Decision on External Bank Audit

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 Pursuant to Article 21, paragraph 1 of the Law on the National Bank of Serbia ("RS Official Gazette", Nos 72/2003 and 55/2004), Article 52, paragraph 3 and Article 56, paragraph 3 of the Law on Banks ("RS Official Gazette", No 107/2005), the Governor of the National Bank of Serbia hereby issues the following D E C I S I O N ОN EXTERNAL BANK AUDIT

1. This Decision prescribes a set of criteria based on which the National Bank of Serbia shall establish and publish a list of external auditors eligible to perform audit of financial statements of banks (hereinafter: the List), and the minimum scope and contents of the external auditor’s report on the audited financial statements. I. CRITERIA FOR ESTABLISHING AND PUBLISHING THE LIST OF EXTERNAL AUDITORS
2. In order to perform the audit of bank financial statements, an external auditor must meet the following criteria:

1. it complies with the conditions prescribed for an audit firm by the law on accounting and auditing;
2. it employs at least six certified auditors licensed to perform audit of financial statements, at least three of whom have a minimum three￾year track record in auditing financial statements of banks;
3. it employs at least 20 people in its organisational unit in charge of audit;
4. it has not been removed by the National Bank of Serbia from the List based on Section 5, paragraph 4 of this Decision in the past five years.

3. To become a listed external auditor, the audit firm shall submit to the National Bank of Serbia a written request together with supporting documentation to prove compliance with the criteria set out in Section 2 hereof. The National Bank of Serbia shall make a decision on the request referred to in paragraph 1 hereof within 30 days after receipt of the duly completed request. In the decision-making process referred to in paragraph 1 hereof, the audit firm shall, at the request of the National Bank of Serbia, give a presentation of the methodology applied in its financial statement auditing.
4. The National Bank of Serbia shall publish the List on its website.

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 5. Should there be any changes affecting compliance with the criteria set out in Section 2 of this Decision after the List is published, the external auditor shall promptly notify the National Bank of Serbia thereof. The National Bank of Serbia may from time to time request that a listed external auditor submits evidence of continued compliance with the criteria specified in Section 2 hereof. The National Bank of Serbia shall remove from the List any external auditor who fails to comply with the criteria set out in Section 2, provisions 1)– 3), or an external auditor who fails to act in accordance with paragraphs 1 and 2 hereof. The National Bank of Serbia shall also remove an external auditor from the List:

1. if it determines that the external auditor failed to comply with Article 58, paragraph 1 of the Law on Banks (hereinafter: the Law), and/or in the event specified in Article 62 of the Law, or
2. if the ministry in charge of finance, the Chamber of Certified Auditors or other competent body determine that the external auditor failed to comply with the International Standards on Auditing and/or Code of Ethics for Professional Accountants. If there is reasonable doubt that an external auditor failed to act in compliance with Article 58, paragraph 1 of the Law, the National Bank of Serbia may suspend such auditor from the List until doubt is resolved, but no longer than 90 days. When it establishes that the external auditor acted in compliance with Article 58, paragraph 1 of the Law, and/or when the timeframe from paragraph 5 hereof expires, the National Bank of Serbia shall end the external auditor’s suspension from the List. Until the timeframe from Section 5 hereof expires, and/or until the National Bank of Serbia determines whether the external auditor complied with Article 58, paragraph 1 of the Law or not, the external auditor suspended from the List may complete the audit of financial statements of a bank initiated prior to the date of receiving the suspension decision, but may not take on new audit engagements.

6. A listed external auditor may not, in the course of the same year, engage in auditing of financial statements of a bank and provide it with consultancy services (e.g. bookkeeping and accounting, value appraisal, internal audit, IT, legal matters, business finance, advice or assistance, and/or other services), nor conduct an audit of financial statements for the year during which such services were provided. Furthermore, the listed external auditor

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 may not conduct an audit of financial statements of a bank for the year in which one of its employees was temporarily hired to work in, or by which he/she was temporarily hired at the time of conducting the audit. 7. Representatives of the National Bank of Serbia and external auditors may hold meetings regarding the auditing of bank financial statements prior to its commencement, in its course and after its completion. The meeting referred to in paragraph 1 hereof shall be attended by the representatives of the bank whose financial statements are being audited or the bank shall be informed of the outcome of such meeting by its external auditor. Upon the request of the National Bank of Serbia, the external auditor shall submit the methodology applied in the audit of bank financial statements, the plan of audit activities regarding individual audit of bank financial statements, along with other information pertaining to the audit. II. MINIMUM SCOPE AND CONTENTS OF EXTERNAL AUDITOR’S REPORT ON THE AUDITED FINANCIAL STATEMENTS OF A BANK 8. External auditor’s report on the performed audit of annual bank financial statements (hereinafter: audit report) shall be formulated in compliance with the law on auditing and this Decision. The audit report shall include in particular:

1. external auditor’s opinion;
2. audited financial statements;
3. opinion on whether the performance report complies with financial statements for the same business year, along with the pertaining performance report;
4. letter on financial statement presentation,
5. analyses for the needs of the National Bank of Serbia. External auditor’s opinion referred to in paragraph 2, provision 1) herein, shall mean the opinion on whether the audited financial statements are compiled in accordance with International Financial Reporting Standards within the meaning of the law on accounting and the National Bank of Serbia’s regulations, and whether they give a true and fair view, in all material respects, of the bank’s financial position, business performance and cash flows. Financial statements referred to in paragraph 2, provision 2) herein shall be enclosed in a summary form, which means that the forms of such

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 statements are in accordance with the decision on forms and content of items in the financial statement forms to be completed by banks, but they do not contain items with the value equal to zero, columns relating to financial statements mapping nor ADP codes. Notes to financial statements shall be submitted in full. Each individual summary financial statement form shall be signed by the management of the bank. Letter on financial statement presentation, signed by responsible bank officers, confirms that financial statements give a fair presentation of the bank’s financial position, its business performance, cash flows and changes in equity for the relevant year and are in compliance with law. Analyses for the needs of the National Bank of Serbia shall contain: (А) Analysis of balance sheet, income statement and off-balance sheet assets, and (B) Business quality (solvency) analysis. The analyses referred to herein may also contain potential adjustments made by the certified auditor and/or bank. А. Analysis of balance sheet, income statement and off-balance sheet assets The analysis of balance sheet, income statement and off-balance sheet assets contains a brief comment by the external auditor on the bank’s balance sheet, income statement and off-balance sheet assets and their structure, and must contain at least one separate review and an explanation of those balance and off-balance sheet positions that have changed significantly from the previous reporting period. B. Business quality (solvency) analysis

1. Bank capital Provide a comment on the bank’s capital before and after any adjustments are made by the certified auditor or by the bank at certified auditor’s suggestion, then make up a list of the bank’s major shareholders, i.e. persons holding more than 5% of voting rights, enumerate changes in the bank’s ownership structure in the course of the year and analyse whether shareholders are related in such a manner that they are thought to be acting as a single acquirer within the meaning of the provisions of the Law regulating ownership acquisition in a bank.
2. Asset quality Show the structure of risk-weighted and non-risk weighted assets after adjustments, analyse risk-weighted assets and show value adjustment as the indirect write-off of investments in respect of balance sheet assets, and/or reserves for losses on off-balance sheet assets, analyse the credit portfolio (credits, interest, assumed and potential obligations), materially significant debtors and their financial positions, credits approved to

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 persons related to the bank within the meaning of the Law, as well as their financial position, then show interest-bearing and non-interest bearing assets after adjustments and analyse their relationship, present the structure and level of receivables from other banks and comment on their collectability; analyse transactions performed in the name and for the account of legal and natural persons, and if any risk-weighted investments are entered on the accounts of such persons, reclassify them to appropriate accounts. State the amount of payments under guarantees issued, if any, and state whether the bank continues to provide guarantees to clients on whose behalf it has already made payments; specify average time period needed for the collection of payments made under guarantees. 3) Business performance indicators and risk exposure Specify if, how many times and during which time period in the course of the year, the bank failed to comply with the prescribed capital adequacy ratio, risk exposure ratio (to a single or a group of related parties, as well as the bank’s exposure to a person related to the bank), investment risk ratio, liquidity ratio, and foreign exchange risk ratio, calculated in line with the National Bank of Serbia’s regulations. State whether the bank has adopted procedures that ensure adequate internal controls and consistent application of the risk management strategy and policies, the procedures for risk identification and measurement, i.e. the procedures for risk assessment and management of materially significant risks, as well as procedures for regular reporting on risk management issues to the bank’s bodies and the National Bank of Serbia. Provide a comment on the activities undertaken by the bank, with a view to maintaining the prescribed value of ratios, particularly for the ratios the bank has failed to observe in the course of the year, or the ratios that came close to the minimum and/or maximum prescribed values. 4) Capital adequacy State if the bank has managed to maintain an adequate level of capital during the year – proportionate to the scope and type of its business activities and exposure; if the National Bank of Serbia has set a higher-than-prescribed capital adequacy ratio for the bank due to the type and level of such bank’s risk exposure and business activities so as to ensure that the bank’s operations are safe and sound and the bank itself capable of meeting obligations towards creditors; if the bank applies appropriate procedures for monitoring and estimating the necessary level of capital considering the risks it is exposed to or is likely to be exposed to in its future business operations. 5) Profitability

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 Comment on the spread between the lending and deposit rates, analyse interest by the type of investment and appropriate source of funding, with special emphasis on the share of credits, and show the relation between:

• profit (loss) and assets,
• profit (loss) and total balance sheet capital,
• interest income and assets,
• interest expenses and liabilities,
• net income/expenses in respect of impairment of financial assets and credit risk-weighted off-balance sheet items and assets. Analyse the interest-bearing and/or non-interest bearing assets and activities undertaken by the bank with a view to increasing the level of collectability and show the ratio of net interest income to interest-bearing assets. Comment on the structure of loss, and/or the amount of uncovered loss (causes and the year of incurrence, reasons for lack of coverage, as well as activities taken to eliminate the root causes of the loss incurred); interest income from impaired investments; interest expenses on deposits and loans taken; the manner of profit distribution.

6. Human resources and organisational capacity Present the structure of the bank’s personnel, specifying the total number of employees: management, experts and auxiliary staff; members of the board of directors (name and surname, and name of the legal entity which employs them) and of the executive board. Specify total gross and net remuneration to the president and members of the board of directors, and aggregate amount of remuneration to other members of the board of directors, as well as total gross and net remuneration and earnings for the president of the executive board, and aggregate amount for other members of the executive board - earned in the bank. Show the bank’s organisational scheme with all organisational parts (branches, business units and representative offices in the country and abroad) and their seat.
7. Information system Describe the organisation and management of information system and other technologies, its adequacy, reliability and compatibility with operations performed by the bank. State whether the bank has adopted appropriate internal general acts that establish the framework for information system security management and assess the degree of physical protection of the bank’s data and information system.

11. Along with the audit report, the bank shall submit to the National Bank of Serbia the management letter delivered by the external auditor

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 before the completion of audit, by no later than 120 days after the end of the business year to which the audit report relates. One copy of the external auditor’s report shall also be submitted to the committee for monitoring the bank’s operations (audit committee). The bank shall submit consolidated annual financial statements along with the report from the external auditor to the National Bank of Serbia, for the previous business year, by no later than 150 days from the end of that year. The consolidated annual financial statements referred to in paragraph 3 hereof shall mean consolidated annual financial statements compiled in accordance with the law on accounting. External auditor’s report on the performed audit of annual consolidated financial statements of the bank shall be created in compliance with the law on auditing and shall contain external auditor’s opinion and consolidated financial statements audited. 12. Management letter shall contain, inter alia, findings and recommendations regarding the effectiveness of internal audit, compliance control, the established risk management system and the system of internal controls of the bank. 13. No later than 15 days from the submission of audit report, the bank shall publish:

• complete external auditor’s report on its website and shall keep it on the website until the publication of the auditor’s report for the next business year. Under the terms hereof, a complete external auditor’s report shall mean the audit report containing all the elements referred to in Section 8, paragraph 2, provisions 1) and 2) hereof,
• external auditor’s summary report in daily newspapers circulated in the territory of the Republic of Serbia. External auditor’s summary report shall mean the audit report containing the elements referred to in Section 8, paragraph 2, provisions 1) and 2) hereof, excluding notes to the financial statements.

14. If the National Bank of Serbia refuses to accept the external auditor’s report, in line with Article 62 of the Law, the bank shall replace such report on its website with a report on a newly conducted audit prepared by another external auditor.
15. External auditors from the List of External Auditors ("RS Official Gazette", No 8/2007) shall conduct the audit of financial statements of a bank for the business year of 2007 only if they did not conduct an audit of such bank’s financial statements for three consecutive years prior to

"RS Official Gazette", Nos 41/2007, 59/2008, 67/2012 and 18/2015 16. This Decision shall supersede the Decision on External Bank Audit ("RS Official Gazette", No 57/2006). 17. This Decision shall take effect one day after its publication in the "RS Official Gazette". D. No. 52 G o v e r n o r 8 May 2007 National Bank of Serbia B e l g r a d e Radovan Jelasic, sign