 3.0% 3.0% 2.0% 1.5% 2.0% 4.0% HY/NR bucket 10 11 12 13 14 15 16 17 Risk weight 12.0% 7.0% 8.5% 5.5% 5.0% 12.0% 1.5% 5.0% 11.69. Reference credit spread vega risk factors for a given bucket: (1) The single reference credit spread Vega risk factor is a simultaneous relative shift of the volatilities of credit spreads of all tenors for all reference names in the bucket. (2) The sensitivity to the reference credit spread vega risk factor is measured by simultaneously shifting the volatilities of credit spreads of all tenors for all reference names in the bucket by 1% relative to their current values and

Page Number 117 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) Risk weights for reference credit spread volatilities 𝑅𝑊𝑘 are set to 100%. Equity buckets, risk factors, sensitivities, risk weights and correlations 11.70. For equity delta and vega risks, buckets are set as follow, where: (1) Market capitalization (“market cap”) is defined as the sum of the market capitalizations of the same legal entity or group of legal entities across all stock markets globally. The reference to “group of legal entities” covers cases where the listed entity is a parent company of a group of legal entities. Under no circumstances should the sum of the market capitalizations of multiple related listed entities be used to determine whether a listed entity is “large market cap” or “small market cap”. (2) “Large market cap” is defined as a market capitalization equal to or greater than USD 2 billion and “small market cap” is defined as a market capitalization of less than USD 2 billion. (3) The advanced economies are Canada, the United States, Mexico, the euro area, the non-euro area western European countries (the United Kingdom, Norway, Sweden, Denmark and Switzerland), Japan, Oceania (Australia and New Zealand), Singapore and Hong Kong SAR. (4) To assign a risk exposure to a sector, banks must rely on a classification that is commonly used in the market for grouping issuers by industry sector. The bank must assign each issuer to one of the sector buckets in the table above and it must assign all issuers from the same industry to the same sector. Risk positions from any issuer that a bank cannot assign to a sector in this fashion must be assigned to the “other sector” (i.e. bucket 11). For multinational multi-sector equity issuers, the allocation to a particular bucket must be done according to the most material region and sector in which the issuer operates. Table 11: Buckets for equity risk

Page Number 118 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Bucket number Size Region Sector 1 Large Emerging market economies Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 2 Telecommunications, industrials 3 Basic materials, energy, agriculture, manufacturing, mining and quarrying 4 Financials including government-backed financials, real estate activities, technology 5 Advanced economies Consumer goods and services, transportation and storage, administrative and support service activities, healthcare, utilities 6 Telecommunications, industrials 7 Basic materials, energy, agriculture, manufacturing, mining and quarrying 8 Financials including government-backed financials, real estate activities, technology 9 Small Emerging market economies All sectors described under bucket numbers 1, 2, 3, and 4 10 Advanced economies All sectors described under bucket numbers 5, 6, 7, and 8 11 (Not applicable) Other sector

Page Number 119 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12 Large cap, advanced economies Qualified Indices 13 Other Qualified Indices 11.71. For equity delta and vega risks, cross-bucket correlation 𝛾𝑏𝑐 is set at 15% for all cross-bucket pairs that fall within bucket numbers 1 to 10. The cross-bucket correlation between buckets 12 and 13 is set at 75% and the cross bucket correlation between buckets 12 or 13 and any of the buckets 1-10 is 45%. 𝛾𝑏𝑐 is set at 0% for all cross-bucket pairs that include bucket 11. 11.72. Equity delta risk factors for a given bucket: (1) The single equity delta risk factor is a simultaneous relative shift of equity spot prices for all reference names in the bucket. (2) The sensitivity to the equity delta risk factors is measured by simultaneously shifting the equity spot prices for all reference names in the bucket by 1% relative to their current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) Risk weights 𝑅𝑊𝑘 are set as follows depending on the reference name’s bucket: Table 12: Risk weights for equity delta risk Bucket number Risk weight 1 55% 2 60% 3 45% 4 55%

Page Number 120 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 5 30% 6 35% 7 40% 8 50% 9 70% 10 50% 11 70% 12 15% 13 25% 11.73. Equity Vega risk factors for a given bucket: (1) The single equity vega risk factor is a simultaneous relative shift of the volatilities for all reference names in the bucket. (2) The sensitivity to equity vega risk factors are measured by simultaneously shifting the volatilities for all reference names in the bucket by 1% relative to their current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) The risk weights for equity volatilities 𝑅𝑊𝑘 are set to 78% for large market capitalization buckets and to 100% for other buckets. Commodity buckets, risk factors, sensitivities, risk weights and correlations 11.74. For commodity delta and vega risks, buckets are set as follows: Table 13: Buckets for commodity risk Bucket number Commodity group Examples

Page Number 121 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 1 Energy – Solid combustibles coal, charcoal, wood pellets, nuclear fuel (such as uranium) 2 Energy – Liquid combustibles crude oil (such as Light-sweet, heavy, WTI and Brent); biofuels (such as bioethanol and biodiesel); petrochemicals (such as propane, ethane, gasoline, methanol and butane); refined fuels (such as jet fuel, kerosene, gasoil, fuel oil, naptha, heating oil and diesel) 3 Energy – Electricity and carbon trading electricity (such as spot, day-ahead, peak and off-peak); carbon emissions trading (such as certified emissions reductions, in delivery month EUA, RGGI CO2 allowance and renewable energy certificates) 4 Freight dry-bulk route (such as capesize, panamex, handysize and supramax); liquid-bulk/gas shipping route (such as suezmax, aframax and very large crude carriers) 5 Metals – non￾precious base metal (such as aluminum, copper, lead, nickel, tin and zinc); steel raw materials (such as steel billet, steel wire, steel coil, steel scrap and steel rebar, iron ore, tungsten, vanadium, titanium and tantalum); minor metals (such as cobalt, manganese, molybdenum) 6 Gaseous combustibles natural gas; liquefied natural gas 7 Precious metals (including gold) gold; silver; platinum; palladium 8 Grains & oilseed corn; wheat; soybean (such as soybean seed, soybean oil and soybean meal); oats; palm oil; canola; barley; rapeseed (such as rapeseed seed, rapeseed oil, and rapeseed meal); red bean, sorghum; coconut oil; olive oil; peanut oil; sunflower oil; rice 9 Livestock & dairy cattle (such live and feeder); poultry; lamb; fish; shrimp; dairy (such as milk, whey, eggs, butter and cheese) 10 Softs and other agriculturals cocoa; coffee (such as arabica and robusta); tea; citrus and orange juice; potatoes; sugar; cotton; wool; lumber and pulp; rubber 11 Other commodity industrial minerals (such as potash, fertilizer and phosphate rocks), rare earths; terephthalic acid; flat glass 11.75. For commodity delta and vega risks, cross-bucket correlation 𝛾𝑏𝑐 is set at 20% for all cross-bucket pairs that fall within bucket numbers 1 to 10. 𝛾𝑏𝑐 is set at 0% for all cross-bucket pairs that include bucket 11. 11.76. Commodity delta risk factors for a given bucket: (1) The single commodity delta risk factor is a simultaneous relative shift of commodity spot prices for all commodities in the bucket. (2) The sensitivities to commodity delta risk factors are measured by shifting the spot prices of all commodities in the bucket by 1% relative to their

Page Number 122 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) The risk weights 𝑅𝑊𝑘 are set as follows depending on the reference name’s bucket: Table 14: Risk weights for commodity delta risk Bucket 1 2 3 4 5 6 7 8 9 10 11 RW 30% 35% 60% 80% 40% 45% 20% 35% 25% 35% 50% 11.77. Commodity vega risk factors for a given bucket: (1) The single commodity vega risk factor is a simultaneous relative shift of the volatilities for all commodities in the bucket. (2) The sensitivity to commodity vega risk factors is measured by simultaneously shifting the volatilities for all commodities in the bucket by 1% relative to their current values and dividing the resulting change in the aggregate CVA (or the value of CVA hedges) by 0.01. (3) Risk weights for commodity volatilities 𝑅𝑊𝑘 are set to 100%⋅

Page Number 123 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Application Guidance/ Illustrative examples 12.The application of the (SA-CCR) to sample portfolios 12.1. This section sets out the calculation of exposure at default (EAD) for five sample portfolios using SA-CCR. The calculations for the sample portfolios assume that intermediate values are not rounded (i.e. the actual results are carried through in sequential order). However, for ease of presentation, these intermediate values as well as the final EAD are rounded. 12.2. The EAD for all netting sets in SA-CCR is given by the following formula, where alpha is assigned a value of 1.4: 𝐸𝐴𝐷 = 𝑎𝑙𝑝ℎ𝑎 ∗ (𝑅𝐶 + 𝑚𝑢𝑙𝑡𝑖𝑝𝑙𝑖𝑒𝑟 ∗ 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 Example 1: Interest rate derivatives (unmargined netting set) 12.3. Netting set 1 consists of three interest rates derivatives: two fixed versus floating interest rate swaps and one purchased physically-settled European swaption. The table below summarizes the relevant contractual terms of the three derivatives. All notional amounts and market values in the table are given in USD thousands. Trade # Nature Residual maturity Base currency Notional (USD thousands) Pay Leg () Receive Leg () Market value (USD thousands) 1 Interest Rate Swap 10 years USD 10,000 Fixed Floating 30 2 Interest Rate Swap 4 years USD 10,000 Floating Fixed -20 3 European Swaption 1 into 10 years EUR 5,000 Floating Fixed 50 (*) For the swaption, the legs are those of the underlying swap 12.4. The netting set is not subject to a margin agreement and there is no exchange of collateral (independent amount/initial margin) at inception. For unmargined netting sets, the replacement cost is calculated using the following formula, where:

Page Number 124 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)V is a simple algebraic sum of the derivatives’ market values at the reference date (2)C is the haircut value of the initial margin, which is zero in this example 𝑅𝐶 = max{𝑉 − 𝐶; 0} 12.5. Thus, using the market values indicated in the table (expressed in USD thousands): 𝑅𝐶 = max{30 − 20 + 50 − 0; 0} = 60 12.6. Since V-C is positive (i.e. USD 60,000), the value of the multiplier is 1, as explained in 6.24. 12.7. The remaining term to be calculated in the calculation EAD is the aggregate add￾on (𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒). All the transactions in the netting set belong to the interest rate asset class. The 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 for the interest rate asset class can be calculated using the seven steps set out in 6.60. 12.8. Step 1: Calculate the effective notional for each trade in the netting set. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (δ); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional Di is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿. 12.9. For interest rate derivatives, the trade-level adjusted notional (𝑑𝑖 ) is the product of the trade notional amount and the supervisory duration (𝑆𝐷𝑖 ), i.e. 𝑑𝑖 = 𝑛𝑜𝑡𝑖𝑜𝑛𝑎𝑙 ∗ 𝑆𝐷𝑖 . The supervisory duration is calculated using the following formula, where: (1)𝑆𝑖 and 𝐸𝑖 are the start and end dates, respectively, of the time period referenced by the interest rate derivative (or, where such a derivative references the value of another interest rate instrument, the time period determined on the basis of the underlying instrument). If the start date has occurred (e.g. an ongoing interest rate swap), 𝑆𝑖 must be set to zero. (2)The calculated value of 𝑆𝐷𝑖 is floored at 10 business days (which expressed in years, using an assumed market convention of 250 business days a year is 10/250 years

Page Number 125 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑆𝐷𝑖 = exp(−0.05 ∗ 𝑆𝑖 ) − exp(−0.05 ∗ 𝐸𝑖) 0.05 12.10.Using the formula for supervisory duration above, the trade-level adjusted notional amounts for each of the trades in Example 1 are as follows: Trade # Notional (USD thousand) 𝑆𝑖 𝐸𝑖 𝑆𝐷𝑖 Adjusted notional, 𝑑𝑖 (USD thousands) 1 10,000 0 10 7.87 78,694 2 10,000 0 4 3.63 36,254 3 5,000 1 11 7.49 37,428 12.11.6.51 sets out the calculation of the maturity factor (𝑀𝐹𝑖 ) for unmargined trades. For trades that have a remaining maturity in excess of one year, which is the case for all trades in this example, the formula gives a maturity factor of 1. 12.12.As set out in 6.40 to 6.43, a supervisory delta is assigned to each trade. In particular: (1)Trade 1 is long in the primary risk factor (the reference floating rate) and is not an option so the supervisory delta is equal to 1. (2)Trade 2 is short in the primary risk factor and is not an option; thus, the supervisory delta is equal to -1. (3)Trade 3 is an option to enter into an interest rate swap that is short in the primary risk factor and therefore is treated as a bought put option. As such, the supervisory delta is determined by applying the relevant formula in 6.42, using 50% as the supervisory option volatility and 1 (year) as the option exercise date. In particular, assuming that the underlying price (the appropriate forward swap rate) is 6% and the strike price (the swaption’s fixed rate) is 5%, the supervisory delta is: 𝛿𝑖 = −Φ (− ln ( 0.06 0.05) + 0.05 ∙ 0.052 ∙ 1 0.5 ∙ √1 )

Page Number 126 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12.13.The effective notional for each trade in the netting set (𝐷𝑖 ) is calculated using the formula 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 and values for each term noted above. The results of applying the formula are as follows: Trade # Notional (USD thousands) Adjusted notional, 𝑑𝑖 (USD, thousands) Maturity Factor, 𝑀𝐹𝑖 Delta, 𝛿𝑖 Effective notional, 𝐷𝑖 (USD, thousands) 1 10,000 78,694 1 1 78,694 2 10,000 36,254 1 -1 -36,254 3 5,000 37,428 1 -0.2694 -10,083 12.14.Step 2: Allocate the trades to hedging sets. In the interest rate asset class the hedging sets consist of all the derivatives that reference the same currency. In this example, the netting set is comprised of two hedging sets, since the trades refer to interest rates denominated in two different currencies (USD and EUR). 12.15.Step 3: Within each hedging set allocate each of the trades to the following three maturity buckets: less than one year (bucket 1), between one and five years (bucket 2) and more than five years (bucket 3). For this example, within the hedging set “USD”, trade 1 falls into the third maturity bucket (more than 5 years) and trade 2 falls into the second maturity bucket (between one and five years). Trade 3 falls into the third maturity bucket (more than 5 years) of the hedging set “EUR”. The results of steps 1 to 3 are summarized in the table below: Trade # Effective notional, 𝐷𝑖 (USD, thousands) Hedging set Maturity bucket 1 78,694 USD 3 2 -36,254 USD 2 3 -10,083 EUR 3 12.16.Step 4: Calculate the effective notional of each maturity bucket (𝐷 𝐵1 , 𝐷 𝐵2 and 𝐷 𝐵3 ) within each hedging set (USD and EUR) by adding together all the trade

Page Number 127 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 level effective notionals within each maturity bucket in the hedging set. In this example, there are no maturity buckets within a hedging set with more than one trade, and so this case the effective notional of each maturity bucket is simply equal to the effective notional of the single trade in each bucket. Specifically: (1)For the USD hedging set: 𝐷 𝐵1 is zero, 𝐷 𝐵2 is -36,254 (thousand USD) and 𝐷 𝐵3 is 78,694 (thousand USD) (2)For the EUR hedging set: 𝐷 𝐵1 and 𝐷 𝐵2 are zero and 𝐷 𝐵3 is -10,083 (thousand USD). 12.17.Step 5: Calculate the effective notional of the hedging set (𝐸𝑁𝐻𝑆) by using either of the two following aggregation formulas (the latter is to be used if the bank chooses not to recognize offsets between long and short positions across maturity buckets): Offset formula: 𝐸𝑁ℎ𝑠 = [(𝐷 𝐵1 ) 2 + (𝐷 𝐵2 ) 2 + (𝐷 𝐵3 ) 2 + 1.4 ∗ 𝐷 𝐵1 ∗ 𝐷 𝐵2 + 1.4 ∗ 𝐷 𝐵2 ∗ 𝐷 𝐵3 + 0.6 ∗ 𝐷 𝐵1 ∗ 𝐷 𝐵3 ] 1 2 No offset formula: 𝐸𝑁ℎ𝑠 = |𝐷 𝐵1 | + |𝐷 𝐵2 | + |𝐷 𝐵3 | 12.18.In this example, the first of the two aggregation formulas is used. Therefore, the effective notionals for the USD hedging set (𝐸𝑁𝑈𝑆𝐷) and the EUR hedging (𝐸𝑁𝐸𝑈𝑅) are, respectively (expressed in USD thousands): 𝐸𝑁𝑈𝑆𝐷 = [(−36,254) 2 + (78,694) 2 + 1.4 ∗ (−36,254) ∗ 78,694] 1 2 = 59,270 𝐸𝑁𝐸𝑈𝑅 = [(−10,083) 2 ] 1 2 = 10,083 12.19.Step 6: Calculate the hedging set level add-on (𝐴𝑑𝑑𝑂𝑛ℎ𝑠 ) by multiplying the effective notional of the hedging set (𝐸𝑁ℎ𝑠 ) by the prescribed supervisory factor (𝑆𝐹ℎ𝑠 ). The prescribed supervisory factor in the interest rate asset class is set at 0.5%. Therefore, the add-on for the USD and EUR hedging sets are, respectively (expressed in USD thousands): 𝐴𝑑𝑑𝑂𝑛𝑈𝑆𝐷 = 59,270 ∗ 0.005 = 296.35 𝐴𝑑𝑑𝑂𝑛𝐸𝑈𝑅 = 10,083 ∗ 0.005 = 50.415

Page Number 128 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12.20.Step 7: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐼𝑅) by adding together all of the hedging set level add-ons calculated in step 6. Therefore, the add-on for the interest rate asset class is (expressed in USD thousands): 𝐴𝑑𝑑𝑂𝑛𝐼𝑅 = 296.35 + 50.415 = 347 12.21.For this netting set the interest rate add-on is also the aggregate add-on because there are no derivatives belonging to other asset classes. The EAD for the netting set can now be calculated using the formula set out in 12.2 (expressed in USD thousands): 𝐸𝐴𝐷 = 𝑎𝑙𝑝ℎ𝑎 ∗ (𝑅𝐶 + 𝑚𝑢𝑙𝑡𝑖𝑝; 𝑖𝑒𝑟 ∗ 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒) = 1.4 ∗ (60 + 1 ∗ 347) = 569 Example 2: Credit derivatives (unmargined netting set) 12.22.Netting set 2 consists of three credit derivatives: one long single-name credit default swap (CDS) written on Firm A (rated AA), one short single-name CDS written on Firm B (rated BBB), and one long CDS index (investment grade). The table below summarizes the relevant contractual terms of the three derivatives. All notional amounts and market values in the table are in USD thousands. Trade # Nature Reference entity/ index name Rating reference entity Residual maturity Base currency Notional (USD thousands) Position Market value (USD thousands) 1 Single name CDS Firm A AA 3 years USD 10,000 Protection buyer 20 2 Single￾name CDS Firm B BBB 6 years EUR 10,000 Protection seller -40 3 CDS CDX.IG 5y Investment grade 5 years USD 10,000 Protection buyer 0 12.23.As in the previous example, the netting set is not subject to a margin agreement and there is no exchange of collateral (independent amount/IM) at inception. For unmargined netting sets, the replacement cost is calculated using the following formula, where:

Page Number 129 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (1)V is a simple algebraic sum of the derivatives’ market values at the reference date (2)C is the haircut value of the IM, which is zero in this example 𝑅𝐶 = 𝑚𝑎𝑥{𝑉 − 𝐶; 0} 12.24.Thus, using the market values indicated in the table (expressed in USD thousands): 𝑅𝐶 = 𝑚𝑎𝑥{20 − 40 + 0 − 0; 0} = 0 12.25.Since in this example V-C is negative (equal to V, i.e. -20,000), the multiplier will be activated (i.e. it will be less than 1). Before calculating its value, the aggregate add-on (𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒) needs to be determined. 12.26.All the transactions in the netting set belong to the credit derivatives asset class. The 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 for the credit derivatives asset class can be calculated using the four steps set out in 6.64. 12.27.Step 1: Calculate the effective notional for each trade in the netting set. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (δ); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional Di is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 . 12.28.For credit derivatives, like interest rate derivatives, the trade-level adjusted notional (𝑑𝑖 ) is the product of the trade notional amount and the supervisory duration (𝑆𝐷𝑖 ), i.e. 𝑑𝑖 = 𝑛𝑜𝑡𝑖𝑜𝑛𝑎𝑙 ∗ 𝑆𝐷𝑖 . The trade-level adjusted notional amounts for each of the trades in Example 2 are as follows: Trade # Notional (USD thousand) 𝑆𝑖 𝐸𝑖 𝑆𝐷𝑖 Adjusted notional, 𝑑𝑖 (USD thousands) 1 10,000 0 3 2.79 27,858 2 10,000 0 6 5.18 51,836 3 5,000 0 5 4.42 44,240

Page Number 130 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12.29.6.51 sets out the calculation of the maturity factor (𝑀𝐹𝑖 ) for unmargined trades. For trades that have a remaining maturity in excess of one year, which is the case for all trades in this example, the formula gives a maturity factor of 1. 12.30.As set out in 6.40 to 6.43, a supervisory delta is assigned to each trade. In particular: (1)Trade 1 and Trade 3 are long in the primary risk factors (CDS spread) and are not options so the supervisory delta is equal to 1 for each trade. (2)Trade 2 is short in the primary risk factor and is not an option; thus, the supervisory delta is equal to -1. 12.31.The effective notional for each trade in the netting set (𝐷𝑖 ) is calculated using the formula 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 and values for each term noted above. The results of applying the formula are as follows: Trade # Notional (USD thousands) Adjusted notional, 𝑑𝑖 (USD, thousands) Maturity Factor, 𝑀𝐹𝑖 Delta, 𝛿𝑖 Effective notional, 𝐷𝑖 (USD, thousands) 1 10,000 27,858 1 1 27,858 2 10,000 51,836 1 -1 -51,836 3 10,000 44,240 1 1 44,240 12.32.Step 2: Calculate the combined effective notional for all derivatives that reference the same entity. The combined effective notional of the entity (𝐸𝑁𝑒𝑛𝑡𝑖𝑡𝑦) is calculated by adding together the trade level effective notionals calculated in step 1 that reference that entity. However, since all the derivatives refer to different entities (single names/indices), the effective notional of the entity is simply equal to the trade level effective notional (𝐷𝑖 ) for each trade. 12.33.Step 3: Calculate the add-on for each entity (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) by multiplying the entity level effective notional in step 2 by the supervisory factor that is specified for that entity (𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦). The supervisory factors are set out in table 2 in 6.75. A supervisory factor is assigned to each single-name entity based on the rating of the reference entity (0.38% for AA-rated firms and 0.54% for BBB-rated firms).

Page Number 131 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 For CDS indices, the SF is assigned according to whether the index is investment or speculative grade; in this example, its value is 0.38% since the index is investment grade. Thus, the entity level add-ons are the following (USD thousands): Reference Entity Effective notional, 𝐷𝑖 (USD, thousands) Supervisory factor, 𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦 Entity-level add-on, 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦(= 𝐷𝑖 ∗ 𝑆𝐹𝑒𝑛𝑡𝑖𝑡𝑦) Firm A 27,858 0.38% 106 Firm B -51,836 0.54% -280 CDX.IG 44,240 0.38% 168 12.34.Step 4: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝑐𝑟𝑒𝑑𝑖𝑡) by using the formula that follows, where: (1)The summations are across all entities referenced by the derivatives. (2)𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 is the add-on amount calculated in step 3 for each entity referenced by the derivatives. (3)𝜌𝑒𝑛𝑡𝑖𝑡𝑦 is the supervisory prescribed correlation factor corresponding to the entity. As set out in Table 2 in 6.75, the correlation factor is 50% for single entities (Firm A and Firm B) and 80% for indexes (CDX.IG). 𝐴𝑑𝑑𝑂𝑛𝑐𝑟𝑒𝑑𝑖𝑡 = [( ∑ 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 ∗ 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 𝑒𝑛𝑡𝑖𝑡𝑦 ) 2

• ∑ (1 − (𝜌𝑒𝑛𝑡𝑖𝑡𝑦) 2 ) 𝑒𝑛𝑡𝑖𝑡𝑦 ∗ (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2 ] 1 2 12.35.The following table shows a simple way to calculate of the systematic and idiosyncratic components in the formula: Reference Entity 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 𝜌𝑒𝑛𝑡𝑖𝑡𝑦 ∗ 𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦 1 − (𝜌𝑒𝑛𝑡𝑖𝑡𝑦) 2 (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2 (1 − (𝜌𝑒𝑛𝑡𝑖𝑡𝑦) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝑒𝑛𝑡𝑖𝑡𝑦) 2 Firm A 0.5 106 52.9 0.75 11,207 8,405

Page Number 132 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 Firm B 0.5 -280 -140 0.75 78,353 58,765 CDX.IG 0.8 168 134.5 0.36 28,261 101,174 Sum= 47.5 77,344 (𝑺𝒖𝒎) 𝟐 = 2,253 12.36.According to the calculations in the table, the systematic component is 2,253, while the idiosyncratic component is 77,344. Thus, the add-on for the credit asset class is calculated as follows: 𝐴𝑑𝑑𝑂𝑛𝑐𝑟𝑒𝑑𝑖𝑡 = [2,253 + 77,344] 1 2 = 282 12.37.For this netting set the credit add-on (𝐴𝑑𝑑𝑂𝑛𝑐𝑟𝑒𝑑𝑖𝑡) is also the aggregate add-on (𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒) because there are no derivatives belonging to other asset classes. 12.38.The value of the multiplier can now be calculated as follows, using the formula set out in 6.25: 𝑚𝑢𝑙𝑡𝑖𝑝𝑙𝑖𝑒𝑟 = 𝑚𝑖𝑛 {1; 0.05 + 0.95 ∗ 𝑒𝑥𝑝 ( −20 2 ∗ 0.95 ∗ 282)} = 0.965 12.39.Finally, aggregating the replacement cost and the potential future exposure (PFE) component and multiplying the result by the alpha factor of 1.4, the EAD is as follows (USD thousands): 𝐸𝐴𝐷 = 1.4 ∗ (0 + 0.965 ∗ 282) = 381 Example 3: Commodity derivatives (unmargined netting set) 12.40.Netting set 3 consists of three commodity forward contracts. The table below summarizes the relevant contractual terms of the three derivatives. All notional amounts and market values in the table are in USD thousands. Trade # Notional Nature Underlying Direction Residual maturity Market value

Page Number 133 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 1 10,000 Forward (West Texas Intermediate, or WTI) Crude Oil Long 9 months -50 2 20,000 Forward (Brent) Crude Oil Short 2 years -30 3 10,000 Forward Silver Long 5 years 100 12.41.As in the previous two examples, the netting set is not subject to a margin agreement and there is no exchange of collateral (independent amount/IM) at inception. Thus, the replacement cost is given by: 𝑅𝐶 = 𝑚𝑎𝑥{𝑉 − 𝐶; 0} = 𝑚𝑎𝑥{100 − 30 − 50 − 0; 0} = 20 12.42.Since V-C is positive (i.e. USD 20,000), the value of the multiplier is 1, as explained in 6.24. 12.43.All the transactions in the netting set belong to the commodities derivatives asset class. The 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 for the commodities derivatives asset class can be calculated using the six steps set out in 6.72. 12.44.Step 1: Calculate the effective notional for each trade in the netting set. This is calculated as the product of the following three terms: (i) the adjusted notional of the trade (d); (ii) the supervisory delta adjustment of the trade (δ); and (iii) the maturity factor (MF). That is, for each trade i, the effective notional 𝐷𝑖D is calculated as 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 . 12.45.For commodity derivatives, the adjusted notional is defined as the product of the current price of one unit of the commodity (e.g. barrel of oil) and the number of units referenced by the derivative. In this example, for the sake of simplicity, it is assumed that the adjusted notional (𝑑𝑖 ) is equal to the notional value. 12.46.6.51 sets out the calculation of the maturity factor (𝑀𝐹𝑖 ) for unmargined trades. For trades that have a remaining maturity in excess of one year (trades 2 and 3 in this example), the formula gives a maturity factor of 1. For trade 1 the formula gives the following maturity factor:

Page Number 134 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝑀𝐹 = √ 𝑚𝑖𝑛{𝑀𝑖 ; 1𝑦𝑒𝑎𝑟} 1𝑦𝑒𝑎𝑟 = √ 𝑚𝑖𝑛{9/12; 1} 1 = √9/12 12.47.As set out in 6.40 to 6.43, a supervisory delta is assigned to each trade. In particular: (1)Trade 1 and Trade 3 are long in the primary risk factors (WTI Crude Oil and Silver respectively) and are not options so the supervisory delta is equal to 1 for each trade. (2)Trade 2 is short in the primary risk factor (Brent Crude Oil) and is not an option; thus, the supervisory delta is equal to -1. Trade # Notional (USD thousands) Adjusted notional, 𝑑𝑖 (USD, thousands) Maturity Factor, 𝑀𝐹𝑖 Delta, 𝛿𝑖 Effective notional, 𝐷𝑖 (USD, thousands) 1 10,000 10,000 (9/12) 0.5 1 8,660 2 20,000 20,000 1 -1 -20,000 3 10,000 10,000 1 1 10,000 12.48.Step 2: Allocate the trades in commodities asset class to hedging sets. In the commodities asset class there are four hedging sets consisting of derivatives that reference: energy (trades 1 and 2 in this example), metals (trade 3 in this example), agriculture and other commodities. Hedging set Commodity type Trades Energy Crude oil 1 and 2 Natural gas None Coal None Electricity None Metals Silver 3 Gold None

Page Number 135 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 ... ... Agriculture ... ... ... ... Other ... ... Trade # Effective notional, 𝐷𝑖 (USD thousands) Hedging set Commodity type 1 8,660 Energy Crude oil 2 -20,000 Energy Crude Oil 3 10,000 Metal Silver 12.49.Step 3: Calculate the combined effective notional for all derivatives with each hedging set that reference the same commodity type. The combined effective notional of the commodity type (𝐸𝑁𝐶𝑜𝑚𝑇𝑦𝑝𝑒) is calculated by adding together the trade level effective notionals calculated in step 1 that reference that commodity type. For purposes of this calculation, the bank can ignore the basis difference between the WTI and Brent forward contracts since they belong to the same commodity type, “Crude Oil” (unless the national supervisor requires the bank to use a more refined definition of commodity types). This step gives the following: (1)𝐸𝑁𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 = 8,660 + (−20,000) = −11,340 (2)𝐸𝑁𝑆𝑖𝑙𝑣𝑒𝑟 = 10,000 12.50.Step 4: Calculate the add-on for each commodity type (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒) within each hedging set by multiplying the combined effective notional for that commodity calculated in step 3 by the supervisory factor that is specified for that commodity type (𝑆𝐹𝐶𝑜𝑚𝑇𝑦𝑝𝑒). The supervisory factors are set out in table 2 in 6.75 and are set at 40% for electricity derivatives and 18% for derivatives that reference all other types of commodities. Therefore: (1)𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 = -11,340 * 0.18 = -2,041 (2)𝐴𝑑𝑑𝑂𝑛𝑆𝑖𝑙𝑣𝑒𝑟= 10,000 * 0.18 = 1,800

Page Number 136 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12.51.Step 5: Calculate the add-on for each of the four commodity hedging sets (𝐴𝑑𝑑𝑂𝑛𝐻𝑆) by using the formula that follows. In the formula: (1)The summations are across all commodity types within the hedging set. (2)𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒 is the add-on amount calculated in step 4 for each commodity type. (3)𝜌𝐶𝑜𝑚𝑇𝑦𝑝𝑒 is the supervisory prescribed correlation factor corresponding to the commodity type. As set out in Table 2 in 6.75, the correlation factor is set at 40% for all commodity types. 𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = [( ∑ 𝜌𝐶𝑜𝑚𝑇𝑦𝑝𝑒 ∗ 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒 𝐶𝑜𝑚𝑇𝑦𝑝𝑒 ) 2

• ∑ (1 − (𝜌𝐶𝑜𝑚𝑇𝑦𝑝𝑒) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑇𝑦𝑝𝑒) 2 𝐶𝑜𝑚𝑇𝑦𝑝𝑒 ] 1 2 12.52.In this example, however, there is only one commodity type within the “Energy” hedging set (ie Crude Oil). All other commodity types within the energy hedging set (eg coal, natural gas etc) have a zero add-on. Therefore, the add-on for the energy hedging set is calculated as follows: 𝐴𝑑𝑑𝑂𝑛𝐸𝑛𝑒𝑟𝑔𝑦 = [(𝜌𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 ∗ 𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙) 2 + (1 − (𝜌𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙) 2 ) ∗ (𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙) 2 ] 1 2 𝐴𝑑𝑑𝑂𝑛𝐸𝑛𝑒𝑟𝑔𝑦 = [(0.4 ∗ (−2,041)) 2 + (1 − (0.4) 2 ) ∗ (−2,041) 2 ] 1 2 = 2,041 12.53.The calculation above shows that, when there is only one commodity type within a hedging set, the hedging-set add-on is equal (in absolute value) to the commodity-type add-on. 12.54.Similarly, “Silver” is the only commodity type in the “Metals” hedging set, and so the add-on for the metals hedging set is: 𝐴𝑑𝑑𝑂𝑛𝑀𝑒𝑡𝑎𝑙𝑠 = |𝐴𝑑𝑑𝑂𝑛𝑆𝑖𝑙𝑣𝑒𝑟| = 1,800 12.55.Step 6: Calculate the asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦) by adding together all of the hedging set level add-ons calculated in step 5:

Page Number 137 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦 = ∑𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = 𝐴𝑑𝑑𝑂𝑛𝐸𝑛𝑒𝑟𝑔𝑦 + 𝐴𝑑𝑑𝑂𝑛𝑀𝑒𝑡𝑎𝑙𝑠 = 2,041 + 1,800 = 3841 𝐻𝑆 12.56.For this netting set the commodity add-on (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦) is also the aggregate add-on (𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒) because there are no derivatives belonging to other asset classes. 12.57.Finally, aggregating the replacement cost and the PFE component and multiplying the result by the alpha factor of 1.4, the EAD is as follows (USD thousands): 𝐸𝐴𝐷 = 1.4 ∗ (20 + 1 ∗ 3,841) = 5,406 Example 4: Interest rate and credit derivatives (unmargined netting set) 12.58. Netting set 4 consists of the combined trades of Examples 1 and 2. There is no margin agreement and no collateral. The replacement cost of the combined netting set is: 𝑅𝐶 = 𝑚𝑎𝑥{𝑉 − 𝐶; 0} = 𝑚𝑎𝑥{30 − 20 + 50 + 20 − 40 + 0; 0} = 40 12.59.The aggregate add-on for the combined netting set is the sum of add-ons for each asset class. In this case, there are two asset classes, interest rates and credit, and the add-ons for these asset classes have been copied from Examples 1 and 2: 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 = 𝐴𝑑𝑑𝑂𝑛𝐼𝑅 + 𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑒𝑑𝑖𝑡 = 347 + 282 = 629 12.60.Because V-C is positive, the multiplier is equal to 1. Finally, the EAD can be calculated as: 𝐸𝐴𝐷 = 1.4 ∗ (40 + 1 ∗ 629) = 936 Example 5: Interest rate and commodities derivatives (unmargined netting set) 12.61.Netting set 5 consists of the combined trades of Examples 1 and 3. However, instead of being unmargined (as assumed in those examples), the trades are subject to a margin agreement with the following specifications: Margin frequency Threshold, TH Minimum Transfer Amount, MTA Independent Amount, IA Total net collateral held by bank

Page Number 138 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 (USD thousands) (USD thousands) (USD thousands) Weekly 0 5 150 200 12.62.The above table depicts a situation in which the bank received from the counterparty a net independent amount of 150 (taking into account the net amount of initial margin posted by the counterparty and any unsegregated initial margin posted by the bank). The total net collateral (after the application of haircuts) currently held by the bank is 200, which includes 50 for variation margin (VM) received and 150 for the net independent amount. 12.63.First, we determine the replacement cost. The net collateral currently held is 200 and the net independent collateral amount (NICA) is equal to the independent amount (that is, 150). The current market value of the trades in the netting set (V) is 80, it is calculated as the sum of the market value of the trades, i.e. 30 – 20 + 50 – 50 – 30 + 100 = 80. The replacement cost for margined netting sets is calculated using the formula set out in 6.20. Using this formula the replacement cost for the netting set in this example is: 𝑅𝐶 = 𝑚𝑎𝑥{𝑉 − 𝐶; 𝑇𝐻 + 𝑀𝑇𝐴 − 𝑁𝐼𝐶𝐴; 0} = 𝑚𝑎𝑥{80 − 200; 0 + 5 − 150; 0} = 0 12.64.Second, it is necessary to recalculate the interest rate and commodity add-ons, based on the value of the maturity factor for margined transactions, which depends on the margin period of risk. For daily re-margining, the margin period of risk (MPOR) would be 10 days. In accordance with 6.53, for netting sets that are not subject daily margin agreements the MPOR is the sum of nine business days plus the re-margining period (which is five business days in this example). Thus the MPOR is 14 (= 9 + 5) in this example. 12.65.The re-scaled maturity factor for the trades in the netting set is calculated using the formula set out in 6.55. Using the MPOR calculated above, the maturity factor for all trades in the netting set in this example it is calculated as follows (a market convention of 250 business days in the financial year is used): 𝑀𝐹𝑖 (𝑚𝑎𝑟𝑔𝑖𝑛𝑒𝑑) = 3 2 √ 𝑀𝑃𝑂𝑅𝑖 1𝑦𝑒𝑎𝑟 = 1.5 ∗ √14⁄250

Page Number 139 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 12.66.For the interest rate add-on, the effective notional for each trade (𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 ) calculated in 12.13 must be recalculated using the maturity factor for the margined netting set calculated above. That is: IR Trade

Notional (USD thousands) Base currency (hedging set) Maturity bucket Adjusted notional, 𝑑𝑖 (USD, thousands) Maturity Factor, 𝑀𝐹𝑖 Delta, 𝛿𝑖 Effective notional, 𝐷𝑖 (USD, thousands) 1 10,000 USD 3 78,694 1.5 ∗ √14⁄250 1 27,934 2 10,000 USD 2 36,254 1.5 ∗ √14⁄250 -1 -12,869 3 5,000 EUR 3 37,428 1.5 ∗ √14⁄250 -0.2694 -3,579 12.67.Next, the effective notional of each of the three maturity buckets within each hedging set must now be calculated. However, as set out in 12.16, given that in this example there are no maturity buckets within a hedging set with more than a single trade, the effective maturity of each maturity bucket is simply equal to the effective notional of the single trade in each bucket. Specifically: (1)For the USD hedging set: 𝐷 𝐵1 is zero, 𝐷 𝐵2 is -12,869 (thousand USD) and DB3 is 27,934 (thousand USD). (2)For the EUR hedging set: 𝐷 𝐵1 and 𝐷 𝐵2 are zero and 𝐷 𝐵3 is -3,579 (thousand USD). 12.68.Next, the effective notional of each of the two hedging sets (USD and EUR) must be recalculated using formula set out in 12.18 and the updated values of the effective notionals of each maturity bucket. The calculation is as follows: 𝐸𝑁𝑈𝑆𝐷 = [(−12,869) 2 + (27,934) 2 + 1.4 ∗ (−12,869) ∗ 27,934] 1 2 = 21,934 𝐸𝑁𝐸𝑈𝑅 = [(−3,579) 2 ] 1 2 = 3 ,579 12.69.Next, the hedging set level add-ons (𝐴𝑑𝑑𝑂𝑛ℎ𝑠 ) must be recalculated by multiplying the recalculated effective notionals of each hedging set (𝐸𝑁ℎ𝑠 ) by the prescribed supervisory factor of the hedging set (𝑆𝐹𝑈𝑆𝐷). As set out in 12.16, the

Page Number 140 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 prescribed supervisory factor in this case is 0.5%. Therefore, the add-on for the USD and EUR hedging sets are, respectively (expressed in USD thousands): 𝐴𝑑𝑑𝑂𝑛𝑈𝑆𝐷 = 21,039 ∗ 0.005 = 105 𝐴𝑑𝑑𝑂𝑛𝐸𝑈𝑅 = 3,579 ∗ 0.005 = 18 12.70.Finally, the interest rate asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐼𝑅) can be recalculated by adding together the USD and EUR hedging set level add-ons as follows (expressed in USD thousands): 𝐴𝑑𝑑𝑂𝑛𝐼𝑅 = 105 + 18 = 123 12.71.The add-on for the commodity asset class must also be recalculated using the maturity factor for the margined netting. The effective notional for each trade 𝐷𝑖 = 𝑑𝑖 ∗ 𝑀𝐹𝑖 ∗ 𝛿𝑖 is set out in the table below: Commodity Trade

Notional (USD thousands) Hedging set Commodity type Adjusted notional, 𝑑𝑖 (USD, thousands) Maturity Factor, 𝑀𝐹𝑖 Delta, 𝛿𝑖 Effective notional, Di (USD, thousands) 1 10,000 Energy Crude Oil 10,000 1.5 ∗ √14⁄250 1 3,550 2 20,000 Energy Crude Oil 20,000 1.5 ∗ √14⁄250 -1 -7,100 3 10,000 Metals Silver 10,000 1.5 ∗ √14⁄250 1 3,550 12.72.The combined effective notional for all derivatives with each hedging set that reference the same commodity type (𝐸𝑁𝐶𝑜𝑚𝑇𝑦𝑝𝑒) must be recalculated by adding together the trade-level effective notionals above for each commodity type. This gives the following: (1)𝐸𝑁𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 = 3,550 + (−7,100) = 3,550 (2)𝐸𝑁𝑆𝑖𝑙𝑣𝑒𝑟 = 3,550 12.73.The add-on for each commodity type (𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 and 𝐴𝑑𝑑𝑂𝑛𝑆𝑖𝑙𝑣𝑒𝑟) within each hedging set calculated in 12.50 must now be recalculated by multiplying the

Page Number 141 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 recalculated combined effective notional for that commodity by the relevant supervisory factor (i.e. 18%). Therefore: (1)𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙 = −3,550 ∗ 0.18 = −639 (2)𝐴𝑑𝑑𝑂𝑛𝑆𝑖𝑙𝑣𝑒𝑟 = 3,550 ∗ 0.18 = −639 12.74.Next, recalculate the add-on for energy and metals hedging sets using the recalculated add-ons for each commodity type above. As noted in 12.53, given that there is only one commodity type with each hedging set, the hedging set level add on is simply equal to the absolute value of the commodity type add-on. That is: 𝐴𝑑𝑑𝑂𝑛𝐸𝑛𝑒𝑟𝑔𝑦 = |𝐴𝑑𝑑𝑂𝑛𝐶𝑟𝑢𝑑𝑒𝑂𝑖𝑙| = 639 𝐴𝑑𝑑𝑂𝑛𝑀𝑒𝑡𝑎𝑙 = |𝐴𝑑𝑑𝑂𝑛𝑆𝑖𝑙𝑣𝑒𝑟| = 639 12.75.Finally, calculate the commodity asset class level add-on (𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦) by adding together the hedging set level add-ons: 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦 = ∑𝐴𝑑𝑑𝑂𝑛𝐻𝑆 = 639 + 639 = 1,278 𝐻𝑆 12.76.The aggregate netting set level add-on can now be calculated. As set out in 6.27, it is calculated as the sum of the asset class level add-ons. That is for this example: 𝐴𝑑𝑑𝑂𝑛𝑎𝑔𝑔𝑟𝑒𝑔𝑎𝑡𝑒 = ∑ 𝐴𝑑𝑑𝑂𝑛(𝑎𝑠𝑠𝑒𝑡𝑐𝑙𝑎𝑠𝑠) = 𝐴𝑑𝑑𝑂𝑛𝐼𝑅 + 𝐴𝑑𝑑𝑂𝑛𝐶𝑜𝑚𝑚𝑜𝑑𝑖𝑡𝑦 𝑎𝑠𝑠𝑒𝑡𝑐𝑙𝑎𝑠𝑠 = 123 + 1,278 = 1,401 12.77.As can be seen from 12.63, the value of V-C is negative (i.e. -120) and so the multiplier will be less than 1. The multiplier is calculated using the formula set out in 6.25, which for this example gives: 𝑚𝑢𝑙𝑡𝑖𝑝𝑙𝑖𝑒𝑟 = 𝑚𝑖𝑛 (1; 0.05 + 0.95 ∗ 𝑒𝑥𝑝 ( 80 − 200 2 ∗ 0.95 ∗ 1,401)) = 0.958 12.78.Finally, aggregating the replacement cost and the PFE component and multiplying the result by the alpha factor of 1.4, the EAD is as follows (USD thousands):

Page Number 142 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 𝐸𝐴𝐷 = 1.4 ∗ (0 + 0.958 ∗ 1,401) = 1,879 13.The effect of standard margin agreements on the calculation of replacement cost with SA-CCR 13.1. In this section (13.1 to 13.18), five examples are used to illustrate the operation of the SA-CCR in the context of standard margin agreements. In particular, they relate to the formulation of replacement cost for margined trades, as set out in 6.20: 𝑅𝐶 = 𝑚𝑎𝑥{𝑉 − 𝐶; 𝑇𝐻 + 𝑀𝑇𝐴 − 𝑁𝐼𝐶𝐴; 0} Example 1 13.2. The bank currently has met all past VM calls so that the value of trades with its counterparty (€80 million) is offset by cumulative VM in the form of cash collateral received. There is a small “Minimum Transfer Amount” (MTA) of €1 million and a €0 ”Threshold” (TH). Furthermore, an “Independent Amount” (IA) of €10 million is agreed in favor of the bank and none in favor of its counterparty (i.e. the NICA is €10 million. This leads to a credit support amount of €90 million, which is assumed to have been fully received as of the reporting date. 13.3. In this example, the three terms in the replacement cost formula are: (1)V - C =€80 million – €90 million = negative €10 million. (2)TH + MTA – NICA = €0 + €1 million - €10 million = negative €9 million. (3)The third term in the RC formula is always zero, which ensures that replacement cost is not negative. 13.4. The highest of the three terms (-€10 million, -€9 million, 0) is zero, so the replacement cost is zero. This is due to the large amount of collateral posted by the bank’s counterparty. Example 2 13.5. The counterparty has met all VM calls but the bank has some residual exposure due to the MTA of €1 million in its master agreement, and has a €0 TH. The value of the bank’s trades with the counterparty is €80 million and the bank holds €79.5 million in VM in the form of cash collateral. In addition, the bank holds €10

Page Number 143 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 million in independent collateral (here being an initial margin independent of VM, the latter of which is driven by mark-to-market (MTM) changes) from the counterparty. The counterparty holds €10 million in independent collateral from the bank, which is held by the counterparty in a non-segregated manner. The NICA is therefore €0 (= €10 million independent collateral held less €10 million independent collateral posted). 13.6. In this example, the three terms in the replacement formula are: (1)V – C = €80 million – (€79.5 million + €10 million - €10 million)= €0.5 million. (2)TH + MTA – NICA = €0 + €1 million – €0 = €1 million. (3)The third term is zero. 13.7. The replacement cost is the highest of the three terms (€0.5 million, €1 million, 0) which is €1 million. This represents the largest exposure before collateral must be exchanged. Bank as a clearing member 13.8. The case of central clearing can be viewed from a number of perspectives. One example in which the replacement cost formula for margined trades can be applied is when the bank is a clearing member and is calculating replacement cost for its own trades with a central counterparty (CCP). In this case, the MTA and TH are generally zero. VM is usually exchanged at least daily and the independent collateral amount (ICA) in the form of a performance bond or IM is held by the CCP. Example 3 13.9. The bank, in its capacity as clearing member of a CCP, has posted VM to the CCP in an amount equal to the value of the trades it has with the CCP. The bank has posted cash as initial margin and the CCP holds the IM in a bankruptcy￾remote fashion. Assume that the value of trades with the CCP are negative €50 million, the bank has posted €50 million in VM and €10 million in IM to the CCP. 13.10.Given that the IM is held by the CCP in a bankruptcy remote fashion, 6.19 permits this amount to be excluded in the calculation NICA. Therefore, the NICA is €0

Page Number 144 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 because the bankruptcy-remote IM posted to the CCP can be exclude and the bank has not received any IM from the CCP. The value of C is calculated as the value of NICA plus any VM received less any VM posted. The value of C is thus negative €50 million (= €0 million + €0 million - €50 million). 13.11.In this example, the three terms in the replacement formula are: (1)V – C = (-€50 million) – (-€50 million) = €0. That is, the negative value of the trades has been fully offset by the VM posted by the bank. (2)TH + MTA – NICA = €0 + €0 - €0 = €0. (3)The third term is zero. 13.12.The replacement cost is therefore €0. Example 4 13.13.Example 4 is the same as Example 3, except that the IM posted to the CCP is not bankruptcy-remote. As a consequence, the €10 million of IM must be included in the calculation of NICA. Thus, NICA is negative €10 million (= ICA received of €0 minus unsegregated ICA posted of €10 million). Also, the value of C is negative €60 million (=NICA + VM received - VM posted = -€10 million + €0 - €50 million). 13.14.In this example, the three terms in the replacement formula are: (1)V – C = (-€50 million) – (-€60 million) = €10 million. That is, the negative value of the trades is more than fully offset by collateral posted by the bank. (2)TH + MTA – NICA = €0 + €0 – (-€10 million) = €10 million. (3)The third term is zero. 13.15.The replacement cost is therefore €10 million. This represents the IM posted to the CCP which risks being lost upon default and bankruptcy of the CCP. Example 5: Maintenance Margin Agreement 13.16.Some margin agreements specify that a counterparty (in this case, a bank) must maintain a level of collateral that is a fixed percentage of the MTM of the transactions in a netting set. For this type of margining agreement, ICA is the

Page Number 145 of 145 Issue Date December 2022 Version Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) 1.1 amount of collateral that the counterparty must maintain above the net MTM of the transactions. 13.17.For example, suppose the agreement states that a counterparty must maintain a collateral balance of at least 140% of the MTM of its transactions and that the MtM of the derivatives transactions is €50 in the bank’s favor. ICA in this case is €20 (= 140% * €50 – €50). Further, suppose there is no TH, no MTA, the bank has posted no collateral and the counterparty has posted €80 in cash collateral. In this example, the three terms of the replacement cost formula are: (1)V – C = €50 - €80 = -€30. (2)MTA + TH - NICA = €0 + €0 - €20 = -€20. (3)The third term is zero. 13.18.Thus, the replacement cost is zero in this example.

Saudi Central Bank (SAMA) Leverage Ratio Framework December 2022

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 1 of 31 Contents

1. Introduction ............................................................................................................. 2
2. Scope of Application................................................................................................ 2
3. Implementation Timeline........................................................................................ 3
4. SAMA Reporting Requirements............................................................................ 3
5. Policy Requirements................................................................................................ 3
6. Exposure Measure ................................................................................................... 4
7. Treatment of Exposure Measures Items ............................................................... 6 7.1 On-balance sheet exposures................................................................................ 6 7.2 Derivative exposures ........................................................................................... 9 7.3 Securities financing transaction exposures....................................................... 22 7.4 Off-balance sheet (OBS) items .......................................................................... 28

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 2 of 31 Leverage Ratio Framework

1. Introduction: In line with SAMA’s continuous efforts to maintain the quality and soundness of Leverage Ratio Framework and due to the issuance of Basel III: Finalizing post-crisis reforms on December 2017, SAMA has decided to issue this updated Leverage Ratio Framework to act as a credible supplementary measure to the risk-based capital requirements to restrict the build-up of leverage in the banking sector and to reinforce the risk-based requirements with a simple, transparent, non-risk-based “backstop” measure. This updated framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. The Leverage Ratio Framework issued by this circular supersedes the previous Guidance Document and Prudential Returns concerning the Implementation of Basel III Leverage Ratio Framework issued via SAMA circular 351000133367 dated 25 August 2014.
2. Scope of Application: 2.1 This framework applies to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 2.2 Leverage ratio framework follows the same scope of regulatory consolidation as is used for the risk-based capital. The treatment of investments in the capital of banking, financial, insurance and commercial entities which are outside the regulatory scope of consolidation should be as following: (i) Investments in capital of such entities (i.e. only the carrying value of the investment, as opposed to the underlying assets and other exposures of the investee) is to be included in the Leverage ratio exposure measure.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 3 of 31 (ii) Investments in capital of such entities that have been deducted from Tier 1 capital as set out in paragraph 6.2 below should be excluded from the Leverage ratio exposure measure. 2.3 This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia, and the branches shall comply with the regulatory requirements stipulated by their respective home regulators. 3. Implementation Timeline: This framework will be effective on 01 January 2023. 4. SAMA Reporting Requirements: SAMA expects all Banks to report the Leveraged Ratio, using SAMA’s Q17 reporting template, within 30 days after the end of each quarter. 5. Policy Requirements: 5.1 The Leverage ratio is defined as the capital measure (the numerator) divided by the exposure measure (the denominator). This ratio should be expressed as a percentage. 𝐋𝐞𝐯𝐞𝐫𝐚𝐠𝐞 𝐑𝐚𝐭𝐢𝐨 = Capital Measure Exposure Measure 5.2 Capital measure for Leverage ratio is Tier 1 regulatory capital1 , which include common equity Tier 1 and Additional Tier 1 Capital as defined in in the Finalized Guidance Document Concerning the Implementation of Basel III issued by SAMA circular No. 341000015689 Dated 19 December 2012 and any subsequent adjustments. 5.3 The exposure measure for the Leverage ratio should generally follow gross accounting value unless different treatment is specifically mentioned in this framework.

1 In other words, the capital measure used for the Leverage ratio at any particular point in time is the Tier 1 capital measure applicable at that time taking into consideration all regulatory adjustments allowed by SAMA from time to time.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 4 of 31 5.4 Exposure measure should include the following exposures: (i) On-balance sheet exposures (excluding on-balance sheet derivative and securities financing transaction exposures); (ii) Derivative exposures; (iii) Securities financing transaction (SFT) exposures; and (iv) Off-balance sheet (OBS) items. 5.5 The leverage ratio (Capital measure and Exposure measure) must be calculated and reported to SAMA on a quarter-end basis. 5.6 Banks’ Leverage ratio must be at least 3% at all time. 6. Exposure Measure: 6.1 Banks must not use physical or financial collateral, guarantees or other credit risk mitigation techniques to reduce the Leverage ratio exposure measure, nor may banks net assets and liabilities, unless specified differently by SAMA. 6.2 Any item deducted from Tier 1 capital, according to the Finalized Guidance Document Concerning the Implementation of Basel III issued by SAMA in 19 December 2012 and any subsequent regulatory adjustments, other than those related to liabilities can be deducted from the Leverage ratio exposure measure. Three examples follow: (i) Where a banking, financial or insurance entity is not included in the regulatory scope of consolidation as set out in paragraph 2.2, the amount of any investment in the capital of that entity that is totally or partially deducted from Common Equity Tier 1 (CET1) capital or from Additional Tier 1 capital of the bank follow the corresponding deduction approach in the Finalized Guidance Document Concerning the Implementation of Basel III issued by SAMA in 19 December 2012 and any subsequent regulatory adjustments, may also be deducted from the Leverage ratio exposure measure; (ii)For banks using the internal ratings-based (IRB) approach to determining capital requirements for credit risk, the Excess of total eligible provisions under IRB section in the Finalized Guidance Document Concerning the Implementation of Basel III issued by

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 5 of 31 SAMA in 19 December 2012 and any subsequent regulatory adjustments requires any shortfall in the stock of eligible provisions relating to expected loss amounts to be deducted from CET1 capital. The same amount may be deducted from the Leverage ratio exposure measure; and (iii) Prudent valuation adjustments (PVAs) for exposures to less liquid positions, other than those related to liabilities, that are deducted from Tier 1 capital as per Prudent valuation guidance set out in the Basel framework, should be deducted from the Leverage ratio exposure measure. 6.3 Deducting Liability items from the Leverage ratio exposure measure is not allowed. For example, gains/losses on fair valued liabilities or accounting value adjustments on derivative liabilities due to changes in the bank’s own credit risk as described in the Cumulative gains and losses due to changes in own credit risk on fair valued financial liabilities section in of the Finalized Guidance Document Concerning the Implementation of Basel III circular No. 341000015689 issued by SAMA dated 19 December in 2012 and any subsequent adjustments, must not be deducted from the Leverage ratio exposure measure. 6.4 With regard to traditional securitizations, the originating bank may exclude securitized exposures from its leverage ratio exposure measure if the securitization meets the operational requirements for the recognition of risk transference2 . Banks meeting these conditions must include any retained securitization exposures in their leverage ratio exposure measure.In all other cases, traditional securitizations exposures that do not meet the operational requirements for the recognition of risk transference or synthetic securitizations, the securitized exposure must be included in the Leverage ratio exposure measure. 6.5 Banks should be particularly cautious to transactions and structures that have the result of inadequately capturing banks’ sources of Leverage.

2 As per paragraph 18.24 in the Minimum Capital Requirements for Credit Risk issued by SAMA.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 6 of 31 Examples of concerns that might arise in such Leverage ratio exposure measure minimizing transactions and structures include the following: (i) Securities financing transactions where exposure to the counterparty increases as the counterparty’s credit quality decreases, or securities financing transactions in which the credit quality of the counterparty is positively correlated with the value of the securities received in the transaction (i.e. the credit quality of the counterparty falls when the value of the securities falls); (ii) Banks that normally act as principal but adopt an agency model to transact in derivatives and SFTs in order to benefit from the more favorable treatment permitted for agency transactions under the Leverage ratio framework; (iii) Collateral swap trades structured to mitigate inclusion in the leverage ratio exposure measure; or use of structures to move assets off the balance sheet. The above list of examples is by no means exhaustive. 6.6 SAMA reserves should be included in the Leverage exposure measure. SAMA may temporarily exempt central bank reserves from the Leverage ratio exposure measure in exceptional cases and when it deems necessary. 7. Treatment of Exposure Measures Items: 7.1 On-balance sheet exposures 7.1.1 All balance sheet assets including on-balance sheet derivatives collateral and collateral for secured financing transactions (SFTs) should be included in the Leverage ratio exposure measure except for the following: (i) On-balance sheet derivative and SFT assets that are covered in 7.2 Derivatives and 7.3 Security Financing Transactions below. (ii)fiduciary assets: Where a bank according to its operative accounting framework recognizes fiduciary assets on the balance sheet, these assets can be excluded from the Leverage ratio exposure measure

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 7 of 31 provided that the assets meet the IFRS 9 criteria for de-recognition and, where applicable, IFRS 10 for deconsolidation. 7.1.2 On-balance sheet non-derivative assets are included in the Leverage ratio exposure measure at their accounting values less deductions for associated specific provisions. 7.1.3 General provisions or general loan loss reserves that reduce the regulatory capital should be deducted from the Leverage ratio exposure measure. For the purposes of the leverage ratio exposure measure, the definition of general provisions/general loan-loss reserves applies to all banks regardless of whether they use the standardized approach or the IRB approach for credit risk for their risk based capital calculations. 7.1.4 The accounting for regular-way purchases or sales 3 of financial assets that have not been settled (hereafter “unsettled trades”) differs across and within accounting frameworks. Unsettled trades can be accounted on the trade date (trade date accounting) or on the settlement date (settlement date accounting). For the purpose of the Leverage ratio exposure measure, treatment should be as below: (i) Banks using trade date accounting: must reverse out any offsetting between cash receivables for unsettled sales and payables for unsettled purchases of financial assets that may be recognized under the applicable accounting framework, but may offset between those cash receivables and cash payables (regardless of whether such offsetting is recognized under the applicable accounting framework) if the following conditions are met: a. The financial assets bought and sold that are associated with cash payables and receivables are fair valued through income and included in the bank’s regulatory trading book as specified in Boundary between the banking book and

3 “regular-way purchases or sales” are purchases or sales of financial assets under contracts for which the terms require delivery of the assets within the time frame established generally by regulation or convention in the marketplace concerned.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 8 of 31 the trading book in the Minimum Capital Requirement for Market Risk issued by SAMA. b. The transactions of the financial assets are settled on a delivery￾versus-payment (DVP) basis. (ii) Banks using settlement date: accounting will be subject to the treatment set out in paragraph 7.4 off-balance sheet items below. 7.1.5 Cash pooling refers to arrangements involving treasury products whereby a bank combines the credit and/or debit balances of several individual participating customer accounts into a single account balance to facilitate cash and/or liquidity management. For the purposes of Leverage ratio exposure measure, the treatment of cash pooling should be as follow: (i) where a cash pooling arrangement entails a transfer at least on a daily basis of the credit and /or debit balances of the individual participating customer accounts into a single account balance, the individual participating customer accounts are deemed to be extinguished and transformed into a single account balance upon the transfer provided the bank is not liable for the balances on an individual basis upon the transfer. Thus, the basis of the leverage ratio exposure measure for such a cash pooling arrangement is the single account balance and not the individual participating customer accounts (ii)If the transfer of credit and/or debit balances of the individual participating customer accounts does not occur daily, extinguishment and transformation into a single account balance is deemed to occur and this single account balance may serve as the basis of the Leverage ratio exposure measure provided all of the following conditions are met: a. In addition to providing for the several individual participating customer accounts, the cash pooling arrangement provides for a single account, into which the balances of all individual participating customer accounts can be transferred and thus extinguished; b. The bank first has a legally enforceable right to transfer the balances of the individual participating customer accounts into a single account so that the bank is not liable for the balances on an individual

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 9 of 31 basis and second at any point in time, the bank must have the discretion and be in a position to exercise this right; c. There are no maturity mismatches among the balances of the individual participating customer accounts included in the cash pooling arrangement or all balances are either overnight or on demand; and d. The bank charges or pays interest and/or fees based on the combined balance of the individual participating customer accounts included in the cash pooling arrangement. e. SAMA does not deem as inadequate the frequency by which the balances of individual participating customer accounts are transferred to a single account. In the event the abovementioned conditions are not met, the individual balances of the participating customer accounts must be reflected separately in the Leverage ratio exposure measure. 7.2 Derivative exposures 7.2.1 Treatment of derivatives: Exposures to derivatives includes the following components under the Leverage ratio exposure measure: (i) Replacement cost (RC) (ii)Potential future exposure (PFE) 7.2.2 Calculation of Derivatives (i) Banks must calculate their exposures associated with all derivative transactions, including where a bank sells protection using a credit derivative as per subparagraph (iv) below (ii) If the derivative exposure covered by an eligible bilateral netting contract as specified in subparagraphs (v) and (vi) below, a specific treatment may be applied. (iii) Written credit derivatives are subject to an additional treatment, as set out in paragraphs 7.2.8 to 7.2.15 below. (iv) Derivative transactions not covered by an eligible bilateral netting contract as specified in subparagraphs (v) and (vi) below ,the

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 10 of 31 amount included in the Leverage ratio exposure measure will be determined for each transaction separately, as follows: Exposure measure = Alpha * (RC + PFE) Where: a. Alpha = 1.4; b. RC = the replacement cost measured as follows: Where:  V is the market value of the individual derivative transaction or of the derivative transactions in a netting set;  CVMr is the cash variation margin received that meets the conditions set out in paragraph 7.2.4 and for which the amount has not already reduced the market value of the derivative transaction V under the bank’s operative accounting standard; and  CVMp is the cash variation margin provided by the bank and that meets the same conditions.  If there is no accounting measure of exposure for certain derivative instruments because they are held (completely) off balance sheet, the bank must use the sum of positive fair values of these derivatives as the replacement cost. c. PFE = The potential future exposure (PFE) for derivative exposures must be calculated in accordance with the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment paragraph 6.22 to 6.79. Mathematically: Where:

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 11 of 31  Multiplier fixed at one.  When calculating the aggregate Add-on component, for all margined transactions the maturity factor set out in the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment issued by SAMA paragraph 6.51 to 6.56 may be used. Further, as written options create an exposure to the underlying, they must be included in the Leverage ratio exposure measure by applying the required treatment, even if certain written options are permitted the zero exposure at default (EAD) treatment allowed in the risk-based framework. (v) Bilateral netting: when an eligible bilateral netting contract is in place the following will apply: a. Banks may net transactions subject to novation under which any obligation between a bank and its counterparty to deliver a given currency on a given value date is automatically amalgamated with all other obligations for the same currency and value date, legally substituting one single amount for the previous gross obligations. b. Banks may also net transactions subject to any legally valid form of bilateral netting not covered in point (a) above, including other forms of novation. c. In both cases (a) and (b) above, a bank will need to prove that it has:  A netting contract or agreement with the counterparty that creates a single legal obligation, covering all included transactions, such that the bank would have either a claim to receive or obligation to pay only the net sum of the positive and negative mark-to-market values of included individual transactions in the event that a counterparty fails to perform due to any of the following: default, bankruptcy, liquidation or similar circumstances;

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 12 of 31  Written and reasoned legal opinions that, in the event of a legal challenge, the relevant courts and authorities would find the bank’s exposure to be such a net amount under:

• The law of the jurisdiction in which the counterparty is chartered and, if the foreign branch of a counterparty is involved, then also under the law of jurisdiction in which the branch is located;
• The law that governs the individual transactions; and
• The law that governs any contract or agreement necessary to effect the netting.  Procedures in place to ensure that the legal characteristics of netting arrangements are kept under review in the light of possible changes in relevant law.  Netting agreements are not allowed in Saudi Arabia however, if netting is enforceable in any jurisdiction, positive and negative mark to market exposures in that jurisdiction will be allowed to net; 4 (vi) Contracts containing walkaway clauses will not be eligible for netting for the purpose of calculating the Leverage ratio exposure measure pursuant to this framework. A walkaway clause is a provision that permits a non-defaulting counterparty to make only limited payments or no payment at all, to the estate of a defaulter, even if the defaulter is a net creditor. 7.2.3 Treatment of related collateral (i) Collateral received a. Collateral received in connection with derivative contracts has two countervailing effects on Leverage:  Reduces counterparty exposure

4 Paragraph 14 in SAMA Margin Requirements for Non-centrally Cleared Derivatives circular No42008998 dated 18/02/1442H

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 13 of 31  Increases the economic resources at the disposal of the bank, as the bank can use the collateral to Leverage itself. b. Collateral received in connection with derivative contracts does not necessarily reduce the Leverage inherent in a bank’s derivative position, which is generally the case if the settlement exposure arising from the underlying derivative contract is not reduced. c. Collateral received should not be netted against derivative exposures whether or not netting is permitted under the bank’s operative accounting or risk-based framework. By applying 7.2.2 (derivative calculation) above, banks must not reduce the Leverage ratio exposure measure amount by any collateral received from the counterparty. This implies that replacement cost cannot be reduced by collateral received and the multiplier referenced in paragraph 7.2.2 is fixed at one for the purpose of the PFE calculation. However, the maturity factor in the PFE add-on calculation can recognize the PFE-reducing effect from the regular exchange of variation margin as specified above in paragraph 7.2.2. (ii) Collateral provided Banks must gross up their Leverage ratio exposure measure by the amount of any derivatives collateral provided where the provision of that collateral has reduced the value of their balance sheet assets under their operative accounting framework. 7.2.4 Treatment of cash variation margin: (i) Treatment of derivative exposures for the purpose of the Leverage ratio exposure measure, the cash portion of variation margin exchanged between counterparties may be viewed as a form of pre￾settlement payment if the following conditions are met: a. Trades not cleared through a qualifying central counterparty (QCCP)5 the cash received by the recipient counterparty is not segregated. Cash variation margin would satisfy the non-

5 QCCP is defined in the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment issued by SAMA under paragraph 3 “Definitions”.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 14 of 31 segregation criterion if the recipient counterparty has no restrictions by law, regulation, or any agreement with the counterparty on the ability to use the cash received (i.e. the cash variation margin received used as its own cash). b. Variation margin is calculated and exchanged on at least a daily basis based on mark-to-market valuation of derivative positions. To meet this criterion, derivative positions must be valued daily and cash variation margin must be transferred at least daily to the counterparty or to the counterparty’s account, as appropriate. Cash variation margin exchanged on the morning of the subsequent trading day based on the previous, end-of-day market values would meet this criterion. c. The variation margin is received in a currency specified in the derivative contract, governing master netting agreement (MNA), credit support annex (CSA) to the qualifying MNA or as defined by any netting agreement with a CCP. d. Variation margin exchanged is the full amount that would be necessary to extinguish the mark to-market exposure of the derivative subject to the threshold and minimum transfer amounts applicable to the counterparty. If a margin dispute arises, the amount of non-disputed variation margin that has been exchanged can be recognized. e. Derivative transactions and variation margins are covered by a single MNA between the legal entities that are the counterparties in the derivative transaction. The MNA must explicitly stipulate that the counterparties agree to settle net any payment obligations covered by such a netting agreement, taking into account any variation margin received or provided if a credit event occurs involving either counterparty. The MNA must be legally enforceable and effective (i.e. it satisfies the conditions in point (c) in subparagraph (v) and subparagraph (vi) in paragraph 7.2.2

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 15 of 31 Calculation of Derivatives above) in all relevant jurisdictions, including in the event of default and bankruptcy or insolvency.6 (ii)If the conditions above are met, the cash portion of variation margin received may be used to reduce the replacement cost portion of the Leverage ratio exposure measure, and the receivables assets from cash variation margin provided may be deducted from the Leverage ratio exposure measure as follows: a. In the case of cash variation margin received, the receiving bank may reduce the replacement cost (but not the PFE component) of the exposure amount of the derivative asset as specified 7.2.2 above. b. In the case of cash variation margin provided to a counterparty, the posting bank may deduct the resulting receivable from its Leverage ratio exposure measure. Where the cash variation margin has been recognized as an asset under the bank’s operative accounting framework, and instead include the cash variation margin provided in the calculation of the derivative replacement cost as specified 7.2.2 above. 7.2.5 Treatment of clearing services: (i) If a bank acting as clearing member (CM) 7 offers clearing services to clients. a. The CM’s trade exposures to the central counterparty (CCP) that arise when the CM is obligated to reimburse the client for any losses suffered due to changes in the value of its transactions in the event that the CCP defaults must be captured by applying the same treatment that applies to any other type of derivative transaction.

6 For the purposes of this paragraph, the term “MNA” includes any netting agreement that provides legally enforceable rights of offset (taking into account the fact that, for netting agreements employed by CCPs, no standardization has currently emerged that would be comparable with respect to over-the￾counter netting agreements for bilateral trading) and Master MNA may be deemed to be a single MNA. 7 The terms “clearing member”, “trade exposure”, “central counterparty” and “qualifying central counterparty” are defined in the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment issued by SAMA under paragraph 3 “Definitions”. In addition, for the purposes of this paragraph, the term “trade exposures“ includes initial margin irrespective of whether or not it is posted in a manner that makes it remote from the insolvency of the CCP.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 16 of 31 b. If the clearing member CM, based on the contractual arrangements with the client, is not obligated to reimburse the client for any losses suffered in the event that a QCCP defaults, the CM does not need to recognize the resulting trade exposures to the QCCP in the Leverage ratio exposure measure. (ii) Bank provides clearing services as a “higher level client” within a multi-level client structure8 , the bank should not recognize in its Leverage ratio exposure measure the resulting trade exposures to the CM or to an entity that serves as a higher level client to the bank in the Leverage ratio exposure measure if it meets all of the following conditions: a. The offsetting transactions are identified by the QCCP as higher level client transactions and collateral to support them is held by the QCCP and/or the CM, as applicable, under arrangements that prevent any losses to the higher level client due to:  The default or insolvency of the CM,  The default or insolvency of the CM’s other clients, and  The joint default or insolvency of the CM and any of its other clients9 b. The bank must have conducted a sufficient legal review (and undertake such further review as necessary to ensure continuing enforceability) and have a well-founded basis to conclude that, in the event of legal challenge, the relevant courts and administrative authorities would find that such arrangements mentioned above would be legal, valid, binding and enforceable under relevant laws of the relevant jurisdiction(s); c. Relevant laws, regulation, rules, contractual or administrative arrangements provide that the offsetting transactions with the

8 A multi-level client structure is one in which banks can centrally clear as indirect clients; that is, when clearing services are provided to the bank by an institution which is not a direct clearing member, but is itself a client of a CM or another clearing client. The term “higher-level client” refers to the institution that provides clearing services. 9 upon the insolvency of the clearing member, there is no legal impediment (other than the need to obtain a court order to which the client is entitled) to the transfer of the collateral belonging to clients of a defaulting clearing member to the QCCP, to one of more other surviving clearing members or to the client or the client’s nominee.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 17 of 31 defaulted or insolvent CM are highly likely to continue to be indirectly transacted through the QCCP, or by the QCCP, if the CM defaults or becomes insolvent10. In such circumstances, the higher level client positions and collateral with the QCCP will be transferred at market value unless the higher level client requests to close out the position at market value; d. The bank is not obligated to reimburse its client for any losses suffered in the event of default of either the CM or the QCCP. (iii) Derivative exposures associated with the bank’s offering of client clearing services, the RC and the PFE of the exposure to the client (or the exposure to the “lower level client” in the case of a multi-level client structure) may be calculated according to the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment issued by SAMA paragraph 6.15 to 6.80. 11 For the determination of RC and PFE, the amount of initial margin received by the bank from its client that may be included in the haircut value of net collateral held (C) and net independent collateral amount (NICA) should be limited to the amount that is subject to appropriate segregation by the bank as defined in the relevant jurisdiction. 7.2.6 If a client enters into a derivative transaction with the CCP directly, and the CM guarantees the performance of its client’s derivative trade exposures to the CCP. The bank who’s acting as CM for the client to the CCP, must calculate its related Leverage ratio exposure resulting from the guarantee as a derivative exposure as set out in paragraphs 7.2.2 to 7.2.4 above, as if it had entered directly into the transaction

10 If there is a clear precedent for transactions being ported at a QCCP and industry intent for this practice to continue, then these factors must be considered when assessing if trades are highly likely to be ported. The fact that QCCP documentation does not prohibit client trades from being ported is not sufficient to say they are highly likely to be ported. 11 The term “lower level client” refers to the institution that clears through that client.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 18 of 31 with the client, including with regard to the receipt or provision of cash variation margin. 7.2.7 Affiliated entities to the bank acting as a CM may be considered a client if it is outside the relevant scope of regulatory consolidation at the level at which the Leverage ratio is applied. In contrast, if an affiliate entity falls within the regulatory scope of consolidation, the trade between the affiliate entity and the CM is eliminated in the course of consolidation but the CM still has a trade exposure to the CCP. In this case, the transaction with the CCP will be considered proprietary and the exemption in paragraph 7.2.5 above will not apply. 7.2.8 In addition to the CCR exposure arising from the fair value of the contracts, written credit derivatives create a notional credit exposure arising from the credit worthiness of the entity. Banks should treat written credit derivatives consistently with cash instruments (e.g. loans, bonds) for the purposes of the Leverage ratio exposure measure. 7.2.9 To capture the credit exposure of a certain entity, taking into consideration the treatment of derivatives and related collateral above, the effective notional amount referenced by a written credit derivative must be included in the Leverage ratio exposure measure. Unless the written credit derivative is included in a transaction cleared on behalf of a client of the bank acting as a CM (or acting as a clearing services provider in a multi-level client structure as referenced in paragraph 7.2.5 and the transaction meets the requirements of paragraph 7.2.5 for the exclusion of trade exposures to the QCCP (or, in the case of a multi￾level client structure, the requirements of paragraph 7.2.5 for the exclusion of trade exposures to the CM or the QCCP). 7.2.10 The “effective notional amount” obtained by adjusting the notional amount to reflect the true exposure of contracts that are Leveraged or otherwise enhanced by the structure of the transaction. Further, the effective notional amount of a written credit derivative may be reduced by any negative change in fair value amount that has been incorporated into the calculation of Tier 1 capital with respect to the written credit

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 19 of 31 derivative1213 . The resulting amount may be further reduced by the effective notional amount of a purchased credit derivative on the same reference name, provided that: (i) The credit protection purchased through credit derivatives is otherwise subject to the same or more conservative material terms as those in the corresponding written credit derivative. This ensures that if a bank provides written protection via some type of credit derivative, the bank may only recognize offsetting from another purchased credit derivative to the extent that the purchased protection is certain to deliver a payment in all potential future states. Material terms include the level of subordination, optionality, credit events, reference and any other characteristics relevant to the valuation of the derivative For example, the application of the same material terms condition would result in the following treatments: a. in the case of single name credit derivatives, the credit protection purchased through credit derivatives is on a reference obligation which ranks pari passu with or is junior to the underlying reference obligation of the written credit derivative. Credit protection purchased through credit derivatives that references a subordinated position may offset written credit derivatives on a more senior position of the same reference entity as long as a credit event on the senior reference asset would result in a credit event on the subordinated reference asset;

12 For example, if a written credit derivative had a positive fair value of 20 on one date and has a negative fair value of 10 on a subsequent reporting date, the effective notional amount of the credit derivative may be reduced by 10. The effective notional amount cannot be reduced by 30. However, if on the subsequent reporting date the credit derivative has a positive fair value of five, the effective notional amount cannot be reduced at all. 13 This treatment is consistent with the rationale that the effective notional amounts included in the exposure measure may be capped at the level of the maximum potential loss, which means that the maximum potential loss at the reporting date is the notional amount of the credit derivative minus any negative fair value that has already reduced Tier 1 capital.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 20 of 31 b. for tranche products, the credit protection purchased through credit derivatives must be on a reference obligation with the same level of seniority. (ii) The remaining maturity of the credit protection purchased through credit derivatives is equal to or greater than the remaining maturity of the written credit derivative; (iii)The credit protection purchased through credit derivatives is not purchased from a counterparty whose credit quality is highly correlated with the value of the reference obligation in the sense specified in the Minimum Capital Requirement for Counterparty Credit Risk and Credit Valuation Adjustment issued by SAMA paragraph 7.48. The credit quality of the counterparty must not be positively correlated with the value of the reference obligation (ie the credit quality of the counterparty falls when the value of the reference obligation falls and the value of the purchased credit derivative increases). In making this determination, there does not need to exist a legal connection between the counterparty and the underlying reference entity. (iv) In the event that the effective notional amount of a written credit derivative is reduced by any negative change in fair value reflected in the bank’s Tier 1 capital, the effective notional amount of the offsetting credit protection purchased through credit derivatives must also be reduced by any resulting positive change in fair value reflected in Tier 1 capital; and (v) The credit protection purchased through credit derivatives is not included in a transaction that has been cleared on behalf of a client (or that has been cleared by the bank in its role as a clearing services provider in a multi-level client services structure as referenced in paragraph 7.2.5) and for which the effective notional amount referenced by the corresponding written credit derivative is excluded from the Leverage ratio exposure measure according to this paragraph.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 21 of 31 7.2.11 Written credit derivative refers to a broad range of credit derivatives through which a bank effectively provides credit protection and is not limited solely to credit default swaps and total return swaps. For example, all options where the bank has the obligation to provide credit protection under certain conditions qualify as “written credit derivatives”. The effective notional amount of such options sold by the bank may be offset by the effective notional amount of options by which the bank has the right to purchase credit protection which fulfils the conditions of paragraph 7.2.9 and 7.2.10 above. Also, the condition of same or more conservative material terms as those in the corresponding written credit derivatives as referenced in paragraph 7.2.9 and 7.2.10 above can be considered met only when the strike price of the underlying purchased credit protection is equal to or lower than the strike price of the underlying sold credit protection. 7.2.12 For the purposes of paragraph 7.2.9 and 7.2.10 above, two reference names are considered identical only if they refer to the same legal entity. Credit protection on a pool of reference names purchased through credit derivatives may offset credit protection sold on individual reference names, if the credit protection purchased is economically equivalent to purchasing credit protection separately on each of the individual names in the pool (this would, for example, be the case if a bank were to purchase credit protection on an entire securitization structure). 7.2.13 If a bank purchases credit protection on a pool of reference names through credit derivatives but the credit protection purchase does not cover the entire pool (i.e. the protection covers only a subset of the pool, as in the case of an nth-to-default credit derivative or a securitization tranche), then the written credit derivatives on the individual reference names should not be offset. However, such purchased credit protection may offset written credit derivatives on a pool provided that the credit protection purchased through credit

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 22 of 31 derivatives covers the entirety of the subset of the pool on which the credit protection has been sold.14

7.2.14 Where a bank purchases credit protection through a total return swap (TRS) and records the net payments received as net income, but does not record offsetting deterioration in the value of the written credit derivative (either through reductions in fair value or by an addition to reserves) in Tier 1 capital, the credit protection will not be recognized for the purpose of offsetting the effective notional amounts related to written credit derivatives. 7.2.15 Since written credit derivatives are included in the Leverage ratio exposure measure at their effective notional amounts, and are also subject to amounts for PFE, the Leverage ratio exposure measure for written credit derivatives may be overstated. Banks may therefore choose to exclude from the netting set for the PFE calculation the portion of a written credit derivative which is not offset according to paragraph 7.2.9 and 7.2.10 15 and for which the effective notional amount is included in the Leverage ratio exposure measure. 7.3 Securities financing transaction exposures 7.3.1 SFTs such as repurchase agreements, reverse repurchase agreements, security lending and borrowing, and margin-lending transactions where the value of the transactions depends on market valuations and the transactions are often subject to margin agreements, are included in the Leverage ratio exposure measure. 7.3.2 The treatment recognizes that secured lending and borrowing in the form of SFTs is an important source of Leverage, and ensures consistent international implementation by providing a common

14 In other words, offsetting may only be recognized when the pool of reference entities and the level of subordination in both transactions are identical. 15 the removal of a PFE add-on associated with a written credit derivative from the leverage ratio exposure measure refers only to the offset by credit protection purchased through a credit derivative according to paragraph 7.2.9 and 7.2.10 and not to the reduction of the effective notional amount as a result of the negative change in fair value that has reduced Tier 1 capital.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 23 of 31 measure for dealing with the main differences in the operative accounting frameworks. Treatment of Securities financing transaction exposures: 7.3.3 Bank acting as principal (General treatment): the sum of the amounts below must be included in the Leverage ratio exposure measure: (i) Gross SFT assets 16 recognized for accounting purposes (i.e. with no recognition of accounting netting)17 will be adjusted as follows: a. Excluding from the Leverage ratio exposure measure the value of any securities received under an SFT, where the bank has recognized the securities as an asset on its balance sheet. b. Cash payables and cash receivables in SFTs with the same counterparty may be measured net if all the following criteria are met:  Transactions have the same explicit final settlement date; in particular, transactions with no explicit end date but which can be unwound at any time by either party to the transaction are not eligible;  The right to set off the amount owed to the counterparty with the amount owed by the counterparty is legally enforceable both currently in the normal course of business and in the event of the counterparty’s default; insolvency; or bankruptcy;  The counterparties intend to settle net, settle simultaneously, or the transactions are subject to a settlement mechanism that results in the functional equivalent of net settlement – that is, the cash flows of the transactions are equivalent, in effect, to

16 For SFT assets subject to novation and cleared through QCCPs, “gross SFT assets recognized for accounting purposes” are replaced by the final contractual exposure, i.e. the exposure to the QCCP after the process of novation has been applied, given that pre-existing contracts have been replaced by new legal obligations through the novation process. However, banks can only net cash receivables and cash payables with a QCCP if the criteria in paragraph 7.3.3 (i) are met. Any other netting permitted by the QCCP is not permitted for the purposes of the Leverage ratio. 17 Gross SFT assets recognized for accounting purposes must not recognize any accounting netting of cash payables against cash receivables (eg as currently permitted under the IFRS). This regulatory treatment has the benefit of avoiding inconsistencies from netting which may arise across different accounting regimes

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 24 of 31 a single net amount on the settlement date. To achieve such equivalence both transactions are settled through the same settlement system and the settlement arrangements are supported by cash and/or intraday credit facilities intended to ensure that settlement of both transactions will occur by the end of the business day and any issues arising from the securities legs of the SFTs do not interfere with the completion of the net settlement of the cash receivables and payables. In particular, this latter condition means that the failure of any single securities transaction in the settlement mechanism may delay settlement of only the matching cash leg or create an obligation to the settlement mechanism, supported by an associated credit facility. If there is a failure of the securities leg of a transaction in such a mechanism at the end of the window for settlement in the settlement mechanism, then this transaction and its matching cash leg must be split out from the netting set and treated gross.18 (ii) A measure of CCR calculated as the current exposure without an add-on for PFE, should be calculated as follows: a. Where a qualifying MNA19 is in place, the current exposure (E*) is the greater of zero and the total fair value of securities and cash lent to a counterparty for all transactions included in the qualifying MNA (∑Ei), less the total fair value of cash and securities received from the counterparty for those transactions (∑Ci). This is illustrated in the following formula: E* = max {0, [∑Ei – ∑Ci]}

18 the criteria in this paragraph are not intended to preclude a DVP settlement mechanism or other type of settlement mechanism, provided that the settlement mechanism meets the functional requirements. For example, a settlement mechanism may meet these functional requirements if any failed transactions (ie the securities that failed to transfer and the related cash receivable or payable) can be re-entered in the settlement mechanism until they are settled. 19 A “qualifying” MNA is one that meets the requirements under paragraphs 7.3.4 in this document.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 25 of 31 b. Where no qualifying MNA is in place, the current exposure for transactions with a counterparty must be calculated on a transaction-by-transaction basis – that is, each transaction i is treated as its own netting set, as shown in the following formula: Ei* = max {0, [Ei – Ci]} Where Ei* may be set to zero if:  Ei is the cash lent to a counterparty.  This transaction is treated as its own netting set and  The associated cash receivable is not eligible for the netting treatment in paragraph 7.3.3 (i). For the purposes of the above subparagraph, the term “counterparty” includes not only the counterparty of the bilateral repo transactions but also triparty repo agents that receive collateral in deposit and manage the collateral in the case of triparty repo transactions. Therefore, securities deposited at triparty repo agents are included in “total value of securities and cash lent to a counterparty” (E) up to the amount effectively lent to the counterparty in a repo transaction. However, excess collateral that has been deposited at triparty agents but that has not been lent out may be exclude. 7.3.4 Securities financing transaction exposures calculation: (i) The effects of bilateral netting agreements20 for covering SFTs will be recognized on a counterparty-by-counterparty basis if the agreements are legally enforceable in each relevant jurisdiction upon the occurrence of an event of default and regardless of whether the counterparty is insolvent or bankrupt. In addition, netting agreements must: a. Provide the non-defaulting party with the right to terminate and close out in a timely manner all transactions under the agreement

20 The provisions related to qualifying master netting agreements for SFTs are intended for the calculation of the counterparty credit risk measure of SFTs as set out in paragraph 7.3.3 (ii) only.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 26 of 31 upon an event of default, including in the event of insolvency or bankruptcy of the counterparty; b. Provide for the netting of gains and losses on transactions (including the value of any collateral) terminated and closed out under it so that a single net amount is owed by one party to the other; c. Allow for the prompt liquidation or setoff of collateral upon the event of default; and d. Be together with the rights arising from provisions required in (a) and (c) above, legally enforceable in each relevant jurisdiction upon the occurrence of an event of default regardless of the counterparty’s insolvency or bankruptcy. (ii) Netting across positions held in the banking book and trading book will only be recognized when the netted transactions fulfil the following conditions: a. All transactions are marked to market daily; and b. The collateral instruments used in the transactions are recognized as eligible financial collateral in the banking book 7.3.5 Sale accounting transactions: Leverage may remain with the lender of the security in an SFT whether or not sale accounting is achieved under the operative accounting framework. If the sale accounting is achieved for an SFT under the bank’s operative accounting framework, the bank must reverse all sales-related accounting entries, and then calculate its exposure as if the SFT had been treated as a financing transaction under the operative accounting framework. I.e. the bank must include the sum of amounts in subparagraphs (i) and (ii) of paragraph 7.3.3 for such an SFT) for the purpose of determining its Leverage ratio exposure measure. 7.3.6 Bank acting as agent: (i) A bank acting as agent in an SFT provides Indemnity or guarantee to only one of the two parties involved, and only for the difference between the value of the security or cash its customer has lent and the value of collateral the borrower has provided. In this situation,

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 27 of 31 the bank is exposed to the counterparty of its customer for the difference in values rather than to the full exposure to the underlying security or cash of the transaction (as is the case where the bank is one of the principals in the transaction). (ii)A bank acting as agent in an SFT provides Indemnity or guarantee to a customer or counterparty for any difference between the value of the security or cash the customer has lent and the value of collateral the borrower has provided and the bank does not own or control the underlying cash or security resource, then the bank will be required to calculate its Leverage ratio exposure measure by applying only measure of CCR calculated as the current exposure without an add-on for PFE (subparagraph (ii) of paragraph 7.3.3). In addition to the conditions mentioned from paragraph 7.3.3 to 7.3.6 bank acting as an agent in an SFT does not provide an indemnity or guarantee to any of the involved parties, the bank is not exposed to the SFT and therefore need not recognize those SFTs in its Leverage ratio exposure measure. (iii) A bank acting as agent in an SFT provides Indemnity or guarantee to a customer or counterparty will be considered eligible for the exceptional treatment above only if the bank’s exposure to the transaction is limited to the guaranteed difference between the values of the security or cash its customer has lent and the value of the collateral the borrower has provided. In situations where the bank is further economically exposed (i.e. beyond the guarantee for the difference) to the underlying security or cash in the transaction, a further exposure equal to the full amount of the security or cash must be included in the Leverage ratio exposure measure. For example, due to the bank managing collateral received in the bank’s name or on its own account rather than on the customer’s or borrower’s account (eg by on-lending or managing unsegregated collateral, cash or securities). However, this does not apply to client omnibus accounts that are used by agent lenders to hold and manage client collateral provided that client collateral is segregated from the

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 28 of 31 bank’s proprietary assets and the bank calculates the exposure on a client-by-client basis. (iv)A bank acting as agent in an SFT provides Indemnity or guarantee to both parties involved in an SFT (i.e. securities lender and securities borrower), the bank will be required to calculate its Leverage ratio exposure measure in accordance with paragraph 7.3.3 to 7.3.6 separately for each party involved in the transaction. 7.4 Off-balance sheet (OBS) items 7.4.1 OBS items include commitments (including liquidity facilities), whether or not unconditionally cancellable, direct credit substitutes, acceptances, standby letters of credit and trade letters of credit. 7.4.2 Treatment of OBS items for inclusion in the Leverage ratio exposure measure should be as follows: (i) The standardized approach for credit risk as it applies to individual claims and the standardized approach for counterparty credit risk (SA-CCR) as well as treatments unique to the Leverage ratio framework. (ii) If the OBS item is treated as a derivative exposure per the bank’s relevant accounting standard, then the item must be measured as a derivative exposure for the purpose of the Leverage ratio exposure measure. In this case, the bank does not need to apply the OBS item treatment to the exposure. (iii) OBS items are converted under the standardized approach for credit risk into credit exposure equivalents through the use of credit conversion factors (CCFs) as mentioned in the latest risk-based capital framework adopted by SAMA. For the purpose of determining the exposure amount of OBS items for the Leverage ratio, the CCFs set out in Paragraph 7.4.3 from (iv) to (x) must be applied to the notional amount. (iv) Specific and general provisions set aside against OBS exposures that have decreased regulatory capital may be deducted from the credit exposure equivalent amount of those exposures (ie the exposure

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 29 of 31 amount after the application of the relevant CCF). However, the resulting total off-balance sheet equivalent amount for OBS exposures cannot be less than zero. 7.4.3 Calculation of off balance sheet items should be as follows: (i) For the purposes of the Leverage ratio, OBS items will be converted into credit exposures by multiplying the committed but undrawn amount by a credit conversion factor (CCF). (ii) Commitment means any contractual arrangement that has been offered by the bank and accepted by the client to extend credit, purchase assets or issue credit substitutes. It includes the following: a. Any arrangement that can be unconditionally cancelled by the bank at any time without prior notice to the obligor. b. Any arrangement that can be cancelled by the bank if the obligor fails to meet conditions set out in the facility document, including conditions that must be met by the obligor prior to any initial or subsequent drawdown arrangement. (iii) Certain arrangements that meets the following requirements can be exempted from the definition of commitments after obtaining SAMA prior approval: a. The bank receives no fees or commissions to establish or maintain the arrangements; b. The client is required to apply to the bank for the initial and each subsequent drawdown; c. The bank has full authority, regardless of the fulfilment by the client of the conditions set out in the facility documentation, over the execution of each drawdown; and d. The bank’s decision on the execution of each drawdown is only made after assessing the creditworthiness of the client immediately prior to drawdown. Exempted arrangements that meet the above criteria are confined to certain arrangements for

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 30 of 31 corporates and SMEs21, where counterparties are closely monitored on an ongoing basis). (iv) A 100% CCF will be applied to the following items: a. Direct credit substitutes, e.g. general guarantees of indebtedness (including standby letters of credit serving as financial guarantees for loans and securities) and acceptances (including endorsements with the character of acceptances). b. Forward asset purchases, forward forward deposits and partly paid shares and securities, which represent commitments with certain drawdown. c. The exposure amount associated with unsettled financial asset purchases (i.e. the commitment to pay) where regular-way unsettled trades are accounted for at settlement date. Banks may offset commitments to pay for unsettled purchases and cash to be received for unsettled sales provided that the following conditions are met:  the financial assets bought and sold that are associated with cash payables and receivables are fair valued through income and included in the bank’s regulatory trading book as specified in Boundary between the banking book and the trading book in the Minimum Capital Requirement for Market Risk issued by SAMA paragraph 5.1 to 5.13; and  The transactions of the financial assets are settled on a DVP basis. d. Off-balance sheet items that are credit substitutes not explicitly included in any other category. (v) A 50% CCF will be applied to the following : a. Note issuance facilities (NIFs) and revolving underwriting facilities (RUFs) regardless of the maturity of the underlying facility.

21 As defined in SAMA circular No.381000064902 dated 16/06/1438 or any subsequent definition by SAMA.

Version Issuance Date Page Number Leverage Ratio Framework 2.1 December 2022 31 of 31 b. To certain transaction-related contingent items (e.g. performance bonds, bid bonds, warranties and standby letters of credit related to particular transactions). (vi) A 40% CCF will be applied to commitments, regardless of the maturity of the underlying facility, unless they qualify for a lower CCF. (vii) A 20% CCF will be applied to both the issuing and confirming banks of short-term(Less than a year) self-liquidating trade letters of credit arising from the movement of goods (e.g. documentary credits collateralized by the underlying shipment). (viii) A 10% CCF will be applied to commitments that are unconditionally cancellable at any time by the bank without prior notice, or that effectively provide for automatic cancellation due to deterioration in a borrower’s creditworthiness. (ix) Where there is an undertaking to provide a commitment on an off-balance sheet item, banks are to apply the lower of the two applicable CCFs. For example, if a bank has a commitment to open short-term self-liquidating trade letters of credit arising from the movement of goods, a 20% CCF will be applied (instead of a 40% CCF); and if a bank has an unconditionally cancellable commitment described in 7.92 in the Minimum Capital Requirements for Credit Risk issued by SAMA to issue direct credit substitutes, a 10% CCF will be applied (instead of a 100% CCF). (x) OBS securitization exposures must be treated as per paragraph 18.20 in the Minimum Capital Requirements for Credit Risk issued by SAMA.

Saudi Central Bank (SAMA) Output Floor Requirements December 2022

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 2 of 8 Contents

1. Introduction 3
2. Scope of Application 3
3. Implementation Timeline 3
4. SAMA Reporting Requirements 3
5. Minimum risk-based capital requirements 3 Risk-weighted assets and Output Floor requirements 4 RWA for credit risk 5 RWA for market risk 6 RWA for operational risk 6 Calculation of the output floor 7

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 3 of 8 Output Floor Requirements

1. Introduction 1.1 The Basel Committee on Banking Supervision issued the Basel III: Finalizing post-crisis reforms in December 2017, which includes among others, the requirements for output floor, which aims to reduce excessive variability of Risk￾Weighted Assets “RWA” and to enhance the comparability of risk-weighted capital ratios. Under these requirements, banks using internal models to derive RWAs will be subject to a floor requirement that is applied to RWAs. The output floor will ensure that banks’ capital requirements do not fall below a certain percentage of capital requirements derived under standardized approaches. 1.2 The output floor requirements are issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H.
2. Scope of Application 2.1 These requirements apply to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 2.2 These requirements are not applicable to foreign banks’ branches operating in the Kingdom of Saudi Arabia, and the branches shall comply with the regulatory capital requirements stipulated by their respective home regulators.
3. Implementation Timeline 3.1 These requirements will be effective on 1 January 2023, subject to the transitional arrangements in paragraph 5.10.
4. SAMA Reporting Requirements 4.1 To the extent that output floor is applicable, SAMA expects banks to report their regulatory capital and RWA calculated based on the Output Floor Requirements based on SAMA’s reporting template within 30 days after the end of each quarter starting from 1 January 2023.
5. Minimum Risk-Based Capital Requirements 5.1 Minimum capital requirements and the components of capital are as per the

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 4 of 8 definitions in SAMA’s Enhanced Finalized Guidance Document Concerning the Implementation of Basel III circular No. 351000123076 issued in 2014, and subject to the transitional arrangements in Paragraph 5.10. Calculation of RWA shall be in accordance with the requirements as mentioned in paragraphs 5.2 and 5.3. Risk-weighted Assets and Output Floor Requirements 5.2 There are different approaches to calculate RWA for market risk, credit risk including counterparty credit risk; some of these approaches require SAMA’s prior approval. The nominated approaches of a bank refer to all the approaches that the bank is using or may use with SAMA’s approval, to calculate regulatory capital requirements, other than those approaches used solely for the purpose of the output floor calculation outlined below. 5.3 The RWA that banks must use to determine compliance with the requirements referred in paragraph 5.2 above and capital buffers requirements in accordance with SAMA Circular No. 351000123076, dated 21 July 2014, entitled “Enhanced Finalized Guidance Document Concerning the Implementation of Basel III, Section A”, SAMA Circular No. 371000034973, dated 4 January 2016, entitled “Applicability of Countercyclical Capital Buffer (CCyB) in Saudi Arabia”, and SAMA Circular No. 351000138356, dated 7 September 2014, entitled “Domestic Systemically Important Banks (D-SIBs) Framework”, is the higher of: (1) The sum of the following three elements, calculated using the bank’s nominated approaches: (a) RWA for credit risk (as calculated in paragraphs 5.4); (b) RWA for market risk (as calculated in paragraph 5.5); (c) RWA for operational risk (as calculated in paragraph 5.6); (2) 72.5% of the sum of the elements listed in point (1) above, calculated using only the standardized approaches listed in paragraph 5.7. This requirement is referred to as the output floor, and the RWA amount that is multiplied by 72.5% is referred to as the base of the output floor. This requirement is subject to transitional arrangements set out in 5.10.

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 5 of 8 RWA for Credit Risk 5.4 RWA for credit risk and counterparty credit risk is calculated as the sum of the following: (1) Credit RWA for banking book exposures, except the RWA listed in (2) to (6) below, calculated using: (a) The standardized approach, set out in SAMA Minimum Capital Requirements for Credit Risk chapters 7 to 9; or (b) The internal ratings-based (IRB) approach, set out in SAMA Minimum Capital Requirements for Credit Risk chapters 10 to 16. (2) RWA for counterparty credit risk arising from banking book exposures and from trading book instruments (as specified in SAMA Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA)), except the exposures listed in (3) to (6) below. (3) Credit RWA for equity investments in funds that are held in the banking book calculated using one or more of the approaches set out in chapter 24 of SAMA Minimum Capital Requirements for Credit Risk: (a) The look-through approach. (b) The mandate-based approach. (c) The fall-back approach. (4) RWA for securitization exposures held in the banking book, calculated using one or more of the approaches set out in chapters 18 to 23 of SAMA Minimum Capital Requirements for Credit Risk: (a) Securitization Standardized Approach (SEC-SA). (b) Securitization External Ratings-Based Approach (SEC-ERBA). (c) Internal Assessment Approach (IAA). (d) Securitization Internal Ratings-Based Approach (SEC-IRBA). (e) A risk weight of 1250% in cases where the bank cannot use (a) to (d) above.

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 6 of 8 (5) RWA for exposures to central counterparties in the banking book and trading book, calculated using the approach set out in chapter 8 of SAMA Minimum Capital Requirements for CCR and CVA. (6) RWA for the risk posed by unsettled transactions and failed trades, where these transactions are in the banking book or trading book and are within scope of the rules set out in chapter 25 of SAMA Minimum Capital Requirements for Credit Risk. RWA for Market Risk 5.5 RWA for market risk is calculated as the sum of the following: (1) RWA for market risk for instruments in the trading book and for foreign exchange risk and commodities risk for exposures in the banking book, calculated using one or more of the following approaches: (a) The standardized approach for market risk, set out in chapters 6 to 9 of SAMA Minimum Capital Requirements for Market Risk; (b) The internal models approach (IMA) for market risk, set out in chapters 10 to 13 of SAMA Minimum Capital Requirements for Market Risk; or (c) The simplified standardized approach for market risk, set out in chapter 14 of SAMA Minimum Capital Requirements for Market Risk. (2) RWA for credit valuation adjustment (CVA) risk in the banking and trading book, calculated using one of the following methods set out in chapter 11 of SAMA CCR and CVA Framework: (a) The basic approach to CVA risk (BA-CVA). (b) The standardized approach to CVA risk (SA-CVA). (c) 100% of the bank’s RWA for counterparty credit risk, for banks that have exposures below a materiality threshold (see paragraph 9 of chapter 11 in SAMA CCR and CVA Framework). RWA for Operational Risk 5.6 RWA for operational risk is calculated using the standardized approach for operational risk, set out in paragraph 7.1 of SAMA Minimum Capital Requirements for Operational Risk.

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 7 of 8 Calculation of the Output Floor 5.7 The standardized approaches to be used to calculate the base of the output floor referenced in paragraph 5.3 (2) are as follows: (1) The standardized approach for credit risk. (2) The bank's nominated approach for equity investments in funds. (3) For securitization exposures in the banking book and when determining the default risk charge component for securitization exposures in the trading book: (a) if a bank does not use SEC-IRBA or SEC-IAA, its nominated approach; or (b) if a bank does use SEC-IRBA or SEC-IAA, then the SEC-ERBA, SEC￾SA or a risk-weight of 1250% as determined per the hierarchy of approaches. (4) For counterparty credit risk exposure measurement: (a) if a bank does not use IMM or the VaR models approach, then its nominated approach; or (b) if a bank does use IMM or the VaR models approach, then the SA-CCR or the comprehensive approach. (5) For market risk: (a) If a bank uses the IMA for market risk, then the standardized approach for market risk; or (b) If a bank does not use the IMA for market risk, then its nominated approach. (6) The bank's nominated approach for CVA risk. (7) The standardized approach for operational risk.

Output Floor Requirements Version Issuance Date Page Number 1.1 December 2022 8 of 8 5.8 As per paragraph 5.7 above, the following approaches are not permitted to be used, directly or by cross reference,1 in the calculation of the base of the output floor: (1) IRB approach to credit risk; (2) SEC-IRBA; (3) IMA for market risk; (4) VaR models approach to counterparty credit risk; and (5) IMM for counterparty credit risk. 5.9 SAMA may review the level of the incremental increase for all banks. In addition, SAMA may also apply a cap on the incremental increase during the phase-in period on case–by-case basis. In this regard, banks must submit an application to SAMA with supporting justification for applying the cap on the incremental increase. 5.10 The output floor will be implemented as of 1 January 2023, the required calibration percentage will gradually increase as following: Phase-in arrangements for output floor Table 1 Date Calibration 1 January 2023 50% 1 January 2024 55% 1 January 2025 60% 1 January 2026 65% 1 January 2027 70% 1 January 2028 72.5%

1 As examples:

• Although the requirements for calculating exposures to central counterparties (chapter 8 of SAMA CCR and CVA framework) cross-refer to IMM as a possible method for calculating exposure values, IMM may not be used when these rules are applied for calculating the base of the output floor.
• For the look-through and mandate-based approaches for equity investments in funds, banks must use the standardized approach for credit risk when calculating the RWA of the underlying assets of the funds for the base of the output floor.
• Although there is a cross reference in the standardized approach for market risk to the securitization chapters of the credit risk standard (chapter 18 to 23 of SAMA Minimum Capital Requirements for Credit Risk), SEC-IRBA may not be used when the standardized approach for market risk is calculated for the base of the output floor.

Saudi Central Bank (SAMA) Pillar 3 Disclosure Requirements Framework December 2022

Page Number 2 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Contents

1. Introduction:.........................................................................................................................................................4
2. Scope of application:............................................................................................................................................5
3. Implementation dates: .........................................................................................................................................5
4. Guiding principles of banks’ Pillar 3 disclosures:.............................................................................................5
5. Assurance of Pillar 3 data: ..................................................................................................................................6
6. Reporting location:...............................................................................................................................................7
7. Presentation of the disclosure requirements: ....................................................................................................7
8. Frequency and timing of disclosures:.................................................................................................................9
9. Retrospective disclosures, disclosure of transitional metrics and reporting periods:..................................10
10. Proprietary and confidential information: ....................................................................................................10
11. Qualitative narrative to accompany the disclosure requirements:..............................................................10
12. Overview of risk management, key prudential metrics and RWA: ............................................................11
13. Comparison of modelled and standardised RWA: .......................................................................................19
14. Composition of capital and TLAC: ................................................................................................................25
15. Capital distribution constraints:.....................................................................................................................44
16. Links between financial statements and regulatory exposures:...................................................................46 17- Asset encumbrance:.........................................................................................................................................53
17. Remuneration:..................................................................................................................................................55
18. Credit risk:........................................................................................................................................................60
19. Counterparty credit risk: ................................................................................................................................85
20. Securitisation:...................................................................................................................................................95
21. Market Risk:...................................................................................................................................................106
22. Credit valuation adjustment risk: ................................................................................................................113
23. Operational risk:............................................................................................................................................120
24. Interest rate risk in the banking book:.........................................................................................................127
25. Macroprudential supervisory measures: .....................................................................................................131
26. Leverage ratio: ...............................................................................................................................................135
27. Liquidity: ........................................................................................................................................................142
28. Worked examples:..........................................................................................................................................151
29. Annexure 1: Frequently asked questions (FAQ):........................................................................................157
30. Annexure 2: Frequency and timing of disclosures:.....................................................................................165

Page Number 3 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Glossary SACAP SAMA's Final Guidance Document Concerning Implementation of Capital Reforms Under Basel III Framework No.341000015689 date 06/02/1434AH, Section A SCRE Calculation of the Minimum Capital Requirements for Credit Risk issued by SAMA as part of its adoption of Basel III post-crisis final reforms. SCCR Minimum Capital Requirements for Counterparty Credit Risk (CCR) and Credit Valuation Adjustment (CVA) issued by SAMA as part of its adoption of Basel III post-crisis final reforms. SMAR Minimum Capital Requirements for market risk issued by SAMA, as part of its adoption of Basel III post-crisis final reforms. SOPE Minimum Capital Requirements for operational risk issued by SAMA as part of its adoption of Basel III post-crisis final reforms. SLEV Leverage Ratio Framework issued by SAMA as part of its adoption of Basel III post-crisis final reforms. SLCR SAMA’s Finalized Guidance and Prudential Returns Concerning Amended Liquidity Coverage Ratio (LCR) – Based on BCBS Amendments of January 2013 No.341000107020 date 1434/09/02AH. SNSF Guidance Document Concerning BASEL III: The Net Stable Funding Ratio (NSFR) – Based on BCBS Document of October 2014 No.44967/41 date 1439/10/13AH.

Page Number 4 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Pillar 3 Disclosure Requirements Framework

1. Introduction: Basel Committee on Banking Supervision issued a document on Basel III: Finalizing post-crisis reforms in December 2017. Which includes the revised disclosure requirements that aims to enhance transparency by setting the minimum requirements for market disclosures of information on the risk management practices and capital adequacy of banks. This will enable market participants to obtain key information on risk exposures, risk management framework, adequacy of regulatory capital of banks, reduces information asymmetry and helps promote comparability of banks’ risk profiles within and across jurisdictions. In addition, banks’ Pillar 3 disclosure will also facilitate supervisory monitoring while strengthening incentives for banks to implement robust risk management. Among the key revisions to the Pillar 3 framework include disclosure requirements related to: a) Credit risk, operational risk, the leverage ratio and credit valuation adjustment (CVA) risk; b) Risk-weighted assets (RWAs) as calculated by the bank's internal models and according to the standardised approaches; c) Disclosures related to the revised market risk framework d) Overview of risk management framework, RWAs and key prudential metrics; and e) Asset encumbrance; and f) Capital distribution constraints This framework is issued by SAMA in exercise of the authority vested in SAMA under the Central Bank Law issued via Royal Decree No. M/36 dated 11/04/1442H, and the Banking Control Law issued 01/01/1386H. This framework supersedes all circulars/instructions/rules related to Pillar 3 Disclosure Requirements previously issued by SAMA.

Page Number 5 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 2. Scope of application: 2.1 Disclosure requirements are an integral part of the Basel framework. Unless otherwise stated, the Tables and Templates are applicable to all domestic banks both on a consolidated basis, which include all branches and subsidiaries, and on a standalone basis. 2.2 This framework is not applicable to Foreign Banks Branches operating in the kingdom of Saudi Arabia. 2.3 Banks must assess the applicability of the disclosure requirements based on their specific compliance obligations. 3. Implementation dates: 3.1 Disclosure requirements will be effective on 01 January 2023. 3.2 Disclosure requirements are applicable for Pillar 3 reports related to fiscal periods that include or come after the specific calendar implementation date which means that the first set of templates/tables will cover data as at March 31, 2023. 4. Guiding principles of banks’ Pillar 3 disclosures: 4.1 Banks should ensure compliance with the following guiding principles which aim to provide a firm foundation for achieving transparent, high-quality Pillar 3 risk disclosures that will enable users to better understand and compare a bank's business and its risks: Principle 1: Disclosures should be clear 4.2 Disclosures should be presented in a form that is understandable to key stakeholders (eg investors, analysts, financial customers and others) and communicated through an accessible medium. Important messages should be highlighted and easy to find. Complex issues should be explained in simple language with important terms defined. Related risk information should be presented together. Principle 2: Disclosures should be comprehensive 4.3 Disclosures should describe a bank's main activities and all significant risks, supported by relevant underlying data and information. Significant changes in risk exposures between reporting periods should be described, together with the appropriate response by management. 4.4 Disclosures should provide sufficient information in both qualitative and quantitative terms on a bank's processes and procedures for identifying, measuring

Page Number 6 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 and managing those risks. The level of detail of such disclosure should be proportionate to a bank's complexity. 4.5 Approaches to disclosure should be sufficiently flexible to reflect how senior management and the board of directors internally assess and manage risks and strategy, helping users to better understand a bank's risk tolerance/appetite. Principle 3: Disclosures should be meaningful to users 4.6 Disclosures should highlight a bank's most significant current and emerging risks and how those risks are managed, including information that is likely to receive market attention. Where meaningful, linkages must be provided to line items on the balance sheet or the income statement. Disclosures that do not add value to users' understanding or do not communicate useful information should be avoided. Furthermore, information which is no longer meaningful or relevant to users should be removed. Principle 4: Disclosures should be consistent over time 4.7 Disclosures should be consistent over time to enable key stakeholders to identify trends in a bank's risk profile across all significant aspects of its business. Additions, deletions and other important changes in disclosures from previous reports, including those arising from a bank's specific, regulatory or market developments, should be highlighted and explained. Principle 5: Disclosures should be comparable across banks 4.8 The level of detail and the format of presentation of disclosures should enable key stakeholders to perform meaningful comparisons of business activities, prudential metrics, risks and risk management between banks and across jurisdictions. 5. Assurance of Pillar 3 data: 5.1 Banks must establish a formal board-approved disclosure policy for Pillar 3 information that sets out the internal controls and procedures for disclosure of such information. The key elements of this policy should be described in the year-end Pillar 3 report or cross-referenced to another location where they are available. 5.2 The board of directors and senior management are responsible for establishing and maintaining an effective internal control structure over the disclosure of financial information, including Pillar 3 disclosures. They must also ensure that appropriate review of the disclosures takes place. The information provided by banks under Pillar 3 must be subject, at a minimum, to the same level of internal review and internal control processes as the information provided by banks for their financial

Page Number 7 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 reporting (i.e. the level of assurance must be the same as for information provided within the management discussion and analysis part of the financial report). 5.3 One or more senior officers of a bank must attest in writing that all Pillar 3 disclosures have been prepared in accordance with the board-agreed internal control processes. 6. Reporting location: 6.1 Banks must publish their Pillar 3 report in a standalone document that provides a readily accessible source of prudential measures for users. The Pillar 3 report may be appended to, or form a discrete section of, a bank's financial reporting, but it must be easily identifiable to users. Signposting of disclosure requirements is permitted in certain circumstances, as set out in section 7.2. Banks must also make available on their websites an archive for 10 years retention period of Pillar 3 reports (quarterly, semi-annual and annual) relating to prior reporting periods. 6.2 Banks are required to submit a copy of the disclosures to SAMA via the following email address: BankingDataSection@SAMA.GOV.SA 7. Presentation of the disclosure requirements: 7.1 Templates and tables: 7.1.1 The disclosure requirements are presented either in the form of templates or tables. Templates must be completed with quantitative data in accordance with the definitions provided. Tables generally relate to qualitative requirements, but quantitative information is also required in some instances. Banks may choose the format they prefer when presenting the information requested in tables. 7.1.2 In line with Principle 3 in section 4.6, the information provided in the templates and tables should be meaningful to users. The disclosure requirements in this document that necessitate an assessment from banks are specifically identified. When preparing these individual tables and templates, banks will need to consider carefully how widely the disclosure requirement should apply. If a bank considers that the information requested in a template or table would not be meaningful to users, for example because the exposures and risk-weighted asset (RWA) amounts are deemed immaterial, it may choose not to disclose part or all of the information requested. In such circumstances, however, the bank will be required to explain in a narrative commentary why it considers such information not to be meaningful to users. It should describe the portfolios

Page Number 8 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 excluded from the disclosure requirement and the aggregate total RWA those portfolios represent. 7.1.3 For templates, the format is designated as either fixed or flexible: a) Where the format of a template is described as fixed, banks must complete the fields in accordance with the instructions given. If a row/column is not considered to be relevant to a bank's activities or the required information would not be meaningful to users (eg immaterial from a quantitative perspective), the bank may delete the specific row/column from the template, but the numbering of the subsequent rows and columns must not be altered. Banks may add extra rows and extra columns to fixed format templates if they wish to provide additional detail to a disclosure requirement by adding sub-rows or columns, but the numbering of prescribed rows and columns in the template must not be altered. b)Where the format of a template is described as flexible, banks may present the required information either in the format provided in this document or in one that better suits the bank. The format for the presentation of qualitative information in tables is not prescribed. Notwithstanding, banks should comply with the restrictions in presentation, should such restrictions be prescribed in the template (eg Template CCR5 in section 20). In addition, when a customised presentation of the information is used, the bank must provide information comparable with that required in the disclosure requirement (ie at a similar level of granularity as if the template/table were completed as presented in this document). 7.2 Signposting: 7.2.1 Banks may disclose in a document separate from their Pillar 3 report (eg in a bank's annual report or through published regulatory reporting) the templates/tables with a flexible format, and the fixed format templates where the criteria in section 7.2.2 are met. In such circumstances, the bank must signpost clearly in its Pillar 3 report where the disclosure requirements have been published. This signposting in the Pillar 3 report must include: a) The title and number of the disclosure requirement; b)The full name of the separate document in which the disclosure requirement has been published; c) A web link, where relevant; and

Page Number 9 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 d)The page and paragraph number of the separate document where the disclosure requirements can be located. 7.2.2 The disclosure requirements for templates with a fixed format may be disclosed by banks in a separate document other than the Pillar 3 report, provided all of the following criteria are met: a) The information contained in the signposted document is equivalent in terms of presentation and content to that required in the fixed template and allows users to make meaningful comparison with information provided by banks disclosing the fixed format templates; b)The information contained in the signposted document is based on the same scope of consolidation as the one used in the disclosure requirement; c) The disclosure in the signposted document is mandatory; and d)SAMA is responsible for ensuring the implementation of the Basel standards is subject to legal constraints in its ability to require the reporting of duplicative information. 7.2.3 Banks can only make use of signposting to another document if the level of assurance on the reliability of data in the separate document are equivalent to, or greater than, the internal assurance level required for the Pillar 3 report (see sections on reporting location and assurance above). 8. Frequency and timing of disclosures: 8.1 The frequencies of disclosure as indicated in the disclosure templates and tables vary between quarterly, semiannual and annual reporting depending upon the nature of the specific disclosure requirement. Annexure 2 summarizes the frequency and timing of disclosures for each table. 8.2 A bank's Pillar 3 report must be published concurrently with its financial report for the corresponding period. If a Pillar 3 disclosure is required to be published for a period when a bank does not produce any financial report (eg semiannual), disclosures must be published as soon as practicable and the time lag must be no longer than the maximum period of 30 days for quarterly disclosures and 60 days for semiannually and annually disclosures from its regular financial reporting period-ends.

Page Number 10 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 9. Retrospective disclosures, disclosure of transitional metrics and reporting periods: 9.1 In templates which require the disclosure of data points for current and previous reporting periods, the disclosure of the data point for the previous period is not required when a metric for a new standard is reported for the first time unless this is explicitly stated in the disclosure requirement. 9.2 Unless otherwise specified in the disclosure templates, when a bank is under a transitional regime permitted by the standards, the transitional data should be reported unless the bank already complies with the fully loaded requirements. Banks should clearly state whether the figures disclosed are computed on a transitional or fully-loaded basis. Where applicable, banks under a transitional regime may separately disclose fully-loaded figures in addition to transitional metrics. 9.3 Unless otherwise specified in the disclosure templates, the data required for annual, semiannual and quarterly disclosures should be for the corresponding 12-month, six￾month and three-month period, respectively. 10. Proprietary and confidential information: 10.1 In exceptional cases, where disclosure of certain items required by Pillar 3 may reveal the position of a bank or contravene its legal obligations by making public information that is proprietary or confidential in nature, a bank does not need to disclose those specific items, but must disclose more general information about the subject matter of the requirement instead. It must also explain in the narrative commentary to the disclosure requirement the fact that the specific items of information have not been disclosed and the reasons for this. 11. Qualitative narrative to accompany the disclosure requirements: 11.1 Banks should supplement the quantitative information provided in both fixed and flexible templates with a narrative commentary to explain at least any significant changes between reporting periods and any other issues that management considers to be of interest to market participants. The form taken by this additional narrative is at the bank's discretion. 11.2 Additional voluntary risk disclosures allow banks to present information relevant to their business model that may not be adequately captured by the standardised requirements. Additional quantitative information that banks choose to disclose must provide sufficient meaningful information to enable market participants to understand and analyse any figures provided. It must also be accompanied by a qualitative discussion. Any additional disclosure must comply with the five guiding principles above.

Page Number 11 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 12. Overview of risk management, key prudential metrics and RWA: 12.1 The disclosure requirements under this section are: 12.1.1Template KM1 – Key metrics (at consolidated level) 12.1.2Template KM2 – Key metrics – total loss-absorbing capacity (TLAC) requirements (at resolution group level) 12.1.3Table OVA – Bank risk management approach 12.1.4Template OV1 – Overview of risk-weighted assets (RWA) 12.2 The disclosure requirements related to TLAC are not required to be completed by banks unless otherwise specified by SAMA. 12.3 Template KM1 provides users of Pillar 3 data with a time series set of key prudential metrics covering a bank’s available capital (including buffer requirements and ratios), its RWA, leverage ratio, Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR). As set out in circular No.391000029731 dated 15/03/1439 AH, banks are required to publicly disclose whether they are applying a transitional arrangement for the impact of expected credit loss accounting on regulatory capital. If a transitional arrangement is applied, Template KM1 will provide users with information on the impact on the bank’s regulatory capital and leverage ratios compared to the bank’s “fully loaded” capital and leverage ratios had the transitional arrangement not been applied. 12.4 Template KM2 requires global systemically important banks (G-SIBs) to disclose key metrics on TLAC. Template KM2 becomes effective from the TLAC conformance date. 12.5 Table OVA provides information on a bank’s strategy and how senior management and the board of directors assess and manage risks. 12.6 Template OV1 provides an overview of total RWA forming the denominator of the risk-based capital requirements.

Page Number 12 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template KM1: Key metrics (at consolidated group level) Purpose: To provide an overview of a bank’s prudential regulatory metrics. Scope of application: The template is mandatory for all banks. Content: Key prudential metrics related to risk-based capital ratios, leverage ratio and liquidity standards. Banks are required to disclose each metric’s value using the corresponding standard’s specifications for the reporting period-end (designated by T in the template below) as well as the four previous quarter-end figures (T–1 to T–4). All metrics are intended to reflect actual bank values for (T), with the exception of “fully loaded expected credit losses (ECL)” metrics, the leverage ratio (excluding the impact of any applicable temporary exemption of central bank reserves) and metrics designated as “pre-floor” which may not reflect actual values. Frequency: Quarterly. Format: Fixed. If banks wish to add rows to provide additional regulatory or financial metrics, they must provide definitions for these metrics and a full explanation of how the metrics are calculated (including the scope of consolidation and the regulatory capital used if relevant). The additional metrics must not replace the metrics in this disclosure requirement. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change in each metric’s value compared with previous quarters, including the key drivers of such changes (eg whether the changes are due to changes in the regulatory framework, group structure or business model). Banks that apply transitional arrangement for ECL are expected to supplement the template with the key elements of the transition they use. a b c d e T T-1 T-2 2-3 T-4 Available capital (amounts) 1 Common Equity Tier 1 (CET1) 1a Fully loaded ECL accounting model 2 Tier 1 2a Fully loaded ECL accounting model Tier 1 3 Total capital 3a Fully loaded ECL accounting model total capital Risk-weighted assets (amounts) 4 Total risk-weighted assets (RWA) 4a Total risk-weighted assets (pre-floor) Risk-based capital ratios as a percentage of RWA 5 CET1 ratio (%) 5a Fully loaded ECL accounting model CET1 (%) 5b CET1 ratio (%) (pre-floor ratio) 6 Tier 1 ratio (%) 6a Fully loaded ECL accounting model Tier 1 ratio (%) 6b Tier 1 ratio (%) (pre-floor ratio) 7 Total capital ratio (%) 7a Fully loaded ECL accounting model total capital ratio (%) 7b Total capital ratio (%) (pre-floor ratio) Additional CET1 buffer requirements as a percentage of RWA 8 Capital conservation buffer requirement (2.5% from 2019) (%) 9 Countercyclical buffer requirement (%) 10 Bank G-SIB and/or D-SIB additional requirements (%) 11 Total of bank CET1 specific buffer requirements (%) (row 8 + row 9 + row 10) 12 CET1 available after meeting the bank’s minimum capital requirements (%) Basel III leverage ratio 13 Total Basel III leverage ratio exposure measure 14 Basel III leverage ratio (%) (including the impact of any applicable temporary exemption of central bank reserves) 14a Fully loaded ECL accounting model Basel III leverage ratio (including the impact of any applicable temporary exemption of central bank reserves) (%) 14b Basel III leverage ratio (%) (excluding the impact of any applicable temporary exemption of central bank reserves) 14c Basel III leverage ratio (%) (including the impact of any applicable temporary exemption of central bank reserves) incorporating mean values for SFT assets 14d Basel III leverage ratio (%) (excluding the impact of any applicable temporary exemption of central bank reserves) incorporating mean values for SFT assets Liquidity Coverage Ratio (LCR) 15 Total high-quality liquid assets (HQLA) 16 Total net cash outflow 17 LCR ratio (%) Net Stable Funding Ratio (NSFR) 18 Total available stable funding 19 Total required stable funding 20 NSFR ratio

Page Number 13 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Instructions Row Number Explanation 4a For pre-floor total RWA, the disclosed amount should exclude any adjustment made to total RWA from the application of the capital floor. 5a, 6a, 7a, 14a For fully loaded ECL ratios (%) in rows 5a, 6a, 7a and 14a, the denominator (RWA, Basel III leverage ratio exposure measure) is also “Fully loaded ECL”, ie as if ECL transitional arrangements were not applied. 5b, 6b, 7b For pre-floor risk based ratios in rows 5b, 6b and 7b, the disclosed ratios should exclude the impact of the capital floor in the calculation of RWA. 12 CET1 available after meeting the bank’s minimum capital requirements (as a percentage of RWA): it may not necessarily be the difference between row 5 and the Basel III minimum CET1 requirement of 4.5% because CET1 capital may be used to meet the bank’s Tier 1 and/or total capital ratio requirements. See instructions to [CC1:68/a]. 13 Total Basel III leverage ratio exposure measure: The amounts may reflect period-end values or averages depending on local implementation. 15 Total HQLA: total adjusted value using simple averages of daily observations over the previous quarter (ie the average calculated over a period of, typically, 90 days). 16 Total net cash outflow: total adjusted value using simple averages of daily observations over the previous quarter (ie the average calculated over a period of, typically, 90 days). Linkages across templates Amount in [KM1:1/a] is equal to [CC1:29/a] Amount in [KM1:2/a] is equal to [CC1:45/a] Amount in [KM1:3/a] is equal to [CC1:59/a] Amount in [KM1:4/a] is equal to [CC1:60/a] and is equal to [OV1.29/a] Amount in [KM1:4a/a] is equal to ([OV1.29/a] – [[OV1.28/a]) Amount in [KM1:5/a] is equal to [CC1:61/a] Amount in [KM1:6/a] is equal to [CC1:62/a] Amount in [KM1:7/a] is equal to [CC1:63/a] Amount in [KM1:8/a] is equal to [CC1:65/a] Amount in [KM1:9/a] is equal to [CC1:66/a] Amount in [KM1:10/a] is equal to [CC1:67/a] Amount in [KM1:12/a] is equal to [CC1:68/a] Amount in [KM1:13/a] is equal to [LR2:24/a] (only if the same calculation basis is used) Amount in [KM1:14/a] is equal to [LR2:25/a] (only if the same calculation basis is used) Amount in [KM1:14b/a] is equal to [LR2:25a/a] (only if the same calculation basis is used) Amount in [KM1:14c/a] is equal to [LR2:31/a] Amount in [KM1:14d/a] is equal to [LR2:31a/a] Amount in [KM1:15/a] is equal to [LIQ1:21/b] Amount in [KM1:16/a] is equal to [LIQ1:22/b] Amount in [KM1:17/a] is equal to [LIQ1:23/b] Amount in [KM1:18/a] is equal to [LIQ2:14/e] Amount in [KM1:19/a] is equal to [LIQ2:33/e] Amount in [KM1:20/a] is equal to [LIQ2:34/e]

Page Number 14 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template KM2: Key metrics - TLAC requirements (at resolution group level) Purpose: Provide summary information about total loss-absorbing capacity (TLAC) available, and TLAC requirements applied, at resolution group level under the single point of entry and multiple point of entry (MPE) approaches. Scope of application: The template is mandatory for all resolution groups of G-SIBs. Content: Key prudential metrics related to TLAC. Banks are required to disclose the figure as of the end of the reporting period (designated by T in the template below) as well as the previous four quarter-ends (designed by T-1 to T-4 in the template below). When the banking group includes more than one resolution group (MPE approach), this template is to be reproduced for each resolution group. Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. a b c d e T T-1 T-2 T-3 T-4 Resolution group 1 1 Total Loss Absorbing Capacity (TLAC) available 1a Fully loaded ECL accounting model TLAC available 2 Total RWA at the level of the resolution group 3 TLAC as a percentage of RWA (row1/row2) (%) 3a Fully loaded ECL accounting model TLAC as a percentage of fully loaded ECL accounting model RWA (%) 4 Leverage exposure measure at the level of the resolution group 5 TLAC as a percentage of leverage exposure measure (row1/row4) (%) 5a Fully loaded ECL accounting model TLAC as a percentage of fully loaded ECL accounting model leverage ratio exposure measure (%) 6a Does the subordination exemption in the antepenultimate paragraph of Section 11 of the FSB TLAC Term Sheet apply? 6b Does the subordination exemption in the penultimate paragraph of Section 11 of the FSB TLAC Term Sheet apply? 6c If the capped subordination exemption applies, the amount of funding issued that ranks pari passu with Excluded Liabilities and that is recognised as external TLAC, divided by funding issued that ranks pari passu with Excluded Liabilities and that would be recognised as external TLAC if no cap was applied (%) Linkages across templates Amount in [KM2:1/a] is equal to [resolution group-level TLAC1:22/a] Amount in [KM2:2/a] is equal to [resolution group-level TLAC1:23/a] Aggregate amounts in [KM2:2/a] across all resolution groups will not necessarily equal or directly correspond to amount in [KM1:4/a] Amount in [KM2:3/a] is equal to [resolution group-level TLAC1:25/a] Amount in [KM2:4/a] is equal to [resolution group-level TLAC1:24/a] Amount in [KM2:5/a] is equal to [resolution group-level TLAC1:26/a] [KM2:6a/a] refers to the uncapped exemption in Section 11 of the FSB TLAC Term Sheet in which all liabilities excluded from TLAC specified in Section 10 are statutorily excluded from the scope of the bail-in tool and therefore cannot legally be written down or converted to equity in a bail-in resolution. Possible answers for [KM2:6a/a]: [Yes], [No]. [KM2:6b/a] refers to the capped exemption in Section 11 of the FSB TLAC Term Sheet where SAMA may, under exceptional circumstances specified in the applicable resolution law, exclude or partially exclude from bail-in all of the liabilities excluded from TLAC specified in Section 10, and where the relevant authorities have permitted liabilities that would otherwise be eligible to count as external TLAC but which rank alongside those excluded liabilities in the insolvency creditor hierarchy to contribute a quantum equivalent of up to 2.5% RWA (from 2019) or 3.5% RWA (from 2022. Possible answers for [KM2:6b/a]: [Yes], [No]. Amount in [KM2:6c/a] is equal to [resolution group-level TLAC1:14 divided by TLAC1:13]. This only needs to be completed if the answer to [KM2:6b] is [Yes].

Page Number 15 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table OVA: Bank risk management approach Purpose: Description of the bank's strategy and how senior management and the board of directors assess and manage risks, enabling users to gain a clear understanding of the bank's risk tolerance/appetite in relation to its main activities and all significant risks. Scope of application: The template is mandatory for all banks. Content: Qualitative information. Frequency: Annual Format: Flexible Banks must describe their risk management objectives and policies, in particular: (a) How the business model determines and interacts with the overall risk profile (eg the key risks related to the business model and how each of these risks is reflected and described in the risk disclosures) and how the risk profile of the bank interacts with the risk tolerance approved by the board. (b) The risk governance structure: responsibilities attributed throughout the bank (eg oversight and delegation of authority; breakdown of responsibilities by type of risk, business unit etc); relationships between the structures involved in risk management processes (eg board of directors, executive management, separate risk committee, risk management structure, compliance function, internal audit function). (c) Channels to communicate, decline and enforce the risk culture within the bank (eg code of conduct; manuals containing operating limits or procedures to treat violations or breaches of risk thresholds; procedures to raise and share risk issues between business lines and risk functions). (d) The scope and main features of risk measurement systems. (e) Description of the process of risk information reporting provided to the board and senior management, in particular the scope and main content of reporting on risk exposure. (f) Qualitative information on stress testing (eg portfolios subject to stress testing, scenarios adopted and methodologies used, and use of stress testing in risk management). (g) The strategies and processes to manage, hedge and mitigate risks that arise from the bank's business model and the processes for monitoring the continuing effectiveness of hedges and mitigants.

Page Number 16 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template OV1: Overview of RWA Purpose: To provide an overview of total RWA forming the denominator of the risk-based capital requirements. Further breakdowns of RWA are presented in subsequent parts. Scope of application: The template is mandatory for all banks. Content: RWA and capital requirements under Pillar 1. Pillar 2 requirements should not be included. Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks are expected to identify and explain the drivers behind differences in reporting periods T and T-1 where these differences are significant. When minimum capital requirements in column (c) do not correspond to 8% of RWA in column (a), banks must explain the adjustments made. If the bank uses the internal model method (IMM) for its equity exposures under the market-based approach, it must provide annually a description of the main characteristics of its internal model. a b c RWA Minimum capital requirements T T-1 T 1 Credit risk (excluding counterparty credit risk) 2 Of which: standardised approach (SA) 3 Of which: foundation internal ratings-based (F-IRB) approach 4 Of which: supervisory slotting approach 5 Of which: advanced internal ratings-based (A-IRB) approach 6 Counterparty credit risk (CCR) 7 Of which: standardised approach for counterparty credit risk 8 Of which: IMM 9 Of which: other CCR 10 Credit valuation adjustment (CVA) 11 Equity positions under the simple risk weight approach and the internal model method during the five-year linear phase-in period 12 Equity investments in funds - look-through approach 13 Equity investments in funds - mandate-based approach 14 Equity investments in funds - fall-back approach 15 Settlement risk 16 Securitisation exposures in banking book 17 Of which: securitisation IRB approach (SEC-IRBA) 18 Of which: securitisation external ratings-based approach (SEC-ERBA), including internal assessment approach (IAA) 19 Of which: securitisation standardised approach (SEC-SA) 20 Market risk 21 Of which: standardised approach (SA) 22 Of which: internal model approach (IMA) 23 Capital charge for switch between trading book and banking book 24 Operational risk 25 Amounts below the thresholds for deduction (subject to 250% risk weight) 26 Output floor applied 27 Floor adjustment (before application of transitional cap) 28 Floor adjustment (after application of transitional cap) 29 Total (1 + 6 + 10 + 11 + 12 + 13 + 14 + 15 + 16 + 20 + 23 + 24 + 25 + 28) Definitions and instructions RWA: risk-weighted assets according to the Basel framework and as reported in accordance with the subsequent parts of this standard. Where the regulatory framework does not refer to RWA but directly to capital charges (eg for market risk and operational risk), banks should indicate the derived RWA number (ie by multiplying capital charge by 12.5). RWA (T-1): risk-weighted assets as reported in the previous Pillar 3 report (ie at the end of the previous quarter).

Page Number 17 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Minimum capital requirement T: Pillar 1 capital requirements at the reporting date. This will normally be RWA * 8% but may differ if a floor is applicable or adjustments (such as scaling factors) are applied at jurisdiction level. Row number Explanation 1 Credit risk (excluding counterparty credit risk): RWA and capital requirements according to the credit risk standard of the Basel framework (SCRE), with the exceptions of RWA and capital requirements related to: (i) counterparty credit risk (reported in row 6); (ii) equity positions (reported in row 11 to 14); (iii) settlement risk (reported in row 15); (iv) securitisation positions subject to the securitisation regulatory framework, including securitisation exposures in the banking book (reported in row 16); and (v) amounts below the thresholds for deduction (reported in row 25). 2 Of which: standardised approach: RWA and capital requirements according to the standardised approach to credit risk (as specified in SCRE5 to SCRE9). 3 and 5 Of which: (foundation/advanced) internal rating based approaches: RWA and capital requirements according to the F-IRB approach and/or A-IRB approach (as specified in SCRE10 to SCRE16 with the exception of SCRE13). 4 Of which: supervisory slotting approach: RWA and capital requirements according to the supervisory slotting approach (as specified in SCRE13). 6 to 9 Counterparty credit risk: RWA and capital charges according to the counterparty credit risk chapters of the Basel framework (SCCR3 to SCCR10). 10 Credit valuation adjustment: RWA and capital charge requirements according to SCCR11. 11 Equity positions under the simple risk weight approach and internal models method: the amounts in row 11 correspond to RWA where the bank applies the simple risk weight approach or the internal model method, which remain available during the five-year linear phase-in arrangement as specified in SCRE17.2. Equity positions under the PD/LGD approach during the five-year linear phase-in arrangement should be reported in row 3. Where the regulatory treatment of equities is in accordance with the standardised approach, the corresponding RWA are reported in Template CR4 and included in row 2 of this template. 12 Equity investments in funds - look-through approach: RWA and capital requirements calculated in accordance with SCRE24. 13 Equity investments in funds - mandate-based approach: RWA and capital requirements calculated in accordance with SCRE24. 14 Equity investments in funds - fall-back approach: RWA and capital requirements calculated in accordance with SCRE24. 15 Settlement risk: the amounts correspond to the requirements in SCRE25. 16 to 19 Securitisation exposures in banking book: the amounts correspond to capital requirements applicable to the securitisation exposures in the banking book. The RWA amounts must be derived from the capital requirements (which include the impact of the cap in accordance with SCRE18.50 to SCRE18.55, and do not systematically correspond to the RWA reported in Templates SEC3 and SEC4, which are before application of the cap). 20 Market risk: the amounts reported in row 20 correspond to the RWA and capital requirements in the market risk standard (MAR), with the exception of amounts that relate to CVA risk (as specified in SCCR11 and reported in row 10). They also include capital charges for securitisation positions booked in the trading book but exclude the counterparty credit risk capital charges (reported in row 6 of this template). The RWA for market risk correspond to the capital charge times 12.5. 21 Of which: standardised approach: RWA and capital requirements according to the market risk standardised approach, including capital requirements for securitisation positions booked in the trading book. 22 Of which: Internal Models Approach: RWA and capital requirements according to the market risk IMA. 23 Capital charge for switch between trading book and banking book: outstanding accumulated capital surcharge imposed on the bank in accordance with Basel Framework “Risk-based capital requirements” (Boundary between the banking book and trading book) 25.14 and 25.15, when the total capital charge (across banking book and trading book) of a bank is reduced as a result of the instruments being switched between the trading book and the banking book at the bank's discretion and after their original designation. The outstanding accumulated capital surcharge takes into account any adjustment due to run-off as the positions mature or expire, in a manner agreed with SAMA. 24 Operational risk: the amounts corresponding to the minimum capital requirements for operational risk as specified in the operational risk standard (SOPE). 25 Amounts below the thresholds for deduction (subject to 250% risk weight): the amounts correspond to items subject to a 250% risk weight according to SACAP4.4. They include significant investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation and below the threshold for deduction, after application of the 250% risk weight. 26 Output floor applied: the output floor (expressed as a percentage) applied by the bank in its computation of the floor adjustment value in rows 27 and 28. 27 Floor adjustment (before the application of transitional cap): the impact of the output floor before the application of the transitional cap, based on the output floor applied in row 26, in terms of the increase in RWA. 28 Floor adjustment (after the application of transitional cap): the impact of the output floor after the application of the transitional cap, based on the output floor applied in row 26, in terms of the increase in RWA. The figure disclosed in this row takes into account the transitional cap (if any) applied by SAMA, which will limit the increase in RWA to 25% of the bank's RWA before the application of the output floor. 29 The bank's total RWA.

Page Number 18 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Linkages across templates Amount in [OV1:2/a] is equal to [CR4:12/e] Amount in [OV1:3/a] and [OV1:5/a] is equal to the sum of [CR6: Total (all portfolios)/i] Amount in [OV1:6/a] is equal to the sum of [CCR1:6/f+CCR8:1/b+CCR8:11/b] Amount in [OV1:16/c] is equal to the sum of [SEC3:1/n + SEC3:1/o + SEC3:1/p + SEC3:1/q] + [SEC4:1/n + SEC4:1/o + SEC4:1/p + SEC4:1/q] Amount in [OV1:21/c] is equal to [MR1:12/a] Amount in [OV1:22/c] is equal to [MR2:12]

Page Number 19 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 13. Comparison of modelled and standardised RWA: 13.1 This chapter covers disclosures on RWA calculated according to the full standardised approach as compared to the actual RWA at the risk level, and for credit risk at asset class and sub-asset class levels. The disclosure requirements related in this section are not required to be completed by banks unless SAMA approve the bank to use the IRB and/or IMA approach. 13.2 The disclosure requirements under this section are: 13.2.1Template CMS1 – Comparison of modelled and standardised RWA at risk level 13.2.2Template CMS2 – Comparison of modelled and standardised RWA for credit risk at asset class level 13.3 Template CMS1 provides the disclosure of RWA calculated according to the full standardised approach as compared to actual RWA at risk level. Template CMS2 further elaborates on the comparison between RWA computed under the standardised and the internally modelled approaches by focusing on RWA for credit risk at asset class and sub-asset class levels.

Page Number 20 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CMS1 – Comparison of modelled and standardised RWA at risk level Purpose: To compare full standardised risk-weighted assets (RWA) against modelled RWA for banks which have received SAMA’s approval to use internal models in accordance with the Basel framework. The disclosure also provides the full standardised RWA amount that is the base of the output floor as defined in Basel Framework “Risk-based capital requirements” (calculation of minimum risk-based capital requirements) as specified in the Output floor to be issued by SAMA. Scope of application: The template is mandatory for all banks using internal models. Content: RWA. Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks are expected to explain the main drivers of difference (eg asset class or sub-asset class of a particular risk category, key assumptions underlying parameter estimations, national implementation differences) between the internally modelled RWA disclosed that are used to calculate their capital ratios and RWA disclosed under the full standardised approach that would be used should the banks not be allowed to use internal models. Explanation should be specific and, where appropriate, might be supplemented with quantitative information. In particular, if the RWA for securitisation exposures in the banking book are a main driver of the difference, banks are expected to explain the extent to which they are using each of the three potential approaches (SEC-ERBA, SEC-SA and 1,250% risk weight) for calculating SA RWA for securitisation exposures. a b c d RWA RWA for modelled approaches banks which have received SAMA approval to use internal model RWA for portfolios where standardised approaches are used Total Actual RWA (a

• b) (ie RWA which banks report as current requirements) RWA calculated using full standardised approach (ie RWA used in capital floor computation) 1 Credit risk (excluding counterparty credit risk) 2 Counterparty credit risk 3 Credit valuation adjustment 4 Securitisation exposures in the banking book 5 Market risk 6 Operational risk 7 Residual RWA 8 Total

Page Number 21 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Definitions and instructions Rows: Credit risk (excluding counterparty credit risk, credit valuation adjustments and securitisation exposures in the banking book) (row 1): Definition of standardised approach: The standardised approach for credit risk. When calculating the degree of credit risk mitigation, banks must use the simple approach or the comprehensive approach with standard supervisory haircuts. This also includes failed trades and non-delivery-versus-payment transactions as set out in SCRE25. The prohibition on the use of the IRB approach for equity exposures will be subject to a five-year linear phase-in arrangement as specified in SCRE17.2. During the phase-in period, the risk weight for equity exposures used to calculate the RWA reported in column (a) will be the greater of: (i) the risk weight as calculated under the IRB approach, and (ii) the risk weight set for the linear phase-in arrangement under the standardised approach for credit risk RWA for modelled approaches that banks have SAMA approval to use (cell 1/a): For exposures where the RWA is not computed based on the standardised approach described above (ie subject to the credit risk IRB approaches (Foundation Internal Ratings-Based (F-IRB), Advanced Internal Ratings-Based (A￾IRB) and supervisory slotting approaches of the credit risk framework). The row excludes all positions subject to SCRE18 to SCRE23, including securitisation exposures in the banking book (which are reported in row 4) and capital requirements relating to a counterparty credit risk charge, which are reported in row 2. RWA for portfolios where standardised approaches are used (cell 1/b): RWA which result from applying the above-described standardised approach. RWA for portfolios where standardised approaches are used (cell 1/b): RWA which result from applying the above-described standardised approach. Total actual RWA (cell 1/c): The sum of cells 1/a and 1/b. RWA calculated using full standardised approach (cell 1/d): RWA as would result from applying the above-described standardised approach to all exposures giving rise to the RWA reported in cell 1/c. Counterparty credit risk (row 2): Definition of standardised approach: To calculate the exposure for derivatives, banks must use the standardised approach for measuring counterparty credit risk (SA-CCR). The exposure amounts must then be multiplied by the relevant borrower risk weight using the standardised approach for credit risk to calculate RWA under the standardised approach for credit risk. RWA for modelled approaches that banks have SAMA approval to use (cell 2/a): For exposures where the RWA is not computed based on the standardised approach described above. RWA for portfolios where standardised approaches are used (cell 2/b): RWA which result from applying the above-described standardised approach. Total actual RWA (cell 2/c): The sum of cells 2/a and 2/b. RWA calculated using full standardised approach (cell 2/d): RWA as would result from applying the above-described standardised approach to all exposures giving rise to the RWA reported in cell 2/c. Credit valuation adjustment (row 3): Definition of standardised approach: The standardised approach for CVA (SA-CVA), the basic approach (BA-CVA) or 100% of a bank’s counterparty credit risk capital requirements (depending on which approach the bank uses for CVA risk). Total actual RWA (cell 3/c) and RWA calculated using full standardised approach (cell 3/d): RWA according to the standardised approach described above. Securitisation exposures in the banking book (row 4): Definition of standardised approach: The external ratings-based approach (SEC-ERBA), the standardised approach (SEC-SA) or a risk weight of 1,250%. RWA for modelled approaches that banks have SAMA approval to use (cell 4/a): For exposures where the RWA is computed based on the SEC-IRBA or SEC-IAA. RWA for portfolios where standardised approaches are used (cell 4/b): RWA which result from applying the above-described standardised approach. Total actual RWA (cell 4/c): The sum of cells 4/a and 4/b. RWA calculated using full standardised approach (cell 4/d): RWA as would result from applying the above-described standardised approach to all exposures giving rise to the RWA reported in cell 4/c.

Page Number 22 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Market risk (row 5): Definition of standardised approach: The standardised approach for market risk. The SEC-ERBA, SEC-SA or a risk weight of 1,250% must also be used when determining the default risk charge component for securitisations held in the trading book. RWA for modelled approaches that banks have SAMA approval to use (cell 5/a): For exposures where the RWA is not computed based on the standardised approach described above. RWA for portfolios where standardised approaches are used (cell 5/b): RWA which result from applying the above-described standardised approach. Total actual RWA (cell 5/c): The sum of cells 5/a and 5/b. RWA calculated using full standardised approach (cell 5/d): RWA as would result from applying the above-described standardised approach to all exposures giving rise to the RWA reported in cell 5/c. Operational risk (row 6): Definition of standardised approach: The standardised approach for operational risk. Total actual RWA (cell 6/c) and RWA calculated using full standardised approach (cell 6/d): RWA according to the revised standardised approach for operational risk. Residual RWA (row 7): Total actual RWA (cell 7/c) and RWA calculated using full standardised approach (cell 7/d): RWA not captured within rows 1 to 6 (ie the RWA arising from equity investments in funds (rows 12 to 14 in Template OV1), settlement risk (row 15 in Template OV1), capital charge for switch between trading book and banking book (row 23 in Template OV1) and amounts below the thresholds for deduction (row 25 in Template OV1)). Total (row 8): RWA for modelled approaches that banks have SAMA approval to use (cell 8/a): The total sum of cells 1/a, 2/a, 4/a and 5/a. RWA for portfolios where standardised approaches are used (cell 8/b): The total sum of cells 1/b, 2/b, 3/b, 4/b, 5/b, 6/b and 7/b. Total actual RWA (cell 8/c): The bank’s total RWA before the output floor adjustment. The total sum of cells 1/c, 2/c, 3/c, 4/c, 5/c, 6/c and 7/c. RWA calculated using full standardised approach (cell 8/d): The bank’s RWA that are the base of the output floor, as specified in the Output floor to be issued by SAMA (ie amount before multiplication by 72.5%). The total sum of cells 1/d, 2/d, 3/d, 4/d, 5/d, 6/d and 7/d. Disclosed numbers in rows 1 to 7 are calculated purely for comparison purposes and do not represent requirements under the Basel framework. Linkages across templates [CMS1: 1/c] is equal to [OV1:1/a] [CMS1: 2/c] is equal to [OV1:6/a] [CMS1:3/c] is equal to [OV1:10/a] [CMS1: 4/c] is equal to [OV1:16/a] [CMS1: 5/c] is equal to [OV1:20/a] [CMS1:5/d] is equal to [MR2:12/a] multiplied by 12.5 [CMS1:6/c] is equal to [OV1:24/a]

Page Number 23 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CMS2 – Comparison of modelled and standardised RWA for credit risk at asset class level Purpose: To compare risk-weighted assets (RWA) calculated according to the standardised approach (SA) for credit risk at the asset class level against the corresponding RWA figure calculated using the approaches (including both the standardised and IRB approach for credit risk and the supervisory slotting approach) that banks have SAMA approval to use in accordance with the Basel framework for credit risk. Scope of application: The template is mandatory for all banks using internal models for credit risk. Similar to row 1 of Template CMS1, it excludes counterparty credit risk, credit valuation adjustments and securitisation exposures in the banking book. Content: RWA. Frequency: Semiannual. Format: Fixed. The columns are fixed, but the portfolio breakdowns in the rows will be set by SAMA to reflect the exposure classes required under national implementation of IRB and SA. Banks are encouraged to add rows to show where significant differences occur. Accompanying narrative: Banks are expected to explain the main drivers of differences between the internally modelled amounts disclosed that are used to calculate their capital ratios and amounts disclosed should the banks apply the standardised approach. Where differences are attributable to mapping between IRB and SA, banks are encouraged to provide explanation and estimated materiality. a b c d RWA RWA for modelled approaches that banks have SAMA approval to use RWA for column (a) if re-computed using the standardised approach Total Actual RWA (ie RWA which banks report as current requirements) RWA calculated using full standardised approach (ie RWA used in the base of the output floor) 1 Sovereign Of which: categorised as MDB/PSE in SA 2 Banks and other financial institutions 3 Equity1 4 Purchased receivables 5 Corporates Of which: F-IRB is applied Of which: A-IRB is applied 6 Retail Of which: qualifying revolving retail Of which: other retail Of which: retail residential mortgages 7 Specialised lending Of which: income-producing real estate and high volatility commercial real estate

1 The prohibition on the use of the IRB approach for equity exposures will be subject to a five-year linear phase-in arrangement as specified in SCRE17.2. During the phase-in period, the risk weight for equity exposures (to be reported in column (a)) will be the greater of: (i) the risk weight as calculated under the IRB approach, and (ii) the risk weight set for the linear phase-in arrangement under the standardised approach for credit risk. Column (b) should reflect the corresponding RWA for these exposures based on the phased-in standardised approach. After the phase-in period, columns (a) and (b) for equity exposures should both be empty.

Page Number 24 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 8 Others 9 Total Definitions and instructions Columns: RWA for modelled approaches that banks have SAMA approval to use (column (a)): Represents the portion of RWA according to the IRB approach for credit risk as specified in SCRE10 to SCRE16. Corresponding standardised approach RWA for column (a) (column (b)): RWA equivalent as derived under the standardised approach. Total actual RWA (column (c)): Represents the sum of the RWA for modelled approaches that banks have SAMA approval to use and the RWA under standardised approaches. RWA calculated using full standardised approach (column (d)): Total RWA assuming the full standardised approach applied at asset class level. Disclosed numbers for each asset class are calculated purely for comparison purposes and do not represent requirements under the Basel framework. Linkages across templates [CMS2:9/a] is equal to [CMS1:1/a] [CMS2:9/c] is equal to [CMS1:1/c] [CMS2:9/d] is equal to [CMS1:1/d]

Page Number 25 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 14. Composition of capital and TLAC: 14.1 The disclosures described in this chapter cover the composition of regulatory capital, the main features of regulatory capital instruments and, for global systemically important banks, the composition of total loss-absorbing capacity and the creditor hierarchies of material subgroups and resolution entities. The disclosure requirements related to TLAC only, are not required to be completed by banks unless otherwise specified by SAMA. 14.2 The disclosure requirements set out in this chapter are: 14.2.1Table CCA – Main features of regulatory capital instruments and of other total loss-absorbing capacity (TLAC) - eligible instruments 14.2.2Template CC1 – Composition of regulatory capital 14.2.3Template CC2 – Reconciliation of regulatory capital to balance sheet 14.2.4Template TLAC1 – TLAC composition for global systemically important banks (G-SIBs) (at resolution group level) 14.2.5Template TLAC2 – Material subgroup entity – creditor ranking at legal entity level 14.2.6Template TLAC3 – Resolution entity – creditor ranking at legal entity level 14.3 The following table and templates must be completed by all banks: 14.3.1Table CCA details the main features of a bank’s regulatory capital instruments and other TLAC-eligible instruments, where applicable. This table should be posted on a bank’s website, with the web link referenced in the bank’s Pillar 3 report to facilitate users’ access to the required disclosure. Table CCA represents the minimum level of disclosure that banks are required to report in respect of each regulatory capital instrument and, where applicable, other TLAC-eligible instruments issued.2

2 In this context, “other TLAC-eligible instruments” are instruments other than regulatory capital instruments issued by G-SIBs that meet the TLAC eligibility criteria.

Page Number 26 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 14.3.2Template CC1 details the composition of a bank’s regulatory capital. 14.3.3Template CC2 provides users of Pillar 3 data with a reconciliation between the scope of a bank’s accounting consolidation, as per published financial statements, and the scope of its regulatory consolidation. 14.4 The following additional templates must be completed by banks which have been designated as G-SIBs: 14.4.1Template TLAC1 provides details of the TLAC positions of G-SIB resolution groups. This disclosure requirement applies to all G-SIBs at the resolution group level. For single point of entry G-SIBs, there is only one resolution group. This means that they only need to complete Template TLAC1 once to report their TLAC positions. 14.4.2Templates TLAC2 and TLAC3 present information on creditor rankings at the legal entity level for material subgroup entities (ie entities that are part of a material subgroup) which have issued internal TLAC to one or more resolution entities, and also for resolution entities. These templates provide information on the amount and residual maturity of TLAC and on the instruments issued by resolution entities and material subgroup entities that rank pari passu with, or junior to, TLAC instruments. 14.5 Templates TLAC1, TLAC2 and TLAC3 become effective from the TLAC conformance date. 14.6 Through the following three-step approach, all banks are required to show the link between the balance sheet in their published financial statements and the numbers disclosed in Template CC1: 14.6.1Step 1: Disclose the reported balance sheet under the regulatory scope of consolidation in Template CC2. If the scopes of regulatory consolidation and accounting consolidation are identical for a particular banking group, banks should state in Template CC2 that there is no difference and move on to Step 2. Where the accounting and regulatory scopes of consolidation differ, banks are required to disclose the list of those legal entities that are included within the accounting scope of consolidation, but excluded from the regulatory scope of consolidation or, alternatively, any legal entities included in the regulatory consolidation that are not included in the accounting scope of consolidation. This will enable users of Pillar 3 data to consider any risks posed by unconsolidated subsidiaries. If some entities are included in both the regulatory and accounting scopes of consolidation, but the method of consolidation differs between these two scopes, banks are required to list the relevant legal entities separately and explain the

Page Number 27 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 differences in the consolidation methods. For each legal entity that is required to be disclosed in this requirement, a bank must also disclose the total assets and equity on the entity’s balance sheet and a description of the entity’s principal activities. 14.6.2Step 2: Expand the lines of the balance sheet under the regulatory scope of consolidation in Template CC2 to display all of the components that are used in Template CC1. It should be noted that banks will only need to expand elements of the balance sheet to the extent necessary to determine the components that are used in Template CC1 (eg if all of the paid-in capital of the bank meets the requirements to be included in Common Equity Tier 1 (CET1) capital, the bank would not need to expand this line). The level of disclosure should be proportionate to the complexity of the bank’s balance sheet and its capital structure. 14.6.3Step 3: Map each of the components that are disclosed in Template CC2 in Step 2 to the composition of capital disclosure set out in Template CC1.

Page Number 28 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CCA - Main features of regulatory capital instruments and of other TLAC-eligible instruments Purpose: Provide a description of the main features of a bank's regulatory capital instruments and other TLAC-eligible instruments, as applicable, that are recognised as part of its capital base / TLAC resources. Scope of application: The template is mandatory for all banks. In addition to completing the template for all regulatory capital instruments, G-SIB resolution entities should complete the template (including lines 3a and 34a) for all other TLAC-eligible instruments that are recognised as external TLAC resources by the resolution entities, starting from the TLAC conformance date. Internal TLAC instruments and other senior debt instruments are not covered in this template. Content: Quantitative and qualitative information as required. Frequency: Table CCA should be posted on a bank's website. It should be updated whenever the bank issues or repays a capital instrument (or other TLAC-eligible instrument where applicable), and whenever there is a redemption, conversion/writedown or other material change in the nature of an existing instrument. Updates should, at a minimum, be made semiannually. Banks should include the web link in each Pillar 3 report to the issuances made over the previous period. Format: Flexible. Accompanying information: Banks are required to make available on their websites the full terms and conditions of all instruments included in regulatory capital and TLAC. a Quantitative / qualitative information 1 Issuer 2 Unique identifier (eg Committee on Uniform Security Identification Procedures (CUSIP), International Securities Identification Number (ISIN) or Bloomberg identifier for private placement) 3 Governing law(s) of the instrument 3a Means by which enforceability requirement of Section 13 of the TLAC Term Sheet is achieved (for other TLAC-eligible instruments governed by foreign law) 4 Transitional Basel III rules 5 Post-transitional Basel III rules 6 Eligible at solo/group/group and solo 7 Instrument type (refer to SACAP) 8 Amount recognised in regulatory capital (currency in millions, as of most recent reporting date) 9 Par value of instrument 10 Accounting classification 11 Original date of issuance 12 Perpetual or dated 13 Original maturity date 14 Issuer call subject to prior SAMA approval 15 Optional call date, contingent call dates and redemption amount 16 Subsequent call dates, if applicable Coupons / dividends 17 Fixed or floating dividend/coupon 18 Coupon rate and any related index 19 Existence of a dividend stopper 20 Fully discretionary, partially discretionary or mandatory 21 Existence of step-up or other incentive to redeem 22 Non-cumulative or cumulative 23 Convertible or non-convertible 24 If convertible, conversion trigger(s) 25 If convertible, fully or partially 26 If convertible, conversion rate

Page Number 29 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 27 If convertible, mandatory or optional conversion 28 If convertible, specify instrument type convertible into 29 If convertible, specify issuer of instrument it converts into 30 Writedown feature 31 If writedown, writedown trigger(s) 32 If writedown, full or partial 33 If writedown, permanent or temporary 34 If temporary write-down, description of writeup mechanism 34a Type of subordination 35 Position in subordination hierarchy in liquidation (specify instrument type immediately senior to instrument in the insolvency creditor hierarchy of the legal entity concerned). 36 Non-compliant transitioned features 37 If yes, specify non-compliant features Instructions Banks are required to complete the template for each outstanding regulatory capital instrument and, in the case of G-SIBs, TLAC-eligible instruments (banks should insert "NA" if the question is not applicable). Banks are required to report each instrument, including common shares, in a separate column of the template, such that the completed Table CCA would provide a "main features report" that summarises all of the regulatory capital and TLAC-eligible instruments of the banking group. G-SIBs disclosing these instruments should group them under three sections (horizontally along the table) to indicate whether they are for meeting (i) only capital (but not TLAC) requirements; (ii) both capital and TLAC requirements; or (iii) only TLAC (but not capital) requirements. Row number Explanation Format / list of options (where relevant) 1 Identifies issuer legal entity. Free text 2 Unique identifier (eg CUSIP, ISIN or Bloomberg identifier for private placement). Free text 3 Specifies the governing law(s) of the instrument. Free text 3a Other TLAC-eligible instruments governed by foreign law (ie a law other than that of the home jurisdiction of a resolution entity) include a clause in the contractual provisions whereby investors expressly submit to, and provide consent to the application of, the use of resolution tools in relation to the instrument by the home authority notwithstanding any provision of foreign law to the contrary, unless there is equivalent binding statutory provision for cross-border recognition of resolution actions. Select "NA" where the governing law of the instrument is the same as that of the country of incorporation of the resolution entity. Disclosure: [Contractual] [Statutory] [NA] 4 Specifies the regulatory capital treatment during the Basel III transitional phase (ie the component of capital from which the instrument is being phased out). Disclosure: [Common Equity Tier 1] [Additional Tier 1] [Tier 2] 5 Specifies regulatory capital treatment under Basel III rules not taking into account transitional treatment. Disclosure: [Common Equity Tier 1] [Additional Tier 1] [Tier 2] [Ineligible] 6 Specifies the level(s) within the group at which the instrument is included in capital. Disclosure: [Solo] [Group] [Solo and Group] 7 Specifies instrument type, varying by jurisdiction. Helps provide more granular understanding of features, particularly during transition. Disclosure: refer to SACAP. 8 Specifies amount recognised in regulatory capital. Free text 9 Par value of instrument. Free text 10 Specifies accounting classification. Helps to assess loss-absorbency. Disclosure: [Shareholders' equity] [Liability - amortised cost] [Liability - fair value option] [Non-controlling interest in consolidated subsidiary] 11 Specifies date of issuance. Free text 12 Specifies whether dated or perpetual. Disclosure: [Perpetual] [Dated] 13 For dated instrument, specifies original maturity date (day, month and year). For perpetual instrument, enter "no maturity". Free text 14 Specifies whether there is an issuer call option. Disclosure: [Yes] [No] 15 For instrument with issuer call option, specifies: (i) the first date of call if the instrument has a call option on a specific date (day, month and year); (ii) the instrument has a tax and/or regulatory event call; and (iii) the redemption price. Free text 16 Specifies the existence and frequency of subsequent call dates, if applicable. Free text 17 Specifies whether the coupon/dividend is fixed over the life of the instrument, floating over the life of the instrument, currently fixed but will move to a floating rate in the future, or currently floating but will move to a fixed rate in the future. Disclosure: [Fixed], [Floating] [Fixed to floating], [Floating to fixed] 18 Specifies the coupon rate of the instrument and any related index that the coupon/dividend rate references. Free text

Page Number 30 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 19 Specifies whether the non-payment of a coupon or dividend on the instrument prohibits the payment of dividends on common shares (ie whether there is a dividend-stopper). Disclosure: [Yes] [No] 20 Specifies whether the issuer has full, partial or no discretion over whether a coupon/dividend is paid. If the bank has full discretion to cancel coupon/dividend payments under all circumstances, it must select "fully discretionary" (including when there is a dividend-stopper that does not have the effect of preventing the bank from cancelling payments on the instrument). If there are conditions that must be met before payment can be cancelled (eg capital below a certain threshold), the bank must select "partially discretionary". If the bank is unable to cancel the payment outside of insolvency, the bank must select "mandatory". Disclosure: [Fully discretionary] [Partially discretionary] [Mandatory] 21 Specifies whether there is a step-up or other incentive to redeem. Disclosure: [Yes] [No] 22 Specifies whether dividends/coupons are cumulative or non-cumulative. Disclosure: [Non-cumulative] [Cumulative] 23 Specifies whether the instrument is convertible. Disclosure: [Convertible] [Non￾convertible] 24 Specifies the conditions under which the instrument will convert, including point of non-viability. Where one or more authorities have the ability to trigger conversion, the authorities should be listed. For each of the authorities it should be stated whether the legal basis for the authority to trigger conversion is provided by the terms of the contract of the instrument (a contractual approach) or statutory means (a statutory approach). Free text 25 For conversion trigger separately, specifies whether the instrument will: (i) always convert fully; (ii) may convert fully or partially; or (iii) will always convert partially. Free text referencing one of the options above 26 Specifies the rate of conversion into the more loss-absorbent instrument. Free text 27 For convertible instruments, specifies whether conversion is mandatory or optional. Disclosure: [Mandatory] [Optional] [NA] 28 For convertible instruments, specifies the instrument type it is convertible into. Disclosure: [Common Equity Tier 1] [Additional Tier 1] [Tier 2] [Other] 29 If convertible, specifies the issuer of the instrument into which it converts. Free text 30 Specifies whether there is a writedown feature. Disclosure: [Yes] [No] 31 Specifies the trigger at which writedown occurs, including point of non-viability. Where one or more authorities have the ability to trigger writedown, the authorities should be listed. For each of the authorities it should be stated whether the legal basis for the authority to trigger conversion is provided by the terms of the contract of the instrument (a contractual approach) or statutory means (a statutory approach). Free text 32 For each writedown trigger separately, specifies whether the instrument will: (i) always be written down fully; (ii) may be written down partially; or (iii) will always be written down partially. Free text referencing one of the options above 33 For writedown instruments, specifies whether writedown is permanent or temporary. Disclosure: [Permanent] [Temporary] [NA] 34 For instruments that have a temporary writedown, description of writeup mechanism. Free text 34a Type of subordination. Disclosure: [Structural] [Statutory] [Contractual] [Exemption from subordination] 35 Specifies instrument to which it is most immediately subordinate. Where applicable, banks should specify the column numbers of the instruments in the completed main features template to which the instrument is most immediately subordinate. In the case of structural subordination, "NA" should be entered. Free text 36 Specifies whether there are non-compliant features. Disclosure: [Yes] [No] 37 If there are non-compliant features, specifies which ones. Free text

Page Number 31 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CC1 - Composition of regulatory capital Purpose: Provide a breakdown of the constituent elements of a bank's capital. Scope of application: The template is mandatory for all banks at the consolidated level. Content: Breakdown of regulatory capital according to the scope of regulatory consolidation Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such change. a b Amounts Source based on reference numbers/letters of the balance sheet under the regulatory scope of consolidation Common Equity Tier 1 capital: instruments and reserves 1 Directly issued qualifying common share (and equivalent for non-joint stock companies) capital plus related stock surplus h 2 Retained earnings 3 Accumulated other comprehensive income (and other reserves) 4 Directly issued capital subject to phase-out from CET1 capital (only applicable to non-joint stock companies) 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 6 Common Equity Tier 1 capital before regulatory adjustments Common Equity Tier 1 capital: regulatory adjustments 7 Prudent valuation adjustments 8 Goodwill (net of related tax liability) a minus d 9 Other intangibles other than mortgage servicing rights (MSR) (net of related tax liability) b minus e 10 Deferred tax assets (DTA) that rely on future profitability, excluding those arising from temporary differences (net of related tax liability) 11 Cash flow hedge reserve 12 Shortfall of provisions to expected losses 13 Securitisation gain on sale (as set out in SACAP4.1.4) 14 Gains and losses due to changes in own credit risk on fair valued liabilities 15 Defined benefit pension fund net assets 16 Investments in own shares (if not already subtracted from paid-in capital on reported balance sheet) 17 Reciprocal cross-holdings in common equity 18 Investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation, where the bank does not own more than 10% of the issued share capital (amount above 10% threshold) 19 Significant investments in the common stock of banking, financial and insurance entities that are outside the scope of regulatory consolidation (amount above 10% threshold)

Page Number 32 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 20 MSR (amount above 10% threshold) c minus f minus 10% threshold 21 DTA arising from temporary differences (amount above 10% threshold, net of related tax liability) 22 Amount exceeding the 15% threshold 23 Of which: significant investments in the common stock of financials 24 Of which: MSR 25 Of which: DTA arising from temporary differences 26 National specific regulatory adjustments 27 Regulatory adjustments applied to Common Equity Tier 1 capital due to insufficient Additional Tier 1 and Tier 2 capital to cover deductions 28 Total regulatory adjustments to Common Equity Tier 1 capital 29 Common Equity Tier 1 capital (CET1) Additional Tier 1 capital: instruments 30 Directly issued qualifying additional Tier 1 instruments plus related stock surplus i 31 Of which: classified as equity under applicable accounting standards 32 Of which: classified as liabilities under applicable accounting standards 33 Directly issued capital instruments subject to phase-out from additional Tier 1 capital 34 Additional Tier 1 instruments (and CET1 instruments not included in row 5) issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 35 Of which: instruments issued by subsidiaries subject to phase-out 36 Additional Tier 1 capital before regulatory adjustments Additional Tier 1 capital: regulatory adjustments 37 Investments in own additional Tier 1 instruments 38 Reciprocal cross-holdings in additional Tier 1 instruments 39 Investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation, where the bank does not own more than 10% of the issued common share capital of the entity (amount above 10% threshold) 40 Significant investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation 41 National specific regulatory adjustments 42 Regulatory adjustments applied to additional Tier 1 capital due to insufficient Tier 2 capital to cover deductions 43 Total regulatory adjustments to additional Tier 1 capital 44 Additional Tier 1 capital (AT1) 45 Tier 1 capital (T1 = CET1 + AT1) Tier 2 capital: instruments and provisions 46 Directly issued qualifying Tier 2 instruments plus related stock surplus

Page Number 33 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 47 Directly issued capital instruments subject to phase-out from Tier 2 capital 48 Tier 2 instruments (and CET1 and AT1 instruments not included in rows 5 or 34) issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 49 Of which: instruments issued by subsidiaries subject to phase-out 50 Provisions 51 Tier 2 capital before regulatory adjustments Tier 2 capital: regulatory adjustments 52 Investments in own Tier 2 instruments 53 Reciprocal cross-holdings in Tier 2 instruments and other TLAC liabilities 54 Investments in the capital and other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation, where the bank does not own more than 10% of the issued common share capital of the entity (amount above 10% threshold) 54a Investments in the other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation and where the bank does not own more than 10% of the issued common share capital of the entity: amount previously designated for the 5% threshold but that no longer meets the conditions (for G-SIBs only) 55 Significant investments in the capital and other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation (net of eligible short positions) 56 National specific regulatory adjustments 57 Total regulatory adjustments to Tier 2 capital 58 Tier 2 capital 59 Total regulatory capital (= Tier 1 + Tier2) 60 Total risk-weighted assets Capital adequacy ratios and buffers 61 Common Equity Tier 1 capital (as a percentage of risk-weighted assets) 62 Tier 1 capital (as a percentage of risk-weighted assets) 63 Total capital (as a percentage of risk-weighted assets) 64 Institution-specific buffer requirement (capital conservation buffer plus countercyclical buffer requirements plus higher loss absorbency requirement, expressed as a percentage of risk￾weighted assets) 65 Of which: capital conservation buffer requirement 66 Of which: bank-specific countercyclical buffer requirement 67 Of which: higher loss absorbency requirement 68 Common Equity Tier 1 capital (as a percentage of risk-weighted assets) available after meeting the bank's minimum capital requirements National minima (if different from Basel III) 69 National minimum Common Equity Tier 1 capital adequacy ratio (if different from Basel III minimum) 70 National minimum Tier 1 capital adequacy ratio (if different from Basel III minimum)

Page Number 34 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 71 National minimum Total capital adequacy ratio (if different from Basel III minimum) Amounts below the thresholds for deduction (before risk-weighting) 72 Non-significant investments in the capital and other TLAC liabilities of other financial entities 73 Significant investments in the common stock of financial entities 74 MSR (net of related tax liability) 75 DTA arising from temporary differences (net of related tax liability) Applicable caps on the inclusion of provisions in Tier 2 capital 76 Provisions eligible for inclusion in Tier 2 capital in respect of exposures subject to standardised approach (prior to application of cap) 77 Cap on inclusion of provisions in Tier 2 capital under standardised approach 78 Provisions eligible for inclusion in Tier 2 capital in respect of exposures subject to internal ratings￾based approach (prior to application of cap) 79 Cap for inclusion of provisions in Tier 2 capital under internal ratings-based approach Capital instruments subject to phase-out arrangements (only applicable between 1 Jan 2018 and 1 Jan 2022) 80 Current cap on CET1 instruments subject to phase-out arrangements 81 Amount excluded from CET1 capital due to cap (excess over cap after redemptions and maturities) 82 Current cap on AT1 instruments subject to phase-out arrangements 83 Amount excluded from AT1 capital due to cap (excess over cap after redemptions and maturities) 84 Current cap on Tier 2 instruments subject to phase-out arrangements 85 Amount excluded from Tier 2 capital due to cap (excess over cap after redemptions and maturities) Instructions (i) Rows in italics will be deleted after all the ineligible capital instruments have been fully phased out (ie from 1 January 2022 onwards). (ii) The reconciliation requirements included in Template CC2 result in the decomposition of certain regulatory adjustments. For example, the disclosure template below includes the adjustment "Goodwill net of related tax liability". The reconciliation requirements will lead to the disclosure of both the goodwill component and the related tax liability component of this regulatory adjustment. (iii) Shading:

• Each dark grey row introduces a new section detailing a certain component of regulatory capital.
• Light grey rows with no thick border represent the sum cells in the relevant section.
• Light grey rows with a thick border show the main components of regulatory capital and the capital adequacy ratios. Columns Source: Banks are required to complete column b to show the source of every major input, which is to be cross-referenced to the corresponding rows in Template CC2. Rows Set out in the following table is an explanation of each row of the template above. Regarding the regulatory adjustments, banks are required to report deductions from capital as positive numbers and additions to capital as negative numbers. For example, goodwill (row 8) should be reported as a positive number, as should gains due to the change in the own credit risk of the bank (row 14). However, losses due to the change in the own credit risk of the bank should be reported as a negative number as these are added back in the calculation of CET1 capital. Row number Explanation 1 Instruments issued by the parent company of the reporting group that meet all of the CET1 capital entry criteria set out in SACAP2.2.1. This should be equal to the sum of common stock (and related surplus only) and other instruments for non-joint stock companies, both of which must meet the common stock criteria. This should be net of treasury stock and other investments in own shares to the extent that these are already derecognised on the balance sheet under the relevant accounting standards. Other paid-in capital elements must be excluded. All minority interest must be excluded. 2 Retained earnings, prior to all regulatory adjustments. In accordance with SACAP2.2.1, this row should include interim profit and loss that has met any audit, verification or review procedures that SAMA has put in place. Dividends are to be removed in accordance with the applicable accounting standards, ie they should be removed from this row when they are removed from the balance sheet of the bank. 3 Accumulated other comprehensive income and other disclosed reserves, prior to all regulatory adjustments. 4 Directly issued capital instruments subject to phase-out from CET1 capital in accordance with the requirements of SACAP5.7. This is only applicable to non-joint stock companies. Banks structured as joint stock companies must report zero in this row. 5 Common share capital issued by subsidiaries and held by third parties. Only the amount that is eligible for inclusion in group CET1 capital should be reported here, as determined by the application of SACAP3.1 (see SACAP Annex #7 for an example of the calculation). 6 Sum of rows 1 to 5.

Page Number 35 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 7 Prudent valuation adjustments according to the requirements of Basel Framework “prudent valuation guidance” (Adjustment to the current valuation of less liquid positions for regulatory capital purposes), taking into account the guidance set out in Supervisory guidance for assessing banks' financial instrument fair value practices, April 2009 (in particular Principle 10). 8 Goodwill net of related tax liability, as set out in SACAP4.1.1. 9 Other intangibles other than MSR (net of related tax liability), as set out in SACAP4.1.1. 10 DTA that rely on future profitability excluding those arising from temporary differences (net of related tax liability), as set out in SACAP4.1.2. 11 The element of the cash flow hedge reserve described in SACAP4.1.3. 12 Shortfall of provisions to expected losses as described in SACAP4.1.4. 13 Securitisation gain on sale (as set out in SACAP4.1.4). 14 Gains and losses due to changes in own credit risk on fair valued liabilities, as described in SACAP4.1.4. 15 Defined benefit pension fund net assets, the amount to be deducted as set out in SACAP4.1.5. 16 Investments in own shares (if not already subtracted from paid-in capital on reported balance sheet), as set out in SACAP4.1.6. 17 Reciprocal cross-holdings in common equity, as set out in SACAP4.1.7. 18 Investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation and where the bank does not own more than 10% of the issued share capital, net of eligible short positions and amount above 10% threshold. Amount to be deducted from CET1 capital calculated in accordance with SACAP4.2. 19 Significant investments in the common stock of banking, financial and insurance entities that are outside the scope of regulatory consolidation, net of eligible short positions and amount above 10% threshold. Amount to be deducted from CET1 capital calculated in accordance with SACAP4.3 to SACAP4.4. 20 MSR (amount above 10% threshold), amount to be deducted from CET1 capital in accordance with SACAP4.4. 21 DTA arising from temporary differences (amount above 10% threshold, net of related tax liability), amount to be deducted from CET1 capital in accordance with SACAP4.4. 22 Total amount by which the three threshold items exceed the 15% threshold, excluding amounts reported in rows 19-21, calculated in accordance with SACAP4.4. 23 The amount reported in row 22 that relates to significant investments in the common stock of financials. 24 The amount reported in row 22 that relates to MSR. 25 The amount reported in row 22 that relates to DTA arising from temporary differences. 26 Any national specific regulatory adjustments that SAMA requires to be applied to CET1 capital in addition to the Basel III minimum set of adjustments. Refer to SACAP for guidance. 27 Regulatory adjustments applied to CET1 capital due to insufficient AT1 capital to cover deductions. If the amount reported in row 43 exceeds the amount reported in row 36, the excess is to be reported here. 28 Total regulatory adjustments to CET1 capital, to be calculated as the sum of rows 7-22 plus rows 26-7. 29 CET1 capital, to be calculated as row 6 minus row 28. 30 Instruments issued by the parent company of the reporting group that meet all of the AT1 capital entry criteria set out in SACAP2.2.2 and any related stock surplus as set out in SACAP2.2.2. All instruments issued by subsidiaries of the consolidated group should be excluded from this row. This row may include AT1 capital issued by an SPV of the parent company only if it meets the requirements set out in SACAP3.3. 31 The amount in row 30 classified as equity under applicable accounting standards. 32 The amount in row 30 classified as liabilities under applicable accounting standards. 33 Directly issued capital instruments subject to phase-out from AT1 capital in accordance with the requirements of SACAP5.7. 34 AT1 instruments (and CET1 instruments not included in row 5) issued by subsidiaries and held by third parties, the amount allowed in group AT1 capital in accordance with SACAP3.2. 35 The amount reported in row 34 that relates to instruments subject to phase-out from AT1 capital in accordance with the requirements of SACAP5.7. 36 The sum of rows 30, 33 and 34. 37 Investments in own AT1 instruments, amount to be deducted from AT1 capital in accordance with SACAP4.1.6. 38 Reciprocal cross-holdings in AT1 instruments, amount to be deducted from AT1 capital in accordance with SACAP4.1.7. 39 Investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation and where the bank does not own more than 10% of the issued common share capital of the entity, net of eligible short positions and amount above 10% threshold. Amount to be deducted from AT1 capital calculated in accordance with SACAP4.2. 40 Significant investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation, net of eligible short positions. Amount to be deducted from AT1 capital in accordance with SACAP4.3. 41 Any national specific regulatory adjustments that SAMA requires to be applied to AT1 capital in addition to the Basel III minimum set of adjustments. Refer to SACAP for guidance. 42 Regulatory adjustments applied to AT1 capital due to insufficient Tier 2 capital to cover deductions. If the amount reported in row 57 exceeds the amount reported in row 51, the excess is to be reported here. 43 The sum of rows 37-42. 44 AT1 capital, to be calculated as row 36 minus row 43. 45 Tier 1 capital, to be calculated as row 29 plus row 44. 46 Instruments issued by the parent company of the reporting group that meet all of the Tier 2 capital criteria set out in SACAP2.2.3 and any related stock surplus as set out in SACAP2.2.3. All instruments issued by subsidiaries of the consolidated group should be excluded from this row. This row may include Tier 2 capital issued by an SPV of the parent company only if it meets the requirements set out in SACAP3.3 47 Directly issued capital instruments subject to phase-out from Tier 2 capital in accordance with the requirements of SACAP5.7. 48 Tier 2 instruments (and CET1 and AT1 instruments not included in rows 5 or 34) issued by subsidiaries and held by third parties (amount allowed in group Tier 2 capital), in accordance with SACAP3.3. 49 The amount reported in row 48 that relates to instruments subject to phase-out from Tier 2 capital in accordance with the requirements of SACAP5.7.

Page Number 36 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 50 Provisions included in Tier 2 capital, calculated in accordance with SACAP2.2.3. 51 The sum of rows 46-8 and row 50. 52 Investments in own Tier 2 instruments, amount to be deducted from Tier 2 capital in accordance with SACAP4.1.6. 53 Reciprocal cross-holdings in Tier 2 capital instruments and other TLAC liabilities, amount to be deducted from Tier 2 capital in accordance with SACAP4.1.7. 54 Investments in the capital instruments and other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation, net of eligible short positions, where the bank does not own more than 10% of the issued common share capital of the entity: amount in excess of the 10% threshold that is to be deducted from Tier 2 capital in accordance with SACAP4.2. For non-G-SIBs, any amount reported in this row will reflect other TLAC liabilities not covered by the 5% threshold and that cannot be absorbed by the 10% threshold. For G-SIBs, the 5% threshold is subject to additional conditions; deductions in excess of the 5% threshold are reported instead in 54a. 54a (This row is for G-SIBs only.) Investments in other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation and where the bank does not own more than 10% of the issued common share capital of the entity, previously designated for the 5% threshold but no longer meeting the conditions under paragraph 80a of the TLAC holdings standard, measured on a gross long basis. The amount to be deducted will be the amount of other TLAC liabilities designated to the 5% threshold but not sold within 30 business days, no longer held in the trading book or now exceeding the 5% threshold (eg in the instance of decreasing CET1 capital). Note that, for G-SIBs, amounts designated to this threshold may not subsequently be moved to the 10% threshold. This row does not apply to non-G-SIBs, to whom these conditions on the use of the 5% threshold do not apply. 55 Significant investments in the capital and other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation (net of eligible short positions), amount to be deducted from Tier 2 capital in accordance with SACAP4.3. 56 Any national specific regulatory adjustments that SAMA requires to be applied to Tier 2 capital in addition to the Basel III minimum set of adjustments. Refer to SACAP for guidance. 57 The sum of rows 52-6. 58 Tier 2 capital, to be calculated as row 51 minus row 57. 59 Total capital, to be calculated as row 45 plus row 58. 60 Total risk-weighted assets of the reporting group. 61 CET1 capital adequacy ratio (as a percentage of risk-weighted assets), to be calculated as row 29 divided by row 60 (expressed as a percentage). 62 Tier 1 capital adequacy ratio (as a percentage of risk-weighted assets), to be calculated as row 45 divided by row 60 (expressed as a percentage). 63 Total capital adequacy ratio (as a percentage of risk-weighted assets), to be calculated as row 59 divided by row 60 (expressed as a percentage). 64 Bank-specific buffer requirement (capital conservation buffer plus countercyclical buffer requirements plus higher loss absorbency requirement, expressed as a percentage of risk-weighted assets). If an MPE G-SIB resolution entity is not subject to a buffer requirement at that scope of consolidation, then it should enter zero. 65 The amount in row 64 (expressed as a percentage of risk-weighted assets) that relates to the capital conservation buffer, ie banks will report 2.5% here. 66 The amount in row 64 (expressed as a percentage of risk-weighted assets) that relates to the bank-specific countercyclical buffer requirement. 67 The amount in row 64 (expressed as a percentage of risk-weighted assets) that relates to the bank's higher loss absorbency requirement, if applicable. 68 CET1 capital (as a percentage of risk-weighted assets) available after meeting the bank's minimum capital requirements. To be calculated as the CET1 capital adequacy ratio of the bank (row 61) less the ratio of RWA of any common equity used to meet the bank's minimum CET1, Tier 1 and Total capital requirements. For example, suppose a bank has 100 RWA, 10 CET1 capital, 1.5 additional Tier 1 capital and no Tier 2 capital. Since it does not have any Tier 2 capital, it will have to earmark its CET1 capital to meet the 8% minimum capital requirement. The net CET1 capital left to meet other requirements (which could include Pillar 2, buffers or TLAC requirements) will be 10 - 4.5 - 2 = 3.5. 69 National minimum CET1 capital adequacy ratio (if different from Basel III minimum). Refer to SACAP for guidance. 70 National minimum Tier 1 capital adequacy ratio (if different from Basel III minimum). Refer to SACAP for guidance. 71 National minimum Total capital adequacy ratio (if different from Basel III minimum). Refer to SACAP for guidance. 72 Investments in the capital instruments and other TLAC liabilities of banking, financial and insurance entities that are outside the scope of regulatory consolidation where the bank does not own more than 10% of the issued common share capital of the entity (in accordance with SACAP4.2. 73 Significant investments in the common stock of financial entities, the total amount of such holdings that are not reported in row 19 and row 23. 74 MSR, the total amount of such holdings that are not reported in row 20 and row 24. 75 DTA arising from temporary differences, the total amount of such holdings that are not reported in row 21 and row 25. 76 Provisions eligible for inclusion in Tier 2 capital in respect of exposures subject to standardised approach, calculated in accordance with SACAP2.2.3, prior to the application of the cap. 77 Cap on inclusion of provisions in Tier 2 capital under the standardised approach, calculated in accordance with SACAP2.2.3. 78 Provisions eligible for inclusion in Tier 2 capital in respect of exposures subject to the internal ratings-based approach, calculated in accordance with SACAP2.2.3, prior to the application of the cap. 79 Cap on inclusion of provisions in Tier 2 capital under the internal ratings-based approach, calculated in accordance with SACAP2.2.3. 80 Current cap on CET1 instruments subject to phase-out arrangements; see SACAP5.7. 81 Amount excluded from CET1 capital due to cap (excess over cap after redemptions and maturities); see SACAP5.7. 82 Current cap on AT1 instruments subject to phase-out arrangements; see SACAP5.7. 83 Amount excluded from AT1 capital due to cap (excess over cap after redemptions and maturities); see SACAP5.7. 84 Current cap on Tier 2 capital instruments subject to phase-out arrangements; see SACAP5.7. 85 Amount excluded from Tier 2 capital due to cap (excess over cap after redemptions and maturities); see SACAP5.7.

Page Number 37 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CC2 - Reconciliation of regulatory capital to balance sheet Purpose: Enable users to identify the differences between the scope of accounting consolidation and the scope of regulatory consolidation, and to show the link between a bank's balance sheet in its published financial statements and the numbers that are used in the composition of capital disclosure template set out in Template CC1. Scope of application: The template is mandatory for all banks. Content: Carrying values (corresponding to the values reported in financial statements). Frequency: Semiannual. Format: Flexible (but the rows must align with the presentation of the bank's financial report). Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes in the expanded balance sheet items over the reporting period and the key drivers of such change. Narrative commentary to significant changes in other balance sheet items could be found in Table LIA. a b c Balance sheet as in published financial statements Under regulatory scope of consolidation Reference As at period-end As at period-end Assets Cash and balances at central banks Items in the course of collection from other banks Trading portfolio assets Financial assets designated at fair value Derivative financial instruments Loans and advances to banks Loans and advances to customers Reverse repurchase agreements and other similar secured lending Available for sale financial investments Current and deferred tax assets Prepayments, accrued income and other assets Investments in associates and joint ventures Goodwill and intangible assets Of which: goodwill a Of which: other intangibles (excluding MSR) b Of which: MSR c Property, plant and equipment Total assets Liabilities Deposits from banks Items in the course of collection due to other banks Customer accounts Repurchase agreements and other similar secured borrowing Trading portfolio liabilities Financial liabilities designated at fair value Derivative financial instruments Debt securities in issue Accruals, deferred income and other liabilities Current and deferred tax liabilities Of which: deferred tax liabilities (DTL) related to goodwill d Of which: DTL related to intangible assets (excluding MSR) e Of which: DTL related to MSR f

Page Number 38 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Subordinated liabilities Provisions Retirement benefit liabilities Total liabilities Shareholders' equity Paid-in share capital Of which: amount eligible for CET1 capital h Of which: amount eligible for AT1 capital i Retained earnings Accumulated other comprehensive income Total shareholders' equity Columns Banks are required to take their balance sheet in their published financial statements (numbers reported in column a above) and report the numbers when the regulatory scope of consolidation is applied (numbers reported in column b above).. If there are rows in the balance sheet under the regulatory scope of consolidation that are not present in the published financial statements, banks are required to add these and give a value of zero in column a. If a bank's scope of accounting consolidation and its scope of regulatory consolidation are exactly the same, columns a and b should be merged and this fact should be clearly disclosed. Rows Similar to Template LI1, the rows in the above template should follow the balance sheet presentation used by the bank in its financial statements, on which basis the bank is required to expand the balance sheet to identify all the items that are disclosed in Template CC1. Set out above (ie items a to i) are some examples of items that may need to be expanded for a particular banking group. Disclosure should be proportionate to the complexity of the bank's balance sheet. Each item must be given a reference number/letter in column c that is used as cross-reference to column b of Template CC1. Linkages across templates (i) The amounts in columns a and b in Template CC2 before balance sheet expansion (ie before Step 2) should be identical to columns a and b in Template LI1. (ii) Each expanded item is to be cross-referenced to the corresponding items in Template CC1.

Page Number 39 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template TLAC1: TLAC composition for G-SIBs (at resolution group level) Purpose: Provide details of the composition of a G-SIB's TLAC. Scope of application: This template is mandatory for all G-SIBs. It should be completed at the level of each resolution group within a G-SIB. Content: Carrying values (corresponding to the values reported in financial statements). Frequency: Semiannual. Format: Fixed. Accompanying narrative: G-SIBs are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of any such change(s). Qualitative narrative on the G-SIB resolution strategy, including the approach (SPE or multiple point of entry (MPE)) and structure to which the resolution measures are applied, may be included to help understand the templates. a Amounts Regulatory capital elements of TLAC and adjustments 1 Common Equity Tier 1 (CET1) capital 2 Additional Tier 1 (AT1) capital before TLAC adjustments 3 AT1 capital ineligible as TLAC as issued out of subsidiaries to third parties 4 Other adjustments 5 AT1 instruments eligible under the TLAC framework 6 Tier 2 capital before TLAC adjustments 7 Amortised portion of Tier 2 instruments where remaining maturity > 1 year 8 Tier 2 capital ineligible as TLAC as issued out of subsidiaries to third parties 9 Other adjustments 10 Tier 2 instruments eligible under the TLAC framework 11 TLAC arising from regulatory capital Non-regulatory capital elements of TLAC 12 External TLAC instruments issued directly by the bank and subordinated to excluded liabilities 13 External TLAC instruments issued directly by the bank which are not subordinated to excluded liabilities but meet all other TLAC Term Sheet requirements 14 Of which: amount eligible as TLAC after application of the caps 15 External TLAC instruments issued by funding vehicles prior to 1 January 2022 16 Eligible ex ante commitments to recapitalise a G-SIB in resolution 17 TLAC arising from non-regulatory capital instruments before adjustments Non-regulatory capital elements of TLAC: adjustments 18 TLAC before deductions 19 Deductions of exposures between MPE resolution groups that correspond to items eligible for TLAC (not applicable to single point of entry G-SIBs) 20 Deduction of investments in own other TLAC liabilities 21 Other adjustments to TLAC

Page Number 40 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 22 TLAC after deductions Risk-weighted assets (RWA) and leverage exposure measure for TLAC purposes 23 Total RWA adjusted as permitted under the TLAC regime 24 Leverage exposure measure TLAC ratios and buffers 25 TLAC (as a percentage of RWA adjusted as permitted under the TLAC regime) 26 TLAC (as a percentage of leverage exposure) 27 CET1 (as a percentage of RWA) available after meeting the resolution group's minimum capital and TLAC requirements 28 Bank-specific buffer requirement (capital conservation buffer plus countercyclical buffer requirements plus higher loss￾absorbency requirement, expressed as a percentage of RWA) 29 Of which: capital conservation buffer requirement 30 Of which: bank-specific countercyclical buffer requirement 31 Of which: higher loss-absorbency requirement Instructions For SPE G-SIBs, where the resolution group is the same as the regulatory scope of consolidation for Basel III regulatory capital, those rows that refer to regulatory capital before adjustments coincide with information provided under Template CC1. For MPE G-SIBs, information is provided for each resolution group. Aggregation of capital and total RWA for capital purposes across resolution groups will not necessarily equal or directly correspond to values reported for regulatory capital and RWA under Template CC1. The TLAC position related to the regulatory capital of the resolution group shall include only capital instruments issued by entities belonging to the resolution group. Similarly, the TLAC position is based on the RWA (adjusted as permitted under Section 3 of the TLAC Term Sheet) and leverage ratio exposure measures calculated at the level of the resolution group. Regarding the shading:

• Each dark grey row introduces a new section detailing a certain component of TLAC.
• The light grey rows with no thick border represent the sum cells in the relevant section.
• The light grey rows with a thick border show the main components of TLAC. The following table explains each row of the above template. Regarding the regulatory adjustments, banks are required to report deductions from capital or TLAC as positive numbers and additions to capital or TLAC as negative numbers. For example, the amortised portion of Tier 2 where remaining maturity is greater than one year (row 7) should be reported as a negative number (as it adds back in the calculation of Tier 2 instruments eligible as TLAC), while Tier 2 capital ineligible as TLAC (row 8) should be reported as a positive number. Row number Explanation 1 CET1 capital of the resolution group, calculated in line with the Basel III and TLAC frameworks. 2 AT 1 capital. This row will provide information on the AT1 capital of the resolution group, calculated in line with the SACAP standard and the TLAC framework. 3 AT1 instruments issued out of subsidiaries to third parties that are ineligible as TLAC. According to Section 8c of the TLAC Term Sheet, such instruments could be recognised to meet minimum TLAC until 31 December 2021. An amount (equal to that reported in row 34 in Template CC1) should thus be reported only starting from 1 January 2022. 4 Other elements of AT1 capital that are ineligible as TLAC (excluding those already incorporated in row 3). 5 AT1 instruments eligible under the TLAC framework, to be calculated as row 2 minus rows 3 and 4. 6 Tier 2 capital of the resolution group, calculated in line with the Basel III and TLAC frameworks. 7 Amortised portion of Tier 2 instruments where remaining maturity is greater than one year. This row recognises that as long as the remaining maturity of a Tier 2 instrument is above the one-year residual maturity requirement of the TLAC Term Sheet, the full amount may be included in TLAC, even if the instrument is partially derecognised in regulatory capital via the requirement to amortise the instrument in the five years before maturity. Only the amount not recognised in regulatory capital but meeting all TLAC eligibility criteria should be reported in this row. 8 Tier 2 instruments issued out of subsidiaries to third parties that are ineligible as TLAC. According to Section 8c of the TLAC Term Sheet, such instruments could be recognised to meet minimum TLAC until 31 December 2021. An amount (equal to that reported in row 48 of Template CC1) should thus be reported only starting from 1 January 2022. 9 Other elements of Tier 2 capital that are ineligible as TLAC (excluding those that are already incorporated in row 8).

Page Number 41 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 10 Tier 2 instruments eligible under the TLAC framework, to be calculated as: row 6 + row 7 - row 8 - row 9. 11 TLAC arising from regulatory capital, to be calculated as: row 1 + row 5 + row 10. 12 External TLAC instruments issued directly by the resolution entity and subordinated to excluded liabilities. The amount reported in this row must meet the subordination requirements set out in points (a) to (c) of Section 11 of the TLAC Term Sheet, or be exempt from the requirement by meeting the conditions set out in points (i) to (iv) of the same section. 13 External TLAC instruments issued directly by the resolution entity that are not subordinated to Excluded Liabilities but meet the other TLAC Term Sheet requirements. The amount reported in this row should be those subject to recognition as a result of the application of the penultimate and antepenultimate paragraphs of Section 11 of the TLAC Term Sheet. The full amounts should be reported in this row, ie without applying the 2.5% and 3.5% caps set out the penultimate paragraph. 14 The amount reported in row 13 above after the application of the 2.5% and 3.5% caps set out in the penultimate paragraph of Section 11 of the TLAC Term Sheet. 15 External TLAC instrument issued by a funding vehicle prior to 1 January 2022. Amounts issued after 1 January 2022 are not eligible as TLAC and should not be reported here. 16 Eligible ex ante commitments to recapitalise a G-SIB in resolution, subject to the conditions set out in the second paragraph of Section 7 of the TLAC Term Sheet. 17 Non-regulatory capital elements of TLAC before adjustments. To be calculated as: row 12 + row 14 + row 15 + row 16. 18 TLAC before adjustments. To be calculated as: row 11 + row 17. 19 Deductions of exposures between MPE G-SIB resolution groups that correspond to items eligible for TLAC (not applicable for SPE G￾SIBs). All amounts reported in this row should correspond to deductions applied after the appropriate adjustments agreed by the crisis management group (CMG) (following the penultimate paragraph of Section 3 of the TLAC Term Sheet, the CMG shall discuss and, where appropriate and consistent with the resolution strategy, agree on the allocation of the deduction). 20 Deductions of investments in own other TLAC liabilities; amount to be deducted from TLAC resources in accordance with SACAP4.1.6. 21 Other adjustments to TLAC. 22 TLAC of the resolution group (as the case may be) after deductions. To be calculated as: row 18 - row 19 - row 20 - row 21. 23 Total RWA of the resolution group under the TLAC regime. For SPE G-SIBs, this information is based on the consolidated figure, so the amount reported in this row will coincide with that in row 60 of Template CC1. 24 Leverage exposure measure of the resolution group (denominator of leverage ratio). 25 TLAC ratio (as a percentage of RWA for TLAC purposes), to be calculated as row 22 divided by row 23. 26 TLAC ratio (as a percentage of leverage exposure measure), to be calculated as row 22 divided by row 24. 27 CET1 capital (as a percentage of RWA) available after meeting the resolution group's minimum capital requirements and TLAC requirement. To be calculated as the CET1 capital adequacy ratio, less any common equity (as a percentage of RWA) used to meet CET1, Tier 1, and Total minimum capital and TLAC requirements. For example, suppose a resolution group (that is subject to regulatory capital requirements) has 100 RWA, 10 CET1 capital, 1.5 AT1 capital, no Tier 2 capital and 9 non-regulatory capital TLAC-eligible instruments. The resolution group will have to earmark its CET1 capital to meet the 8% minimum capital requirement and 18% minimum TLAC requirement. The net CET1 capital left to meet other requirements (which could include Pillar 2 or buffers) will be 10 - 4.5 - 2 - 1 = 2.5. 28 Bank-specific buffer requirement (capital conservation buffer plus countercyclical buffer requirements plus G-SIB buffer requirement, expressed as a percentage of RWA). Calculated as the sum of: (i) the G-SIB's capital conservation buffer; (ii) the G-SIB's specific countercyclical buffer requirement calculated in accordance with SACAP; and (iii) the higher loss-absorbency requirement as set out in SACAP. Not applicable to individual resolution groups of an MPE G-SIB, unless the relevant authority imposes buffer requirements at the level of consolidation and requires such disclosure. 29 The amount in row 28 (expressed as a percentage of RWA) that relates to the capital conservation buffer), ie G-SIBs will report 2.5% here. Not applicable to individual resolution groups of an MPE G-SIB, unless otherwise required by the relevant authority. 30 The amount in row 28 (expressed as a percentage of RWA) that relates to the G-SIB's specific countercyclical buffer requirement. Not applicable to individual resolution groups of an MPE G-SIB, unless otherwise required by the relevant authority. 31 The amount in row 28 (expressed as a percentage of RWA) that relates to the higher loss-absorbency requirement. Not applicable to individual resolution groups of an MPE G-SIB, unless otherwise required by the relevant authority.

Page Number 42 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template TLAC2 - Material subgroup entity - creditor ranking at legal entity level Purpose: Provide creditors with information regarding their ranking in the liabilities structure of a material subgroup entity (ie an entity that is part of a material subgroup) which has issued internal TLAC to a G-SIB resolution entity. Scope of application: The template is mandatory for all G-SIBs. It is to be completed in respect of every material subgroup entity within each resolution group of a G-SIB, as defined by the FSB TLAC Term Sheet, on a legal entity basis. G-SIBs should group the templates according to the resolution group to which the material subgroup entities belong (whose positions are represented in the templates) belong, in a manner that makes it clear to which resolution entity they have exposures. Content: Nominal values. Frequency: Semiannual. Format: Fixed (number and description of each column under "Creditor ranking" depending on the liabilities structure of a material subgroup entity). Accompanying narrative: Where appropriate, banks should provide bank- or jurisdiction-specific information relating to credit hierarchies. Creditor ranking Sum of 1 to n 1 1 2 2 - n n (most junior) (most junior) (most senior) (most senior) 1 Is the resolution entity the creditor/investor? (yes or no) - 2 Description of creditor ranking (free text) 3 Total capital and liabilities net of credit risk mitigation - 4 Subset of row 3 that are excluded liabilities - 5 Total capital and liabilities less excluded liabilities (row 3 minus row 4) - 6 Subset of row 5 that are eligible as TLAC - 7 Subset of row 6 with 1 year ≤ residual maturity < 2 years - 8 Subset of row 6 with 2 years ≤ residual maturity < 5 years - 9 Subset of row 6 with 5 years ≤ residual maturity < 10 years - 10 Subset of row 6 with residual maturity ≥ 10 years, but excluded perpetual securities - 11 Subset of row 6 that is perpetual securities

Page Number 43 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template TLAC3 - Resolution entity - creditor ranking at legal entity level Purpose: Provide creditors with information regarding their ranking in the liabilities structure of each G-SIB resolution entity. Scope of application: The template is to be completed in respect of every resolution entity within the G-SIB, as defined by the TLAC standard, on a legal entity basis. Content: Nominal values. Frequency: Semiannual. Format: Fixed (number and description of each column under "Creditor ranking" depending on the liabilities structure of a resolution entity). Accompanying narrative: Where appropriate, banks should provide bank- or jurisdiction-specific information relating to credit hierarchies. Creditor ranking Sum of 1 to n 1 2 - n (most junior) (most senior) 1 Description of creditor ranking (free text) 2 Total capital and liabilities net of credit risk mitigation - 3 Subset of row 2 that are excluded liabilities - 4 Total capital and liabilities less excluded liabilities (row 2 minus row 3) - 5 Subset of row 4 that are potentially eligible as TLAC - 6 Subset of row 5 with 1 year ≤ residual maturity < 2 years - 7 Subset of row 5 with 2 years ≤ residual maturity < 5 years - 8 Subset of row 5 with 5 years ≤ residual maturity < 10 years - 9 Subset of row 5 with residual maturity ≥ 10 years, but excluding perpetual securities - 10 Subset of row 5 that is perpetual securities - Definitions and instructions This template is the same as Template TLAC 2 except that no information is collected regarding exposures to the resolution entity (since the template describes the resolution entity itself). This means that there will only be one column for each layer of the creditor hierarchy. Row 5 represents the subset of the amounts reported in row 4 that are TLAC-eligible according to the FSB TLAC Term Sheet (eg those that have a residual maturity of at least one year, are unsecured and if redeemable are not redeemable without SAMA approval). For the purposes of reporting this amount, the 2.5% cap (3.5% from 2022) on the exemption from the subordination requirement under the penultimate paragraph of Section 11 of the TLAC Term Sheet should be disapplied. That is, amounts that are ineligible solely as a result of the 2.5% cap (3.5%) should be included in full in row 5 together with amounts that are receiving recognition as TLAC. See also the second paragraph in Section 7 of the FSB TLAC Term Sheet.

Page Number 44 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 15. Capital distribution constraints: 15.1 The disclosure requirement under this section is: Template CDC - Capital distribution constraints. 15.2 Template CDC provides the common equity tier 1 (CET1) capital ratios that would trigger capital distribution constraints. This disclosure extends to leverage ratio in the case of G-SIBs.

Page Number 45 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CDC: Capital distribution constraints Purpose: To provide disclosure of the capital ratio(s) below which capital distribution constraints are triggered as required under the Basel framework (i.e. risk-based, leverage, etc.) to allow meaningful assessment by market participants of the likelihood of capital distributions becoming restricted. Scope of application The table is mandatory for banks. Where applicable, the template may include additional rows to accommodate other national requirements that could trigger capital distribution constraints. Content: Quantitative information. Includes the CET1 capital ratio that would trigger capital distribution constraints when taking into account (i) CET1 capital that banks must maintain to meet the minimum CET1 capital ratio, applicable risk based buffer requirements (i.e. capital conservation buffer, G-SIB surcharge and countercyclical capital buffer) and Pillar 2 capital requirements (if CET1 capital is required); (ii) CET1 capital that banks must maintain to meet the minimum regulatory capital ratios and any CET1 capital used to meet Tier 1 capital, total capital and TLAC3 requirements, applicable risk-based buffer requirements (i.e. capital conservation buffer, G-SIB surcharge and countercyclical capital buffer) and Pillar 2 capital requirements (if CET1 capital is required); and (iii) the leverage ratio inclusive of leverage ratio buffer requirement. Frequency: Annual. Format: Fixed. Accompanying narrative: In cases where capital distribution constraints have been imposed, banks should describe the constraints imposed. In addition, banks shall provide a link to the SAMA’s website, where the characteristics governing capital distribution constraints are set out (eg stacking hierarchy of buffers, relevant time frame between breach of buffer and application of constraints, definition of earnings and distributable profits used to calculate restrictions). Further, banks may choose to provide any additional information they consider to be relevant for understanding the stated figures. a b CET1 capital ratio that would trigger capital distribution constraints (%) Current CET1 capital ratio (%) 1 CET1 minimum requirement plus Basel III buffers (not taking into account CET1 capital used to meet other minimum regulatory capital/ TLAC ratios) 2 CET1 capital plus Basel III buffers (taking into account CET1 capital used to meet other minimum regulatory capital/ TLAC ratios) Leverage ratio that would trigger capital distribution constraints (%) Current leverage ratio (%) 3 [Applicable only for G-SIBs] Leverage ratio Instructions Row Number Explanation 1 CET1 minimum plus Basel III buffers (not taking into account CET1 capital used to meet other minimum regulatory capital/TLAC ratios): CET1 capital ratio which would trigger capital distribution constraints, should the bank’s CET1 capital ratio fall below this level. The ratio takes into account only CET1 capital that banks must maintain to meet the minimum CET1 capital ratio (4.5%), applicable risk-based buffer requirements (i.e. capital conservation buffer (2.5%), G-SIB surcharge and countercyclical capital buffer) and Pillar 2 capital requirements (if CET1 capital is required). The ratio does not take into account instances where the bank has used its CET1 capital to meet its other minimum regulatory ratios (i.e. Tier 1 capital, total capital and/or TLAC requirements), which could increase the CET1 capital ratio which the bank has to meet in order to prevent capital distribution constraints from being triggered. 2 CET1 minimum plus Basel III buffers (taking into account CET1 capital used to meet other minimum regulatory capital/TLAC ratios): CET1 capital ratio which would trigger capital distribution constraints, should the bank’s CET1 capital ratio fall below this level. The ratio takes into account CET1 capital that banks must maintain to meet the minimum regulatory ratios (ie CET1, Tier 1, total capital requirements and TLAC requirements), applicable risk-based buffer requirements (i.e. capital conservation buffer (2.5%), G-SIB surcharge and countercyclical capital buffer) and Pillar 2 capital requirements (if CET1 capital is required). 3 Leverage ratio: Leverage ratio which would trigger capital distribution constraints, should the bank’s leverage ratio fall below this level. Linkages across templates Amount in [CDC:1/b] is equal to [KM1:5/a] Amount in [CDC:3/b] is equal to [KM1:14/a]

3 SACAP9.1 (B) states that Common Equity Tier 1 must first be used to meet the minimum capital and TLAC requirements if necessary (including the 6% Tier 1, 8% total capital and 18% TLAC requirements), before the remainder can contribute to the capital conservation buffer.

Page Number 46 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 16. Links between financial statements and regulatory exposures: 16.1 This chapter describes requirements for banks to disclose reconciliations between elements of the calculation of regulatory capital to audited financial statements. 16.2 The disclosure requirements set out in this chapter are: 16.2.1Table LIA – Explanations of differences between accounting and regulatory exposure amounts 16.2.2Template LI1 – Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories 16.2.3Template LI2 – Main sources of differences between regulatory exposure amounts and carrying values in financial statements 16.2.4Template PV1 – Prudent valuation adjustments (PVAs) 16.3 Table LIA provides qualitative explanations on the differences observed between accounting carrying value (as defined in Template LI1) and amounts considered for regulatory purposes (as defined in Template LI2) under each framework.

Page Number 47 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table LIA: Explanations of differences between accounting and regulatory exposure amounts Purpose: Provide qualitative explanations on the differences observed between accounting carrying value (as defined in Template LI1) and amounts considered for regulatory purposes (as defined in Template LI2) under each framework. Scope of application: The template is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must explain the origins of the differences between accounting amounts, as reported in financial statements amounts and regulatory exposure amounts, as displayed in Templates LI1 and LI2. (a) Banks must explain the origins of any significant differences between the amounts in columns (a) and (b) in Template LI1. (b) Banks must explain the origins of differences between carrying values and amounts considered for regulatory purposes shown in Template LI2. (c) In accordance with the implementation of the guidance on prudent valuation (see Basel Framework “prudent valuation guidance”), banks must describe systems and controls to ensure that the valuation estimates are prudent and reliable. Disclosure must include:  Valuation methodologies, including an explanation of how far mark-to-market and mark-to-model methodologies are used.  Description of the independent price verification process.  Procedures for valuation adjustments or reserves (including a description of the process and the methodology for valuing trading positions by type of instrument). (d) Banks with insurance subsidiaries must disclose:  The national regulatory approach used with respect to insurance entities in determining a bank's reported capital positions (ie deduction of investments in insurance subsidiaries or alternative approaches, as discussed in Basel Framework “Scope and definitions” Banking, securities and other financial subsidiaries (Insurance entities); and  Any surplus capital in insurance subsidiaries recognized when calculating the bank's capital adequacy (see Basel Framework “Scope and definitions” Banking, securities and other financial subsidiaries (Insurance entities).

Page Number 48 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories Purpose: Columns (a) and (b) enable users to identify the differences between the scope of accounting consolidation and the scope of regulatory consolidation; and columns (c)-(g) break down how the amounts reported in banks' financial statements (rows) correspond to regulatory risk categories. Scope of application: The template is mandatory for all banks. Content: Carrying values (corresponding to the values reported in financial statements). Frequency: Annual. Format: Flexible (but the rows must align with the presentation of the bank's financial report). Accompanying narrative: See Table LIA. Banks are expected to provide qualitative explanation on items that are subject to regulatory capital charges in more than one risk category. a b c d e f g Carrying values as reported in published financial statements Carrying values under scope of regulatory consolidation Carrying values of items: Subject to credit risk framework Subject to counterparty credit risk framework Subject to the securitization framework Subject to the market risk framework Not subject to capital requirements or subject to deduction from capital Assets Cash and balances at central banks Items in the course of collection from other banks Trading portfolio assets Financial assets designated at fair value Derivative financial instruments Loans and advances to banks Loans and advances to customers Reverse repurchase agreements and other similar secured lending Available for sale financial investments -. Total assets Liabilities Deposits from banks Items in the course of collection due to other banks Customer accounts Repurchase agreements and other similar secured borrowings Trading portfolio liabilities Financial liabilities designated at fair value Derivative financial instruments -. Total liabilities

Page Number 49 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Instructions Rows The rows must strictly follow the balance sheet presentation used by the bank in its financial reporting. Columns If a bank's scope of accounting consolidation and its scope of regulatory consolidation are exactly the same, columns (a) and (b) should be merged. The breakdown of regulatory categories (c) to (f) corresponds to the breakdown prescribed in the rest of SDIS, ie column (c) corresponds to the carrying values of items other than off-balance sheet items reported in section 19 column (d) corresponds to the carrying values of items other than off-balance sheet items reported in section 20, column (e) corresponds to carrying values of items in the banking book other than off-balance sheet items reported in section 21 and column (f) corresponds to the carrying values of items other than off-balance sheet items reported in section 22. Column (g) includes amounts not subject to capital requirements according to the Basel framework or subject to deductions from regulatory capital. Note: Where a single item attracts capital charges according to more than one risk category framework, it should be reported in all columns that it attracts a capital charge. As a consequence, the sum of amounts in columns (c) to (g) may not equal the amounts in column (b) as some items may be subject to regulatory capital charges in more than one risk category. For example, derivative assets/liabilities held in the regulatory trading book may relate to both column (d) and column (f). In such circumstances, the sum of the values in columns (c)-(g) would not equal to that in column (b). When amounts disclosed in two or more different columns are material and result in a difference between column (b) and the sum of columns (c)-(g), the reasons for this difference should be explained by banks in the accompanying narrative.

Page Number 50 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements Purpose: Provide information on the main sources of differences (other than due to different scopes of consolidation which are shown in Template LI1) between the financial statements' carrying value amounts and the exposure amounts used for regulatory purposes. Scope of application: The template is mandatory for all banks. Content: Carrying values that correspond to values reported in financial statements but according to the scope of regulatory consolidation (rows 1-3) and amounts considered for regulatory exposure purposes (row 10). Frequency: Annual. Format: Flexible. Row headings shown below are provided for illustrative purposes only and should be adapted by the bank to describe the most meaningful drivers for differences between its financial statement carrying values and the amounts considered for regulatory purposes. Accompanying narrative: See Table LIA. a b c d e Total Items subject to: Credit risk framework Securitization framework Counterparty credit risk framework Market risk framework 1 Asset carrying value amount under scope of regulatory consolidation (as per Template LI1) 2 Liabilities carrying value amount under regulatory scope of consolidation (as per Template LI1) 3 Total net amount under regulatory scope of consolidation (Row 1 - Row 2) 4 Off-balance sheet amounts 5 Differences in valuations 6 Differences due to different netting rules, other than those already included in row 2 7 Differences due to consideration of provisions 8 Differences due to prudential filters 9 ⁞ 10 Exposure amounts considered for regulatory purposes Instructions Amounts in rows 1 and 2, columns (b)-(e) correspond to the amounts in columns (c)-(f) of Template LI1. Row 1 of Template LI2 includes only assets that are risk-weighted under the Basel framework, while row 2 includes liabilities that are considered for the application of the risk weighting requirements, either as short positions, trading or derivative liabilities, or through the application of the netting rules to calculate the net position of assets to be risk-weighted. These liabilities are not included in column (g) in Template LI1. Assets that are risk￾weighted under the Basel framework include assets that are not deducted from capital because they are under the applicable thresholds or due to the netting with liabilities. Off-balance sheet amounts include off-balance sheet original exposure in column (a) and the amounts subject to regulatory framework, after application of the credit conversion factors (CCFs) where relevant in columns (b)-(d). Column (a) is not necessarily equal to the sum of columns (b)-(e) due to assets being risk-weighted more than once (see Template LI1). In addition, exposure values used for risk weighting may differ under each risk framework depending on whether standardized approaches or internal models are used in the computation of this exposure value. Therefore, for any type of risk framework, the exposure values under different regulatory approaches can be presented separately in each of the columns if a separate presentation eases the reconciliation of the exposure values for banks. The breakdown of columns in regulatory risk categories (b)-(e) corresponds to the breakdown prescribed in the rest of the document, ie column (b) credit risk corresponds to the exposures reported in section 19, column (c) corresponds to the exposures reported in section 21, column (d) corresponds to exposures reported in section 20, and column (e) corresponds to the exposures reported in section 22. Differences due to consideration of provisions: The exposure values under row 1 are the carrying amounts and hence net of provisions (ie specific and general provisions, as set out in SACAP2.2.3). Nevertheless, exposures under the foundation internal ratings-based (F-IRB) and advanced internal ratings-based (A-IRB) approaches are risk-weighted gross of provisions. Row 7 therefore is the re-inclusion of general and specific provisions in the carrying amount of exposures in the F-IRB and A-IRB approaches so that the carrying amount of those exposures is reconciled with their regulatory exposure value. Row 7 may also include the elements qualifying as general provisions that may have been deducted from the carrying amount of

Page Number 51 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 exposures under the standardized approach and that therefore need to be reintegrated in the regulatory exposure value of those exposures. Any differences between the accounting impairment and the regulatory provisions under the Basel framework that have an impact on the exposure amounts considered for regulatory purposes should also be included in row 7. Exposure amounts considered for regulatory purposes: The expression designates the aggregate amount considered as a starting point of the RWA calculation for each of the risk categories. Under the credit risk framework this should correspond either to the exposure amount applied in the standardized approach for credit risk (see SCRE5) or to the exposures at default (EAD) in the IRB approach for credit risk (see SCRE12.29); securitization exposures should be defined as in the securitization framework (see SCRE18.4 and SCRE18.5); and counterparty credit exposures are defined as the EAD considered for counterparty credit risk purposes (see SCCR5). Linkages across templates Template LI2 is focused on assets in the regulatory scope of consolidation that are subject to the regulatory framework. Therefore, column (g) in Template LI1, which includes the elements of the balance sheet that are not subject to the regulatory framework, is not included in Template LI2. The following linkage holds: column (a) in Template LI2 = column (b) in Template LI1 - column (g) in Template LI1.

Page Number 52 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template PV1: Prudent valuation adjustments (PVAs) Purpose: Provide a breakdown of the constituent elements of a bank's PVAs according to the requirements of Basel Framework “prudent valuation guidance”, taking into account SAMA’s circular No. 301000000768 on Supervisory guidance for assessing banks' financial instrument fair value practices, July 2009. Scope of application: The template is mandatory for all banks which record PVAs. Content: PVAs for all assets measured at fair value (marked to market or marked to model) and for which PVAs are required. Assets can be non￾derivative or derivative instruments. Frequency: Annual. Format: Fixed. The row number cannot be altered. Rows which are not applicable to the reporting bank should be filled with "0" and the reason why they are not applicable should be explained in the accompanying narrative. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. In particular, banks are expected to detail "Other adjustments", where significant, and to define them when they are not listed in the Basel framework. Banks are also expected to explain the types of financial instruments for which the highest amounts of PVAs are observed. a b c d e f g h Equity Interest rates Foreign exchange Credit Commodities Total Of which: in the trading book Of which: in the banking book 1 Closeout uncertainty, of which: 2 Mid-market value 3 Closeout cost 4 Concentration 5 Early termination 6 Model risk 7 Operational risk 8 Investing and funding costs 9 Unearned credit spreads 10 Future administrative costs 11 Other 12 Total adjustment Definitions and instructions Row number Explanation 3 Closeout cost: PVAs required to take account of the valuation uncertainty to adjust for the fact that the position level valuations calculated do not reflect an exit price for the position or portfolio (for example, where such valuations are calibrated to a mid-market price). 4 Concentration: PVAs over and above market price and closeout costs that would be required to get to a prudent exit price for positions that are larger than the size of positions for which the valuation has been calculated (i.e. cases where the aggregate position held by the bank is larger than normal traded volume or larger than the position sizes on which observable quotes or trades that are used to calibrate the price or inputs used by the core valuation model are based). 5 Early termination: PVAs to take into account the potential losses arising from contractual or non-contractual early terminations of customer trades that are not reflected in the valuation. 6 Model risk: PVAs to take into account valuation model risk which arises due to: (i) the potential existence of a range of different models or model calibrations which are used by users of Pillar 3 data; (ii) the lack of a firm exit price for the specific product being valued; (iii) the use of an incorrect valuation methodology; (iv) the risk of using unobservable and possibly incorrect calibration parameters; or (v) the fact that market or product factors are not captured by the core valuation model. 7 Operational risk: PVAs to take into account the potential losses that may be incurred as a result of operational risk related to valuation processes. 8 Investing and funding costs: PVAs to reflect the valuation uncertainty in the funding costs that other users of Pillar 3 data would factor into the exit price for a position or portfolio. It includes funding valuation adjustments on derivatives exposures. 9 Unearned credit spreads: PVAs to take account of the valuation uncertainty in the adjustment necessary to include the current value of expected losses due to counterparty default on derivative positions, including the valuation uncertainty on CVA. 10 Future administrative costs: PVAs to take into account the administrative costs and future hedging costs over the expected life of the exposures for which a direct exit price is not applied for the closeout costs. This valuation adjustment has to include the operational costs arising from hedging, administration and settlement of contracts in the portfolio. The future administrative costs are incurred by the portfolio or position but are not reflected in the core valuation model or the prices used to calibrate inputs to that model. 11 Other: "Other" PVAs which are required to take into account factors that will influence the exit price but which do not fall in any of the categories listed in Basel Framework “prudent valuation guidance” (Introduction). These should be described by banks in the narrative commentary that supports the disclosure. Linkages across templates [PV1:12/f] is equal to [CC1:7/a]

Page Number 53 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 17- Asset encumbrance: 17.1 The disclosure requirement under this section is: Template ENC – Asset encumbrance. 17.2 Template ENC provides information on the encumbered and unencumbered assets of a bank. 17.3 The definition of “encumbered assets” in Template ENC is different to that under LCR30 for on-balance sheet assets. Specifically, the definition of “encumbered assets” in Template ENC excludes the aspect of asset monetization. Under Template ENC, “encumbered assets” are assets that the bank is restricted or prevented from liquidating, selling, transferring or assigning, due to regulatory, contractual or other limitations.

Page Number 54 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template ENC: Asset encumbrance Purpose: To provide the amount of encumbered and unencumbered assets. Scope of application The template is mandatory for all banks. Content: Carrying amount for encumbered and unencumbered assets on the balance sheet using period-end values. Banks must use the specific definition of “encumbered assets” set out in the instructions below in making the disclosure. The scope of consolidation for the purposes of this disclosure requirement should be a bank’s regulatory scope of consolidation, but including its securitization exposures. Frequency: Semiannual. Format: Fixed. Banks should always complete columns (a), (b) and (c). Banks should group any assets used in central bank facilities with other encumbered and unencumbered assets, as appropriate. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain (i) any significant change in the amount of encumbered and unencumbered assets from the previous disclosure; (ii) as applicable, any definition of the amounts of encumbered and/or unencumbered assets broken down by types of transaction/category; and (iii) any other relevant information necessary to understand the context of the disclosed figures. a b c Encumbered assets Unencumbered assets Total The assets on the balance sheet would be disaggregated; there can be as much disaggregation as desired Definitions The definitions are specific to this template and are not applicable for other parts of the Basel framework. Encumbered assets: Encumbered assets are assets that the bank is restricted or prevented from liquidating, selling, transferring or assigning due to legal, regulatory, contractual or other limitations. The definition of “encumbered assets” in Template ENC is different than that under the Liquidity Coverage Ratio for on-balance sheet assets. Specifically, the definition of “encumbered assets” in Template ENC excludes the aspect of asset monetization. For an unencumbered asset to qualify as high-quality liquid assets, the LCR requires a bank to have the ability to monetize that asset during the stress period such that the bank can meet net cash outflows. Unencumbered assets: Unencumbered assets are assets which do not meet the definition of encumbered. Instructions Total (in column (c)): Sum of encumbered and unencumbered assets. The scope of consolidation for the purposes of this disclosure requirement should be based on a bank’s regulatory scope of consolidation, but including its securitization exposures.

Page Number 55 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 18. Remuneration: 18.1 The disclosures described in this chapter provide information on a bank's remuneration policy, the fixed and variable remuneration awarded during the financial year, details of any special payments made, and information on a bank's total outstanding deferred and retained remuneration. 18.2 The disclosure requirements under this section are: 18.2.1Table REMA – Remuneration policy 18.2.2Template REM1 – Remuneration awarded during financial year 18.2.3Template REM2 – Special payments 18.2.4Template REM3 – Deferred remuneration 18.3 Table REMA provides information on a bank’s remuneration policy as well as key features of the remuneration system. 18.4 Templates REM1, REM2 and REM3 provide information on a bank’s fixed and variable remuneration awarded during the financial year, details of any special payments made, and information on a bank’s total outstanding deferred and retained remuneration, respectively. 18.5 The disclosure requirements should be published annually. When it is not possible for the remuneration disclosures to be made at the same time as the publication of a bank’s annual report, the disclosures should be made as soon as possible thereafter.

Page Number 56 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table REMA: Remuneration policy Purpose: Describe the bank's remuneration policy as well as key features of the remuneration system to allow meaningful assessments by users of Pillar 3 data of banks' compensation practices. Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual Format: Flexible. Banks must describe the main elements of their remuneration system and how they develop this system. In particular, the following elements, where relevant, should be described: Qualitative disclosures (a) Information relating to the bodies that oversee remuneration. Disclosures should include:  Name, composition and mandate of the main body overseeing remuneration.  External consultants whose advice has been sought, the body by which they were commissioned, and in what areas of the remuneration process.  A description of the scope of the bank's remuneration policy (eg by regions, business lines), including the extent to which it is applicable to foreign subsidiaries and branches.  A description of the types of employees considered as material risk-takers and as senior managers. (b) Information relating to the design and structure of remuneration processes. Disclosures should include:  An overview of the key features and objectives of remuneration policy.  Whether the remuneration committee reviewed the firm's remuneration policy during the past year, and if so, an overview of any changes that were made, the reasons for those changes and their impact on remuneration.  A discussion of how the bank ensures that risk and compliance employees are remunerated independently of the businesses they oversee. (c) Description of the ways in which current and future risks are taken into account in the remuneration processes. Disclosures should include an overview of the key risks, their measurement and how these measures affect remuneration. (d) Description of the ways in which the bank seeks to link performance during a performance measurement period with levels of remuneration. Disclosures should include:  An overview of main performance metrics for bank, top-level business lines and individuals.  A discussion of how amounts of individual remuneration are linked to bank-wide and individual performance.  A discussion of the measures the bank will in general implement to adjust remuneration in the event that performance metrics are weak, including the bank's criteria for determining "weak" performance metrics. (e) Description of the ways in which the bank seeks to adjust remuneration to take account of longer-term performance. Disclosures should include:  A discussion of the bank's policy on deferral and vesting of variable remuneration and, if the fraction of variable remuneration that is deferred differs across employees or groups of employees, a description of the factors that determine the fraction and their relative importance.  A discussion of the bank's policy and criteria for adjusting deferred remuneration before vesting and after vesting through clawback arrangements, subject to the relevant laws in Saudi Arabia. (f) Description of the different forms of variable remuneration that the bank utilizes and the rationale for using these different forms. Disclosures should include:  An overview of the forms of variable remuneration offered (ie cash, shares and share-linked instruments and other forms).  A discussion of the use of the different forms of variable remuneration and, if the mix of different forms of variable remuneration differs across employees or groups of employees), a description the factors that determine the mix and their relative importance.

Page Number 57 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template REM1: Remuneration awarded during the financial year Purpose: Provide quantitative information on remuneration for the financial year. Scope of application: The template is mandatory for all banks. Content: Quantitative information. Frequency: Annual Format: Flexible. Accompanying narrative: Banks may supplement the template with a narrative commentary to explain any significant movements over the reporting period and the key drivers of such movements. a b Remuneration amount Senior management, as defined in SAMA circular No.42081293 date 21/11/1442AH Other material risk￾takers 1 Fixed remuneration Number of employees 2 Total fixed remuneration (rows 3 + 5 + 7) 3 Of which: cash-based 4 Of which: deferred 5 Of which: shares or other share-linked instruments 6 Of which: deferred 7 Of which: other forms 8 Of which: deferred 9 Variable remuneration Number of employees 10 Total variable remuneration (rows 11 + 13 + 15) 11 Of which: cash-based 12 Of which: deferred 13 Of which: shares or other share-linked instruments 14 Of which: deferred 15 Of which: other forms 16 Of which: deferred 17 Total remuneration (rows 2 + 10) Definitions and instructions Senior management and other material risk-takers categories in columns (a) and (b) must correspond to the type of employees described in Table REMA. Other forms of remuneration in rows 7 and 15 must be described in Table REMA and, if needed, in the accompanying narrative.

Page Number 58 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template REM2: Special payments Purpose: Provide quantitative information on special payments for the financial year. Scope of application: The template is mandatory for all banks. Content: Quantitative information. Frequency: Annual. Format: Flexible. Accompanying narrative: Banks may supplement the template with a narrative commentary to explain any significant movements over the reporting period and the key drivers of such movements. Special payments Guaranteed bonuses Sign-on awards Severance payments Number of employees Total amount Number of employees Total amount Number of employees Total amount Senior management Other material risk-takers Definitions and instructions Senior management and other material risk-takers categories in rows 1 and 2 must correspond to the type of employees described in Table REMA. Guaranteed bonuses are payments of guaranteed bonuses during the financial year. Sign-on awards are payments allocated to employees upon recruitment during the financial year. Severance payments are payments allocated to employees dismissed during the financial year.

Page Number 59 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template REM3: Deferred remuneration Purpose: Provide quantitative information on deferred and retained remuneration. Scope of application: The template is mandatory for all banks. Content: Quantitative information. Frequency: Annual. Format: Flexible. Accompanying narrative: Banks may supplement the template with a narrative commentary to explain any significant movements over the reporting period and the key drivers of such movements. a b c d e Deferred and retained remuneration Total amount of outstanding deferred remuneration Of which: total amount of outstanding deferred and retained remuneration exposed to ex post explicit and/or implicit adjustment Total amount of amendment during the year due to ex post explicit adjustments Total amount of amendment during the year due to ex post implicit adjustments Total amount of deferred remuneration paid out in the financial year Senior management Cash Shares Cash-linked instruments Other Other material risk-takers Cash Shares Cash-linked instruments Other Total Definitions Outstanding exposed to ex post explicit adjustment: Part of the deferred and retained remuneration that is subject to direct adjustment clauses (for instance, subject to malus, clawbacks or similar reversal or downward revaluations of awards). Outstanding exposed to ex post implicit adjustment: Part of the deferred and retained remuneration that is subject to adjustment clauses that could change the remuneration, due to the fact that they are linked to the performance of other indicators (for instance, fluctuation in the value of shares performance or performance units). In columns (a) and (b), the amounts at reporting date (cumulated over the last years) are expected. In columns (c)-(e), movements during the financial year are expected. While columns (c) and (d) show the movements specifically related to column (b), column (e) shows payments that have affected column (a).

Page Number 60 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 19. Credit risk: 19.1 The scope of section 19 includes items subject to risk-weighted assets (RWA) for credit risk as defined in Basel Framework “Risk-based capital requirements” (Calculation of Minimum risk-based capital requirements) 20.6(1), i.e. excluding: 19.1.1All positions subject to the securitization regulatory framework, including those that are included in the banking book for regulatory purposes, which are reported in section 21. 19.1.2Capital requirements relating to counterparty credit risk, which are reported in section 20.General information about credit risk: 19.2 The disclosure requirements under this section are: 19.2.1General information about credit risk: a. Table CRA - General qualitative information about credit risk b. Template CR1 - Credit quality of assets c. Template CR2 - Changes in stock of defaulted loans and debt securities d. Table CRB - Additional disclosure related to the credit quality of assets e. Table CRB-A - Additional disclosure related to prudential treatment of problem assets 19.2.2Credit risk mitigation: f. Table CRC - Qualitative disclosure related to credit risk mitigation techniques g. Template CR3 - Credit risk mitigation techniques – overview 19.2.3Credit risk under standardized approach: h. Table CRD - Qualitative disclosure on banks' use of external credit ratings under the standardised approach for credit risk i. Template CR4 - Standardised approach - Credit risk exposure and credit risk mitigation effects j. Template CR5 - Standardised approach - Exposures by asset classes and risk weights 19.2.4Credit risk under internal risk-based approaches. The disclosure requirements related in this section are not required to be completed by banks unless SAMA approve the bank to use the IRB approach.

Page Number 61 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 k. Table CRE - Qualitative disclosure related to internal ratings-based (IRB) models l. Template CR6 - IRB - Credit risk exposures by portfolio and probability of default (PD) range m. Template CR7 - IRB - Effect on RWA of credit derivatives used as credit risk mitigation (CRM) techniques n. Template CR8 - RWA flow statements of credit risk exposures under IRB o. Template CR9 - IRB - Backtesting of PD per portfolio p. Template CR10 - IRB (specialised lending and equities under the simple risk weight method)

Page Number 62 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CRA: General qualitative information about credit risk Purpose: Describe the main characteristics and elements of credit risk management (business model and credit risk profile, organization and functions involved in credit risk management, risk management reporting). Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must describe their risk management objectives and policies for credit risk, focusing in particular on: (a) How the business model translates into the components of the bank's credit risk profile (b) Criteria and approach used for defining credit risk management policy and for setting credit risk limits (c) Structure and organization of the credit risk management and control function (d) Relationships between the credit risk management, risk control, compliance and internal audit functions (e) Scope and main content of the reporting on credit risk exposure and on the credit risk management function to the executive management and to the board of directors

Page Number 63 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR1: Credit quality of assets Purpose: Provide a comprehensive picture of the credit quality of a bank's (on- and off-balance sheet) assets. Scope of application: The template is mandatory for all banks. Columns d, e and f are only applicable for banks that have adopted an ECL accounting model. Content: Carrying values (corresponding to the accounting values reported in financial statements but according to the scope of regulatory consolidation). Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks must include their definition of default in an accompanying narrative. a b c d e f g Gross carrying values of Allowances/ impairments Of which ECL accounting provisions for credit losses on SA exposures Of which ECL accounting provisions for credit losses on IRB exposures Net values Defaulted (a+b-c) exposures Non￾defaulted exposures Allocated in regulatory category of Specific Allocated in regulatory category of General 1 Loans 2 Debt Securities 3 Off-balance sheet exposures 4 Total Definitions Gross carrying values: on- and off-balance sheet items that give rise to a credit risk exposure according to the Basel framework. On-balance sheet items include loans and debt securities. Off-balance sheet items must be measured according to the following criteria: (a) guarantees given - the maximum amount that the bank would have to pay if the guarantee were called. The amount must be gross of any credit conversion factor (CCF) or credit risk mitigation (CRM) techniques. (b) Irrevocable loan commitments - total amount that the bank has committed to lend. The amount must be gross of any CCF or CRM techniques. Revocable loan commitments must not be included. The gross value is the accounting value before any allowance/impairments but after considering write-offs. Banks must not take into account any credit risk mitigation technique. Write-offs for the purpose of this template are related to a direct reduction of the carrying amount when the entity has no reasonable expectations of recovery. Defaulted exposures: banks should use the definition of default that they also use for regulatory purposes. Banks must provide this definition of default in the accompanying narrative. For a bank using the standardized approach for credit risk, the default exposures in Templates CR1 and CR2 should correspond to exposures that are "past due for more than 90 days", as stated in SCRE7.96. Non-defaulted exposures: any exposure not meeting the above definition of default. Allowances/impairments: are those that are considered "credit-impaired" in the meaning of IFRS 9 Appendix A. Accounting provisions for credit losses: total amount of provisions, made via an allowance against impaired and not impaired exposures according to the applicable accounting framework. For example, when the accounting framework is IFRS 9, "impaired exposures" are those that are considered "credit-impaired" in the meaning of IFRS 9 Appendix A. When the accounting framework is US GAAP, "impaired exposures" are those exposures for which credit losses are measured under ASC Topic 326 and for which the bank has recorded a partial write￾off/write-down. Banks must fill in column d to f in accordance with the categorization of accounting provisions distinguishing those meeting the conditions to be categorized in general provisions, as defined in SACAP2.2.3, and those that are categorized as specific provisions. This categorization must be consistent with information provided in Table CRB. Net values: Total gross value less allowances/impairments. Debt securities: Debt securities exclude equity investments subject to the credit risk framework. However, banks may add a row between rows 2 and 3 for "other investment" (if needed) and explain in the accompanying narrative. Linkages across templates Amount in [CR1:1/g] is equal to the sum [CR3:1/a] + [CR3:1/b]. Amount in [CR1:2/g] is equal to the sum [CR3:2/a] + [CR3:2/b]. Amount in [CR1:4/a] is equal to [CR2:6/a], only when (i) there is zero defaulted off-balance sheet exposure or SAMA has exercised its discretion to include off-balance sheet exposures in Template CR2.

Page Number 64 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CR2: Changes in stock of defaulted loans and debt securities a 1 Defaulted loans and debt securities at end of the previous reporting period 2 Loans and debt securities that have defaulted since the last reporting period 3 Returned to non-defaulted status 4 Amounts written off 5 Other changes 6 Defaulted loans and debt securities at end of the reporting period (1+2-3-4+5) Definitions Defaulted exposure: such exposures must be reported net of write-offs and gross of (ie ignoring) allowances/impairments. For a bank using the standardised approach for credit risk, the default exposures in Templates CR1 and CR2 should correspond to exposures that are "past due for more than 90 days", as stated in SCRE7.96. Loans and debt securities that have defaulted since the last reporting period: refers to any loan or debt securities that became marked as defaulted during the reporting period. Return to non-defaulted status: refers to loans or debt securities that returned to non-default status during the reporting period. Amounts written off: both total and partial write-offs. Other changes: balancing items that are necessary to enable total to reconcile. Purpose: Identify the changes in a bank's stock of defaulted exposures, the flows between non-defaulted and defaulted exposure categories and reductions in the stock of defaulted exposures due to write-offs. Scope of application: The template is mandatory for all banks. Content: Carrying values. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks should explain the drivers of any significant changes in the amounts of defaulted exposures from the previous reporting period and any significant movement between defaulted and non-defaulted loans. Banks should disclose in their accompanying narrative whether defaulted exposures include off-balance sheet items.

Page Number 65 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CRB: Additional disclosure related to the credit quality of assets Banks must provide the following disclosures: Qualitative disclosures (a) The scope and definitions of "past due" and "impaired" exposures used for accounting purposes and the differences, if any, between the definition of past due and default for accounting and regulatory purposes. When the accounting framework is IFRS 9, "impaired exposures" are those that are considered "credit-impaired" in the meaning of IFRS 9 Appendix A. (b) The extent of past-due exposures (more than 90 days) that are not considered to be impaired and the reasons for this. (c) Description of methods used for determining accounting provisions for credit losses. In addition, banks that have adopted an ECL accounting model must provide information on the rationale for categorisation of ECL accounting provisions in general and specific categories for standardised approach exposures. (d) The bank's own definition of a restructured exposure. Banks should disclose the definition of restructured exposures they use (which may be a definition from the local accounting or regulatory framework). Quantitative disclosures (e) Breakdown of exposures by geographical areas, industry and residual maturity. (f) Amounts of impaired exposures (according to the definition used by the bank for accounting purposes) and related accounting provisions, broken down by geographical areas and industry. (g) Ageing analysis of accounting past-due exposures. (h) Breakdown of restructured exposures between impaired and not impaired exposures. Purpose: Supplement the quantitative templates with information on the credit quality of a bank's assets. Scope of application: The table is mandatory for all banks. Content: Additional qualitative and quantitative information (carrying values). Frequency: Annual. Format: Flexible.

Page Number 66 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CRB-A – Additional disclosure related to prudential treatment of problem assets Purpose: To supplement the quantitative templates with additional information related to non-performing exposures and forbearance. Scope of application: The table is mandatory for banks. Content: Qualitative and quantitative information (carrying values corresponding to the accounting values reported in financial statements but according to the regulatory scope of consolidation) Frequency: Annual. Format: Flexible. Banks must provide the following disclosures: Qualitative disclosures a) The bank’s own definition of non-performing exposures. The bank should specify in particular if it is using the definition provided in the guidelines on prudential treatment of problem assets (hereafter in this table referred to as SAMA’s Rules on Management of Problem No. 41033343, January 2020. And provide a discussion on the implementation of its definition, including the materiality threshold used to categorise exposures as past due, the exit criteria of the non-performing category (providing information on a probation period, if relevant), together with any useful information for users’ understanding of this categorisation. This would include a discussion of any differences or unique processes for the categorisation of corporate and retail loans. b) The bank’s own definition of a forborne exposure. The bank should specify in particular if it is using the definition provided in the Guidelines and provide a discussion on the implementation of its definition, including the exit criteria of the restructured or forborne category (providing information on the probation period, if relevant), together with any useful information for users’ understanding of this categorisation. This would include a discussion of any differences or unique processes for the catagorisation of corporate and retail loans.4 Quantitative disclosures c) Gross carrying value of total performing as well as non-performing exposures, broken down first by debt securities, loans and off-balance sheet exposures. Loans should be further broken down by corporate and retail exposures. Non-performing exposures should in addition be split into (i) defaulted exposures and/or impaired exposures;5 (ii) exposures that are not defaulted/impaired exposures but are more than 90 days past due; and (iii) other exposures where there is evidence that full repayment is unlikely without the bank’s realisation of collateral (which would include exposures that are not defaulted/impaired and are not more than 90 days past due but for which payment is unlikely without the bank’s realisation of collateral, even if the exposures are not past due). Value adjustments and provisions6 or non-performing exposures should also be disclosed. d) Gross carrying values of restructured/forborne exposures broken down first by debt securities, loans and off-balance sheet exposures. Loans should be further broken down by corporate and retail exposures to enable an understanding of material differences in the level of risk among different portfolios (eg retail exposures secured by real estate/mortages, revolving exposures, SMEs, other retail). Exposures should, in addition, be split into performing and non-performing, and impaired and not impaired exposures. Value adjustments and provisions for non-performing exposures should also be disclosed.

4 Banks are allowed to (i) merge row (d) of Table CRB with row (b) of Table CRB-A and (ii) merge row (h) of Table CRB with row (d) of Table CRB-A if and only if the bank uses a common definition for restructured and forborne exposures. The bank should clarify in the disclosure that they are applying a common definition for restructured and forborne exposures. In such case, the bank should also specify in the accompanying narrative that it uses a common definition for restructured exposures and forborne exposures that therefore, information disclosed regarding requirements of row (b) and row (d) of Table CRB-A have been merged with the row (d) and row (h) of Table CRB, respectively. 5 When the accounting framework is IFRS 9, “impaired exposures” are those that are considered “credit￾impaired” in the meaning of IFRS 9 Appendix A. 6 Please refer to paragraph 33 of the Guidelines, where it is stated: “these value adjustments and provisions refer to both the allowance for credit losses and direct reductions of the outstanding of an exposure to reflect a decline in the counterparty’s creditworthiness”. For banks not applying the Guidelines, please refer to the definition of accounting provisions included in Template CR1, which is in line with paragraph 33 of the Guidelines.

Page Number 67 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Definitions Gross carrying values: on- and off-balance sheet items that give rise to a credit risk exposure according to the finalised Basel III framework. On-balance sheet items include loans and debt securities. Off-balance sheet items must be measured according to the following criteria: a) Guarantees given – the maximum amount that the bank would have to pay if the guarantee were called. The amount must be gross of any credit conversion factor (CCF) or credit risk mitigation (CRM) techniques. b) Irrevocable loan commitments – the total amount that the bank has committed to lend. The amount must be gross of any CCF or CRM techniques. Revocable loan commitments must not be included. The gross value is the accounting value before any allowance/impairments but after considering write-offs. Banks must not take into account any CRM technique.

Page Number 68 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CRC: Qualitative disclosure related to credit risk mitigation techniques Banks must disclose: (a) Core features of policies and processes for, and an indication of the extent to which the bank makes use of, on- and off-balance sheet netting. (b) Core features of policies and processes for collateral evaluation and management. (c) Information about market or credit risk concentrations under the credit risk mitigation instruments used (ie by guarantor type, collateral and credit derivative providers). Banks should disclose a meaningful breakdown of their credit derivative providers, and set the level of granularity of this breakdown in accordance with section 10. For instance, banks are not required to identify their derivative counterparties nominally if the name of the counterparty is considered to be confidential information. Instead, the credit derivative exposure can be broken down by rating class or by type of counterparty (eg banks, other financial institutions, non-financial institutions). Purpose: Provide qualitative information on the mitigation of credit risk. Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Flexible.

Page Number 69 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CR3: Credit risk mitigation techniques - overview a b c d e Exposures unsecured: carrying amount Exposures to be secured Exposures secured by collateral Exposures secured by financial guarantees Exposures secured by credit derivatives 1 Loans 2 Debt securities 3 Total 4 Of which defaulted Definitions Exposures unsecured- carrying amount: carrying amount of exposures (net of allowances/impairments) that do not benefit from a credit risk mitigation technique. Exposures to be secured: carrying amount of exposures which have at least one credit risk mitigation mechanism (collateral, financial guarantees, credit derivatives) associated with them. The allocation of the carrying amount of multi-secured exposures to their different credit risk mitigation mechanisms is made by order of priority, starting with the credit risk mitigation mechanism expected to be called first in the event of loss, and within the limits of the carrying amount of the secured exposures. Exposures secured by collateral: carrying amount of exposures (net of allowances/impairments) partly or totally secured by collateral. In case an exposure is secured by collateral and other credit risk mitigation mechanism(s), the carrying amount of the exposures secured by collateral is the remaining share of the exposure secured by collateral after consideration of the shares of the exposure already secured by other mitigation mechanisms expected to be called beforehand in the event of a loss, without considering overcollateralisation. Exposures secured by financial guarantees: carrying amount of exposures (net of allowances/impairments) partly or totally secured by financial guarantees. In case an exposure is secured by financial guarantees and other credit risk mitigation mechanism, the carrying amount of the exposure secured by financial guarantees is the remaining share of the exposure secured by financial guarantees after consideration of the shares of the exposure already secured by other mitigation mechanisms expected to be called beforehand in the event of a loss, without considering overcollateralisation. Purpose: Disclose the extent of use of credit risk mitigation techniques. Scope of application: The table is mandatory for all banks. Content: Carrying values. Banks must include all CRM techniques used to reduce capital requirements and disclose all secured exposures, irrespective of whether the standardised or IRB approach is used for RWA calculation. Please refer to section 28.3 for an illustration on how the template should be completed. Frequency: Semiannual. Format: Fixed. Where banks are unable to categorise exposures secured by collateral, financial guarantees or credit derivative into "loans" and "debt securities", they can either (i) merge two corresponding cells, or (ii) divide the amount by the pro-rata weight of gross carrying values; they must explain which method they have used. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes.

Page Number 70 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CRD: Qualitative disclosure on banks' use of external credit ratings under the standardised approach for credit risk A. For portfolios that are risk-weighted under the standardised approach for credit risk, banks must disclose the following information: (a) Names of the external credit assessment institutions (ECAIs); (b) The asset classes for which each ECAI is used; (c) A description of the process used to transfer the issuer to issue credit ratings onto comparable assets in the banking book (see SCRE8.16 to SCRE8.18); and (d) The alignment of the alphanumerical scale of each agency used with risk buckets (as per SAMA circular No. B.C.S 242, issued April 11, 2007). Purpose: Supplement the information on a bank's use of the standardised approach with qualitative data on the use of external ratings. Scope of application: The table is mandatory for all banks that: (a) use the credit risk standardised approach (or the simplified standardised approach); and (b) make use of external credit ratings for their RWA calculation. In order to provide meaningful information to users, the bank may choose not to disclose the information requested in the table if the exposures and RWA amounts are negligible. It is however required to explain why it considers the information not to be meaningful to users, including a description of the portfolios concerned and the aggregate total RWA these portfolios represent. Content: Qualitative information. Frequency: Annual. Format: Flexible.

Page Number 71 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR4: Standardised approach – credit risk exposure and credit risk mitigation (CRM) effects Purpose: To illustrate the effect of CRM (comprehensive and simple approach) on capital requirement calculations under the standardised approach for credit risk. RWA density provides a synthetic metric on the riskiness of each portfolio. Scope of application: The template is mandatory for banks using the standardised approach for credit risk. Subject to SAMA approval of the immateriality of the asset class, banks that intend to adopt a phased rollout of the IRB approach may apply the standardised approach to certain asset classes. In circumstances where exposures and RWA amounts subject to the standardised approach may be considered to be negligible, and disclosure of this information to users would not provide any meaningful information, the bank may choose not to disclose the template for the exposures treated under the standardised approach. The bank must, however, explain why it considers the information not to be meaningful to users. The explanation must include a description of the exposures included in the respective portfolios and the aggregate total of RWA from such exposures. Content: Regulatory exposure amounts Frequency: Semiannual. Format: Fixed. The columns and rows cannot be altered unless SAMA make policy changes to the asset classes as defined under the finalised Basel III framework. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. Banks should describe the sequence in which CCFs, provisioning and credit risk mitigation measures are applied. a b c d e f Exposures before CCF and CRM Exposures post-CCF and post￾CRM RWA and RWA density Asset classes On-balance sheet amount Off-balance sheet amount On-balance sheet amount Off-balance sheet amount RWA RWA density 1 Sovereigns and their central banks 2 Non-central government public sector entities 3 Multilateral development banks 4 Banks Of which: securities firms and other financial institutions 5 Covered bonds 6 Corporates Of which: securities firms and other financial institutions Of which: specialised lending 7 Subordinated debt, equity and other capital 8 Retail MSMEs 9 Real estate Of which: general RR Of which: IPRRE Of which: general CRE Of which: IPCR Of which: land acquisition, development and construction 10 Defaulted exposures 11 Other assets 12 Total

Page Number 72 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Definitions Rows: General residential real estate (General RRE): refers to regulatory residential real estate exposures that are not materially dependent on cash flows generated by the property as set out in SCRE7.74 and SCRE7.75, and any residential real estate exposures covered by SCRE7.81. Income-producing residential real estate (IPRRE): refers to regulatory residential real estate exposures that are materially dependent on cash flows generated by the property as set out in SCRE7.76, and any residential real estate exposures covered by SCRE7.81. General commercial real estate (General CRE): refers to regulatory commercial real estate exposures that are not materially dependent on cash flows generated by the property as set out in SCRE7.77 and SCRE7.78, and any commercial real estate exposures covered by SCRE7.81. Income-producing commercial real estate (IPCRE): refers to regulatory commercial real estate exposures that are materially dependent on cash flows generated by the property as set out in SCRE7.79 and any commercial real estate exposures covered by SCRE7.81. Land acquisition, development and construction: refers to exposures subject to the risk weights set out SCRE7.82 and SCRE7.83. Other assets: refers to assets subject to specific risk weight as set out in SCRE7.102. Columns: Exposures before credit conversion factors (CCF) and CRM - On-balance sheet amount: Banks must disclose the regulatory exposure amount (net of specific provisions, including partial write-offs) under the regulatory scope of consolidation gross of (ie before taking into account) the effect of CRM techniques. Exposures before CCF and CRM - Off-balance sheet amount: Banks must disclose the exposure value, gross of CCFs and the effect of CRM techniques under the regulatory scope of consolidation. Exposures post-CCF and post-CRM: This is the amount to which the capital requirements are applied. It is a net credit equivalent amount, after CRM techniques and CCF have been applied. RWA density: Total risk-weighted assets/exposures post-CCF and post-CRM (ie column (e) / (column (c) + column (d))), expressed as a percentage. Linkages across templates: Amount in [CR4:12/c] + [CR4:12/d] is equal to amount in [CR5: Exposure amounts and CCFs applied to off-balance sheet exposures, categorised based on risk bucket of converted exposures 11/d].

Page Number 73 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template CR5: Standardised approach - exposures by asset classes and risk weights Purpose: To present the breakdown of credit risk exposures under the standardised approach by asset class and risk weight (corresponding to the riskiness attributed to the exposure according to standardised approach). Scope of application: The template is mandatory for banks using the standardised approach. Subject to SAMA approval of the immateriality of the asset class, banks that intend to adopt a phased rollout of the internal ratings-based (IRB) approach may apply the standardised approach to certain asset classes. In circumstances where exposures and RWA amounts subject to the standardised approach may be considered to be negligible, and disclosure of this information would not provide any meaningful information to users, the bank may choose not to disclose the template for the exposures treated under the standardised approach. The bank must, however, explain why it considers the information not to be meaningful to users. The explanation must include a description of the exposures included in the respective portfolios and the aggregate total of RWA from such exposures. Content: Regulatory exposure amounts. Frequency: Semiannual. Format: Fixed. The columns and rows cannot be altered unless SAMA make policy changes to the asset classes as defined under the finalised Basel III framework. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. Banks should describe the sequence in which CCFs, provisioning and credit risk mitigation measures are applied. 0% 20% 50% 100% 150% Other Total credit exposure amount (post-CCF and post-CRM) 1 Sovereigns and their central banks 20% 50% 100% 150% Other Total credit exposure amount (post-CCF and post-CRM) 2 Non-central government public sector entities 0% 20% 30% 50% 100% 150% Other Total credit exposure amount (post-CCF and post-CRM) 3 Multilateral development banks 20% 50% 65% 75% 80% 85% 100% 130% 150% Other Total credit exposure amount (post-CCF and post-CRM) Corporates/including corporate SMEs 6 Of which: securities firms and other financial institutions 20% 30% 40% 50% 75% 100% 150% Other Total credit exposure amount (post-CCF and post-CRM) 4 Banks Of which: securities firms and other financial institutions 10% 15% 50% 20% 25% 50% 100% Other Total credit exposure amount (post-CCF and post-CRM) 5 Covered bonds

Page Number 74 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Of which: specialised lending 45% 75% 100% Other Total credit exposure amount (post-CCF and post-CRM) 8 Retail MSMEs9 0 % 20 % 25 % 30 % 35 % 40 % 45 % 50 % 60 % 65 % 70 % 75 % 85 % 90 % 100 % 105 % 110 % 150 % Ot her s Total credit exposure amount (post-CCF and post￾CRM) 9 Real estate Of which: general RRE Of which: no loan splitting applied Of which: loan splitting applied (secured) Of which: loan splitting applied (unsecured) Of which: IPRRE Of which: general CRE

7 The prohibition on the use of the IRB approach for equity exposures will be subject to a five-year linear phase-in arrangement from 1 January 2022 (please see SCRE17.1 and SCRE17.2). During this phase-in period, the risk weight for equity exposures will be the greater of: (i) the risk weight as calculated under the IRB approach, and (ii) the risk weight set for the linear phase-in arrangement under the standardised approach for credit risk. Alternatively, SAMA may require banks to apply the fully phased-in standardised approach treatment from the date of implementation of this standard. Accordingly, for disclosure purposes, banks that continue to apply the IRB approach during the phase-in period should report their equity exposures in either the 250% or the 400% column, according to whether the respective equity exposures are speculative unlisted equities or all other equities. 8 For disclosure purposes, banks that use the standardised approach for credit risk during the transitional period should report their equity exposures according to whether they would be classified as “other equity holdings” (250%) or “speculative unlisted equity” (400%). Risk weights disclosed for “speculative unlisted equity exposures” and “other equity holdings” should reflect the actual risk weights applied to these exposures in a particular year (please refer to the respective transitional arrangements set out in SCRE17.1) 9 Defined as per SAMA circular No.381000094106 dated 06/09/1438. 100% 150% 250%7 400%7 Other Total credit exposure amount (post-CCF and post-CRM) 7 Subordinated debt, equity and other capital8

Page Number 75 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Of which: no loan splitting applied Of which: loan splitting applied (secured) Of which: loan splitting applied (unsecured) Of which: IPCRE Of which: land acquisition, development and construction 50% 100% 150% Other Total credit exposure amount (post-CCF and post-CRM) 10 Defaulted exposures 0% 20% 100% 1250% Other Total credit exposure amount (post-CCF and post-CRM) 11 Other assets Exposure amounts and CCFs applied to off-balance sheet exposures, categorised based on risk bucket of converted exposures Risk weight a b cd On-balance sheet exposure Off-balance sheet exposure (pre-CCF) Weighted average CCF*Exposure (post-CCF and post-CRM) 1 Less than 40% 2 40-70% 3 75% 4 85% 5 90-100% 6 105-130% 7 150% 8 250% 9 400% 10 1,250% 11 Total exposures

• Weighting is based on off-balance sheet exposure (pre-CCF).

Page Number 76 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions Loan splitting: refers to the approaches set out in SCRE7.75 and SCRE7.78. Total credit exposure amount (post-CCF and post-CRM): the amount used for the capital requirements calculation (for both on- and off-balance sheet amounts), therefore net of specific provisions (including partial write-offs) and after CRM techniques and CCF have been applied but before the application of the relevant risk weights. Defaulted exposures: correspond to the unsecured portion of any loan past due for more than 90 days or represent an exposure to a defaulted borrower, as defined in SCRE7.96. Other assets: refers to assets subject to specific risk weighting as set out in SCRE7.102.

Page Number 77 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template CRE: Qualitative disclosure related to IRB models Purpose: Provide additional information on IRB models used to compute RWA. Scope of application: he table is mandatory for banks using A-IRB or F-IRB approaches for some or all of their exposures. To provide meaningful information to users, the bank must describe the main characteristics of the models used at the group-wide level (according to the scope of regulatory consolidation) and explain how the scope of models described was determined. The commentary must include the percentage of RWA covered by the models for each of the bank's regulatory portfolios. Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must provide the following information on their use of IRB models: (a) Internal model development, controls and changes: role of the functions involved in the development, approval and subsequent changes of the credit risk models. (b) Relationships between risk management function and internal audit function and procedure to ensure the independence of the function in charge of the review of the models from the functions responsible for the development of the models. (c) Scope and main content of the reporting related to credit risk models. (d) Scope of the supervisor's acceptance of approach. The "scope of the supervisor's acceptance of approach" refers to the scope of internal models approved by SAMA in terms of entities within the group (if applicable), portfolios and exposure classes, with a breakdown between foundation IRB (F-IRB) and advanced IRB (A-IRB), if applicable. (e) For each of the portfolios, the bank must indicate the part of EAD within the group (in percentage of total EAD) covered by standardised, F-IRB and A-IRB approach and the part of portfolios that are involved in a roll-out plan. (f) The number of key models used with respect to each portfolio, with a brief discussion of the main differences among the models within the same portfolios. (g) Description of the main characteristics of the approved models: (i) definitions, methods and data for estimation and validation of PD (eg how PDs are estimated for low default portfolios; if there are regulatory floors; the drivers for differences observed between PD and actual default rates at least for the last three periods); and where applicable: (ii) LGD (eg methods to calculate downturn LGD; how LGDs are estimated for low default portfolio; the time lapse between the default event and the closure of the exposure); (iii) credit conversion factors, including assumptions employed in the derivation of these variables;

Page Number 78 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template CR6: IRB - Credit risk exposures by portfolio and PD range Purpose: Provide main parameters used for the calculation of capital requirements for IRB models. The purpose of disclosing these parameters is to enhance the transparency of banks' RWA calculations and the reliability of regulatory measures. Scope of application: The template is mandatory for banks using either the F-IRB or the A-IRB approach for some or all of their exposures. Content: Columns (a) and (b) are based on accounting carrying values and columns (c) to (l) are regulatory values. All are based on the scope of regulatory consolidation. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative to explain the effect of credit derivatives on RWAs. PD scale a b c d e f g h i j k l Original on-balance sheet gross exposure Off￾balance sheet exposures pre CCF Average CCF EAD post CRM and post￾CCF Average PD Number of obligors Average LGD Average maturity RWA RWA density EL Provisions Portfolio X 0.00 to <0.15 0.15 to <0.25 0.25 to <0.50 0.50 to <0.75 0.75 to <2.50 2.50 to <10.00 10.00 to <100.00 100.00 (Default) Sub-total Total (all portfolios)

Page Number 79 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions Rows Portfolio X includes the following prudential portfolios for the FIRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate; (iv) Corporate - Specialised Lending; (v) Purchased receivables, and the following prudential portfolios for the AIRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate; (iv) Corporate - Specialised Lending; (v) Retail - qualifying revolving (QRRE); (vi) Retail - Residential mortgage exposures; (vii) Retail - SME; (viii) Other retail exposures; (ix) Purchased receivables. Information on F-IRB and A-IRB portfolios, respectively, must be reported in two separate templates. Default: The data on defaulted exposures may be further broken down according to SAMA’s definitions for categories of defaulted exposures. Columns PD scale: Exposures shall be broken down according to the PD scale used in the template instead of the PD scale used by banks in their RWA calculation. Banks must map the PD scale they use in the RWA calculations into the PD scale provided in the template. Original on-balance sheet gross exposure: amount of the on-balance sheet exposure gross of accounting provisions (before taking into account the effect of credit risk mitigation techniques). Off-balance sheet exposure pre conversion factor: exposure value without taking into account value adjustments and provisions, conversion factors and the effect of credit risk mitigation techniques. Average CCF: EAD post-conversion factor for off-balance sheet exposure to total off-balance sheet exposure preconversion factor. EAD post-CRM: the amount relevant for the capital requirements calculation. Number of obligors: corresponds to the number of individual PDs in this band. Approximation (round number) is acceptable. Average PD: obligor grade PD weighted by EAD. Average LGD: the obligor grade LGD weighted by EAD. The LGD must be net of any CRM effect. Average maturity: the obligor maturity in years weighted by EAD; this parameter needs to be filled in only when it is used for the RWA calculation. RWA density: Total risk-weighted assets to EAD post-CRM. EL: the expected losses as calculated according to SCRE13.8 to SCRE13.12 and SCRE15.2 to SCRE15.3. Provisions: provisions calculated according to SCRE15.4.

Page Number 80 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR7: IRB - Effect on RWA of credit derivatives used as CRM techniques Purpose: Illustrate the effect of credit derivatives on the IRB approach capital requirements' calculations. The pre-credit derivatives RWA before taking account of credit derivatives mitigation effect has been selected to assess the impact of credit derivatives on RWA. This is irrespective of how the CRM technique feeds into the RWA calculation. Scope of application: The template is mandatory for banks using the A-IRB and/or F-IRB approaches for some or all of their exposures. Content: Risk-weighted assets (subject to credit risk treatment). Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks should supplement the template with a narrative commentary to explain the effect of credit derivatives on the bank's RWAs. a b Pre-credit derivatives RWA Actual RWA 1 Sovereign - F-IRB 2 Sovereign - A-IRB 3 Banks - F-IRB 4 Banks - A-IRB 5 Corporate - F-IRB 6 Corporate - A-IRB 7 Specialised lending - F-IRB 8 Specialised lending - A-IRB 9 Retail - qualifying revolving (QRRE) 10 Retail - residential mortgage exposures 11 Retail -MSMEs 12 Other retail exposures 13 Equity - F-IRB 14 Equity - A-IRB 15 Purchased receivables - F-IRB 16 Purchased receivables - A-IRB 17 Total Pre-credit derivatives RWA: hypothetical RWA calculated assuming the absence of recognition of the credit derivative as a CRM technique. Actual RWA: RWA calculated taking into account the CRM technique impact of the credit derivative.

Page Number 81 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR8: RWA flow statements of credit risk exposures under IRB Purpose: Present a flow statement explaining variations in the credit RWA determined under an IRB approach. Scope of application: The template is mandatory for banks using the A-IRB and/or F-IRB approaches. Content: Risk-weighted assets corresponding to credit risk only (counterparty credit risk excluded). Changes in RWA amounts over the reporting period for each of the key drivers should be based on a bank's reasonable estimation of the figure. Frequency: Quarterly. Format: Fixed. Columns and rows 1 and 9 cannot be altered. Banks may add additional rows between rows 7 and 8 to disclose additional elements that contribute significantly to RWA variations. Accompanying narrative: Banks should supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. a RWA amounts 1 RWA as at end of previous reporting period 2 Asset size 3 Asset quality 4 Model updates 5 Methodology and policy 6 Acquisitions and disposals 7 Foreign exchange movements 8 Other 9 RWA as at end of reporting period Asset size: organic changes in book size and composition (including origination of new businesses and maturing loans) but excluding changes in book size due to acquisitions and disposal of entities. Asset quality: changes in the assessed quality of the bank's assets due to changes in borrower risk, such as rating grade migration or similar effects. Model updates: changes due to model implementation, changes in model scope, or any changes intended to address model weaknesses. Methodology and policy: changes due to methodological changes in calculations driven by regulatory policy changes, including both revisions to existing regulations and new regulations. Acquisitions and disposals: changes in book sizes due to acquisitions and disposal of entities. Foreign exchange movements: changes driven by market movements such as foreign exchange movements. Other: this category must be used to capture changes that cannot be attributed to any other category. Banks should add additional rows between rows 7 and 8 to disclose other material drivers of RWA movements over the reporting period.

Page Number 82 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR9: IRB - Backtesting of probability of default (PD) per portfolio Purpose: Provide backtesting data to validate the reliability of PD calculations. In particular, the template compares the PD used in IRB capital calculations with the effective default rates of bank obligors. A minimum five-year average annual default rate is required to compare the PD with a "more stable" default rate, although a bank may use a longer historical period that is consistent with its actual risk management practices. Scope of application: he template is mandatory for banks using the A-IRB and/or F-IRB approaches. Where a bank makes use of a F-IRB approach for certain exposures and an A-IRB approach for others, it must disclose two separate sets of portfolio breakdown in separate templates. To provide meaningful information to users on the backtesting of their internal models through this template, the bank must include in this template the key models used at the group-wide level (according to the scope of regulatory consolidation) and explain how the scope of models described was determined. The commentary must include the percentage of RWA covered by the models for which backtesting results are shown here for each of the bank's regulatory portfolios. The models to be disclosed refer to any model, or combination of models, approved SAMA, for the generation of the PD used for calculating capital requirements under the IRB approach. This may include the model that is used to assign a risk rating to an obligor, and/or the model that calibrates the internal ratings to the PD scale. Content: Modelling parameters used in IRB calculation. Frequency: Annual. Format: Flexible. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. Banks may wish to supplement the template when disclosing the amount of exposure and the number of obligors whose defaulted exposures have been cured in the year. a b c d e f g h i Portfolio X* PD Range External rating equivalent Weighted average PD Arithmetic average PD by obligors Number of obligors Defaulted obligors in the year of which: new defaulted obligors in the year Average historical annual default rate End of previous year End of the year

• The dimension Portfolio X includes the following prudential portfolios for the F-IRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate; (iv) Corporate - Specialised lending; (v) Purchased receivables, and the following prudential portfolios for the A-IRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate; (iv) Corporate - Specialised Lending; (v) Retail - QRRE; (vi) Retail - Residential mortgage exposures; (vii) Retail - SME; (viii) Other retail exposures; (ix) Purchased receivables. External rating equivalent: refers to external ratings that may be available for retail borrowers. This may, for instance, be the case for small or medium￾sized entities (SMEs) that fit the requirements to be included in the retail portfolios which could have an external rating, or a credit score or a range of credit scores provided by a consumer credit bureau. One column has to be filled in for each rating agency authorised for prudential purposes in the jurisdictions where the bank operates. However, where such external ratings are not available, they need not be provided. Weighted average PD: the same as reported in Template CR6. These are the estimated PDs assigned by the internal model authorised under the IRB approaches. The PD values are EAD-weighted and the "weight" is the EAD at the beginning of the period. Arithmetic average PD by obligors: PD within range by number of obligor within the range. The average PD by obligors is the simple average: Arithmetic average PD = sum of PDs of all accounts (transactions) / number of accounts. Number of obligors: two sets of information are required: (i) the number of obligors at the end of the previous year; (ii) the number of obligors at the end of the year subject to reporting; Defaulted obligors in the year: number of defaulted obligors during the year; of which: new obligors defaulted in the year: number of obligors having defaulted during the last 12-month period that were not funded at the end of the previous financial year; Average historical annual default rate: the five-year average of the annual default rate (obligors at the beginning of each year that are defaulted during that year/total obligor hold at the beginning of the year) is a minimum. The bank may use a longer historical period that is consistent with the bank's actual risk management practices. The disclosed average historical annual default rate disclosed should be before the application of the margin of conservatism.

Page Number 83 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR10: IRB (specialised lending under the slotting approach) Purpose: To provide quantitative disclosures of banks’ specialised lending exposures using the supervisory slotting approach. Scope of application: The template is mandatory for banks using the supervisory slotting approach. The breakdown by regulatory categories included in the template is indicative, as the data included in the template are provided by banks according to applicable domestic regulation. Content: Carrying values, exposure amounts and RWA Frequency: Semiannual. Format: Flexible. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. Specialised lending Other than HVCRE Regulatory categories Residual maturity On￾balance sheet amount Off￾balance sheet amount RW Exposure amount RWA Expected losses PF OF CF IPRE Total Strong Less than 2.5 years 50% Equal to or more than 2.5 years 70% Good Less than 2.5 years 70% Equal to or more than 2.5 years 90% Satisfactory 115% Weak 250% Default - Total HVCRE Regulatory categories Residual maturity On￾balance sheet amount Off￾balance sheet amount RW Exposure amount RWA Expected losses Strong Less than 2.5 years 70% Equal to or more than 2.5 years 95% Good Less than 2.5 years 95% Equal to or more than 2.5 years 120% Satisfactory 140% Weak 250% Default - Total

Page Number 84 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Definitions HVCRE: high-volatility commercial real estate. On-balance sheet amount: banks must disclose the amount of exposure (net of allowances and write-offs) under the regulatory scope of consolidation. Off-balance sheet amount: banks must disclose the exposure value without taking into account conversion factors and the effect of credit risk mitigation techniques. Exposure amount: the amount relevant for the capital requirement’s calculation, therefore after CRM techniques and CCF have been applied. Expected losses: amount of expected losses calculated according to SCRE13.8 to SCRE13.12. PF: project finance.PF: project finance. OF: object finance. CF: commodities finance. IPRRE: income-producing residential real estate.

Page Number 85 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 20. Counterparty credit risk: 20.1 This section includes all exposures in the banking book and trading book that are subject to a counterparty credit risk charge, including the charges applied to exposures to central counterparties (CCPs).10 20.2 The disclosure requirements under this section are: 20.2.1Table CCRA – Qualitative disclosure related to CCR 20.2.2Template CCR1 – Analysis of CCR exposures by approach 20.2.3Template CCR3 – Standardised approach – CCR exposures by regulatory portfolio and risk weights 20.2.4Template CCR4 – IRB – CCR exposures by portfolio and probability-of￾default (PD) scale 20.2.5Template CCR5 – Composition of collateral for CCR exposures 20.2.6Template CCR6 – Credit derivatives exposures 20.2.7Template CCR7 – RWA flow statements of CCR exposures under the internal models method (IMM) 20.2.8Template CCR8 – Exposures to central counterparties

10 The relevant sections of the Basel framework are in SCCR3 to SCCR9 and SCCR11.

Page Number 86 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table CCRA: Qualitative disclosure related to CCR Purpose: Describe the main characteristics of counterparty credit risk management (eg operating limits, use of guarantees and other credit risk mitigation (CRM) techniques, impacts of own credit downgrading). Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must provide risk management objectives and policies related to counterparty credit risk, including: (a) The method used to assign the operating limits defined in terms of internal capital for counterparty credit exposures and for CCP exposures; (b) Policies relating to guarantees and other risk mitigants and assessments concerning counterparty risk, including exposures towards CCPs; (c) Policies with respect to wrong-way risk exposures; (d) The impact in terms of the amount of collateral that the bank would be required to provide given a credit rating downgrade.

Page Number 87 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR1: Analysis of CCR exposures by approach Purpose: Provide a comprehensive view of the methods used to calculate counterparty credit risk regulatory requirements and the main parameters used within each method. Scope of application: The template is mandatory for all banks. Content: Regulatory exposures, RWA and parameters used for RWA calculations for all exposures subject to the counterparty credit risk framework (excluding CVA charges or exposures cleared through a CCP). Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f Replacement cost Potential future exposure Effective EPE Alpha used for computing regulatory EAD EAD post￾CRM RWA 1 SA-CCR (for derivatives) 1.4 2 Internal Model Method (for derivatives and SFTs) 3 Simple Approach for credit risk mitigation (for SFTs) 4 Comprehensive Approach for credit risk mitigation (for SFTs) 5 Value-at-risk (VaR) for SFTs 6 Total Definitions SA-CCR (for derivatives): Banks should report SA-CCR in row 1. Replacement Cost (RC): For trades that are not subject to margining requirements, the RC is the loss that would occur if a counterparty were to default and was closed out of its transactions immediately. For margined trades, it is the loss that would occur if a counterparty were to default at present or at a future date, assuming that the closeout and replacement of transactions occur instantaneously. However, closeout of a trade upon a counterparty default may not be instantaneous. The replacement cost under the standardised approach for measuring counterparty credit risk exposures is described in SCCR6. Potential Future Exposure is any potential increase in exposure between the present and up to the end of the margin period of risk. The potential future exposure for the standardised approach is described in SCCR3. Effective Expected Positive Exposure (EPE) is the weighted average over time of the effective expected exposure over the first year, or, if all the contracts in the netting set mature before one year, over the time period of the longest-maturity contract in the netting set where the weights are the proportion that an individual expected exposure represents of the entire time interval (see SCCR3). EAD post-CRM: exposure at default. This refers to the amount relevant for the capital requirements calculation having applied CRM techniques, credit valuation adjustments according to SCCR5.10 and specific wrong-way adjustments (see SCCR7).

Page Number 88 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR3: Standardised approach - CCR exposures by regulatory portfolio and risk weights Purpose: Provide a breakdown of counterparty credit risk exposures calculated according to the standardised approach: by portfolio (type of counterparties) and by risk weight (riskiness attributed according to standardised approach). Scope of application: The template is mandatory for all banks using the credit risk standardised approach to compute RWA for counterparty credit risk exposures, irrespective of the CCR approach used to determine exposure at default. If a bank deems that the information requested in this template is not meaningful to users because the exposures and RWA amounts are negligible, the bank may choose not to disclose the template. The bank is, however, required to explain in a narrative commentary why it considers the information not to be meaningful to users, including a description of the exposures in the portfolios concerned and the aggregate total of RWAs amount from such exposures. Content: Credit exposure amounts. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g h i Risk weight*→ Regulatory portfolio*↓ 0% 10% 20% 50% 75% 100% 150% Others Total credit exposure Sovereigns Non-central government public sector entities Multilateral development banks Banks Securities firms Corporates Regulatory retail portfolios Other assets Total *The breakdown by risk weight and regulatory portfolio included in the template is for illustrative purposes. Banks may complete the template with the breakdown of asset classes according to the local implementation of the Basel framework. Total credit exposure: the amount relevant for the capital requirements calculation, having applied CRM techniques. Other assets: the amount excludes exposures to CCPs, which are reported in Template CCR8.

Page Number 89 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR4: IRB - CCR exposures by portfolio and PD scale Purpose: Provide all relevant parameters used for the calculation of counterparty credit risk capital requirements for IRB models. Scope of application: The template is mandatory for banks using an advanced IRB (A-IRB) or foundation IRB (F-IRB) approach to compute RWA for counterparty credit risk exposures, whatever CCR approach is used to determine exposure at default. Where a bank makes use of an FIRB approach for certain exposures and an AIRB approach for others, it must disclose two separate sets of portfolio breakdown in two separate templates. To provide meaningful information, the bank must include in this template the key models used at the group-wide level (according to the scope of regulatory consolidation) and explain how the scope of models described in this template was determined. The commentary must include the percentage of RWAs covered by the models shown here for each of the bank's regulatory portfolios. Content: RWA and parameters used in RWA calculations for exposures subject to the counterparty credit risk framework (excluding CVA charges or exposures cleared through a CCP) and where the credit risk approach used to compute RWA is an IRB approach. Frequency: Semiannual. Format: Fixed. Columns and PD scales in the rows are fixed. However, the portfolio breakdown shown in the rows will be set by SAMA to reflect the exposure categories required under local implementations of IRB approaches. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g PD scale EAD post-CRM average PD Number of obligors Average LGD Average maturity RWA RWA density Portfolio X 0.00 to <0.15 0.15 to <0.25 0.25 to <0.50 0.50 to <0.75 0.75 to <2.50 2.50 to <10.00 10.00 to <100.00 100.00 (Default) Sub-total Total (sum of portfolios) Definitions Rows Portfolio X refers to the following prudential portfolios for the FIRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate; and the following prudential portfolios for the AIRB approach: (i) Sovereign; (ii) Banks; (iii) Corporate. The information on FIRB and AIRB portfolios must be reported in separate templates. Default: The data on defaulted exposures may be further broken down according to a SAMA’s definitions for categories of defaulted exposures. Columns PD scale: Exposures shall be broken down according to the PD scale used in the template instead of the PD scale used by banks in their RWA calculation. Banks must map the PD scale they use in the RWA calculations to the PD scale provided in the template; EAD post-CRM: exposure at default. The amount relevant for the capital requirements calculation, having applied the CCR approach and CRM techniques, but gross of accounting provisions; Number of obligors: corresponds to the number of individual PDs in this band. Approximation (round number) is acceptable; Average PD: obligor grade PD weighted by EAD; Average loss-given-default (LGD): the obligor grade LGD weighted by EAD. The LGD must be net of any CRM effect; Average maturity: the obligor maturity weighted by EAD; RWA density: Total RWA to EAD post-CRM.

Page Number 90 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR5: Composition of collateral for CCR exposure Purpose: Provide a breakdown of all types of collateral posted or received by banks to support or reduce the counterparty credit risk exposures related to derivative transactions or to SFTs, including transactions cleared through a CCP. Scope of application: The template is mandatory for all banks. Content: Carrying values of collateral used in derivative transactions or SFTs, whether or not the transactions are cleared through a CCP and whether or not the collateral is posted to a CCP. Please refer to section 29.1 for an illustration on how the template should be completed. Frequency: Semiannual. Format: Flexible (the columns cannot be altered but the rows are flexible). Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f Collateral used in derivative transactions Collateral used in SFTs Fair value of collateral received Fair value of posted collateral Fair value of collateral received Fair value of posted Segregated Unsegregated Segregated Unsegregated collateral Cash - domestic currency Cash - other currencies Domestic sovereign debt Other sovereign debt Government agency debt Corporate bonds Equity securities Other collateral Total Definitions Collateral used is defined as referring to both legs of the transaction. Example: a bank transfers securities to a third party, and the third party in turn posts collateral to the bank. The bank reports both legs of the transaction. The collateral received is reported in column (e), while the collateral posted by the bank is reported in column (f). The fair value of collateral received or posted must be after any haircut. This means the value of collateral received will be reduced by the haircut (ie C(1 - Hs)) and collateral posted will be increased after the haircut (ie E(1 + Hs)). Segregated refers to collateral which is held in a bankruptcy-remote manner according to the description included in SCCR8.18 to SCCR8.23. Unsegregated refers to collateral that is not held in a bankruptcy-remote manner. Domestic sovereign debt refers to the sovereign debt of the jurisdiction of incorporation of the bank, or, when disclosures are made on a consolidated basis, the jurisdiction of incorporation of the parent company. Domestic currency refers to items of collateral that are denominated in the bank's (consolidated) reporting currency and not the transaction currency.

Page Number 91 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR6: Credit derivatives exposures Purpose: Illustrate the extent of a bank's exposures to credit derivative transactions broken down between derivatives bought or sold. Scope of application: This template is mandatory for all banks. Content: Notional derivative amounts (before any netting) and fair values. Frequency: Semiannual. Format: Flexible (the columns are fixed but the rows are flexible). Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b Protection bought Protection sold Notionals Single-name credit default swaps Index credit default swaps Total return swaps Credit options Other credit derivatives Total notionals Fair values Positive fair value (asset) Negative fair value (liability)

Page Number 92 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR7: RWA flow statements of CCR exposures under Internal Model Method (IMM) Purpose: Present a flow statement explaining changes in counterparty credit risk RWA determined under the Internal Model Method for counterparty credit risk (derivatives and SFTs). Scope of application: The template is mandatory for all banks using the IMM for measuring exposure at default of exposures subject to the counterparty credit risk framework, irrespective of the credit risk approach used to compute RWA from exposures at default. Content: Risk-weighted assets corresponding to counterparty credit risk (credit risk shown in Template CR8 is excluded). Changes in RWA amounts over the reporting period for each of the key drivers should be based on a bank's reasonable estimation of the figure. Frequency: Quarterly. Format: Fixed. Columns and rows 1 and 9 are fixed. Banks may add additional rows between rows 7 and 8 to disclose additional elements that contribute to RWA variations. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. a Amounts 1 RWA as at end of previous reporting period 2 Asset size 3 Credit quality of counterparties 4 Model updates (IMM only) 5 Methodology and policy (IMM only) 6 Acquisitions and disposals 7 Foreign exchange movements 8 Other 9 RWA as at end of current reporting period Asset size: organic changes in book size and composition (including origination of new businesses and maturing exposures) but excluding changes in book size due to acquisitions and disposal of entities. Credit quality of counterparties: changes in the assessed quality of the bank's counterparties as measured under the credit risk framework, whatever approach the bank uses. This row also includes potential changes due to IRB models when the bank uses an IRB approach. Model updates: changes due to model implementation, changes in model scope, or any changes intended to address model weaknesses. This row addresses only changes in the IMM model. Methodology and policy: changes due to methodological changes in calculations driven by regulatory policy changes, such as new regulations (only in the IMM model). Acquisitions and disposals: changes in book sizes due to acquisitions and disposal of entities. Foreign exchange movements: changes driven by changes in FX rates. Other: this category is intended to be used to capture changes that cannot be attributed to the above categories. Banks should add additional rows between rows 7 and 8 to disclose other material drivers of RWA movements over the reporting period.

Page Number 93 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR8: Exposures to central counterparties Purpose: Provide a comprehensive picture of the bank's exposures to central counterparties. In particular, the template includes all types of exposures (due to operations, margins, contributions to default funds) and related capital requirements. Scope of application: The template is mandatory for all banks. Content: Exposures at default and risk-weighted assets corresponding to exposures to central counterparties. Frequency: Semiannual. Format: Fixed. Banks are requested to provide a breakdown of the exposures by central counterparties (qualifying, as defined below, or not qualifying). Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b EAD (post-CRM) RWA 1 Exposures to QCCPs (total) 2 Exposures for trades at QCCPs (excluding initial margin and default fund contributions); of which 3 (i) OTC derivatives 4 (ii) Exchange-traded derivatives 5 (iii) Securities financing transactions 6 (iv) Netting sets where cross-product netting has been approved 7 Segregated initial margin 8 Non-segregated initial margin 9 Pre-funded default fund contributions 10 Unfunded default fund contributions 11 Exposures to non-QCCPs (total) 12 Exposures for trades at non-QCCPs (excluding initial margin and default fund contributions); of which 13 (i) OTC derivatives 14 (ii) Exchange-traded derivatives 15 (iii) Securities financing transactions 16 (iv) Netting sets where cross-product netting has been approved 17 Segregated initial margin 18 Non-segregated initial margin 19 Pre-funded default fund contributions 20 Unfunded default fund contributions Definitions Exposures to central counterparties: This includes any trades where the economic effect is equivalent to having a trade with the CCP (eg a direct clearing member acting as an agent or a principal in a client-cleared trade). These trades are described in SCCR8.7 to SCCR8.23. EAD post-CRM: exposure at default. The amount relevant for the capital requirements calculation, having applied CRM techniques, credit valuation adjustments according to SCCR5.10 and specific wrong-way adjustments (see SCCR7).

Page Number 94 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 A qualifying central counterparty (QCCP) is an entity that is licensed to operate as a CCP (including a licence granted by way of confirming an exemption), and is permitted by the appropriate regulator/overseer to operate as such with respect to the products offered. This is subject to the provision that the CCP is based and prudentially supervised in a jurisdiction where the relevant regulator/overseer has established, and publicly indicated, that it applies to the CCP on an ongoing basis, domestic rules and regulations that are consistent with the Committee on Payments and Market Infrastructures and International Organization of Securities Commissions' Principles for Financial Market Infrastructures. See SCCR8 for the comprehensive definition and associated criteria. Initial margin means a clearing member's or client's funded collateral posted to the CCP to mitigate the potential future credit exposure of the CCP to the clearing member arising from the possible future change in the value of their transactions. For the purposes of this template, initial margin does not include contributions to a CCP for mutualised loss-sharing arrangements (ie in cases where a CCP uses initial margin to mutualise losses among the clearing members, it will be treated as a default fund exposure). Prefunded default fund contributions are prefunded clearing member contributions towards, or underwriting of, a CCP's mutualised loss-sharing arrangements. Unfunded default fund contributions are unfunded clearing member contributions towards, or underwriting of, a CCP's mutualised loss-sharing arrangements. If a bank is not a clearing member but a client of a clearing member, it should include its exposures to unfunded default fund contributions if applicable. Otherwise, banks should leave this row empty and explain the reason in the accompanying narrative. Segregated refers to collateral which is held in a bankruptcy-remote manner according to the description included in SCCR8.18 to SCCR8.23. Unsegregated refers to collateral that is not held in a bankruptcy-remote manner.

Page Number 95 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 21. Securitisation: 21.1 This chapter describes the disclosure requirements applying to securitisation exposures. 21.2 The scope of this section: 11 21.2.1Covers all securitisation exposures12 in Table SECA and in templates SEC1 and SEC2; 21.2.2Focuses on banking book securitisation exposures subject to capital charges according to the securitisation framework in templates SEC3 and SEC4; and 21.2.3Excludes capital charges related to securitisation positions in the trading book that are reported in section 22. 21.3 Only securitisation exposures that the bank treats under the securitisation framework (SCRE18 to SCRE22) are disclosed in templates SEC3 and SEC4. For banks acting as originators, this implies that the criteria for risk transfer recognition as described in SCRE18.24 to SCRE18.29 are met. Conversely, all securitisation exposures, including those that do not meet the risk transfer recognition criteria, are reported in templates SEC1 and SEC2. As a result, templates SEC1 and SEC2 may include exposures that are subject to capital requirements according to both the credit risk and market risk frameworks and that are also included in other parts of the Pillar 3 report. The purpose is to provide a comprehensive view of banks' securitisation activities. There is no double￾counting of capital requirements as templates SEC3 and SEC4 are limited to exposures subject to the securitisation framework. 21.4 The disclosure requirements under this section are: 21.4.1Table SECA – Qualitative disclosure requirements related to securitisation exposures

11 Unless stated otherwise, all terms used in section 21 are used consistently with the definitions in SCRE18. 12 Securitisation refers to the definition of what constitutes a securitisation under the Basel framework. Securitisation exposures correspond to securitisation exposures as defined in the Basel framework. According to this framework, securitisation exposures can include, but are not restricted to, the following: asset-backed securities, mortgage-backed securities, credit enhancements, liquidity facilities, interest rate or currency swaps, credit derivatives and tranched cover as described in SCRE9. Reserve accounts, such as cash collateral accounts, recorded as an asset by the originating bank must also be treated as securitisation exposures. Securitisation exposures refer to retained or purchased exposures and not to underlying pools.

Page Number 96 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 21.4.2Template SEC1 – Securitisation exposures in the banking book 21.4.3Template SEC2 – Securitisation exposures in the trading book 21.4.4Template SEC3 – Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor 21.4.5Template SEC4 – Securitisation exposures in the banking book and associated capital requirements – bank acting as investor

Page Number 97 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table SECA: Qualitative disclosure requirements related to securitisation exposures Purpose: Provide qualitative information on a bank's strategy and risk management with respect to its securitisation activities. Scope of application: The table is mandatory for all banks with securitisation exposures. Content: Qualitative information. Frequency: Annually. Format: Flexible. Qualitative disclosures (A) Banks must describe their risk management objectives and policies for securitisation activities and main features of these activities according to the framework below. If a bank holds securitisation positions reflected both in the regulatory banking book and in the regulatory trading book, the bank must describe each of the following points by distinguishing activities in each of the regulatory books. (a) The bank's objectives in relation to securitisation and re-securitisation activity, including the extent to which these activities transfer credit risk of the underlying securitised exposures away from the bank to other entities, the type of risks assumed and the types of risks retained. (b) The bank must provide a list of:  special purpose entities (SPEs) where the bank acts as sponsor (but not as an originator such as an Asset Backed Commercial Paper (ABCP) conduit), indicating whether the bank consolidates the SPEs into its scope of regulatory consolidation. A bank would generally be considered a "sponsor" if it, in fact or in substance, manages or advises the programme, places securities into the market, or provides liquidity and/or credit enhancements. The programme may include, for example, ABCP conduit programmes and structured investment vehicles.  affiliated entities (i) that the bank manages or advises and (ii) that invest either in the securitisation exposures that the bank has securitised or in SPEs that the bank sponsors.  a list of entities to which the bank provides implicit support and the associated capital impact for each of them (as required in SCRE18.14 and SCRE18.49. (c) Summary of the bank's accounting policies for securitisation activities. Where relevant, banks are expected to distinguish securitisation exposures from re-securitisation exposures. (d) If applicable, the names of external credit assessment institution (ECAIs) used for securitisations and the types of securitisation exposure for which each agency is used. (e) If applicable, describe the process for implementing the Basel internal assessment approach (IAA). The description should include:  structure of the internal assessment process and relation between internal assessment and external ratings, including information on ECAIs as referenced in item (d) of this table.  control mechanisms for the internal assessment process including discussion of independence, accountability, and internal assessment process review.  the exposure type to which the internal assessment process is applied; and stress factors used for determining credit enhancement levels, by exposure type. For example, credit cards, home equity, auto, and securitisation exposures detailed by underlying exposure type and security type (eg residential mortgage-backed securities, commercial mortgage-backed securities, asset-backed securities, collateralised debt obligations) etc. (f) Banks must describe the use of internal assessment other than for SEC-IAA capital purposes.

Page Number 98 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template SEC1: Securitisation exposures in the banking book Purpose: Present a bank's securitisation exposures in its banking book. Scope of application: The template is mandatory for all banks with securitisation exposures in the banking book. Content: Carrying values. In this template, securitisation exposures include securitisation exposures even where criteria for recognition of risk transference are not met. Refer to SAMA circular No.371000112753 date 28/10/1437AH on Simple, Transparent and Comparable (STC). Frequency: Semiannually. Format: Flexible. Banks may in particular modify the breakdown and order proposed in rows if another breakdown (eg whether or not criteria for recognition of risk transference are met) would be more appropriate to reflect their activities. Originating and sponsoring activities may be presented together. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g h i j k l Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Of which simple, transparent and comparable (STC) Synthetic Sub￾total Traditional Of which STC Synthetic Sub￾total Traditional Of which STC Synthetic Sub￾total 1 Retail (total)

• of which 2 residential mortgage 3 credit card 4 other retail exposures 5 re-securitisation 6 Wholesale (total)
• of which 7 loans to corporates 8 commercial mortgage 9 lease and receivables 10 other wholesale 11 re-securitisation

Page Number 99 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions (i) When the "bank acts as originator" the securitisation exposures are the retained positions, even where not eligible for the securitisation framework due to the absence of significant and effective risk transfer (which may be presented separately). (ii) When "the bank acts as sponsor", the securitisation exposures include exposures to commercial paper conduits to which the bank provides programme-wide enhancements, liquidity and other facilities. Where the bank acts both as originator and sponsor, it must avoid double-counting. In this regard, the bank can merge the two columns of "bank acts as originator" and "bank acts as sponsor" and use "bank acts as originator/sponsor" columns. (iii) Securitisation exposures when "the bank acts as an investor" are the investment positions purchased in third-party deals. Synthetic transactions: if the bank has purchased protection it must report the net exposure amounts to which it is exposed under columns originator/sponsor (ie the amount that is not secured). If the bank has sold protection, the exposure amount of the credit protection must be reported in the "investor" column. Re-securitisation: all securitisation exposures related to re-securitisation must be completed in rows "re-securitisation", and not in the preceding rows (by type of underlying asset) which contain only securitisation exposures other than re-securitisation.

Page Number 100 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template SEC2: Securitisation exposures in the trading book Purpose: Present a bank's securitisation exposures in its trading book. Scope of application: The template is mandatory for all banks with securitisation exposures in the trading book. In this template, securitisation exposures include securitisation exposures even where criteria for recognition of risk transference are not met. Content: Carrying values. Frequency: Semiannually. Format: Flexible. Banks may in particular modify the breakdown and order proposed in rows if another breakdown (eg whether or not criteria for recognition of risk transference are met) would be more appropriate to reflect their activities. Originating and sponsoring activities may be presented together. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g h i j k l Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Of which STC Synthetic Sub￾total Traditional Of which STC Synthetic Sub￾total Traditional Of which STC Synthetic Sub￾total 1 Retail (total)

• of which 2 residential mortgage 3 credit card 4 other retail exposures 5 re-securitisation 6 Wholesale (total)
• of which 7 loans to corporates 8 commercial mortgage 9 lease and receivables 10 other wholesale 11 re-securitisation

Page Number 101 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions (i) When the "bank acts as originator" the securitisation exposures are the retained positions, even where not eligible to the securitisation framework due to absence of significant and effective risk transfer (which may be presented separately). (ii) When "the bank acts as sponsor", the securitisation exposures include exposures to commercial paper conduits to which the bank provides programme-wide enhancements, liquidity and other facilities. Where the bank acts both as originator and sponsor, it must avoid double-counting. In this regard, the bank can merge two columns of "bank acts as originator" and "bank acts as sponsor" and use "bank acts as originator/sponsor" columns. (iii) Securitisation exposures when "the bank acts as an investor" are the investment positions purchased in third-party deals. Synthetic transactions: if the bank has purchased protection it must report the net exposure amounts to which it is exposed under columns originator/sponsor (ie the amount that is not secured). If the bank has sold protection, the exposure amount of the credit protection must be reported in the "investor" column. Re-securitisation: all securitisation exposures related to re-securitisation must be completed in rows "re-securitisation", and not in the preceding rows (by type of underlying asset) which contain only securitisation exposures other than re-securitisation.

Page Number 102 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements - bank acting as originator or as sponsor Purpose: Present securitisation exposures in the banking book when the bank acts as originator or sponsor and the associated capital requirements. Scope of application: The template is mandatory for all banks with securitisation exposures as sponsor or originator. Content: Exposure amounts, risk-weighted assets and capital requirements. This template contains originator or sponsor exposures that are treated under the securitisation framework. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g h i j k l m n o p q Exposure values (by risk weight bands) Exposure values (by regulatory approach) RWA (by regulatory approach) Capital charge after cap ≤20%

20% to 50% 50% to 100% 100% to <1250% RW 1250% SEC￾IRBA SEC￾ERBA and SEC-IAA SEC￾SA 1250% SEC￾IRBA SEC￾ERBA and SEC-IAA SEC￾SA 1250% SEC￾IRBA SEC￾ERBA and SEC-IAA SEC￾SA 1250% 1 Total exposures 2 Traditional securitisation 3 Of which securitisation 4 Of which retail underlying 5 Of which STC 6 Of which wholesale 7 Of which STC 8 Of which re￾securitisation 9 Synthetic securitisation 10 Of which securitisation 11 Of which retail underlying 12 Of which wholesale 13 Of which re￾securitisation

Page Number 103 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions Columns (a) to (e) are defined in relation to regulatory risk weights. Columns (f) to (q) correspond to regulatory approach used. "1250%" covers securitisation exposures to which none of the approaches laid out in SCRE18.42 to SCRE18.48 can be applied. Capital charge after cap will refer to capital charge after application of the cap as described in SCRE18.50 to SCRE18.55.

Page Number 104 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Template SEC4: Securitisation exposures in the banking book and associated capital requirements - bank acting as investor Purpose: Present securitisation exposures in the banking book where the bank acts as investor and the associated capital requirements. Scope of application: The template is mandatory for all banks having securitisation exposures as investor. Content: Exposure amounts, risk-weighted assets and capital requirements. This template contains investor exposures that are treated under the securitisation framework. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. a b c d e f g h i j k l m n o p q Exposure values (by risk weight bands) Exposure values (by regulatory approach) RWA (by regulatory approach) Capital charge after cap ≤20%

20% to 50% 50% to 100% 100% to <1250% 1250% SEC￾IRBA SEC￾ERBA and SEC-IAA SEC￾SA 1250% SEC￾IRB A SEC￾ERBA and SEC-IAA SEC￾SA 1250% SEC￾IRB A SEC￾ERBA and SEC-IAA SEC￾SA 1250% 1 Total exposures 2 Traditional securitisation 3 Of which securitisation 4 Of which retail underlying 5 Of which STC 6 Of which wholesale 7 Of which STC 8 Of which re￾securitisation 9 Synthetic securitisation 10 Of which securitisation 11 Of which retail underlying 12 Of which wholesale 13 Of which re￾securitisation

Page Number 105 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 Definitions Columns (a) to (e) are defined in relation to regulatory risk weights. Columns (f) to (q) correspond to regulatory approach used. "1250%" covers securitisation exposures to which none of the approaches laid out in SCRE18.42 to SCRE18.48 can be applied Capital charge after cap will refer to capital charge after application of the cap as described in SCRE18.50 to SCRE18.55.

Page Number 106 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 22. Market Risk: 22.1 The market risk section includes the market risk capital requirements calculated for trading book and banking book exposures that are subject to market risk capital requirements in SMAR2 to SMAR13. It also includes capital requirements for securitisation positions held in the trading book. However, it excludes the counterparty credit risk capital requirements that apply to the same exposures, which are reported in section 20. 22.2 The disclosure requirements under this section are: 22.2.1General information about market risk: a. Table MRA - General qualitative disclosure requirements related to market risk under the standardised approach b. Template MR1 - Market risk under the standardised approach 22.2.2Market risk under the internal models approach (IMA). The disclosure requirements related in this section are not required to be completed by banks unless SAMA approves the bank to use the IMA approach. a. Table MRB - Qualitative disclosures for banks using the IMA b. Template MR2 - Market risk IMA per risk type 22.2.3Market risk under the simplified standardised approach (SSA) a. Template MR3 - Market risk under the simplified standardised approach

Page Number 107 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 22.2.1 General information about market risk: Table MRA: General qualitative disclosure requirements related to market risk Purpose: Provide a description of the risk management objectives and policies for market risk as defined in SMAR3.1. Scope of application: The table is mandatory for all banks that are subject to the market risk framework. Content: Quantitative information. Frequency: Annual. Format: Flexible. Banks must describe their risk management objectives and policies for market risk according to the framework as follows: (a) Strategies and processes of the bank, which must include an explanation and/or a description of:  The bank's strategic objectives in undertaking trading activities, as well as the processes implemented to identify, measure, monitor and control the bank's market risks, including policies for hedging risk and the strategies/processes for monitoring the continuing effectiveness of hedges.  Policies for determining whether a position is designated as trading, including the definition of stale positions and the risk management policies for monitoring those positions. In addition, banks should describe cases where instruments are assigned to the trading or banking book contrary to the general presumptions of their instrument category and the market and gross fair value of such cases, as well as cases where instruments have been moved from one book to the other since the last reporting period, including the gross fair value of such cases and the reason for the move.  Description of internal risk transfer activities, including the types of internal risk transfer desk (SMAR5) (b) The structure and organisation of the market risk management function, including a description of the market risk governance structure established to implement the strategies and processes of the bank discussed in row (a) above. (c) The scope and nature of risk reporting and/or measurement systems.

Page Number 108 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table MR1: Market risk under the standardised approach Purpose: Provide the components of the capital requirements under the standardised approach for market risk. Scope of application: The template is mandatory for banks having part or all of their market risk capital requirements measured according to the standardised approach. For banks that use the internal models approach (IMA), the standardised approach capital requirement in this template must be calculated based on the portfolios in trading desks that do not use the IMA (ie trading desks that are not deemed eligible to use the IMA per the terms of SMAR10.4). Content: Capital requirements (as defined in SMAR6 to SMAR9). Frequency: Semiannual. Format: Fixed. Additional rows can be added for the breakdown of other risks. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant change over the reporting period and the key drivers of such changes. In particular, the narrative should inform about changes in the scope of application, including changes due to trading desks for which capital requirements are calculated using the standardised approach. a Capital requirement in standardised approach 1 General interest rate risk 2 Equity risk 3 Commodity risk 4 Foreign exchange risk 5 Credit spread risk - non-securitisations 6 Credit spread risk - securitisations (non-correlation trading portfolio) 7 Credit spread risk - securitisation (correlation trading portfolio) 8 Default risk - non-securitisations 9 Default risk - securitisations (non-correlation trading portfolio) 10 Default risk - securitisations (correlation trading portfolio) 11 Residual risk add-on 12 Total Linkages across templates [MR1 12/a] is equal to [OV1 21/c]

Page Number 109 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 22.2.2 Market risk under the internal models approach (IMA): Table MRB: Qualitative disclosures for banks using the IMA Purpose: Provide the scope, main characteristics and key modelling choices of the different models used for the capital requirement computation of market risks using the IMA. Scope of application: The table is mandatory for all banks using the IMA to calculate the market risk capital requirements. To provide meaningful information to users on a bank’s use of internal models, the bank must describe the main characteristics of the models used at the group-wide level (according to the scope of regulatory consolidation) and explain the extent to which they represent all the models used at the group-wide level. The commentary must include the percentage of capital requirements covered by the models described for each of the regulatory models (expected shortfall (ES), default risk capital (DRC) requirement and stressed expected shortfall (SES) for non-modellable risk factors (NMRFs)). Content: Quantitative information. Frequency: Annual. Format: Flexible. (A) Banks must provide a general description of the trading desk structure (as defined in SMAR4) and types of instruments included in the IMA trading desks. (B) For ES models, banks must provide the following information: (a) A description of trading desks covered by the ES models. Where applicable, banks must also describe the main trading desks not included in ES regulatory calculations (due to lack of historical data or model constraints) and treated under other measures (such as specific treatments allowed in some jurisdictions). (b) The soundness criteria on which the internal capital adequacy assessment is based (eg forward-looking stress testing) and a description of the methodologies used to achieve a capital adequacy assessment that is consistent with the soundness standards. (c) A general description of the ES model(s). For example, banks may describe whether the model(s) is (are) based on historical simulation, Monte Carlo simulations or other appropriate analytical methods and the observation period for ES based on stressed observations (ESR,S). (d) The frequency by which model data is updated. (e) A description of the ES calculation based on current and stressed observations. For example, banks should describe the reduced set of risk factors used to calibrate the period of stress the share of the variations in the full ES that is explained by the reduced set of risk factors, and the observation period used to identify the most stressful 12 months. (C) SES (a) A general description of each methodology used to achieve a capital assessment for categories of NMRFs that is consistent with the required soundness standard. (D) Banks using internal models to determine the DRC must provide the following information: (a) A general description of the methodology: Information about the characteristics and scope of the value-at-risk (VaR) and whether different models are used for different exposure classes. For example, banks may describe the range of probability of default (PD) by obligors on the different types of positions, the approaches used to correct market-implied PDs as applicable, the treatment of netting, basis risk between long and short exposures of different obligors, mismatch between a position and its hedge and concentrations that can arise within and across product classes during stressed conditions. (b) The methodology used to achieve a capital assessment that is consistent with both the required soundness standard and SMAR13.18 to SMAR13.39. (E) Validation of models and modelling processes (a) The approaches used in the validation of the models and modelling processes, describing general approaches used and the types of assumptions and benchmarks on which they rely.

Page Number 110 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table MR2: Market risk for banks using the IMA Purpose: Provide the components of the capital requirement under the IMA for market risk. Scope of application: The template is mandatory for banks using the IMA for part or all of their market risk for regulatory capital calculations. Content: Capital requirement calculation (as defined in SMAR13) at the group-wide level (according to the scope of regulatory consolidation). Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks must report the components of their total capital requirement that are included for their most recent measure and the components that are included for their average of the previous 60 days for ES, IMCC and SES, and 12 weeks for DRC. Banks must also provide a comparison of VaR estimates with actual gains/losses experienced by the bank, with analysis of important “outliers” in backtest results. Banks are also expected to include the corresponding figures at the previous quarter in this template and explain any significant changes in the current figures in the narrative section. a b c d e f g At the current quarter At the previous quarter Risk measure: for previous 60 days / 12 weeks: Number of backtesting exceptions Risk measure: for previous 60 days / 12 weeks Most recent Average High Low VaR measure 99.0% Most recent Average 1 Unconstrained expected shortfall 2 ES for the regulatory risk classes General interest rate risk 3 Equity risk 4 Commodity risk 5 Foreign exchange risk 6 Credit spread risk 7 Constrained expected shortfall 8 IMCC (0.5Unconstrained ES+0.5constrained risk class ES) 9 Capital requirement for non-modellable risk factors; SES 10 Default risk capital requirement 11 Capital surcharge for amber trading desks 12 Capital requirements for green and amber trading desks (including capital surcharge) 13 Total SA capital requirements for trading desks ineligible to use the IMA as reported in MR1 (CU) 14 Difference in capital requirements under the IMA and SA for green and amber trading desks 15 SA capital requirement for all trading desks (including those subject to IMA) 16 Total market risk capital requirement: min(12+13; 15)+max(0, 14)

Page Number 111 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Definitions and instructions Row Number Explanation 1 Unconstrained expected shortfall: Expected shortfall (ES) as defined in SMAR13.1 to SMAR13.12, calculated without supervisory constraints on cross-risk factor correlations. 7 Constrained expected shortfall: ES as defined in SMAR13.1 to SMAR13.12, calculated in accordance with SMAR13.14. The constrained ES disclosed should be the sum of partial expected shortfall capital requirements (ie all other risk factors should be held constant) for the range of broad regulatory risk factor classes (interest rate risk, equity risk, foreign exchange risk, commodity risk and credit spread risk). 9 Capital requirement for non-modellable risk factors: aggregate regulatory capital measure calculated in accordance with SMAR13.16 and SMAR13.17, for risk factors in model-eligible trading desks that are deemed non-modellable in accordance with SMAR10.4. 10 Default risk capital (DRC) requirement: in accordance with SMAR13.18, measure of the default risk of trading book positions, except those subject to standardised capital requirements. This covers, inter alia, sovereign exposures (including those denominated in the sovereign’s domestic currency), equity positions and defaulted debt positions. 11 Capital surcharge for amber trading desks: capital surcharge for eligible trading desks that is in the P&L attribution test “amber zone”, calculated in accordance with SMAR13.45. 12 Subtotal for green and amber trading desks: (CA+DRC) + Capital surcharge, in accordance with SMAR13.41 to SMAR13.43; SMAR13.22; and SMAR13.45. Row 12= max[8/a+9/a; multiplier*8/b+9/b]+max[10/a; 10/b]+11. 13 Total SA capital requirements for trading desks ineligible to use the IMA (CU): standardised approach (SA) capital requirements for trading desks that are either out of scope for model approval or that have been deemed ineligible to use the IMA, corresponding to the total capital requirement under the SA as reported in row 12 of Template MR1. 14 Difference in capital requirements under the IMA and SA for green and amber trading desks: capital requirements for green and amber trading desks under the IMA (IMAG,A) – capital requirements for green and amber trading desks under SA (SAG,A) in accordance with SMAR13.45). 15 SA capital requirement for all trading desks (including those subject to the IMA): the most recent standardised approach capital requirement for all instruments across all trading desks, regardless of whether those trading desks are eligible for the IMA, as set out in SMAR13.43 and SMAR3.10(1). 16 Total market risk capital requirement: the total capital requirement is calculated as set out in SMAR13.43 Linkages across templates [MR2:16 minus MR2:13] is equal to [OV1 22/c] [MR2:16 minus MR2:13] x 12.5 is equal to [CMS1 5/a] (The linkage to “Template CMS1: Comparison of modelled and standardised RWA at risk level” will not hold if a bank using the standardised approach for market risk also uses SEC-IRBA and/or SEC-IAA when determining the default risk charge component for securitisations held in the trading book.) [MR2:13] x 12.5 is equal to [CMS1 5/b] (The linkage to “Template CMS1: Comparison of modelled and standardised RWA at risk level” will not hold if a bank using the standardised approach for market risk also uses SEC-IRBA and/or SEC-IAA when determining the default risk charge component for securitisations held in the trading book.) [MR2:16] x 12.5 is equal to [CMS1 5/c] [MR2:15] x 12.5 is equal to [CMS1 5/d] (The linkage to “Template CMS1: Comparison of modelled and standardised RWA at risk level” will not hold if an AI using the standardised approach for market risk also uses SEC-IRBA and/or SEC-IAA when determining the default risk charge component for securitisations held in the trading book.)

Page Number 112 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 22.2.3 Market risk under the simplified standardised approach (SSA) Table MR3: Market risk under the simplified standardised approach Purpose: Provide the components of the capital requirement under the simplified standardised approach for market risk. Scope of application: The template is mandatory for banks that use the simplified standardised approach to determine market risk capital requirements. Content: Capital requirement (as defined in SMAR14 of the market risk framework). Frequency: Semiannual. Format: Fixed. Additional rows can be added for the breakdown of other risks. Accompanying narrative: a b c d Outright products Options Simplified approach Delta-plus method Scenario approach 1 Interest rate risk 2 Equity risk 3 Commodity risk 4 RWA at end of day previous current quarter 5 Securitisation 6 Total Definitions and instructions Row Number Explanation 5 Securitisation: specific capital requirement under SMAR14.14 a Outright products: positions in products that are not optional. This includes the capital requirement under SMAR14.3 to SMAR14.40 (interest rate risk); the capital requirement under SMAR14.41 to SMAR14.52 (equity risk); the capital requirement under SMAR14.63 to SMAR14.73 (commodities risk); and the capital requirement under SMAR14.53 to SMAR14.62 (FX risk). b Options under the simplified approach: capital requirements for option risks (non-delta risks) under SMAR14.76 from debt instruments, equity instruments, commodities instruments and foreign exchange instruments. c Options under the delta-plus method: capital requirements for option risks (non-delta risks) under SMAR14.77 to SMAR14.80 from debt instruments, equity instruments, commodities instruments and foreign exchange instruments. d Options under the scenario approach: capital requirements for option risks (non-delta risks) under SMAR14.81 to SMAR14.86 from debt instruments, equity instruments, commodities instruments and foreign exchange instruments.

Page Number 113 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 23. Credit valuation adjustment risk: 23.1 The disclosure requirements related in this section are required to be completed by banks when the materiality threshold stated on SAMA’s Revised Risk-based Capital Charge for Counterparty Credit Risk (CCR) issued as part of its adoption of Basel III post-crisis final reforms, paragraph (11.9) is satisfied. 23.2 The disclosure requirements under this section are: 23.2.1General information about CVA risk: a. Table CVAA - General qualitative disclosure requirements related to CVA 23.2.2CVA risk under the basic approach (BA-CVA): a. Template CVA1 - The reduced basic approach for CVA (BA-CVA) b. Template CVA2 - The full basic approach for CVA (BA-CVA) 23.2.3CVA risk under the standardised approach (SA-CVA). a. Table CVAB - Qualitative disclosures for banks using the SA-CVA b. Template CVA3 - The standardised approach for CVA (SA-CVA) c. Template CVA4 - RWA flow statements of CVA risk exposures under SA-CVA

Page Number 114 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 23.2.1 General information about CVA risk: Table CVAA: General qualitative disclosure requirements related to CVA Purpose: To provide a description of the risk management objectives and policies for CVA risk. Scope of application: The table is mandatory for all banks that are subject to CVA capital requirements, including banks which are qualified and have elected to set its capital requirement for CVA at 100% of its counterparty credit risk charge. Content: Quantitative information. Frequency: Annual. Format: Flexible. Banks must describe their risk management objectives and policies for CVA risk as follows: (a) An explanation and/or a description of the bank’s processes implemented to identify, measure, monitor and control the bank’s CVA risks, including policies for hedging CVA risk and the processes for monitoring the continuing effectiveness of hedges. (b) Whether the bank is eligible and has chosen to set its capital requirement for CVA at 100% of the bank's capital requirement for counterparty credit risk as applicable under SMAR14.

Page Number 115 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 23.2.1 CVA risk under the basic approach (BA-CVA): Template CVA1: The reduced basic approach for CVA (BA-CVA) Purpose: To provide the components used for the computation of RWA under the reduced BA-CVA for CVA risk. Scope of application: The template is mandatory for banks having part or all of their RWA for CVA risk measured according to the reduced BA￾CVA. The template should be completed with only the amounts obtained from the netting sets which are under the reduced BA-CVA. Content: RWA. Frequency: Semiannual. Format: Fixed. Accompanying narrative: Banks must describe the types of hedge they use even if they are not taken into account under the reduced BA-CVA. a b Components BA-CVA RWA 1 Aggregation of systematic components of CVA risk 2 Aggregation of idiosyncratic components of CVA risk 3 Total Definitions and instructions Row Number Explanation 1 Aggregation of systematic components of CVA risk: RWA under perfect correlation assumption (∑c 𝑆𝐶𝑉𝐴 c) as per SCCR11.14. 2 Aggregation of idiosyncratic components of CVA risk: RWA under zero correlation assumption (sqrt(∑c SCVAc 2 )) as per SCCR11.14. 3 Total: Kreduced as per SCCR11.14 multiplied by 12.5. Linkages across templates [CVA1:3/b] is equal to [OV1:10/a] if the bank only uses the reduced BA-CVA for all CVA risk exposures.

Page Number 116 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CVA2: The full basic approach for CVA (BA-CVA) Purpose: To provide the components used for the computation of RWA under the full BA-CVA for CVA risk. Scope of application: The template is mandatory for banks having part or all of their RWA for CVA risk measured according to the full version of the BA-CVA. The template should be fulfilled with only the amounts obtained from the netting sets which are under the full BA-CVA. Content: RWA. Frequency: Semiannual. Format: Fixed. Additional rows can be inserted for the breakdown of other risks. a BA-CVA RWA 1 K Reduced 2 K Hedged 3 Total Definitions and instructions Row Number Explanation 1 K Reduced: Kreduced as per SCCR11.14. 2 K Hedged: Khedged as per SCCR11.21. 3 Total: Kfull as per SCCR11.20 multiplied by 12.5. Linkages across templates: [CVA2:3/a] is equal to [OV1:10/a] if the bank only uses the full BA-CVA for all CVA risk exposures.

Page Number 117 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 23.2.1 CVA risk under the standardised approach (SA-CVA): Table CVAB: Qualitative disclosures for banks using the SA-CVA Purpose: To provide the main characteristics of the bank’s CVA risk management framework. Scope of application: The table is mandatory for all banks using the SA-CVA to calculate their RWA for CVA risk. Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must provide the following information on their CVA risk management framework: (a) A description of the bank’s CVA risk management framework. (b) A description of how senior management is involved in the CVA risk management framework. (c) An overview of the governance of the CVA risk management framework (eg documentation, independent control unit, independent review, independence of the data acquisition from the lines of business).

Page Number 118 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CVA3: The standardised approach for CVA (SA-CVA) Purpose: To provide the components used for the computation of RWA under the SA-CVA for CVA risk. Scope of application: The template is mandatory for banks having part or all of their RWA for CVA risk measured according to the SA-CVA. Content: RWA. Frequency: Semiannual. Format: Fixed. Additional rows can be inserted for the breakdown of other risks. a b SA-CVA RWA Number of counterparties 1 Interest rate risk 2 Foreign exchange risk 3 Reference credit spread risk 4 Equity risk 5 Commodity risk 6 Counterparty credit spread risk 7 Total (sum of rows 1 to 6) Linkages across templates [CVA3:7/a] is equal to [OV1:10/a] if the bank only uses the SA-CVA for all CVA risk exposures.

Page Number 119 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CVA4: RWA flow statements of CVA risk exposures under SA-CVA Purpose: Flow statement explaining variations in RWA for CVA risk determined under the SA-CVA. Scope of application: The template is mandatory for banks using the SA-CVA. Content: RWA for CVA risk. Changes in RWA amounts over the reporting period for each of the key drivers should be based on a bank’s reasonable estimation of the figure. Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with a narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. Factors behind changes could include movements in risk levels, scope changes (eg movement of netting sets between SA-CVA and BA-CVA), acquisition and disposal of business/product lines or entities or foreign currency translation movements. a 1 Total RWA for CVA at previous quarter-end 2 Total RWA for CVA at end of reporting period Linkages across templates [CVA4:1/a] is equal to [OV1:10/b] [CVA4:2/a] is equal to [OV1:10/a]

Page Number 120 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 24. Operational risk: 24.1 The disclosure requirements under this section are: 24.1.1 Table ORA – General qualitative information on a bank’s operational risk framework 24.1.2 Template OR1 – Historical losses 24.1.3 Template OR2 – Business indicator and subcomponents 24.1.4 Template OR3 – Minimum required operational risk capital

Page Number 121 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table ORA: General qualitative information on a bank’s operational risk framework Purpose: To describe the main characteristics and elements of a bank’s operational risk management framework. Scope of application: The table is mandatory for all banks Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must describe a) Their policies, frameworks and guidelines for the management of operational risk. b) The structure and organisation of their operational risk management and control function. c) Their operational risk measurement system (ie the systems and data used to measure operational risk in order to estimate the operational risk capital charge). d) The scope and main context of their reporting framework on operational risk to executive management and to the board of directors. e) The risk mitigation and risk transfer used in the management of operational risk. This includes mitigation by policy (such as the policies on risk culture, risk appetite, and outsourcing), by divesting from high-risk businesses, and by the establishment of controls. The remaining exposure can then be absorbed by the bank or transferred. For instance, the impact of operational losses can be mitigated with insurance.

Page Number 122 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template OR1: Historical losses Purpose: To disclose aggregate operational losses incurred over the past 10 years, based on the accounting date of the incurred losses. This disclosure informs the operational risk capital calculation. The general principle on retrospective disclosure set out in section 8.2 does not apply for this template. From the implementation date of the template onwards, disclosure of all prior periods is required, unless firms have been permitted by SAMA to use fewer years in their capital calculation on a transitional basis. Scope of application: The table is mandatory for: (i) all banks that are in the second or third business indicator (BI) bucket, regardless of whether SAMA has exercised the national discretion to set the internal loss multiplier (ILM) equal to one; and (ii) all banks in the first BI bucket which have received SAMA approval to include internal loss data to calculate their operational risk capital requirements. Content: Qualitative information. Frequency: Annual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with narrative commentary explaining the rationale in aggregate, for new loss exclusions since the previous disclosure. Banks should disclose any other material information, in aggregate, that would help inform users as to its historical losses or its recoveries, with the exception of confidential and proprietary information, including information about legal reserves. a b c d e f g h i j k T T-1 T-2 T-3 t-4 t-5 t-6 t-7 t-8 t-9 Ten-year average Using 44,600 SAR threshold 1 Total amount of operational losses net of recoveries (no exclusions) 2 Total number of operational risk losses 3 Total amount of excluded operational risk losses 4 Total number of exclusions 5 Total amount of operational losses net of recoveries and net of excluded losses Using 446,000 SAR threshold 6 Total amount of operational losses net of recoveries (no exclusions) 7 Total number of operational risk losses 8 Total amount of excluded operational risk losses 9 Total number of exclusions

Page Number 123 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 10 Total amount of operational losses net of recoveries and net of excluded losses Details of operational risk capital calculation 11 Are losses used to calculate the ILM (yes/no)? 12 If “no” in row 11, is the exclusion of internal loss data due to non￾compliance with the minimum loss data standards (yes/no)? 13 Loss event threshold: 44,600 SAR or 446,000 SAR for the operational risk capital calculation if applicable Definitions Row 1: Based on a loss event threshold of 44,600 SAR, the total loss amount net of recoveries resulting from loss events above the loss event threshold for each of the last 10 reporting periods. Losses excluded from the operational risk capital calculation must still be included in this row. Row 2: Based on a loss event threshold of 44,600 SAR, the total net loss amounts above the loss threshold excluded (eg due to divestitures) for each of the last 10 reporting periods. Row 3: Based on a loss event threshold of 44,600 SAR, the total number of operational risk losses. Row 4: Based on a loss event threshold of 44,600 SAR, the total number of exclusions. Row 5: Based on a loss event threshold of 44,600 SAR, the total amount or operational risk losses net of recoveries and excluded losses. Row 6: Based on a loss event threshold of 446,000 SAR, the total loss amount net of recoveries resulting from loss events above the loss event threshold for each of the last 10 reporting periods. Losses excluded from the operational risk capital calculation must still be included in this row. Row 7: Based on a loss event threshold of 446,000 SAR, the total net loss amounts above the loss threshold excluded (eg due to divestitures) for each of the last 10 reporting periods. Row 8: Based on a loss event threshold of 446,000 SAR, the total number of operational risk losses. Row 9: Based on a loss event threshold of 446,000 SAR, the total number of exclusions. Row 10: Based on a loss event threshold of 446,000 SAR, the total amount or operational risk losses net of recoveries and excluded losses. Row 11: Indicate whether the bank uses operational risk losses to calculate the ILM. Banks using ILM=1 due to national discretion should answer no. Row 12: Indicate whether internal loss data are not used in the ILM calculation due to non-compliance with the minimum loss data standards as referred to by SOPE7.4.1 and SOPE7.4.2. The application of any resulting multipliers must be disclosed in row 2 of Template OR3 and accompanied by a narrative. Row 13: The loss event threshold used in the actual operational risk capital calculation (ie 44,600 SAR or 446,000 SAR) if applicable. Columns: For rows 1 to 10, T denotes the end of the annual reporting period, T–1 the previous year-end, etc. Column (k) refers to the average annual losses net of recoveries and excluded losses over 10 years. Notes: Loss amounts and the associated recoveries should be reported in the year in which they were recorded in financial statements

Page Number 124 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template OR2: Business Indicator and subcomponents Purpose: To disclose the business indicator (BI) and its subcomponents, which inform the operational risk capital calculation. The general principle on retrospective disclosure set out in section 8.2 does not apply for this template. From the implementation date of this template onwards, disclosure of all prior periods is required. Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with narrative commentary to explain any significant changes over the reporting period and the key drivers of such changes. Additional narrative is required for those banks that have received SAMA approval to exclude divested activities from the calculation of the BI. a b c BI and its subcomponents T T-1 T-2 1 Interest, lease and dividend component 1a Interest and lease income 1b Interest and lease expense 1c Interest earning assets 1d Dividend income 2 Services component 2a Fee and commission income 2b Fee and commission expense 2c Other operating income 2d Other operating expense 3 Financial component 3a Net P&L on the trading boo 3b Net P&L on the banking boo 4 BI 5 Business indicator component (BIC) Disclosure on BI: a 6a BI gross of excluded divested activities 6b Reduction in BI due to excluded divested activities Definitions Row 1: The interest, leases and dividend component (ILDC) = Min [Abs (Interest income – Interest expense); 2.25%* Interest-earning assets] + Dividend income. In the formula, all the terms are calculated as the average over three years: T, T–1 and T–2. The interest-earning assets (balance sheet item) are the total gross outstanding loans, advances, interest-bearing securities (including government bonds) and lease assets measured at the end of each financial year.

Page Number 125 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Row 1a: Interest income from all financial assets and other interest income (includes interest income from financial and operating leases and profits from leased assets). Row 1b: Interest expenses from all financial liabilities and other interest expenses (includes interest expense from financial and operating leases, losses, depreciation and impairment of operating leased assets) Row 1c: Total gross outstanding loans, advances, interest-bearing securities (including government bonds) and lease assets measured at the end of each financial year. Row 1d: Dividend income from investments in stocks and funds not consolidated in the bank’s financial statements, including dividend income from non￾consolidated subsidiaries, associates and joint ventures. Row 2: Service component (SC) = Max (Fee and commission income; Fee and commission expense) + Max (Other operating income; Other operating expense). In the formula, all the terms are calculated as the average over three years: T, T–1 and T–2. Row 2a: Income received from providing advice and services. Includes income received by the bank as an outsourcer of financial services. Row 2b: Expenses paid for receiving advice and services. Includes outsourcing fees paid by the bank for the supply of financial services, but not outsourcing fees paid for the supply of non-financial services (eg logistical, IT, human resources). Row 2c: Income from ordinary banking operations not included in other BI items but of a similar nature (income from operating leases should be excluded). Row 2d: Expenses and losses from ordinary banking operations not included in other BI items but of a similar nature and from operational loss events (expenses from operating leases should be excluded) Row 3: Financial component (FC) = Abs (Net P&L Trading Book) + Abs (Net P&L Banking Book). In the formula, all the terms are calculated as the average over three years: T, T–1 and T–2. Row 3a: This comprises (i) net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity securities, loans and advances, short positions, other assets and liabilities); (ii) net profit/loss from hedge accounting; and (iii) net profit/loss from exchange differences. Row 3b: This comprises (i) net profit/loss on financial assets and liabilities measured at fair value through profit and loss; (ii) realised gains/losses on financial assets and liabilities not measured at fair value through profit and loss (loans and advances, assets available for sale, assets held to maturity, financial liabilities measured at amortised cost); (iii) net profit/loss from hedge accounting; and (iv) net profit/loss from exchange differences. Row 4: The BI is the sum of the three components: ILDC, SC and FC. Row 5: Calculated by multiplying the BI by a set of regulatory determined marginal coefficients or percentages specified in section SOPE7.1. Disclosure on BI should be reported by banks that have received SAMA approval to excluded divested activities from the calculation of the BI. Row 6a: The BI reported in this row includes divested activities. Row 6b: Difference between BI gross of divested activities (row 6a) and BI net of divested activities (row 4). Columns: T denotes the end of the annual reporting period, T–1 the previous year-end, etc. Linkages across templates [OR2:5/a] is equal to [OR3:1/a]

Page Number 126 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template OR3: Minimum required operational risk capital Purpose: To disclose operational risk regulatory capital requirements. Scope of application: The table is mandatory for all banks. Content: Qualitative information. Frequency: Annual. Format: Fixed. a 1 Business indicator component (BIC) 2 Internal loss multiplier (ILM) 3 Minimum required operational risk capital (ORC) 4 Operational risk RWA Definitions Row 1: The BIC used for calculating minimum regulatory capital requirements for operational risk. Row 2: The ILM used for calculating minimum regulatory capital requirements for operational risk (refer to SOPE7.3.4) Row 3: Minimum Pillar 1 operational risk capital requirements. For banks using operational risk losses to calculate the ILM, this should correspond to the BIC times the ILM. For banks not using operational risk losses to calculate the ILM, this corresponds to the BIC. Row 4: Converts the minimum Pillar 1 operational risk capital requirement into RWA.

Page Number 127 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 25. Interest rate risk in the banking book: 25.1 The disclosure requirements set out in this chapter are: 25.1.1 Table IRRBBA – Interest rate risk in the banking book (IRRBB) risk management objective and policies 25.1.2 Template IRRBB1 – Quantitative information on IRRBB 25.2 Table IRRBBA provides information on a bank’s IRRBB risk management objective and policy. Template IRRBB1 provides quantitative IRRBB information, including the impact of interest rate shocks on their change in economic value of equity and net interest income, computed based on a set of prescribed interest rate shock scenarios. 25.3 Banks must disclose the measured changes in economic value of equity (∆EVE) and changes in net interest income (∆NII) under the prescribed interest rate shock scenarios set out in Basel Framework “Supervisory review process” (Interest rate risk in the banking book). In disclosing Table IRRBBA and Template IRRBB1, banks should use their own internal measurement system (IMS) to calculate the IRRBB exposure values refer to SAMA circular No. 381000040243 date 1438/04/12AH on Interest Rating Risk in The Banking Book (IRRBB). Basel Framework “Supervisory review process” (Interest rate risk in the banking book) provides a standardised framework that banks may adopt as their IMS. In addition to quantitative disclosure, banks should provide sufficient qualitative information and supporting detail to enable the market and wider public to: 25.3.1 Monitor the sensitivity of the bank’s economic value and earnings to changes in interest rates; 25.3.2 Understand the primary assumptions underlying the measurement produced by the bank’s IMS; and 25.3.3 Have an insight into the bank’s overall IRRBB objective and IRRBB management. 25.4 For the disclosure of ∆EVE:

Page Number 128 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 25.4.1 Banks should exclude their own equity from the computation of the exposure level; 25.4.2 Banks should include all cash flows from all interest rate-sensitive assets, liabilities and off-balance sheet items in the banking book in the computation of their exposure.13 Banks should disclose whether they have excluded or included commercial margins and other spread components in their cash flows; 25.4.3 Cash flows should be discounted using either a risk-free rate or a risk￾free rate including commercial margins and other spread components (only if the bank has included commercial margins and other spread components in its cash flows).14 Banks should disclose whether they have discounted their cash flows using a risk-free rate or a risk-free rate including commercial margins and other spread components; and 25.4.4 ΔEVE should be computed with the assumption of a run-off balance sheet, where existing banking book positions amortise and are not replaced by any new business. 25.5 In addition to the required disclosures in Table IRRBBA and Template IRRBB1, banks are encouraged to make voluntary disclosures of information on internal measures of IRRBB that would assist the market in interpreting the mandatory disclosure numbers.

13 Interest rate-sensitive assets are assets which are not deducted from Common Equity Tier 1 capital and which exclude (i) fixed assets such as real estate or intangible assets as well as (ii) equity exposures in the banking book. 14 The discounting factors must be representative of a risk-free zero coupon rate. An example of an acceptable yield curve is a secured interest rate swap curve.

Page Number 129 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table IRRBBA - IRRBB risk management objectives and policies Purpose: Provide a description of the risk management objectives and policies concerning IRRBB. Scope of application: Mandatory for all banks within the scope of application set out in Basel Framework “Supervisory review process” (Interest rate risk in the banking book). Content: Qualitative and quantitative information. Quantitative information is based on the daily or monthly average of the year or on the data as at the reporting date. Frequency: Annual. Format: Flexible. Qualitative disclosure a A description of how the bank defines IRRBB for purposes of risk control and measurement. b A description of the bank's overall IRRBB management and mitigation strategies. Examples are: monitoring of economic value of equity (EVE) and net interest income (NII) in relation to established limits, hedging practices, conduct of stress testing, outcome analysis, the role of independent audit, the role and practices of the asset and liability management committee, the bank's practices to ensure appropriate model validation, and timely updates in response to changing market conditions. c The periodicity of the calculation of the bank's IRRBB measures, and a description of the specific measures that the bank uses to gauge its sensitivity to IRRBB. d A description of the interest rate shock and stress scenarios that the bank uses to estimate changes in the economic value and in earnings. e Where significant modelling assumptions used in the bank's internal measurement systems (IMS) (ie the EVE metric generated by the bank for purposes other than disclosure, eg for internal assessment of capital adequacy) are different from the modelling assumptions prescribed for the disclosure in Template IRRBB1, the bank should provide a description of those assumptions and their directional implications and explain its rationale for making those assumptions (eg historical data, published research, management judgment and analysis). f A high-level description of how the bank hedges its IRRBB, as well as the associated accounting treatment. g A high-level description of key modelling and parametric assumptions used in calculating ∆EVE and ∆NII in Template IRRBB1, which includes:  For ∆EVE, whether commercial margins and other spread components have been included in the cash flows used in the computation and discount rate used.  How the average repricing maturity of non-maturity deposits has been determined (including any unique product characteristics that affect assessment of repricing behaviour).  The methodology used to estimate the prepayment rates of customer loans, and/or the early withdrawal rates for time deposits, and other significant assumptions.  Any other assumptions (including for instruments with behavioural optionalities that have been excluded) that have a material impact on the disclosed ∆EVE and ∆NII in Template IRRBB1, including an explanation of why these are material.  Any methods of aggregation across currencies and any significant interest rate correlations between different currencies. h (Optional) Any other information which the bank wishes to disclose regarding its interpretation of the significance and sensitivity of the IRRBB measures disclosed and/or an explanation of any significant variations in the level of the reported IRRBB since previous disclosures. Quantitative disclosures 1 Average repricing maturity assigned to non-maturity deposits (NMDs). 2 Longest repricing maturity assigned to NMDs.

Page Number 130 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template IRRBB1 - Quantitative information on IRRBB Purpose: Provide information on the bank's changes in economic value of equity and net interest income under each of the prescribed interest rate shock scenarios. Scope of application: Mandatory for all banks within the scope of application set out in Basel Framework “Supervisory review process” (Interest rate risk in the banking book) Content: Quantitative information. Frequency: Annual Format: Fixed. Accompanying narrative: Commentary on the significance of the reported values and an explanation of any material changes since the previous reporting period. In reporting currency ∆EVE ∆NII Period T T-1 T T-1 Parallel up Parallel down Steepener Flattener Short rate up Short rate down Maximum Period T T-1 Tier 1 capital Definitions For each of the supervisory prescribed interest rate shock scenarios, the bank must report for the current period and for the previous period: (i) the change in the economic value of equity based on its IMS, using a run-off balance sheet and an instantaneous shock or based on the result of the standardised framework set on Basel Framework “Supervisory review process” (Interest rate risk in the banking book) refer to SAMA circular No. 381000040243 date 12/04/1438AH on Interest Rating Risk in The Banking Book (IRRBB), and SAMA circular No. 321000027835 date 14/12/1432AH on Enhancements to the ICAAP Document at end of 2011; and (ii) the change in projected NII over a forward-looking rolling 12-month period compared with the bank's own best estimate 12-month projections, using a constant balance sheet assumption and an instantaneous shock. (i)

Page Number 131 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 26. Macroprudential supervisory measures: 26.1 The disclosure requirements set out in this chapter are: 26.1.1 Template GSIB1 – Disclosure of global systemically important bank (G￾SIB) indicators 26.1.2 Template CCyB1 – Geographical distribution of credit exposures used in the calculation of the bank-specific countercyclical capital buffer requirement 26.2 Template GSIB1 provides users of Pillar 3 data with details of the indicators used to assess how a G-SIB has been determined. Template GSIB1 is not required to be completed by banks unless SAMA identify the bank as G-SIB. 26.3 Template CCyB1 provides details of the calculation of a bank’s countercyclical capital buffer, including details of the geographical breakdown of the bank’s private sector credit exposures.

Page Number 132 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template GSIB1 - Disclosure of G-SIB indicators Purpose: Provide an overview of the indicators that feed into the Committee's methodology for assessing the systemic importance of global banks. Scope of application: The template is mandatory for banks which in the previous year have either been classified as G-SIBs, have a leverage ratio exposure measure exceeding EUR 200 billion or were included in the assessment sample by supervisory judgment (see Basel Framework “Scope and definitions” Global systemically important Banks). For G-SIB assessment purposes, the applicable leverage ratio exposure measure definition is contained in the SLEV. For application of this threshold, banks should use the applicable exchange rate information provided on the Basel Committee website at www.bis.org/bcbs/gsib/ . The disclosure itself is made in the bank's own currency. Content: At least the 12 indicators used in the assessment methodology of the G-SIB framework (see Basel Framework “Scope and definitions” Global systemically important Banks). Frequency: Annual. Format: Flexible. Accompanying narrative: Banks should indicate the annual reference date of the information reported as well as the date of first public disclosure. Banks should include a web link to the disclosure of the previous G-SIB assessment exercise. Banks may supplement the template with a narrative commentary to explain any relevant qualitative characteristic deemed necessary for understanding the quantitative data. This information may include explanations about the use of estimates with a short explanation as regards the method used, mergers or modifications of the legal structure of the entity subjected to the reported data, the bucket to which the bank was allocated and changes in higher loss absorbency requirements, or reference to the Basel Committee website for data on denominators, cutoff scores and buckets. Regardless of whether Template GSIB1 is included in the annual Pillar 3 report, a bank's annual Pillar 3 report as well as all the interim Pillar 3 reports should include a reference to the website where current and previous disclosures of Template GSIB1 can be found. Category Individual indicator Values 1 Cross-jurisdictional activity Cross-jurisdictional claims 2 Cross-jurisdictional liabilities 3 Size Total exposures 4 Interconnectedness Intra-financial system assets 5 Intra-financial system liabilities 6 Securities outstanding 7 Substitutability/ Financial institution infrastructure Assets under custody 8 Payment activity 9 Underwritten transactions in debt and equity markets 10 Complexity Notional amount of over-the-counter derivatives 11 Level 3 assets 12 Trading and available for sale securities Definitions and instructions The template must be completed according to the instructions and definitions for the corresponding rows in force at the disclosure's reference date, which is based on the Committee's G-SIB identification exercise.

Page Number 133 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCyB1 - Geographical distribution of credit exposures used in the calculation of the bank-specific countercyclical capital buffer requirement Purpose: Provide an overview of the geographical distribution of private sector credit exposures relevant for the calculation of the bank's countercyclical capital buffer. Scope of application: The template is mandatory for all banks subject to a countercyclical capital buffer requirement based on the jurisdictions in which they have private sector credit exposures subject to a countercyclical capital buffer requirement compliant with the Basel standards. Only banks with exposures to jurisdictions in which the countercyclical capital buffer rate is higher than zero should disclose this template. Content: Private sector credit exposures and other relevant inputs necessary for the computation of the bank-specific countercyclical capital buffer rate. Frequency: Semiannual. Format: Flexible. Columns and rows might be added or removed to fit with the domestic implementation of the countercyclical capital buffer and thereby provide information on any variables necessary for its computation. A column or a row may be removed if the information is not relevant to the domestic implementation of the countercyclical capital buffer framework. Accompanying narrative: For the purposes of the countercyclical capital buffer, banks should use, where possible, exposures on an "ultimate risk" basis. They should disclose the methodology of geographical allocation used, and explain the jurisdictions or types of exposures for which the ultimate risk method is not used as a basis for allocation. The allocation of exposures to jurisdictions should be made taking into consideration the clarifications provided by Basel Framework “Risk-based capital requirements” (Buffers above the regulatory minimum). Information about the drivers for changes in the exposure amounts and the applicable jurisdiction-specific rates should be summarised. a b c d e Geographical breakdown Countercyclical capital buffer rate Exposure values and/or risk-weighted assets (RWA) used in the computation of the countercyclical capital buffer Bank-specific countercyclical capital buffer rate Countercyclical capital buffer amount Exposure values RWA (Home) Country 1 Country 2 Country 3 ⋮ Country N Sum Total Definitions and instructions Unless otherwise provided for in the domestic implementation of the countercyclical capital buffer framework, private sector credit exposures relevant for the calculation of the countercyclical capital buffer (relevant private sector credit exposures) refer to exposures to private sector counterparties which attract a credit risk capital charge in the banking book, and the risk-weighted equivalent trading book capital charges for specific risk, the incremental risk charge and securitisation. Interbank exposures and exposures to the public sector are excluded, but non-bank financial sector exposures are included. Country: Country in which the bank has relevant private sector credit exposures, and which has set a countercyclical capital buffer rate greater than zero that was applicable during the reporting period covered by the template. Sum: Sum of private sector credit exposures or RWA for private sector credit exposures, respectively, in jurisdictions with a non-zero countercyclical capital buffer rate.

Page Number 134 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Total: Total of private sector credit exposures or RWA for private sector credit exposures, respectively, across all jurisdictions to which the bank is exposed, including jurisdictions with no countercyclical capital buffer rate or with a countercyclical capital buffer rate set at zero, and value of the bank-specific countercyclical capital buffer rate and resulting countercyclical capital buffer amount. Countercyclical capital buffer rate: Countercyclical capital buffer rate set by SAMA in question and in force during the period covered by the template or, where applicable, the higher countercyclical capital buffer rate set for the country in question by SAMA. Countercyclical capital buffer rates that were set by SAMA, but are not yet applicable in the country in question at the disclosure reference date (pre-announced rates) must not be reported. Total exposure value: If applicable, total private sector credit exposures across all jurisdictions to which the bank is exposed, including jurisdictions with no countercyclical capital buffer rate or with a countercyclical capital buffer rate set at zero. Total RWA: If applicable, total value of RWA for relevant private sector credit exposures, across all jurisdictions to which the bank is exposed, including jurisdictions with no countercyclical capital buffer rate or with a countercyclical capital buffer rate set at zero. Bank-specific countercyclical capital buffer rate: Countercyclical capital buffer that varies between zero and 2.5% or, where appropriate, above 2.5% of total RWA calculated in accordance with SACAP9.2 (B) and (C) as a weighted average of the countercyclical capital buffer rates that are being applied in jurisdictions where the relevant credit exposures of the bank are located and reported in rows 1 to N. This figure (ie the bank-specific countercyclical capital buffer rate) may not be deduced from the figures reported in this template as private sector credit exposures in jurisdictions that do not have a countercyclical capital buffer rate, which form part of the equation for calculating the figure, are not required to be reported in this template. Countercyclical capital buffer amount: Amount of Common Equity Tier 1 capital held to meet the countercyclical capital buffer requirement determined in accordance with SACAP9.2 (B) and (C). Linkages across templates [CCyB1:Total/d] is equal to [KM1:9/a] for the semiannual disclosure of KM1, and [KM1:9/b] for the quarterly disclosure of KM1 [CCyB1:Total/d] is equal to [CC1:66/a] (for all banks) or [TLAC1:30/a] (for G-SIBs)

Page Number 135 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 27. Leverage ratio: 27.1 The disclosure requirements set out in this chapter are: 27.1.1 Template LR1 - Summary comparison of accounting assets vs leverage ratio exposure measure 27.1.2 Template LR2 - Leverage ratio common disclosure template 27.2 Template LR1 provides a reconciliation of a bank’s total assets as published in its financial statements to the leverage ratio exposure measure, and Template LR2 provides a breakdown of the components of the leverage ratio exposure measure.

Page Number 136 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LR1- Summary comparison of accounting assets vs leverage ratio exposure measure Purpose: To reconcile the total assets in the published financial statements with the leverage ratio exposure measure. Scope of application: The table is mandatory for all banks. Content: Quantitative information. The leverage ratio standard of the Basel framework (SLEV) follows the same scope of regulatory consolidation as used for the risk-based capital requirements standard Basel Framework “Risk-based capital requirements”). Disclosures should be reported on a quarter￾end basis. However, banks may, subject to approval from or due to requirements specified by SAMA, use more frequent calculations (eg daily or monthly averaging). Banks are required to include the basis for their disclosures (eg quarter-end, daily averaging or monthly averaging, or a combination thereof). Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks are required to disclose and detail the source of material differences between their total balance sheet assets, as reported in their financial statements, and their leverage ratio exposure measure. a 1 Total consolidated assets as per published financial statements 2 Adjustment for investments in banking, financial, insurance or commercial entities that are consolidated for accounting purposes but outside the scope of regulatory consolidation 3 Adjustment for securitised exposures that meet the operational requirements for the recognition of risk transference 4 Adjustments for temporary exemption of central bank reserves (if applicable) 5 Adjustment for fiduciary assets recognised on the balance sheet pursuant to the operative accounting framework but excluded from the leverage ratio exposure measure 6 Adjustments for regular-way purchases and sales of financial assets subject to trade date accounting 7 Adjustments for eligible cash pooling transactions 8 Adjustments for derivative financial instruments 9 Adjustment for securities financing transactions (ie repurchase agreements and similar secured lending) 10 Adjustment for off-balance sheet items (ie conversion to credit equivalent amounts of offbalance sheet exposures) 11 Adjustments for prudent valuation adjustments and specific and general provisions which have reduced Tier 1 capital 12 Other adjustments 13 Leverage ratio exposure measure Definitions and instructions Row Number Explanation 1 The bank’s total consolidated assets as per published financial statements. 2 Where a banking, financial, insurance or commercial entity is outside the regulatory scope of consolidation, only the amount of the investment in the capital of that entity (ie only the carrying value of the investment, as opposed to the underlying assets and other exposures of the investee) shall be included in the leverage ratio exposure measure. However, investments in those entities that are deducted from the bank's CET1 capital or from Additional Tier 1 capital in accordance with SACAP4.3 to SACAP4.4 may also be deducted from the leverage ratio exposure measure. As these adjustments reduce the total leverage ratio exposure measure, they shall be reported as a negative amount. 3 This row shows the reduction of the leverage ratio exposure measure due to the exclusion of securitised exposures that meet the operational requirements for the recognition of risk transference according SCRE18.24. As these adjustments reduce the total leverage ratio exposure measure, they shall be reported as a negative amount.

Page Number 137 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 4 Adjustments related to the temporary exclusion of central bank reserves from the leverage ratio exposure measure, if enacted by SAMA to facilitate the implementation of monetary policies as per SLEV6.6. As these adjustments reduce the total leverage ratio exposure measure, they shall be reported as a negative amount. 5 This row shows the reduction of the consolidated assets for fiduciary assets that are recognised on the bank’s balance sheet pursuant to the operative accounting framework and which meet the de-recognition criteria of IAS 39 / IFRS 9 or the IFRS 10 de-consolidation criteria. As these adjustments reduce the total leverage ratio exposure measure, they shall be reported as a negative amount. 6 Adjustments for regular-way purchases and sales of financial assets subject to trade date accounting. The adjustment reflects (i) the reverse￾out of any offsetting between cash receivables for unsettled sales and cash payables for unsettled purchases of financial assets that may be recognised under the applicable accounting framework, and (ii) the offset between those cash receivables and cash payables that are eligible per the criteria specified in SLEV7.1.4 (i), (ii). If this adjustment leads to an increase in exposure, it shall be reported as a positive amount. If this adjustment leads to a decrease in exposure, it shall be reported as a negative amount. 7 Adjustments for eligible cash-pooling transactions. The adjustment is the difference between the accounting value of cash-pooling transactions and the treatments specified in SLEV7.1.5. If this adjustment leads to an increase in exposure, it shall be reported as a positive amount. If this adjustment leads to a decrease in exposure, it shall be reported as a negative amount. 8 Adjustments related to derivative financial instruments. The adjustment is the difference between the accounting value of the derivatives recognised as assets and the leverage ratio exposure value as determined by application of SLEV7.2.1 to SLEV7.2.2 ((i) to (v)) and SLEV7.2.3 to SLEV7.2.15. If this adjustment leads to an increase in exposure, institutions shall disclose this as a positive amount. If this adjustment leads to a decrease in exposure, institutions shall disclose this as a negative amount. 9 Adjustments related to Securities Financing Transactions (SFTs) (ie repurchase agreements and other similar secured lending). The adjustment is the difference between the accounting value of the SFTs recognised as assets and the leverage ratio exposure value as determined by application of SLEV7.3.1, SLEV7.3.3 and SLEV7.3.4 to SLEV7.3.5. If this adjustment leads to an increase in the exposure, institutions shall disclose this as a positive amount. If this adjustment leads to a decrease in exposure, institutions shall disclose this as a negative amount. 10 The credit equivalent amount of off-balance sheet items determined by applying the relevant credit conversion factors to the nominal value of the off-balance sheet item, as specified in SLEV7.4.2. (iii), (iv), and SLEV7.4.3 (x) As these amounts increase the total leverage ratio exposure measure, they shall be reported as a positive amount. 11 Adjustments for prudent valuation adjustments and specific and general provisions that have reduced Tier 1 capital. This adjustment reduces the leverage ratio exposure measure by the amount of prudent valuation adjustments and by the amount of specific and general provisions that have reduced Tier 1 capital as determined by SLEV6.2 and SLEV7.1.2 and SLEV7.4.2 (iv), respectively. This adjustment shall be reported as a negative amount. 12 Any other adjustments. If these adjustments lead to an increase in the exposure, institutions shall report this as a positive amount. If these adjustments lead to a decrease in exposure, the institutions shall disclose this as a negative amount. 13 The leverage ratio exposure, which should be the sum of the previous items. Linkages across templates [LR1:13/a] is equal to [LR2:24/a] (depending on basis of calculation)

Page Number 138 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LR2- Leverage ratio common disclosure template Purpose: To provide a detailed breakdown of the components of the leverage ratio denominator, as well as information on the actual leverage ratio, minimum requirements and buffers. Scope of application: The table is mandatory for all banks. Content: Quantitative information. Disclosures should be on a quarter-end basis except where explicitly noted in the instructions for certain rows. However, banks may, subject to approval from or due to requirements specified by SAMA, use more frequent calculations (eg daily or monthly averaging). Banks are required to include the frequency of calculation for their disclosures (eg quarter-end, daily averaging or monthly averaging, or a combination thereof). Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks must describe the key factors that have had a material impact on the leverage ratio for this reporting period compared with the previous reporting period. Banks must also describe the key factors that explain any material differences between the amounts of securities financing transactions (SFTs) that are included in the bank’s Pillar 1 leverage ratio exposure measure and the mean values of SFTs that are disclosed in row 28. a b T T-1 On-balance sheet exposures 1 On-balance sheet exposures (excluding derivatives and securities financing transactions (SFTs), but including collateral) 2 Gross-up for derivatives collateral provided where deducted from balance sheet assets pursuant to the operative accounting framework 3 (Deductions of receivable assets for cash variation margin provided in derivatives transactions) 4 (Adjustment for securities received under securities financing transactions that are recognised as an asset) 5 (Specific and general provisions associated with on-balance sheet exposures that are deducted from Basel III Tier 1 capital) 6 (Asset amounts deducted in determining Basel III Tier 1 capital and regulatory adjustments) 7 Total on-balance sheet exposures (excluding derivatives and SFTs) (sum of rows 1 to 6) Derivative exposures 8 Replacement cost associated with all derivatives transactions (where applicable net of eligible cash variation margin and/or with bilateral netting) 9 Add-on amounts for potential future exposure associated with all derivatives transactions 10 (Exempted central counterparty (CCP) leg of client-cleared trade exposures) 11 Adjusted effective notional amount of written credit derivatives 12 (Adjusted effective notional offsets and add-on deductions for written credit derivatives) 13 Total derivative exposures (sum of rows 8 to 12) Securities financing transaction exposures 14 Gross SFT assets (with no recognition of netting), after adjustment for sale accounting transactions 15 (Netted amounts of cash payables and cash receivables of gross SFT assets) 16 Counterparty credit risk exposure for SFT assets 17 Agent transaction exposures 18 Total securities financing transaction exposures (sum of rows 14 to 17) Other off-balance sheet exposures 19 Off-balance sheet exposure at gross notional amount

Page Number 139 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 20 (Adjustments for conversion to credit equivalent amounts) 21 (Specific and general provisions associated with off-balance sheet exposures deducted in determining Tier 1 capital) 22 Off-balance sheet items (sum of rows 19 to 21) Capital and total exposures 23 Tier 1 capital 24 Total exposures (sum of rows 7, 13, 18 and 22) Leverage ratio 25 Leverage ratio (including the impact of any applicable temporary exemption of central bank reserves) 25a Leverage ratio (excluding the impact of any applicable temporary exemption of central bank reserves) 26 National minimum leverage ratio requirement 27 Applicable leverage buffers Disclosures of mean values 28 Mean value of gross SFT assets, after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables 29 Quarter-end value of gross SFT assets, after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables 30 Total exposures (including the impact of any applicable temporary exemption of central bank reserves) incorporating mean values from row 28 of gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables) 30a Total exposures (excluding the impact of any applicable temporary exemption of central bank reserves) incorporating mean values from row 28 of gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables) 31 Basel III leverage ratio (including the impact of any applicable temporary exemption of central bank reserves) incorporating mean values from row 28 of gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables) 31a Basel III leverage ratio (excluding the impact of any applicable temporary exemption of central bank reserves) incorporating mean values from row 28 of gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables) Definitions and instructions SFTs: transactions such as repurchase agreements, reverse repurchase agreements, securities lending and borrowing, and margin lending transactions, where the value of the transactions depends on market valuations and the transactions are often subject to margin agreements. Capital measure: The capital measure for the leverage ratio is the Tier 1 capital of the risk-based capital framework as defined in the definition of capital standard (SACAP) taking account of the transitional arrangements. Row Number Explanation 1 Banks must include all balance sheet assets in their exposure measure, including on balance sheet derivatives collateral and collateral for SFTs, with the exception of on balance sheet derivative and SFT assets that are included in rows 8 to 18. Derivatives and SFTs collateral refer to either collateral received or collateral provided (or any associated receivable asset) accounted as a balance sheet asset. Amounts are to be reported in accordance with SLEV7.1.1 to SLEV7.1.4 and, where applicable, SLEV6.4 and SLEV6.6. 2 Grossed-up amount of any collateral provided in relation to derivative exposures where the provision of that collateral has reduced the value of the balance sheet assets under the bank's operative accounting framework, in accordance with SLEV7.2.3(ii). 3 Deductions of receivable assets in the amount of the cash variation margin provided in derivatives transactions where the posting of cash variation margin has resulted in the recognition of a receivable asset under the bank's operative accounting framework. As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures. 4 Adjustment for securities received under a securities financing transaction where the bank has recognised the securities as an asset on its balance sheet. These amounts are to be excluded from the exposure measure in accordance with SLEV7.3.3(i). As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures.

Page Number 140 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 5 Amounts of general and specific provisions that are deducted from Tier 1 capital which may be deducted from the exposure measure in accordance with SLEV7.1.2. As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures. 6 All other balance sheet asset amounts deducted from Tier 1 capital and other regulatory adjustments associated with on-balance sheet assets as specified in SLEV6.2. As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures. 7 Sum of rows 1 to 6. 8 Replacement cost (RC) associated with all derivatives transactions (including exposures resulting from direct transactions between a client and a CCP where the bank guarantees the performance of its clients' derivative trade exposures to the CCP). Where applicable, this amount should be net of cash variation margin received (as set out in SLEV7.2.4(ii), and with bilateral netting (as set out in SLEV7.2.2(vi) to (vii). This amount should be reported with the 1.4 alpha factor applied as specified in SLEV7.2.2 (ii) and (v) 9 Add-on amount for the potential future exposure (PFE) of all derivative exposures calculated in accordance with SLEV7.2.2 (ii) and (v). This amount should be reported with the 1.4 alpha factor applied as specified in SLEV7.2.2 (ii) and (v). 10 Trade exposures associated with the CCP leg of derivatives transactions resulting from client-cleared transactions or which the clearing member, based on the contractual arrangements with the client, is not obligated to reimburse the client in respect of any losses suffered due to changes in the value of its transactions in the event that a qualifying central counterparty (QCCP) defaults. As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures. 11 The effective notional amount of written credit derivatives which may be reduced by the total amount of negative changes in fair value amounts that have been incorporated into the calculation of Tier 1 capital with respect to written credit derivatives according to SLEV7.2.9. 12 This row comprises:  The amount by which the notional amount of a written credit derivative is reduced by a purchased credit derivative on the same reference name according to SLEV7.2.9.  The deduction of add-on amounts for PFE in relation to written credit derivatives determined in accordance with SLEV7.2.15. As the adjustments in this row reduce the exposure measure, they shall be reported as negative figures. 13 Sum of rows 8 to 12. 14 The gross amount of SFT assets without recognition of netting, other than novation with QCCPs, determined in accordance with SLEV7.3.3, adjusted for any sales accounting transactions in accordance with SLEV7.3.4. 15 The cash payables and cash receivables of gross SFT assets with netting determined in accordance with SLEV7.3.3(i)(b). As these adjustments reduce the exposure measure, they shall be reported as negative figures. 16 The amount of the counterparty credit risk add-on for SFTs determined in accordance with SLEV7.3.3(ii). 17 The amount for which the bank acting as an agent in a SFT has provided an indemnity or guarantee determined in accordance with SLEV7.3.5. 18 Sum of rows 14 to 17. 19 Total off-balance sheet exposure amounts (excluding off-balance sheet exposure amounts associated with SFT and derivative transactions) on a gross notional basis, before any adjustment for credit conversion factors (CCFs). 20 Reduction in gross amount of off-balance sheet exposures due to the application of CCFs as specified in SLEV7.4.3(iv) to (x). As these adjustments reduce the exposure measure, they shall be reported as negative figures. 21 Amounts of specific and general provisions associated with off-balance sheet exposures that are deducted from Tier 1 capital, the absolute value of which is not to exceed the sum of rows 19 and 20. As these adjustments reduce the exposure measure, they shall be reported as negative figures. 22 Sum of rows 19 to 21. 23 The amount of Tier 1 capital of the risk-based capital framework as defined in the definition of capital standard (SACAP) taking account of the transitional arrangements. 24 Sum of rows 7, 13, 18 and 22. 25 The leverage ratio is defined as the Tier 1 capital measure divided by the exposure measure, with this ratio expressed as a percentage. 25a If a bank’s leverage ratio exposure measure is subject to a temporary exemption of central bank reserves, this ratio is defined as the Tier 1 capital measure divided by the sum of the exposure measure and the amount of the central bank reserves exemption, with this ratio expressed as a percentage. If the bank’s leverage ratio exposure measure is not subject to a temporary exemption of central bank reserves, this ratio will be identical to the ratio reported in row 25. 26 The minimum leverage ratio requirement applicable to the bank. 27 Total applicable leverage buffers. To include the G-SIB leverage ratio buffer requirement and any other applicable buffers. 28 Mean of the sums of rows 14 and 15, based on the sums calculated as of each day of the reporting quarter 29 If rows 14 and 15 are based on quarter-end values, this amount is the sum of rows 14 and 15. If rows 14 and 15 are based on averaged values, this amount is the sum of quarter-end values corresponding to the content of rows 14 and 15. 30 Total exposure measure (including the impact of any applicable temporary exemption of central bank reserves), using mean values calculated as of each day of the reporting quarter for the amounts of the exposure measure associated with gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables).

Page Number 141 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 30a Total exposure measure (excluding the impact of any applicable temporary exemption of central bank reserves), using mean values calculated as of each day of the reporting quarter for the amounts of the exposure measure associated with gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables). If the bank’s leverage ratio exposure measure is not subject to a temporary exemption of central bank reserves, this value will be identical to the value reported in row 30. 31 Tier 1 capital measure divided by the exposure measure (including the impact of any applicable temporary exemption of central bank reserves), using mean values calculated as of each day of the reporting quarter for the amounts of the exposure measure associated with gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables). 31a Tier 1 capital measure divided by the exposure measure (excluding the impact of any applicable temporary exemption of central bank reserves), using mean values calculated as of each day of the reporting quarter for the amounts of the exposure measure associated with gross SFT assets (after adjustment for sale accounting transactions and netted of amounts of associated cash payables and cash receivables). If the bank’s leverage ratio exposure measure is not subject to a temporary exemption of central bank reserves, this ratio will be identical to the ratio reported in row 31. Linkages across templates (valid only if the relevant rows are all disclosed on a quarter-end basis) [LR2:23/a] is equal to [KM1:2/a] [LR2:24/a] is equal to [KM1:13/a] [LR2:25/a] is equal to [KM1:14/a] [LR2:25a/a] is equal to [KM1:14b/a] [LR2:31/a] is equal to [KM1:14c/a] [LR2:31a/a] is equal to [KM1:14d/a]

Page Number 142 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 28. Liquidity: 28.1 The disclosure requirements set out in this chapter are: 28.1.1 Table LIQA – Liquidity risk management 28.1.2 Template LIQ1 – Liquidity coverage ratio (LCR) 28.1.3 Template LIQ2 – Net stable funding ratio (NSFR) 28.2 Table LIQA provides information on a bank’s liquidity risk management framework which it considers relevant to its business model and liquidity risk profile, organisation and functions involved in liquidity risk management. Template LIQ1 presents a breakdown of a bank’s cash outflows and cash inflows, as well as its available high-quality liquid assets under its LCR. Template LIQ2 provides details of a bank’s NSFR and selected details of its NSFR components.

Page Number 143 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Table LIQA - Liquidity risk management Purpose: Enable users of Pillar 3 data to make an informed judgment about the soundness of a bank's liquidity risk management framework and liquidity position. Scope of application: The table is mandatory for all banks. Content: Qualitative and quantitative information. Frequency: Annual. Format: Flexible. Banks may choose the relevant information to be provided depending upon their business models and liquidity risk profiles, organisation and functions involved in liquidity risk management. Below are examples of elements that banks may choose to describe, where relevant: Qualitative disclosures (a) Governance of liquidity risk management, including: risk tolerance; structure and responsibilities for liquidity risk management; internal liquidity reporting; and communication of liquidity risk strategy, policies and practices across business lines and with the board of directors. (b) Funding strategy, including policies on diversification in the sources and tenor of funding, and whether the funding strategy is centralised or decentralised. (c) Liquidity risk mitigation techniques. (d) An explanation of how stress testing is used. (e) An outline of the bank's contingency funding plans. Quantitative disclosures (f) Customised measurement tools or metrics that assess the structure of the bank's balance sheet or that project cash flows and future liquidity positions, taking into account off-balance sheet risks which are specific to that bank. (g) Concentration limits on collateral pools and sources of funding (both products and counterparties). (h) Liquidity exposures and funding needs at the level of individual legal entities, foreign branches and subsidiaries, taking into account legal, regulatory and operational limitations on the transferability of liquidity. (i) Balance sheet and off-balance sheet items broken down into maturity buckets and the resultant liquidity gaps.

Page Number 144 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LIQ1: Liquidity Coverage Ratio (LCR) Purpose: Present the breakdown of a bank's cash outflows and cash inflows, as well as its available high-quality liquid assets (HQLA), as measured and defined according to the LCR standard. Scope of application: The template is mandatory for all banks. Content: Data must be presented as simple averages of daily observations over the previous quarter (ie the average calculated over a period of, typically, 90 days) in the local currency. Frequency: Quarterly. Format: Fixed. Accompanying narrative: Banks must publish the number of data points used in calculating the average figures in the template. In addition, a bank should provide sufficient qualitative discussion to facilitate users' understanding of its LCR calculation. For example, where significant to the LCR, banks could discuss:  the main drivers of their LCR results and the evolution of the contribution of inputs to the LCR's calculation over time;  intra-period changes as well as changes over time;  the composition of HQLA;  concentration of funding sources;  currency mismatch in the LCR; and  other inflows and outflows in the LCR calculation that are not captured in the LCR common template but which the institution considers to be relevant for its liquidity profile. a b Total unweighted value (average) Total weighted value (average) High-quality liquid assets 1 Total HQLA Cash outflows 2 Retail deposits and deposits from small business customers, of which: 3 Stable deposits 4 Less stable deposits 5 Unsecured wholesale funding, of which: 6 Operational deposits (all counterparties) and deposits in networks of cooperative banks 7 Non-operational deposits (all counterparties) 8 Unsecured debt 9 Secured wholesale funding 10 Additional requirements, of which: 11 Outflows related to derivative exposures and other collateral requirements 12 Outflows related to loss of funding on debt products 13 Credit and liquidity facilities 14 Other contractual funding obligations 15 Other contingent funding obligations 16 TOTAL CASH OUTFLOWS Cash inflows 17 Secured lending (eg reverse repos) 18 Inflows from fully performing exposures 19 Other cash inflows 20 TOTAL CASH INFLOWS Total adjusted value 21 Total HQLA 22 Total net cash outflows 23 Liquidity Coverage Ratio (%)

Page Number 145 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 General explanations Figures entered in the template must be averages of the observations of individual line items over the financial reporting period (ie the average of components and the average LCR over the most recent three months of daily positions, irrespective of the financial reporting schedule). The averages are calculated after the application of any haircuts, inflow and outflow rates and caps, where applicable. For example: where T equals the number of observations in period Qi. Weighted figures of HQLA (row 1, third column) must be calculated after the application of the respective haircuts but before the application of any caps on Level 2B and Level 2 assets. Unweighted inflows and outflows (rows 2-8, 11-15 and 17-20, second column) must be calculated as outstanding balances. Weighted inflows and outflows (rows 2-20, third column) must be calculated after the application of the inflow and outflow rates. Adjusted figures of HQLA (row 21, third column) must be calculated after the application of both (i) haircuts and (ii) any applicable caps (ie cap on Level 2B and Level 2 assets). Adjusted figures of net cash outflows (row 22, third column) must be calculated after the application of both (i) inflow and outflow rates and (ii) any applicable cap (ie cap on inflows). The LCR (row 23) must be calculated as the average of observations of the LCR:

Not all reported figures will sum exactly, particularly in the denominator of the LCR. For example, "total net cash outflows" (row 22) may not be exactly equal to "total cash outflows" minus "total cash inflows" (row 16 minus row 20) if the cap on inflows is binding. Similarly, the disclosed LCR may not be equal to an LCR computed on the basis on the average values of the set of line items disclosed in the template. Definitions and instructions: Columns Unweighted values must be calculated as outstanding balances maturing or callable within 30 days (for inflows and outflows). Weighted values must be calculated after the application of respective haircuts (for HQLA) or inflow and outflow rates (for inflows and outflows). Adjusted values must be calculated after the application of both (i) haircuts and inflow and outflow rates and (ii) any applicable caps (ie cap on Level 2B and Level 2 assets for HQLA and cap on inflows). Row number Explanation Relevant paragraph(s) of SLCR, refer to Illustrative Summary of the Amended LCR for the Factors of each item. 1 Sum of all eligible HQLA, as defined in the standard, before the application of any limits, excluding assets that do not meet the operational requirements, and including, where applicable, assets qualifying under alternative liquidity approaches. SLCR28 to SLCR48, SLCR55, SLCR58 to SLCR62, SLCR57 2 Retail deposits and deposits from small business customers are the sum of stable deposits, less stable deposits and any other funding sourced from (i) natural persons and/or (ii) small business customers (as defined by SCRE10.18 and SCRE10.19). SLCR73 to SLCR84, SLCR89 to SLCR92 3 Stable deposits include deposits placed with a bank by a natural person and unsecured wholesale funding provided by small business customers, defined as "stable" in the standard. SLCR73 to SLCR78, SLCR89 to SLCR90 4 Less stable deposits include deposits placed with a bank by a natural person and unsecured wholesale funding provided by small business customers, not defined as "stable" in the standard. SLCR73 and SLCR74, SLCR79 to SLCR81, SLCR89 to SLCR90 5 Unsecured wholesale funding is defined as those liabilities and general obligations from customers other than natural persons and small business customers that are not collateralised. SLCR93 to SLCR111 6 Operational deposits include deposits from bank clients with a substantive dependency on the bank where deposits are required for certain activities (ie clearing, custody or cash management activities). Deposits in institutional networks of cooperative banks include deposits of member institutions with the central institution or specialised central service providers. SLCR93 to SLCR106 7 Non-operational deposits are all other unsecured wholesale deposits, both insured and uninsured SLCR107 to SLCR109

Page Number 146 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 8 Unsecured debt includes all notes, bonds and other debt securities issued by the bank, regardless of the holder, unless the bond is sold exclusively in the retail market and held in retail accounts. SLCR110 9 Secured wholesale funding is defined as all collateralised liabilities and general obligations. SLCR112 to SLCR114 10 Additional requirements include other off-balance sheet liabilities or obligations SLCR112 and SLCR Attachment#2 row 228 to 238. 11 Outflows related to derivative exposures and other collateral requirements include expected contractual derivatives cash flows on a net basis. These outflows also include increased liquidity needs related to: downgrade triggers embedded in financing transactions, derivative and other contracts; the potential for valuation changes on posted collateral securing derivatives and other transactions; excess non-segregated collateral held at the bank that could contractually be called at any time; contractually required collateral on transactions for which the counterparty has not yet demanded that the collateral be posted; contracts that allow collateral substitution to non-HQLA assets; and market valuation changes on derivatives or other transactions. SLCR112 to SLCR Attachment#2 row 221 12 Outflows related to loss of funding on secured debt products include loss of funding on: asset-backed securities, covered bonds and other structured financing instruments; and asset-backed commercial paper, conduits, securities investment vehicles and other such financing facilities. SLCR Attachment#2 row 222 and 223. 13 Credit and liquidity facilities include drawdowns on committed (contractually irrevocable) or conditionally revocable credit and liquidity facilities. The currently undrawn portion of these facilities is calculated net of any eligible HQLA if the HQLA have already been posted as collateral to secure the facilities or that are contractually obliged to be posted when the counterparty draws down the facility. SLCR page 64 to SLCR Attachment#2 row 228 to 238. 14 Other contractual funding obligations include contractual obligations to extend funds within a 30-day period and other contractual cash outflows not previously captured under the standard. SLCR Attachment#2 row 240, 241, and 265. 15 Other contingent funding obligations, as defined in the standard. SLCR Attachment#2 page 69 to 71. 16 Total cash outflows: sum of rows 2-15. 17 Secured lending includes all maturing reverse repurchase and securities borrowing agreements. SLCR Attachment#2 a) page 71 to 72. 18 Inflows from fully performing exposures include both secured and unsecured loans or other payments that are fully performing and contractually due within 30 calendar days from retail and small business customers, other wholesale customers, operational deposits and deposits held at the centralised institution in a cooperative banking network. SLCR Attachment#2 row 301, 303, 306, and 307. 19 Other cash inflows include derivatives cash inflows and other contractual cash inflows. SLCR Attachment#2 row 316, to 317. 20 Total cash inflows: sum of rows 17-19 21 Total HQLA (after the application of any cap on Level 2B and Level 2 assets). SLCR28 to SLCR46, SLCR47 to SLCR annex 1(4), SLCR49 to SLCR54 22 Total net cash outflows (after the application of any cap on cash inflows). SLCR69 23 Liquidity Coverage Ratio (after the application of any cap on Level 2B and Level 2 assets and caps on cash inflows). SLCR22

Page Number 147 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template LIQ2: Net Stable Funding Ratio (NSFR) Purpose: Provide details of a bank's NSFR and selected details of its NSFR components. Scope of application: The template is mandatory for all banks. Content: Data must be presented as quarter-end observations in the local currency. Frequency: Semiannual (but including two data sets covering the latest and the previous quarter-ends). Format: Fixed. Accompanying narrative: Banks should provide a sufficient qualitative discussion on the NSFR to facilitate an understanding of the results and the accompanying data. For example, where significant, banks could discuss: (a) drivers of their NSFR results and the reasons for intra-period changes as well as the changes over time (eg changes in strategies, funding structure, circumstances); and (b) composition of the bank's interdependent assets and liabilities (as defined in SNSF8) and to what extent these transactions are interrelated. (a)the a b c d e (In currency amount) Unweighted value by residual maturity Weighted value No maturity < 6 months 6 months to < 1 year ≥ 1 year Available stable funding (ASF) item 1 Capital: 2 Regulatory capital 3 Other capital instruments 4 Retail deposits and deposits from small business customers: 5 Stable deposits 6 Less stable deposits 7 Wholesale funding: 8 Operational deposits 9 Other wholesale funding 10 Liabilities with matching interdependent assets 11 Other liabilities: 12 NSFR derivative liabilities 13 All other liabilities and equity not included in the above categories 14 Total ASF Required stable funding (RSF) item 15 Total NSFR high-quality liquid assets (HQLA) 16 Deposits held at other financial institutions for operational purposes 17 Performing loans and securities: 18 Performing loans to financial institutions secured by Level 1 HQLA 19 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions

Page Number 148 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 20 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks and PSEs, of which: 21 With a risk weight of less than or equal to 35% under the Basel II standardised approach for credit risk 22 Performing residential mortgages, of which: 23 With a risk weight of less than or equal to 35% under the Basel II standardised approach for credit risk 24 Securities that are not in default and do not qualify as HQLA, including exchange-traded equities 25 Assets with matching interdependent liabilities 26 Other assets: 27 Physical traded commodities, including gold 28 Assets posted as initial margin for derivative contracts and contributions to default funds of central counterparties 29 NSFR derivative assets 30 NSFR derivative liabilities before deduction of variation margin posted 31 All other assets not included in the above categories 32 Off-balance sheet items 33 Total RSF 34 Net Stable Funding Ratio (%) General instructions for completion of the NSFR disclosure template Rows in the template are set and compulsory for all banks. Key points to note about the common template are:  Dark grey rows introduce a section of the NSFR template.  Light grey rows represent a broad subcomponent category of the NSFR in the relevant section.  Unshaded rows represent a subcomponent within the major categories under ASF and RSF items. As an exception, rows 21 and 23 are subcomponents of rows 20 and 22, respectively. Row 17 is the sum of rows 18, 19, 20, 22 and 24.  No data should be entered for the cross-hatched cells.  Figures entered in the template should be the quarter-end observations of individual line items.  Figures entered for each RSF line item should include both unencumbered and encumbered amounts.  Figures entered in unweighted columns are to be assigned on the basis of residual maturity and in accordance with SNSF5. Items to be reported in the "no maturity" time bucket do not have a stated maturity. These may include, but are not limited to, items such as capital with perpetual maturity, non-maturity deposits, short positions, open maturity positions, non-HQLA equities and physical traded commodities. Explanation of each row of the common disclosure template Row number Explanation Relevant paragraph(s) of SNSF 1 Capital is the sum of rows 2 and 3. 2 Regulatory capital before the application of capital deductions, as defined in SACAP2.1. Capital instruments reported should meet all requirements outlined in SACAP2 and should only include amounts after transitional arrangements in SACAP5 have expired under fully implemented Basel III standards (ie as in 2022). SNSF6:

• Receiving a 100% ASF (a).
• Receiving a 50% ASF (d).
• Receiving a 0% ASF (a). 3 Total amount of any capital instruments not included in row 2. SNSF6:
• Receiving a 100% ASF (b).
• Receiving a 50% ASF (d).
• Receiving a 0% ASF (a).

Page Number 149 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 4 Retail deposits and deposits from small business customers, as defined in the SLCR73-82 and SLCR89-92, are the sum of row 5 and 6. 5 Stable deposits comprise "stable" (as defined in SLCR75 to SLCR78) non-maturity (demand) deposits and/or term deposits provided by retail and small business customers. SNSF6:

• Receiving a100% ASF (c).
• Receiving a 95% ASF. 6 Less stable deposits comprise "less stable" (as defined in SLCR79 to SLCR81) non￾maturity (demand) deposits and/or term deposits provided by retail and small business customers. SNSF6:
• Receiving a 100% ASF (c).
• Receiving a 90% ASF. 7 Wholesale funding is the sum of rows 8 and 9. 8 Operational deposits: as defined in SLCR93 to SLCR104, including deposits in institutional networks of cooperative banks. SNSF6:
• Receiving a 100% ASF (c).
• Receiving a 50% ASF (b).
• Receiving a 0% ASF (a).
• Including footnote 17. 9 Other wholesale funding includes funding (secured and unsecured) provided by non-financial corporate customer, sovereigns, public sector entities (PSEs), multilateral and national development banks, central banks and financial institutions. SNSF6:
• Receiving a 100% ASF (c).
• Receiving a 50% ASF (a).
• Receiving a 50% ASF (c).
• Receiving a 50% ASF (d).
• Receiving a 0% ASF (a). 10 Liabilities with matching interdependent assets. SNSF8 11 Other liabilities are the sum of rows 12 and 13. 12 In the unweighted cells, report NSFR derivatives liabilities as calculated according to NSFR paragraphs 19 and 20. There is no need to differentiate by maturities. [The weighted value under NSFR derivative liabilities is cross-hatched given that it will be zero after the 0% ASF is applied.] SNSF5(A), SNSF6:
• Receiving a 0% ASF (c). 13 All other liabilities and equity not included in above categories. SNSF6:
• Receiving a 0% ASF (a).
• Receiving a 0% ASF (b).
• Receiving a 0% ASF (d). 14 Total available stable funding (ASF) is the sum of all weighted values in rows 1, 4, 7, 10 and 11. 15 Total HQLA as defined in SLCR45, SLCR50] to SLCR54, SLCR55, SLCR63, SLCR65, SLCR58, SLCR62, SLCR67, (encumbered and unencumbered), without regard to LCR operational requirements and LCR caps on Level 2 and Level 2B assets that might otherwise limit the ability of some HQLA to be included as eligible in calculation of the LCR: (a)Encumbered assets including assets backing securities or covered bonds. (b)Unencumbered means free of legal, regulatory, contractual or other restrictions on the ability of the bank to liquidate, sell, transfer or assign the asset. SNSF Footnote 9, SNSF7:
• Assigned a 0% ASF (a).
• Assigned a 0% ASF (b).
• Assigned a 5% ASF.
• Assigned a 15% ASF (a).
• Assigned a 50% ASF (a).
• Assigned a 50% ASF (b).
• Assigned a 85% ASF (a).
• Assigned a 100% ASF (a). 16 Deposits held at other financial institutions for operational purposes as defined in SLCR93 to SLCR104. SNSF7:
• Assigned a 50% ASF (d). 17 Performing loans and securities are the sum of rows 18, 19, 20, 22 and 24. 18 Performing loans to financial institutions secured by Level 1 HQLA, as defined in the SLCR50(c) to SLCR50(e). SNSF7:
• Assigned a 10% ASF.
• Assigned a 50% ASF (c).
• Assigned a 100% ASF (c). 19 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions. SNSF7:
• Assigned a 50% ASF (b).
• Assigned a 50% ASF (c).
• Assigned a 100% ASF (c). 20 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks and PSEs. SNSF7:
• Assigned a 0% ASF (c).
• Assigned a 50% ASF (d).
• Assigned a 65% ASF (b).
• Assigned a 85% ASF (b).
• Assigned a 65% ASF (a).

Page Number 150 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 21 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks and PSEs with risk weight of less than or equal to 35% under the Standardised Approach. SNSF7:

• Assigned a 0% ASF (c).
• Assigned a 50% ASF (d).
• Assigned a 65% ASF (b).
• Assigned a 100% ASF (a). 22 Performing residential mortgages. SNSF7:
• Assigned a 50% ASF (e).
• Assigned a 65% ASF (a).
• Assigned a 85% ASF (b).
• Assigned a 100% ASF (a). 23 Performing residential mortgages with risk weight of less than or equal to 35% under the Standardised Approach. SNSF7:
• Assigned a 50% ASF (e).
• Assigned a 65% ASF (a).
• Assigned a 100% ASF (a). 24 Securities that are not in default and do not qualify as HQLA including exchange￾traded equities. SNSF7:
• Assigned a 50% ASF (e).
• Assigned a 85% ASF (c).
• Assigned a 100% ASF (a). 25 Assets with matching interdependent liabilities. SNSF8 26 Other assets are the sum of rows 27-31. 27 Physical traded commodities, including gold. SNSF7:
• Assigned a 85% ASF (d) 28 Cash, securities or other assets posted as initial margin for derivative contracts and contributions to default funds of central counterparties. SNSF7:
• Assigned a 50% ASF (a) 29 In the unweighted cell, report NSFR derivative assets, as calculated according to SNSF5 (B) “Calculation of derivative asset amounts”. There is no need to differentiate by maturities. In the weighted cell, if NSFR derivative assets are greater than NSFR derivative liabilities, (as calculated according to SNSF5 (A) “Calculation of derivative liability amounts”, report the positive difference between NSFR derivative assets and NSFR derivative liabilities. SNSF5 (B) “Calculation of derivative asset amounts” and SNSF7:
• Assigned a 100% ASF (b). 30 In the unweighted cell, report derivative liabilities as calculated according to SNSF5 (A) “Calculation of derivative liability amounts”, ie before deducting variation margin posted. There is no need to differentiate by maturities. In the weighted cell, report 20% of derivatives liabilities' unweighted value (subject to 100% RSF). SNSF5 (A) “Calculation of derivative liability amounts” and SNSF7:
• Assigned a 100% ASF (d). 31 All other assets not included in the above categories. SNSF7:
• Assigned a 0% ASF (d).
• Assigned a 100% ASF (c). 32 Off-balance sheet items. SNSF9 33 Total RSF is the sum of all weighted value in rows 15, 16, 17, 25, 26 and 32. 34 Net Stable Funding Ratio (%), as stated SNSF SNSF4

Page Number 151 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 29. Worked examples: Interpretation of the effective date - illustration 29.1 The following table illustrates the application of paragraph section 3.2 by specifying the first applicable fiscal period for disclosure requirements according to their frequency, using as example a bank with a fiscal year coinciding with the calendar year (case 1), a bank with a fiscal year ending in October of the same calendar year (case 2), and a bank with a fiscal year ending in March of the following calendar year (case 3). 29.1.1 Banks with fiscal year from 1 January to 31 December: a. The first fiscal quarter subject to quarterly disclosure requirements with an "effective as of" date of 1 January of a given year will be the first fiscal quarter, ending in 31 March of that calendar year. The first fiscal quarter subject to quarterly disclosure requirements with an "effective as of" date of 31 December of a given year will be the fourth fiscal quarter, ending in 31 December of that calendar year. b. The first fiscal semester subject to semi-annual disclosure requirements with an "effective as of" date of 1 January of a given year will be the first fiscal semester, ending in 31 June of that calendar year. The first fiscal semester subject to semiannual disclosure requirements with an "effective as of" date of 31 December of a given year will be the second fiscal semester, ending in 31 December of that calendar year. c. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 1 January of a given year will be the fiscal year starting in 1 January of that calendar year. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 31 December of a given year will be the fiscal year ending in that same 31 December of that calendar year. 29.1.2 Banks with fiscal year from 1 November of the previous calendar year to 31 October: a. The first fiscal quarter subject to quarterly disclosure requirements with an "effective as of" date of 1 January of a given year will be the first fiscal quarter, ending in 31 January of that calendar year. The first fiscal quarter subject to quarterly disclosure requirements with an "effective

Page Number 152 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 as of" date of 31 December of a given year will be the first fiscal quarter, ending in 31 January of the following calendar year. b. The first fiscal semester subject to semiannual disclosure requirements with an "effective as of" date of 1 January of a given year will be the first fiscal semester, ending in 31 April of that calendar year. The first fiscal semester subject to semiannual disclosure requirements with an "effective as of" date of 31 December of a given year will be the first fiscal semester, ending in 31 April of the following calendar year. c. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 1 January of a given year will be the fiscal year starting in 1 November of the previous calendar year. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 31 December of a given year will be the fiscal year ending in 31 October of the following calendar year. 29.1.3 Banks with fiscal year from 1 April to 31 March of the next calendar year: a. The first fiscal quarter subject to quarterly disclosure requirements with an "effective as of" date of 1 January of a given year will be the fourth fiscal quarter, ending in 31 March of that calendar year. The first fiscal quarter subject to quarterly disclosure requirements with an "effective as of" date of 31 December of a given year will be the third fiscal quarter, ending in 31 December of that calendar year. b. The first fiscal semester subject to semiannual disclosure requirements with an "effective as of" date of 1 January of a given year will be the second fiscal semester, ending in 31 March of that calendar year. The first fiscal semester subject to semiannual disclosure requirements with an "effective as of" date of 31 December of a given year will be the second fiscal semester, ending in 31 March of the following calendar year. c. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 1 January of a given year will be the fiscal year starting in 1 April of the previous calendar year. The first fiscal year subject to annual disclosure requirements with an "effective as of" date of 31 December of a given year will be the fiscal year ending in 31 March of the following calendar year.

Page Number 153 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CR3 – illustration 29.2 The following scenarios illustrate how Template CR3 should be completed. a b c d e Unsecured exposures: carrying amount Exposures to be secured Exposures secured by collateral Exposures secured by financial guarantees Exposures secured by credit derivatives (i) One secured loan of 100 with collateral of 120 (after haircut) and guarantees of 50 (after haircut), if bank expects that guarantee would be extinguished first 0 100 50 50 0 (ii) One secured loan of 100 with collateral of 120 (after haircut) and guarantees of 50 (after haircut), if bank expects that collateral would be extinguished first 0 100 100 (iii) Secured exposure of 100 partially secured: 50 by collateral (after haircut), 30 by financial guarantee (after haircut), none by credit derivatives 0 100 50 30 0 (iv) One unsecured loan of 20 and one secured loan of 80. The secured loan is over-collateralised: 60 by collateral (after haircut), 90 by guarantee (after haircut), none by credit derivatives. If bank expects that collateral would be extinguished first. 20 80 60 20 0 (v) One unsecured loan of 20 and one secured loan of 80. The secured loan is under-collaterised: 50 by collateral (after haircut), 20 by guarantee (after haircut), none by credit derivatives. 20 80 50 20 0 Definitions Exposures unsecured- carrying amount: carrying amount of exposures (net of allowances/impairments) that do not benefit from a credit risk mitigation technique. Exposures to be secured: carrying amount of exposures which have at least one credit risk mitigation mechanism (collateral, financial guarantees, credit derivatives) associated with them. The allocation of the carrying amount of multi-secured exposures to their different credit risk mitigation mechanisms is made by order of priority, starting with the credit risk mitigation mechanism expected to be called first in the event of loss, and within the limits of the carrying amount of the secured exposures. Exposures secured by collateral: carrying amount of exposures (net of allowances/impairments) partly or totally secured by collateral. In case an exposure is secured by collateral and other credit risk mitigation mechanism(s), the carrying amount of the exposures secured by collateral is the remaining share of the exposure secured by collateral after consideration of the shares of the exposure already secured by other mitigation mechanisms expected to be called beforehand in the event of a loss, without considering overcollateralisation. Exposures secured by financial guarantees: carrying amount of exposures (net of allowances/impairments) partly or totally secured by financial guarantees. In case an exposure is secured by financial guarantees and other credit risk mitigation mechanism, the carrying amount of the exposure secured by financial guarantees is the remaining share of the exposure secured by financial guarantees after consideration of the shares of the exposure already secured by other mitigation mechanisms expected to be called beforehand in the event of a loss, without considering overcollateralisation. Exposures secured by credit derivatives: carrying amount of exposures (net of allowances/impairments) partly or totally secured by credit derivatives. In case an exposure is secured by credit derivatives and other credit risk mitigation mechanism(s), the carrying amount of the exposure secured by credit derivatives is the remaining share of the exposure secured by credit derivatives after consideration of the shares of the exposure already secured by other mitigation mechanisms expected to be called beforehand in the event of a loss, without considering overcollateralisation.

Page Number 154 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template CCR5 - illustration 29.3 The case below illustrates the cash and security legs of two securities lending transactions in Template CCR5: 29.3.1 Repo on foreign sovereign debt with 50 SAR cash received and 55 SAR collateral posted 29.3.2 Reverse repo on domestic sovereign debt with 80 SAR cash paid and 90 SAR collateral received e f Collateral used in securities financing transactions (SFTs) Fair value of collateral received Fair value of posted collateral Cash - domestic currency 80 Cash - other currencies 50 Domestic sovereign debt 90 Other sovereign debt 55

Total 140 135

Page Number 155 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 Template MR2 – illustration 29.4 The paragraphs below describe the relevant provisions for components of IMA capital requirement calculations. 29.4.1 The aggregate capital requirement for approved and eligible trading desks (TDs) (IMAG,A) according to SMAR13.43 is defined as: CA + DRC + Capital surcharge. 29.4.2 According to SMAR13.41 CA is defined as: 29.4.3 According to SMAR13.22 DRC is defined as the greater of: (1) the average of the DRC requirement model measures over the previous 12 weeks; or (2) the most recent DRC requirement model measure. 29.4.4 According to SMAR13.45 Capital surcharge: is calculated as the difference between the aggregated standardised capital charges (SAG,A) and the aggregated internal models-based capital charges (IMA G,A = CA

• DRC) multiplied by a factor k. k and SAG,A are only recent while IMAG,A is average or recent -> Surcharge is average or recent. Example: illustration of the correct specification for row 12 in template MR2 29.5 Applying the formulae set out in SMAR13.22, SMAR13.41, SMAR13.43, and SMAR13.45 (marked in blue below), the relevant components for CA [either most recent (8+9) or average 1.5*8 +9] and DRC should take the respectively greater value of the “most recent” and “average” (marked in red). This results in the green and amber trading desks total capital requirements (including capital surcharge) of

a b Template MR2 Most recent Average

Page Number 156 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 8 IMCC 100 130 1.5 9 SES 130 100 (CA = max [IMCCt-1+SESt-1; mcIMCCavg+SESavg] (230) (295) 10 DRC 100 90 11 Capital surcharge for amber TD 90 12 Capital requirements for green and amber TDs (including capital surcharge) max[a=(8+9); b=(multiplier*8+9)]+max[a=10; b=10]+ 11 485 13 SA Capital requirements for TD ineligible to use IMA CU 20

Page Number 157 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 30. Annexure 1: Frequently asked questions (FAQ): Article # Question Answer Overview of risk management, key prudential metrics and RWA 12 For counterparty credit risk (CCR) (rows 6-9), the split requested is by the exposure at default (EAD) methodology classification used to determine exposure levels rather than the risk￾weighted asset (RWA) methodology classification used to determine risk weights. This contradicts the presentation for credit risk (rows 1–5) and securitisation (rows 16-19). Should line items be added (where necessary) to reconcile the disclosure to the total RWA? Template OV1 does not request CCR to be split by risk weighting methodology, but by EAD methodology. Nevertheless, banks should add extra rows, as appropriate, to split the exposures by risk weighting methodology*, in order to facilitate the reconciliation with the RWA changes in Template CCR7.

• RWA and capital requirements under the Standardised Approach for credit risk weighting are to be subdivided in the standardised approach for counterparty credit risk (SA-CCR) and the internal models method (IMM), and the same for RWA and capital requirements under the internal ratings-based (IRB) approach for credit risk weighting. Composition of capital TLAC 14 For the disclosure requirements under section 14 in the event a bank restates its prior year accounting balance sheet, does the bank restate the archived prior year reconciliation templates? The requirement to keep an archive of a minimum period also applies to the reconciliation template. As such, any prospective/retrospective restatement of the balance sheet would require similar amendments to be reflected in the reconciliation templates within the archive with a clear indication that such a revision has been made. Links between financial statements and regulatory exposures 16 In Template LI1, are assets deducted from regulatory capital in accordance with Basel III (eg goodwill and Elements which are deducted from a bank’s regulatory capital (eg goodwill and intangible assets and deferred tax assets) should be included in column (g), taking into consideration the different thresholds that apply where relevant. Assets should be disclosed

Page Number 158 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 intangible assets) disclosed in column (g)? for the amount that is actually deducted from capital. Some examples are shown below:

• Goodwill and intangible assets: the amount to be disclosed in column (g) is the amount of any goodwill or intangibles,* including any goodwill included in the valuation of significant investments in the capital of banking, financial and insurance entities that are outside the scope of regulatory consolidation. The amount disclosed in the assets rows is net of any associated deferred tax liability which would be extinguished if the intangible assets become impaired or derecognised under the relevant accounting standards. The associated deferred tax liability is also to be disclosed in the liabilities rows of column (g).
• Deferred tax assets: for all types of deferred tax assets to be deducted from own funds, the amount to be disclosed in column (g) is net of associated deferred tax liabilities that are eligible for netting. The associated deferred tax liabilities are to be disclosed in the liabilities rows of column (g). For deferred tax assets, for which the deduction is subject to a threshold, the amount disclosed in column (g) in the assets rows is the amount, net of any eligible deferred tax liability, above the threshold. The associated deferred tax liabilities are also to be disclosed in the liabilities rows of column (g).
• Defined benefit pension fund assets: the amount disclosed is net of any deferred tax liabilities which would be extinguished if the asset should become impaired or derecognised under the relevant accounting standards. These deferred tax liabilities are also to be disclosed in the liabilities rows of column (g).
• Investments in own shares (treasury stock) or own instruments of regulatory capital: when investments in own shares or own instruments of regulatory capital are not already derecognised under the relevant accounting standards, the deducted amount disclosed is net of short positions in the same underlying exposure or in the same underlying index allowed to be netted under the Basel framework. These short positions are also to be disclosed in the liabilities rows of column (g).

• Under SACAP4.1.1, subject to SAMA approval, IFRS definition of intangible assets to determine which assets are classified as intangible and are thus required to be deducted.

Page Number 159 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 In Template LI1, are exposures required to be 1,250% risk-weighted to be disclosed in column (g)? 1,250% risk-weighted exposures should be disclosed in the relevant credit risk or securitisation risk templates. Template LI1: Considering that the risk weighting framework bears on assets rather than liabilities, should all the liabilities be disclosed in column (g)? Should in any case deferred tax liabilities and defined benefit pension fund liabilities be included in column (g)? The liabilities disclosed in column (g) are all liabilities under the regulatory scope of consolidation, except for the following, which are disclosed in columns (c), (d), (e) and (f) as applicable: liabilities that are included in the determination of the exposure values in the market risk or the counterparty credit risk framework; and liabilities that are eligible under the Basel netting rules. What is the difference in Template LI2 between the required disclosure in row 2 (Liabilities carrying value amount under regulatory scope of consolidation) and row 6 (Differences due to different netting rules, other than those already included in row 2). Row 2 refers to balance sheet netting, while row 6 refers to incremental netting in application of the Basel rules (when not already covered by balance sheet netting). The netting rules under the Basel framework are different from the rules under the applicable accounting frameworks. The incremental netting in row 6 could represent an additional deduction from the net exposure value before application of the Basel netting rules (when those rules lead to more netting than the balance sheet netting in row 2) or a gross-up of the net exposure value when the off-balance sheet netting operated in row 2 is broader than what the Basel netting rules allow. How does the disclosure in Template LI2, in particular row 3 (total net amount under regulatory scope of consolidated) relate to accounting equity? The netting between assets and liabilities in Template LI2 does not lead to accounting equity under a regulatory scope of consolidation being disclosed in row 3. Assets and liabilities included in rows 1 and 2 are limited to those assets and liabilities that are taken into consideration in the regulatory framework. Other assets and liabilities not considered in the regulatory framework are to be disclosed in column (g) in Template LI1 and are consequently excluded from rows 1 and 2 of Template LI2. For Template LI2, how would the entry in row 10 (exposure amounts In general, under a regulatory scope of consolidation, the accounting carrying amount and the regulatory exposure value would vary due to the incidence of off-balance sheet elements,

Page Number 160 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 considered for regulatory purpose) differ from the balance sheet values under a regulatory scope of consolidation? Is it correct that there would be no differences to be explained, given that market risk does not have exposure values and the linkage for the other risk categories does not apply? provisions, and different netting and measurement rules. Under market risk, the regulatory exposure value will also differ from the accounting carrying amount. Differences could be due to off￾balance sheet items, netting rules and different measurement rules of market risk positions via prudent valuation (as opposed to fair valuation in the applicable accounting framework). Credit risk 19 How should the disclosure be made in Template CR3, in an example where a loan has multiple types of credit risk mitigation and is overcollateralised (eg a loan of 100 with land collateral of 120 as well as guarantees of 50)? When an exposure benefits from multiple types of credit risk mitigation mechanisms, the exposure value should be allocated to each mechanism by order of priority based on the credit risk mitigation mechanism which banks would apply in the event of loss. Disclosure should be limited to the value of the exposure (ie the amount of overcollateralisation does not need to be disclosed in the table). If the bank wishes to disclose information regarding the over-collateralisation, it may do so in the accompanying narrative. Refer to example in section 28.3. What are the values to be ascribed to collateral, guarantees and credit derivatives in Template CR3? Banks should disclose the amount of credit risk mitigation calculated according to the regulatory framework, including both the costs to sell and of haircut. Where should exposures to central counterparties (CCPs) be included? Exposures for trades, initial margins and default fund contributions are included in Template CCR8. Exposures stemming from loans to CCPs excluding initial margins and default fund contributions should be included within the credit risk framework considering the CCP as an asset class item. These loans should be included in the exposure class where the national

Page Number 161 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 implementation of the Basel framework allows exposures to CCPs to be included. In Template CR7, what is the required disclosure if an exposure is only partially hedged by a credit derivative? For instance, consider a loan with nominal exposure of 100 SAR, risk weight of 150% and therefore RWA of 150 SAR. The bank buys a credit default swap with a 30 SAR nominal amount, and the risk weight of the protection provider is 50%. Which values should be entered in columns (a) and (b)? Under the IRB approach, credit derivatives are recognised as CRM techniques for the F-IRB and A-IRB. In both cases, banks can reflect the risk mitigating effect of credit derivatives on an exposure by adjusting their PD or loss-given-default (LGD). Banks should disclose in column (a), the RWA of an exposure secured by a credit derivative calculated without reflecting the risk mitigating effect of credit derivatives (in the example, banks would disclose 150 SAR). In column (b), the RWA of the same exposure calculated reflecting the risk mitigating effect of credit derivatives (in the example, banks would disclose 3050% + 70150% = 120) should be disclosed. Is the “weighted average PD” in column (d) of Template CR9 to be calculated based on the formula ∑(PDί *EADί)/(∑EADί)? “Weighted” means exposure at default (EAD)-weighted. For this purpose, the formula in the question is correct since the data will be comparable to those reported in column (i). How should “defaulted obligors” be defined, for the purpose of Template CR9? For column (f) (number of obligors), please clarify how “obligors” are defined from a retail perspective. Should “end of the previous year” include only non-defaulted accounts at the beginning of the year, or both defaulted and non-defaulted accounts? Should “end of The definition of obligors or retail obligors is the same as for other obligors; any individual person or persons, or a small or medium￾sized entity. Furthermore, where banks apply the “transaction approach”, each transaction shall be considered as a single obligor. A defaulted obligor is an obligor that meets the conditions set out in SCRE16.67 to SCRE16.74. For column (f), the “end of the previous year” includes non￾defaulted accounts at the beginning of the year of reference for disclosure. The “end of the year” includes all the non-defaulted accounts related to obligors already included in the “end of the previous year” plus all the new obligors acquired during the year of reference for disclosure which did not go into default during the

Page Number 162 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 the year” include all active accounts at the end of the year? For column (g) (defaulted obligors in the year), please clarify whether it is related to accounts that defaulted during the year or from inception. year. Banks have discretion as to whether to include obligors who left during the year within the “end of the year” number. For column (g), “defaulted obligors” includes: (i) obligors not in default at the beginning of the year who went into default during the year; and (ii) new obligors acquired during the year– through origination or purchase of loans, debt securities or off-balance sheet commitments – that were not in default, but which went into default during the year. Obligors under (ii) are also separately disclosed in column (h). The PD or PD range to be included in columns (d) and (e) is the one assigned at the beginning of the period for obligors that are not in default at the beginning of the period. What considerations can institutions reference when disclosing a model performance test (backtesting) when the test is not aligned to the year￾end disclosure timetable? The frequency of the disclosure is not linked to the timing of the bank’s backtesting. The annual disclosure frequency does not require a timetable of model backtesting that is calibrated on a calendar year basis. When the backtesting reference period is not calibrated on a calendar year basis, but on another time interval (for instance, a 12- month interval), “year” as used in columns (f), (g) and (h) of Template CR9 means “over the period used for the backtesting of a model”. Banks must, however, disclose the time horizon (observation period /timetable) they use for their backtesting. Counterparty credit risk 20 The “purpose” of Template CCR5 asks for a breakdown of all types of collateral posted or received. The content section, however, asks for collateral used. These numbers differ as certain transactions are over-collateralised (ie

100% of exposure) and therefore not all collateral would be used for risk mitigation. Should the template include all The numbers reported in Template CCR5 should be the total collateral posted/received (ie not limited to the collateral that is applied/used for risk mitigation). The purpose of the template is to provide a view on the collateral posted/received rather than the value accounted for within the regulatory computation. If the bank wishes to disclose the collateral eligible for credit mitigation, it may do so using an accompanying narrative.

Page Number 163 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 collateral posted/received or just collateral that is applied? Template CCR7 refers to an RWA flow on internal models method (IMM) exposures. Row 4 (Model updates – IMM only) and row 5 (Methodology and policy – IMM only) are specifically to include only model and methodology/policy changes relating to the IMM exposures model. Where in the template would changes to the internal-ratings based (IRB) models that result in changes in risk weights for positions under the IMM be reported? Template CCR7 is consistent with Template OV1, which requests a split by exposure at default (EAD) methodology and not by risk weighting methodology. Banks are recommended to add rows to report any changes relating to risk weighting methodology if they deem them useful. The row breakdown is flexible and intends to depict all the significant drivers of changes for the risk-weighted assets (RWA) under counterparty credit risk. Specific rows should be inserted when changes to the IRB model result in changes to the RWA of instruments under counterparty credit risk whose exposure value is determined based on the IMM. Securitisation 21 Template SEC1 requires the disclosure of “carrying values”. Is there a direct link between columns (d), (h) and (l) of Template SEC1 and column (e) of Template LI1? Reconciliation is not possible when Template SEC1 presents securitisation exposures within and outside the securitisation framework together. However, when banks choose to disclose Template SEC1 and SEC2 separately for securitisation exposures within the securitisation framework and outside that framework, the following reconciliation is possible: the sum of on-balance sheet assets and liabilities included in columns (d), (h) and (l) of Template SEC1 is equal to the amounts disclosed in column (e) of Template LI1. Should institutions disclose RWA before or after the application of the cap? RWA figures disclosed in Templates SEC3 and SEC4 should be before application of the cap, as it is useful for users to compare exposures and risk-weighted assets (RWA) before application of the cap. Columns (a)–(m) in Templates SEC3 and SEC4 should be

Page Number 164 of 168 Pillar 3 Disclosure Requirements Version Number Issue Date Framework 2.1 December 2022 reported prior to application of the cap, while columns (n)–(q) should be reported after application of the cap. RWA after application of the cap are disclosed in Template OV1.

Page Number 165 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 31. Annexure 2: Frequency and timing of disclosures: Section Template Applicability Format Frequency Fixed Flexible Quarterly Semiannual Annual Overview of risk management, key prudential metrics and RWA KM1 Applicable   KM2 Not required to be completed by the bank unless otherwise specified by SAMA.   OVA Applicable   OV1   Comparison of modelled and standardised RWA CMS1 Not required to be completed by the bank unless SAMA approve the bank to use the IRB or IMA approach.   CMS2   Composition of capital and TLAC CCA Applicable   CC1   CC2   TLAC1 Not required to be completed by the bank unless otherwise specified by SAMA.   TLAC2   TLAC3   Capital distribution constraints CDC Applicable   Links between financial statements and regulatory exposures LIA Applicable   LI1   LI2   PV1   Asset encumbrance ENC Applicable   Remuneration REMA Applicable   REM1   REM2  

Page Number 166 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 REM3   Credit risk CRA Applicable   CR1   CR2   CRB   CRB_A   CRC   CR3   CRD   CR4   CR5   CRE Not required to be completed by the bank unless SAMA approve the bank to use the IRB approach.   CR6   CR7   CR8   CR9   CR10   Counterparty credit risk CCRA Applicable   CCR1   CCR3   CCR4 Not required to be completed by the bank unless SAMA approve the bank to use the IRB or IMM approach.   CCR5 Applicable   CCR6   CCR7 Not required to be completed by the bank unless SAMA approve the bank to use the IRB or IMM approach.   CCR8 Applicable   Securitisation SECA Applicable  

Page Number 167 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 SEC1   SEC2   SEC3   SEC4   Market Risk MRA Applicable   MR1   MRB Not required to be completed by the bank unless SAMA approve the bank to use the IMA approach.   MR2   MR3   Credit valuation adjustment risk CVAA The disclosure requirements related in this section are required to be completed by the bank when the materiality threshold stated on SAMA’s Revised Risk-based Capital Charge for Counterparty Credit Risk (CCR) issued as part of its adoption of Basel III post-crisis final reforms, paragraph (11.9) is satisfied.   CVA1   CVA2   CVAB   CVA3   CVA4   Operational risk ORA Applicable   OR1   OR2   OR3   Interest rate risk in the banking book IRRBBA Applicable   IRRBB1   Macroprudential supervisory measures GSIB1 Not required to be completed by the bank unless SAMA identify the bank as G-SIB.   CCYB1 Applicable   Leverage ratio LR1 Applicable   LR2   Liquidity LIQA  

Page Number 168 of 168 Version Number Issue Date Pillar 3 Disclosure Requirements Framework 2.1 December 2022 LIQ1   LIQ2  