Instructive No. 13/2021: Calculation and Requirement of Regulatory Own Funds for Operational Risk

INSTRUCTIVE NO. 13/2021 of September 27 SUBJECT: FINANCIAL SYSTEM

• Calculation and Requirement of Regulatory Own Funds for Operational Risk and respective Periodic Information Reporting Given the need to regulate technical specifics regarding the regulatory own-funds requirement for operational risk, as provided in Notice No. 08/21 of July 5, on Prudential Requirements; Under the combined provisions of letters d) and f) of paragraph 1 of Article 21, and letter d) of paragraph 1 of Article 51, both of Law No. 16/10 of July 15, the Bank of Angola Act, and Article 204 of Law No. 14/21 of May 19, the General Regime for Financial Institutions Act. I DETERMINE:

1. Object This Instructive establishes the regulatory own-funds requirement that Banking Financial Institutions must consider within the scope of operational risk, as well as information reporting, in accordance with Notice No. 08/21 of July 5 on Prudential Requirements.

2. Scope This Instructive applies to Banking Financial Institutions supervised by the Bank of Angola, hereinafter abbreviated as Institutions, provided for in Law No. 14/21 of May 19, the General Regime for Financial Institutions Act.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 2 of 22 3. Regulatory Own-Funds Requirement Institutions must calculate the regulatory own-funds requirement, as provided in Article 31 of Notice No. 08/21 of July 5 on Prudential Requirements, based on one of the following methodologies, provided that specific requirements associated with each are met: a) Basic Indicator Approach, in accordance with the conditions set out in Annex I of this Instructive and forming an integral part thereof; b) Standard Approach, in accordance with the conditions set out in Annex II of this Instructive and forming an integral part thereof; or, c) Alternative Standard Approach, in accordance with the conditions set out in Annex III of this Instructive and forming an integral part thereof.

4. Authorization 4.1. The implementation of the Basic Indicator Approach does not require prior authorization from the Bank of Angola. 4.2. For the purposes of adopting the Standard Approach or the Alternative Standard Approach, Institutions must notify the Bank of Angola 30 (thirty) days in advance, according to the rules set out in Annex IV of this Instructive. 4.3. An Institution may only revert to using the Basic Indicator Approach to assess its operational risk if it cumulatively meets the following conditions: a) It has demonstrated that it no longer complies with the requirements for using the Standard Approach or the Alternative Standard Approach; b) It has ensured that the new method to be adopted will not have a negative impact on the Institution's solvency or its ability to manage operational risk effectively; and, c) It has demonstrated that it obtained prior authorization from the Bank of Angola.

5. Revocation of Authorization The Bank of Angola may revoke the granted authorization if the Institution fails to comply with the requirements for using the Standard Approach or the Alternative Standard Approach, and must use the Basic Indicator Approach for calculating the regulatory own-funds requirement to cover operational risk.

6. Information Reporting 6.1 Institutions must report the information required in Article 31 of Notice No. 08/21 of July 5 on Prudential Requirements, quarterly, on an individual and consolidated basis, through the form provided in Annexes VII and VIII of this Instructive. 6.2 For the purposes of the preceding subsection, where it concerns a financial group, the parent company must report information according to the consolidation perimeter provided in Article 5 of Notice No. 08/21 of July 5 on Prudential Requirements. 6.3 Institutions that, due to the nature of their activity, do not have information to report to the Bank of Angola must declare this fact through the forms attached to this Instructive. 6.4 Institutions must ensure that the data reported in the tables attached to this Instructive are properly documented.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 3 of 22 7. Sanctions Non-compliance with the mandatory rules established in this Instructive constitutes a contravention punishable under Law No. 14/21 of May 19, the General Regime for Financial Institutions Act.

8. Transitional Provisions 8.1 Institutions must comply with the provisions of this Instructive from December 31, 2021. 8.2 For the purposes of subsection 7.1 of this Instructive, Institutions must report to the Bank of Angola the information required in Article 31 of Notice No. 08/21 of July 5 on Prudential Requirements, individually on a monthly basis and consolidated on a quarterly basis, until August 2022.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 4 of 22 8.3 Without prejudice to the preceding paragraph, Institutions must report the information required in Article 31 of Notice No. 08/21 of July 5 on Prudential Requirements, individually and consolidated, quarterly, from September 2022.

9. Doubts and Omissions Doubts and omissions resulting from the interpretation and application of this Instructive are resolved by the Bank of Angola.

10. Revocation All regulations contrary to this Instructive are hereby revoked, namely Instructive No. 16/16 of August 8 on Calculation and Requirement of Regulatory Own Funds for Operational Risk, and Instructive No. 17/16 of August 8 on Information Reporting on the Requirement of Regulatory Own Funds for Operational Risk.

11. Entry into Force This Instructive enters into force on the date of its publication. PUBLISHED Luanda, September 27, 2021. THE GOVERNOR JOSÉ DE LIMA MASSANO

CONTINUED INSTRUCTIVE NO. 13/2021 Page 5 of 22 ANNEX I Basic Indicator Approach

1. For the purposes of calculating the Basic Indicator Approach (BIA), regulatory own-funds requirements to cover operational risk correspond to 15% (fifteen percent) of the average of the last 3 (three) years of the annual exposure indicator, if positive, using the following formula: K_BIA = (Σ IE_i / N) × 15% Where: IE_i = annual exposure indicator for the last 3 (three) years, considered only when positive; N = number of years, out of the last 3, in which numerator portions are positive.
2. The annual exposure indicator consists of the algebraic sum of financial margin with other net revenues, resulting from the Institution's current activity, excluding commissions received for outsourcing services.
3. For calculating the annual exposure indicator mentioned above, the following accounts from the Chart of Accounts for Banking Financial Institutions (PCIFB) listed in Table 1 of this annex must be considered.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 6 of 22 Table 1 – Annual Exposure Indicator Account | Description 5.10.10.10 | Financial margin 5.10.10.30.10 | Results from investments in credit institutions 5.10.10.30.20.10.10 | Results from financial assets and liabilities measured at fair value through profit or loss – Bonds 5.10.10.30.20.10.20 | Results from financial assets and liabilities measured at fair value through profit or loss – Derivatives 5.10.10.60 | Foreign exchange results 5.10.10.80 | Results from financial services provision 4. The calculation of the annual exposure indicator must be based on audited information from Institutions. If audited information is unavailable, Institutions may temporarily use result estimates, and the calculation must be redone when audited data becomes available. 5. For a newly established Institution, the annual exposure indicator must be 0 (zero) in the first year and, from that year onward, consider existing history. 6. For the acquisition of a new activity segment, the exposure indicator calculation must consider results from that activity over the last 3 (three) years, using audited information when available, or result estimates. 7. The BNA may authorize the Institution to alter the calculation in the preceding paragraph whenever using a three-year average for calculating the relevant indicator leads to a distorted estimation of own-funds requirements relative to operational risk. 8. Subsequent positive or negative results after the closure or sale of an activity segment must be considered in calculating the annual exposure indicator.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 7 of 22 ANNEX II Standard Approach

1. For calculating the Standard Approach, regulatory own-funds requirements to cover operational risk correspond to the average of the last 3 (three) years of the sum of exposure indicators for each activity segment, properly weighted by their respective risk, considering Table 2 – Activity Segments and Associated Risk Factors, using the following formula: K_SA = (Σ [Σ IE_ij × β_j] / N) Where: IE_ij = exposure indicator, in a given year i, for each of the eight (j) activity segments; β_j = risk factor (fixed percentage) for each of the eight (j) activity segments. N = number of years, out of the last three, in which numerator portions are greater than 0 (zero). Table 2 – Activity Segments and Associated Risk Factors Activity Segment | Risk Weight (β) | List of Activities Corporate Finance | 18% | • Firm underwriting of financial instruments and/or placement on a firm commitment basis • Services related to firm underwriting • Investment advisory services • Corporate advisory on capital structure, industrial strategy and related issues, as well as merger and acquisition services • Investment analysis, financial analysis and other generic recommendations related to financial instruments transactions Trading & Sales | 18% | • Payment operations • Issuance and management of payment instruments Payment & Settlement | 18% | • Payment operations • Issuance and management of payment instruments Commercial Banking | 15% | • Receipt of deposits and other repayable funds • Loans • Financial leasing • Provision of guarantees and assumption of commitments Agency Services | 15% | • Safekeeping and administration of financial instruments on behalf of clients, namely custody and related services such as treasury/collateral management Retail Banking | 12% | • Receipt of deposits and other repayable funds; • Loans • Financial leasing • Provision of guarantees and assumption of other commitments Retail Portfolio Intermediation | 12% | • Receipt and transmission of orders regarding one or more financial instruments • Order execution on behalf of clients • Placement of financial instruments without firm commitment Asset Management | 12% | • Portfolio management • Other forms of asset management
2. The exposure indicator must be calculated according to the conditions described in paragraph 2 of Annex I.
3. The risk-weighted exposure indicator for a given activity segment may, in a given year, be negative, which may compensate positive exposure indicators associated with other activity segments. However, if the accumulated own-funds requirement for total activity segments is negative in a given year, Institutions must use the value zero in the numerator for that year.
4. The calculation of the annual exposure indicator must be based on audited information from Institutions. If unavailable, temporary result estimates may be used, and the calculation must be redone when audited data becomes available.
5. The BNA may authorize the Institution to alter the calculation in the preceding paragraph whenever, due to mergers, acquisitions, or divestments of entities or activities, using a three-year average for calculating the relevant indicator leads to a distorted estimation of regulatory own-funds requirements relative to operational risk.
6. Institutions wishing to implement the Standard Approach on an individual and consolidated basis must meet the following minimum requirements: a) Develop and document specific policies and criteria for allocating the exposure indicator across activity segments identified in Table 2. b) Specific policies and criteria for allocating the exposure indicator across activity segments must comply with the following guiding principles: i. All activities must be allocated to activity segments identified in Table 2, so that each activity corresponds to a single segment and none are excluded; ii. Any activity not directly classified in the defined segments but representing an auxiliary function must be classified in the segment it supports. If auxiliary to more than one segment, objective allocation criteria must be used; iii. For activities not classifiable in a specific segment, they must be classified in the segment with the highest percentage; iv. Institutions may use internal transfer pricing methods to allocate the exposure indicator across two or more segments, provided the global exposure indicator is not undervalued; v. Allocation across activity segments for determining regulatory own-funds requirements must be consistent with categories used for credit and market risks; vi. Specific policies and criteria for allocation across activity segments must be properly documented, sufficiently clear and detailed to allow replication of the segment mapping process by an external entity; vii. Processes for identifying activity segments for new products or activities must be defined; viii. The governing body is responsible for defining and reviewing specific policies and criteria for allocating the annual exposure indicator across activity segments identified in Table 2; ix. Management personnel with leadership responsibilities are responsible for ensuring the above policies and processes are effectively implemented; x. The activity segment identification process must be subject to independent review. c) Specific policies and criteria for allocating the annual exposure indicator across activity segments must be reviewed and adjusted whenever significant changes occur in current activity or a new segment begins.
7. Institutions implementing the Standard Approach must comply with the following additional internal control and organizational requirements: a) Have an operational risk management function responsible for implementing policies and procedures to identify, assess, monitor, control, and report operational risk; b) Ensure classification, through a set of objective and properly documented criteria, of operational risk events into activity segments identified in Table 2, according to the operational risk event types indicated in Table 3 – Operational Risk Categories; c) Ensure, where applicable, integration of the operational risk measurement system into current risk management procedures; d) Ensure sufficient documentation of the operational risk measurement and management system, including procedures ensuring its efficiency and corrective measures for non-compliance; e) Ensure that internal validation processes of the operational risk measurement system function adequately, and that data flows and associated processes are transparent, up-to-date, and available.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 8 of 22 Table 3 – Operational Risk Categories Operational Risk Category | Operational Risk Events Internal Fraud | • Losses from acts intended to defraud, misappropriate assets or circumvent laws, regulations, rules or corporate policies, excluding acts related to differentiation/discrimination involving at least one internal party External Fraud | • Losses from acts intended to defraud, misappropriate assets or circumvent laws by a third party Employment Practices and Workplace Safety | • Losses from acts not in compliance with laws or employment agreements, health or safety regulations, as well as personal injury payments or acts related to differentiation/discrimination Clients, Products and Business Practices | • Losses from intentional or negligent breach of a professional obligation to specific clients (including fiduciary and suitability requirements) or from the nature or design of a product Physical Damage | • Losses from damage to physical assets caused by natural disasters or other events Business Disruption and System Failures | • Losses from business disruption or system failures Execution, Delivery and Process Management | • Losses from transaction processing errors or process management, as well as counterparty relationships and vendors

CONTINUED INSTRUCTIVE NO. 13/2021 Page 9 of 22 ANNEX III Alternative Standard Approach

1. Within the Alternative Standard Approach, regarding "retail banking" and "commercial banking" activity segments, Institutions must apply the following rules: a) The relevant indicator is a normalized income indicator equal to the nominal amount of loans and advances multiplied by 0.035; b) Loans and advances consist of the total amounts utilized from corresponding credit portfolios. For "Commercial Banking", titles held outside the trading portfolio are also included in the nominal value of loans and advances.
2. The annual exposure indicator must be calculated according to conditions in paragraph 2 of Annex I, considering activity segments presented in Table 2.
3. For acquiring a new retail and/or commercial banking activity segment, the alternative exposure indicator calculation must consider values from that activity over the last 3 (three) years, using audited information when available or result estimates.
4. Institutions implementing the Alternative Standard Approach on an individual and consolidated basis must meet the following minimum requirements: a) Conduct activities predominantly in retail and/or commercial banking segments, meeting: i. Retail and/or commercial banking segments must account for at least 90% (ninety percent) of the Institution's financial intermediation results in the year preceding the request, according to PCIFB; and ii. The Institution must demonstrate that a significant proportion of its retail/commercial banking segments include loans with high probability of default, and that the Alternative Standard Approach provides a more adequate basis for assessing operational risk. b) Allocation requirements across activity segments in paragraph 6 of Annex II must be observed, considering only two groups: retail/commercial banking segments and other activity segments.

CONTINUED INSTRUCTIVE NO. 13/2021 Page 10 of 22 ANNEX IV Notification Process Institutions or financial groups wishing to request authorization from the Bank of Angola to use the Standard Approach or Alternative Standard Approach for calculating regulatory own-funds requirements for operational risk must follow this procedure:

1. Notify in writing to the Bank of Angola, specifying: a) The new applicable method (Standard or Alternative Standard), and indication of situations involving other competent authorities for supervision; b) Statement of reasons for the change; c) Contact person with the Bank of Angola regarding this matter.
2. Along with the letter in the preceding paragraph, the Institution must submit: a) Opinion of the Institution's supervisory body, duly dated and signed, regarding the truthfulness and adequacy of submitted information; b) Opinion of the Institution's external auditor, duly dated and signed, regarding truthfulness and adequacy; c) General framework elements of the Institution or financial group: i. Detail of activity developed by each legal entity covered, with a summary table (e.g., in terms of contribution to assets or, where applicable, risk-weighted assets); ii. Statement of governance structure...