Regulation on Criteria and Method of Risk Management for Leasing Companies

UNOFFICIAL CONSOLIDATED TEXT REGULATION ON CRITERIA AND METHOD OF RISK MANAGEMENT FOR LEASING COMPANIES (Official Gazette No. 86/18 and 150/22)

Regulation on Amendment of the Regulation on Criteria and Method of Risk Management for Leasing Companies (Official Gazette No. 150/22) entered into force and applies from January 1, 2023.

Regulation on Criteria and Method of Risk Management for Leasing Companies - Unofficial Consolidated Text (Official Gazette No. 86/18 and 150/22)

1 INTRODUCTORY PROVISIONS Article 1. (1) This Regulation further prescribes the criteria and method of risk management for leasing companies as defined in Article 69 of the Law. (2) The provisions of this Regulation apply mutatis mutandis to branches of leasing companies from other European Union member states as well as to branches of leasing companies from third countries. (3) The penalty provisions of the Law apply mutatis mutandis to the conduct of leasing companies and responsible persons within leasing companies regarding the application of the provisions of this Regulation.

Terms and Definitions Article 2. The terms used in this Regulation have the following meanings:

1. HANFA is the Croatian Financial Services Supervisory Agency.
2. Law means the Leasing Law ("Official Gazette" No. 141/2013).
3. Credit risk is the risk of loss due to the failure of the lessee to fulfill monetary obligations to the leasing company.
4. Concentration risk is the risk arising from any single, direct or indirect, exposure to one person or a group of related persons, or a set of exposures linked by common risk factors such as the same economic sector, geographical area, or similar activities, which could lead to losses that might endanger the continuation of the leasing company's business.
5. Market risk represents the potential effects that external influences have on the value of assets and liabilities of the leasing company, caused by movements in financial markets. Market risks include currency risk, interest rate risk, and liquidity market risk.
6. Currency risk is the risk of change in the value of a financial instrument due to changes in foreign exchange rates.
7. Interest rate risk is the risk of change in the value of a financial instrument due to changes in market interest rates.
8. Liquidity market risk is the risk of inability to liquidate assets at an acceptable price and within a suitable timeframe.
9. Operational risk is the risk of loss due to inappropriate or incorrectly executed business processes, procedures, and failures relating to human resources or systems within the leasing company, or due to external influences or events.
10. Liquidity risk is the risk of loss arising from the existing or expected inability of the leasing company to meet its monetary obligations as they fall due.
11. Financial instrument is any contract that gives rise to a financial asset of one entity and a financial liability or equity instrument of another entity (in accordance with the provisions of International Financial Reporting Standards).
12. Total exposure of the leasing company is the sum of exposures based on financial leasing, exposures based on operating leasing, exposures based on loans granted, and other exposures.
13. Exposure based on financial leasing is the sum of past-due unpaid receivables and undrawn principal.
14. Exposure based on operating leasing is the sum of receivables and undrawn contractual value.
15. Exposure based on loans granted is the sum of past-due unpaid receivables and undrawn principal.
16. Other exposures are exposures based on deposits granted, investments in securities and business shares, and other exposures carrying credit risk.
17. Group of related persons are two or more persons linked in accordance with the provisions of Articles 12, 13, 14, and 15 of the Law.

Regulation on Criteria and Method of Risk Management for Leasing Companies - Unofficial Consolidated Text (Official Gazette No. 86/18 and 150/22) 2 18. Exposure to the State is exposure to the central government, social security funds, public non-financial enterprises, and units of local government and administration (local state), all in accordance with the sectoral classification of institutional units according to the European System of National and Regional Accounts.

RISK MANAGEMENT SYSTEM Article 3. The leasing company is obliged to establish a comprehensive and effective risk management system in accordance with the type, scope, and complexity of its business, which must include at least: – risk management strategies, policies, procedures, and measures, – risk measurement techniques, – monitoring and reporting on risks, – division of responsibilities regarding risk management.

Strategies, Policies, and Internal Acts for Risk Management Article 4. (1) The leasing company is obliged to adopt strategies, policies, and other internal acts for risk management and ensure their application at the level of the entire leasing company. (2) The risk management strategy referred to in paragraph 1 of this Article is one or more written documents that minimally cover the objectives and basic principles of accepting and managing risks and the leasing company's risk appetite. (3) The policies and internal acts referred to in paragraph 1 of this Article for risk management constitute one or more documents that minimally cover the following: – determination of acceptable levels of risk for specific risks, – clear lines of authority and responsibility for risk management within the leasing company, – methodology for determining and measuring or assessing risks to which the leasing company is or could be exposed, – internal limits and controls and other procedures for managing and monitoring risks, including the establishment of appropriate limits, – procedures and measures in case of deviation from the application of adopted policies and procedures, – procedures and measures in case of crisis situations. (4) The strategies, policies, and internal acts referred to in paragraph 1 of this Article must be in written form, clearly defined, documented, and available to all employees of the leasing company involved in the process of accepting and managing risks. (5) The leasing company is obliged to regularly monitor, evaluate, review, and at least annually revise and update as necessary the appropriateness and effectiveness of the planned measures for the purpose of eliminating possible deficiencies therein.

Identification, Measurement, and Management of Risks Article 5. (1) The leasing company is obliged to continuously identify risks to which it is or could be exposed in its business and analyze the causes of exposure to risks. (2) The leasing company is obliged to regularly measure or assess the risks it has identified in its business. (3) The leasing company is obliged to measure or assess risks based on appropriate quantitative and/or qualitative methods of risk measurement or assessment that will enable the detection of changes in the risk profile of the leasing company, including the emergence of new risks. (4) The leasing company is obliged to clearly determine criteria for decision-making and procedures for managing risks, taking into account the existing and desired risk profile and the appetite for accepting risks. (5) The leasing company is obliged to appropriately document the method of managing risk, including the reasons for accepting, reducing, avoiding, or transferring risk.

Regulation on Criteria and Method of Risk Management for Leasing Companies - Unofficial Consolidated Text (Official Gazette No. 86/18 and 150/22) 3 Monitoring and Reporting on Risks Article 6. (1) The leasing company is obliged to establish a system for regular monitoring and reporting on exposure to risks and the risk profile of the leasing company. (2) The leasing company is obliged to establish a risk monitoring and reporting system in such a way as to enable all relevant levels of management to obtain timely, accurate, and sufficiently detailed information necessary for making business decisions or ensuring the safe and stable operation of the leasing company. (3) The leasing company is obliged to appropriately monitor risks from business processes that it has outsourced to other persons.

Division of Responsibilities Regarding Risk Management Article 7. (1) The Supervisory Board of the leasing company is competent to give consent to the management of the leasing company on the organization of the risk management system. (2) The Management of the leasing company is responsible for: – establishing clear and consistent internal relations regarding responsibility for accepting and managing risks, including the delimitation of authority and responsibility between the Supervisory Board, the Management of the leasing company, and the leadership of the leasing company, – ensuring an adequate number of employees with professional knowledge and experience in the system of managing all significant risks, – approving and periodically (at least once a year) checking and aligning strategies and policies for accepting and managing risks, – establishing general awareness of risks at all levels of the leasing company, the attitude and behavior of employees towards risk and risk management, taking into account the acceptable level of risk for the leasing company. (3) The Management of the leasing company participates in the risk management process and is obliged to actively engage in the management of all significant risks. (4) All employees of the leasing company participate in the implementation of the risk management system.

MANAGEMENT OF SPECIFIC RISKS Article 8. (1) The leasing company is obliged to adopt and implement appropriate risk management policies and procedures for at least the following risks: – credit risk (including concentration risk), – market risk (including currency, interest rate risk, and liquidity market risk), – liquidity risk, – operational risk. (2) The leasing company is obliged to adopt and implement appropriate risk management policies and procedures for all other types of risks to which it is or could be exposed in its business.

CREDIT RISK Management of Credit Risk Article 9. (1) The leasing company is obliged to make decisions on approving leasing business based on appropriate and clearly defined criteria and is obliged to define procedures for decision-making on approval, changes, renewal of leasing contracts, and refinancing of leasing business. (2) Before concluding a contract that is the basis for the emergence of credit risk exposure, the leasing company assesses the creditworthiness of the lessee, the quality, marketability, availability, value, and possibility of subsequent sale of the leased object, as well as the quality, value, and marketability of the instruments securing the receivables.

Regulation on Criteria and Method of Risk Management for Leasing Companies - Unofficial Consolidated Text (Official Gazette No. 86/18 and 150/22) 4 (3) The leasing company is obliged to monitor the business of the lessee and the quality, marketability, availability, and value of the leased object and instruments securing the receivables throughout the duration of the legal relationship representing credit risk exposure. (4) The leasing company is obliged to establish an appropriate and effective system for managing and continuously monitoring the portfolio and individual exposures carrying credit risk, and ensure its implementation, which includes: – management of portfolios and individual exposures carrying credit risk, – recognition and management of problematic leasing receivables, – implementation of valuation adjustments and value corrections for balance sheet and, if applicable, off-balance sheet items. (5) The leasing company is obliged to ensure that the diversification of portfolios carrying credit risk is in line with the strategy and target markets of the leasing company. (6) The leasing company is obliged to establish an internal methodology that enables the assessment of credit risk exposure to individual lessees, and credit risk at the portfolio level.

Credit Process Article 10. The leasing company is obliged to establish and organize the credit process of leasing business in an adequate manner, which must include at least: – the process of approving leasing business, in which the leasing company is obliged to assess the creditworthiness of the lessee and assess the quality, value, and marketability of the leased object and the instrument securing the receivables, – the process of monitoring receivables, in which the creditworthiness of the lessee, the group of related persons with the same, and the quality, value, and marketability of the leased object and the instrument securing the receivables are assessed during the duration of the exposure and the regularity in fulfilling obligations to the leasing company, – analysis of the credit portfolio, which implies continuous analysis of the structure and quality of the entire credit portfolio and includes analysis of the concentration risk contained in the portfolio and assessment of future trends in the structure and quality of the credit portfolio, – handling of problematic receivables, which implies defining criteria for an increased degree of riskiness according to which a specific leasing business will be considered problematic, and handling of problematic receivables that should be subject to special monitoring due to their increased degree of riskiness.

Concentration Risk Article 11. (1) The leasing company is obliged to adopt appropriate rules for identifying and measuring concentration risk, which must minimally include: – identification and measurement of concentration relating to individual persons and groups of related persons, – identification and measurement of concentration relating to a set of exposures linked by common risk factors such as the same economic sector, geographical area, similar activities, and – identification and measurement of concentration relating to the entire portfolio of the leasing company. (2) The leasing company is obliged to adopt appropriate internal acts for monitoring and reducing concentration risk, which must minimally include: – active management of credit portfolio diversification, – determination of concentration limits.

Limitation of Exposure to Individual Persons and Groups of Related Persons Article 12. (1) The leasing company is obliged to adopt and, when concluding business that exposes it to credit risk, apply at least the following exposure limitations so that the maximum exposure to an individual person/group of related persons does not exceed 20% of the total exposure of the leasing company. (2) For exposure to the State, the leasing company may determine exposure limitations different from those in paragraph 1 of this Article through its own internal acts. (3) The leasing company is obliged to regularly monitor and analyze total exposure to ensure that exposure to an individual person/group of related persons is in line with the limitations in paragraph 1 of this Article or in line with limitations determined in its own internal acts. (4) A leasing company with total assets less than 13,000,000.00 euros may determine exposure limitations different from those in paragraph 1 of this Article through its own internal acts, provided that the maximum exposure to an individual person/group of related persons does not exceed 40% of the total exposure of the leasing company.

MARKET RISK Article 13. (1) The leasing company is obliged to adopt appropriate rules for identifying, measuring, and managing all market risks to which it is exposed in its business, particularly in the part of: – currency risk, – interest rate risk, – liquidity market risk. (2) The leasing company is obliged to adopt appropriate rules for identifying and measuring currency risk, which must minimally include: – identification and measurement of mismatches between assets and liabilities by source in specific currencies, including contracts with currency clauses, – identification and measurement of mismatches in cash flows in foreign currencies, including contracts with currency clauses. (3) The leasing company is obliged to adopt appropriate rules for identifying and measuring interest rate risk, which must minimally include: – identification and measurement of changes in assets and liabilities or the financial position of the company with regard to changes in interest rates, – identification and measurement of changes in the company's cash flow with regard to changes in interest rates. (4) The leasing company is obliged to adopt appropriate rules for identifying and measuring liquidity market risk, which must minimally include: – identification and measurement of changes in the company's financial position with regard to the possibility of selling assets at market price and within an acceptable timeframe, – identification and measurement of changes in cash flow with regard to the possibility of selling assets at market price and within an acceptable timeframe. (5) The leasing company should determine an adequate strategy and measures for managing and limiting exposure to specific market risks.

LIQUIDITY RISK Article 14. (1) The leasing company is obliged to appropriately identify, measure, and manage liquidity risk, which includes the risk of difficulties the leasing company may encounter in securing funds to meet obligations related to financial instruments and securing funds to achieve the strategy and business objectives of the leasing company. (2) The leasing company is obliged to adopt appropriate rules for identifying and measuring liquidity risk, which include the identification and measurement of expected and potential cash inflows and outflows, maturity matching of assets and liabilities, and source analysis. (3) The leasing company should determine an adequate strategy and measures for managing and limiting exposure to liquidity risk.

Regulation on Criteria and Method of Risk Management for Leasing Companies - Unofficial Consolidated Text (Official Gazette No. 86/18 and 150/22) 6 OPERATIONAL RISK Article 15. (1) The leasing company is obliged to determine principles for identifying and classifying operational risk events or sources of operational risk for the purposes of managing operational risk. (2) The leasing company is obliged, within the framework of managing operational risk, to particularly cover business changes, including activities, processes, and systems, operational risk arising in project management and outsourced business, and significant risks in existing activities, processes, and systems. (3) The leasing company is obliged, within the framework of identifying and measuring or assessing operational risk, to take into account all relevant internal and external factors and to cover operational risk or events that have resulted in losses as well as operational risk to which the leasing company is exposed but has not resulted in losses. (4) The leasing company is obliged to measure or assess exposure to identified operational risk, taking into account the possibility or frequency of realization of the risk as well as the potential effect on the leasing company. (5) The leasing company is obliged, for the purpose of appropriate management of operational risk, in accordance with the Law, regulations adopted on the basis of that Law, and other regulations, to particularly ensure: – appropriate management of information systems and information system risk, – appropriate management of risks related to outsourced business, – appropriate management of fraud risk, – appropriate management of compliance and legal risk, – appropriate management of business continuity, – establishment of an appropriate system for preventing money laundering and financing of terrorism.

FINAL AND TRANSITIONAL PROVISIONS Article 16. (1) This Regulation enters into force on the eighth day from the date of publication in the "Official Gazette". (2) With the entry into force of this Regulation, the Regulation on Organizational Requirements for Leasing Companies ("Official Gazette" No. 68/2014) ceases to be valid. (3) The leasing company is obliged to compile a Report on Large Exposures (VI) as of the date of entry into force of this Regulation in the manner prescribed by the regulation that specifies the structure and content as well as the method and deadlines for submission of financial and additional reports of leasing companies. (4) If on the date of entry into force of this Regulation the exposures of the leasing company exceed the limitations prescribed in Article 12, paragraph 1 of this Regulation, the leasing company is obliged to adopt a Plan of Measures and deadlines by which exposures will be aligned with the limitations in Article 12, paragraph 1 of this Regulation. (5) The leasing company is obliged to submit the Report on Large Exposures (VI) from paragraph 3 of this Article to HANFA within 30 days, and the Plan of Measures from paragraph 4 of this Article within 90 days from the entry into force of this Regulation, in the manner and in accordance with the Technical Instruction for using the WEB form entry service and submission of documentation in electronic form and the Instruction for filling out WEB forms for leasing companies.