Directive D10/2025 on Pillar 3 Disclosure Requirements

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D10/2025 To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act 94 of 1990 Matters related to Pillar 3 disclosure requirements in terms of regulation 43 of the Regulations relating to Banks Executive summary In terms of regulation 43(1) of the Regulations relating to Banks (Regulations), a bank shall disclose, in its annual financial statements and other disclosures to the public, reliable, relevant and timely quantitative and qualitative information. The disclosed information enables the users, among other things, to make an accurate assessment of the bank’s financial condition, including, but not limited to, its capital adequacy position, liquidity position, financial performance, leverage ratio, ownership, governance, business activities, risk profile and risk management practices. The Pillar 3 disclosure requirements aim to promote market discipline by providing users with key information, such as a bank’s regulatory capital and risk exposures. A key goal of Pillar 3 disclosure requirements is to improve transparency and confidence in a bank’s exposure to risk as well as the overall adequacy of its regulatory capital. The purpose of this Directive is for the Prudential Authority (PA) to inform all banks, controlling companies and branches of foreign institutions (hereinafter collectively referred to as ‘banks’) that the Pillar 3 disclosure requirements have been removed from regulation 43 of the Regulations, which requirements have now been specified in this Directive. This Directive updates the disclosure requirements set out in Directive 1/2019 and directs banks to comply with the specified requirements to ensure that the internationally agreed-upon Pillar 3 disclosure framework is fully implemented. This Directive replaces Directives 11/2015, 1/2018 and 1/2019.

2

1. Introduction 1.1 The Basel Committee on Banking Supervision (BCBS) has consolidated the disclosure requirements in the ‘Disclosure requirements’ (DIS)-themed chapter of the Basel framework1 on disclosure requirements. 1.2 This Directive and Directive D1/2024 on Pillar 3 disclosure requirements in respect of interest rate risk in the banking book (IRRBB) serve as reference points for the respective disclosure requirements applicable to banks, as the detailed disclosure requirements have been removed from the Regulations. However, the essential disclosure principles remain in regulation 43(1) of the Regulations. 1.3 The disclosure requirements must be published in standardised templates and tables to promote consistency and comparability of the disclosed information. These templates and tables are contained in Annexure A and, in respect of credit risk, Annexure B of this Directive. 1.4 The provisions of this directive are not related to any disclosure requirements that may be prescribed by the Johannesburg Stock Exchange Limited (JSE) in respect of the Stock Exchange News Service (SENS), from time to time.
2. Directive 2.1 In accordance with the provisions of section 6(6) of the Banks Act, 1990 (Act No 94 of 1990), banks are hereby directed to adhere to the general and specific requirements in disclosing the required information to the public as follows: 2.2 Banks are required to disclose the relevant information, required in this directive, commencing on the disclosure periods (year-ends and half-years) ending on or after the effective date of this directive. 2.3 Retrospective disclosure and the location of disclosures 2.3.1 With regard to templates that require the disclosure of data points for current and previous reporting periods, the disclosure of data points for previous periods is not required when metrics for new standards are reported for the first time. The requirements for operational risk templates are an exception to this rule, as comparative disclosures are required in the implementation year of these requirements. 2.3.2 Banks shall publish the Pillar 3 report as a stand-alone document that provides a readily accessible source of prudential information to users, or the Pillar 3 report shall be appended to, or form a discrete section of, a bank’s financial report. However, in all cases, the Pillar 3 report shall be easily identifiable to users. 2.4 Scope of application 2.4.1 The Pillar 3 disclosure requirements, as a minimum, apply to all banks at the highest level of consolidation within a bank or banking group, in accordance with the relevant requirements specified in regulation 43(1) read with regulation 43(3) of the Regulations. These disclosure requirements also apply to branches of 1 Please see Basel III: DIS disclosure requirements, available at https://www.bis.org/basel_framework/standard/DIS.htm.

3 foreign institutions conducting business in South Africa, unless the PA has directed otherwise. 2.4.2 Banks shall refer to specific templates and tables in Annexures A and B for additional requirements in respect of the scope of application, where relevant. 2.5 Archive period 2.5.1 Banks shall make available on their websites an archive of Pillar 3 reports in respect of the required quarterly, semi-annual and/or annual disclosures relating to prior reporting periods, which archive must ultimately cover not less than five years from the initial implementation date. 2.6 Presentation of the disclosure requirements 2.6.1 Banks’ disclosures shall adhere to the following guiding principles: • Principle 1: Disclosures must be clear. • Principle 2: Disclosures must be comprehensive. • Principle 3: Disclosures must be meaningful to users. • Principle 4: Disclosures must be consistent over time. • Principle 5: Disclosures must be comparable across banks. 2.6.2 Banks shall explain and supplement their disclosed quantitative information provided in both the fixed templates and the flexible tables with commentary to explain any significant changes between reporting periods and any other matters that management considers to be of importance to users. 2.6.3 Banks shall refer to specific templates and tables in Annexures A and B for additional requirements in respect of the required narratives, where relevant. 2.7 Timing of disclosures 2.7.1 Banks shall publish their Pillar 3 reports concurrently with their financial reports no later than 120 days after year-end. 2.7.2 In instances where the Pillar 3 disclosure must be published for a period when a bank does not produce a full set of financial reports, the disclosure requirements must be published as soon as practicable. The time lag shall in no case exceed 60 days for the bank’s quarterly reporting date and 90 days for the bank’s semi-annual reporting date. 2.8 Format of disclosures 2.8.1 The respective disclosures must be made in either the fixed templates or the flexible tables format, according to the frequency for each relevant template or table, as specified in Annexures A and B, respectively. 2.8.2 With respect to the fixed templates and flexible tables, banks may add extra rows and extra columns if they wish to provide additional detail to a disclosure requirement. However, the numbering of the specified rows and columns in the template shall not be altered. Banks shall adhere to any additional instructions as set out in the respective templates and tables in Annexures A and B, where relevant.

4 2.8.3 Where the format of a template or table is flexible, banks may present the required information either in the format provided in the relevant DIS template/table or in a format that the bank considers most relevant to its business model. Banks shall adhere to any additional instructions as set out in the respective templates and tables in Annexures A and B, where relevant. 2.8.4 In all cases, when a customised presentation of the information is used for flexible templates and tables, the bank must provide information that is comparable with the information required in the relevant DIS-specified requirements. 2.9 Assurance of disclosures 2.9.1 In accordance with the relevant requirements specified in regulation 43(1) of the Regulations, the Board of Directors (Board) and senior management of a bank shall establish and maintain effective internal control structures in respect of the disclosure of the Pillar 3 requirements. 2.9.2 The Board and senior management of a bank shall ensure that an appropriate review, approval and sign-off of the relevant disclosures take place at Board level. One or more senior executive officers of the bank, at Board level or equivalent, shall attest, in writing, that the relevant Pillar 3 disclosures have been prepared in accordance with the Board-approved internal control processes. 2.9.3 The bank shall also describe the key elements of its Board-approved disclosure policy in the Pillar 3 report, that has an annual frequency, or provide the reference(s) to another location(s) where such a policy is available. 2.10 Signposting of disclosure requirements 2.10.1 In all cases, when a bank discloses the required information in a document separate from the Pillar 3 report, the bank shall specify, in its Pillar 3 report, where the disclosure requirements have been published, provided that the signposting in the Pillar 3 report shall include: i. the number and title of the disclosure requirements; ii. the full name of the separate document(s) in which the disclosure requirements have been published; iii. the page and paragraph number of the separate document(s) in which the disclosure requirements are located; and iv. a web link, where relevant. 2.10.2 Banks may only use signposting to another document(s) when the level of assurance on the reliability and credibility of data in the separate document(s) is equivalent to, or greater than, the internal assurance level required for the Pillar 3 report. 2.11 Overview of risk management, key prudential metrics and risk-weighted assets 2.11.1 Banks shall disclose the information required in templates KM1 (‘Key metrics’) and OV1 (‘Overview of risk-weighted assets (RWA)’) as well as table OVA (‘Bank risk management approach’) according to the formats and frequencies specified in DIS 20. These disclosure requirements entail the bank’s strategy and key

5 prudential metrics as well as directors and senior management’s assessment and management of risk. 2.11.2 Template KM2 (‘Key metrics – total loss-absorbing capacity (TLAC)’) requirements (at resolution group level) are only applicable to resolution groups of global systemically important banks (G-SIBs). Banks are not required to disclose template KM2 as the PA is not the home supervisor to any G-SIBs. 2.12 Comparison of modelled and standardised risk-weighted assets 2.12.1 Banks using internal models for their risk exposures must disclose the relevant required information set out in templates CMS1 (‘Comparison of modelled and standardised RWA at risk level’) and CMS2 (‘Comparison of modelled and standardised RWA for credit risk at asset class level’) according to the formats and frequencies specified in DIS 21. 2.13 Composition of capital and total loss-absorbing capacity 2.13.1 Banks must disclose the relevant required information set out in table CCA (‘Main features of regulatory capital instruments and other total loss-absorbing capacity (TLAC)-eligible instruments’) as well as the relevant required information set out in templates CC1 (‘Composition of regulatory capital’) and CC2 (‘Reconciliation of regulatory capital to balance sheet’) according to the formats and frequencies specified in DIS 25. 2.13.2 Table CCA shall be published on the bank’s website, and it shall be updated whenever the bank issues or repays a capital instrument (or another TLAC-eligible instrument, where applicable) and whenever there is a redemption, conversion/write-down or another material change in an existing instrument. 2.13.3 The PA is not the home supervisor to any G-SIBs. Banks are therefore not required to disclose the relevant required information set out in templates that are meant for G-SIBs, including template TLAC1, which provides details of the TLAC positions of G-SIB resolution groups, and templates TLAC2 and TLAC3, which present information on creditor rankings at the legal entity level for material subgroup entities (i.e. entities that are part of a material subgroup) that have issued an internal TLAC to one or more resolution entities. 2.14 Capital distribution constraints 2.14.1 Template CDC (‘Capital distribution constraints’) (CDCs) provides the common equity tier 1 (CET1) capital ratios that would trigger CDCs. The PA has elected to partially implement template CDC in South Africa. 2.14.2 Banks designated as domestic systemically important banks (D-SIBs) shall disclose line 3, columns (a) and (b), related to the leverage ratio, according to the formats and frequencies specified in DIS 26. 2.14.3 Banks that are not designated as D-SIBs are not required to disclose template CDC, until such time as the PA may direct otherwise.

6 2.15 Links between financial statements and regulatory exposures 2.15.1 Banks shall disclose the relevant required information set out in template LI1 (‘Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories’) and template LI2 (‘Main sources of differences between regulatory exposure amounts and carrying values in financial statements’) as well as the relevant required information set out in table LIA (‘Explanation of differences between regulatory and accounting exposure amounts’) and template PV1 (‘Prudent valuation adjustments (PVAs)’) according to the formats and frequencies specified in DIS 30. 2.16 Asset encumbrance 2.16.1 Banks shall disclose the relevant required information set out in template ENC (‘Asset encumbrance’) according to the formats and frequencies specified in DIS 31. Template ENC requires the disclosure of the carrying amount for encumbered and unencumbered assets on the balance sheet using period-end values. Banks shall use the definition of ‘encumbered assets’ set out in the instructions in DIS 31. 2.16.2 Banks shall disclose column (b) (‘Central bank facilities’) of template ENC, which the PA has decided to make mandatory. Banks shall disclose the relevant required information set out in template ENC commencing from the period ending after the effective date of the final Directive. 2.17 Remuneration 2.17.1 Banks shall disclose the relevant required information set out in table REMA (‘Remuneration policy’) as well as in templates REM1 (‘Remuneration awarded during financial year’), REM2 (‘Special payments’) and REM3 (‘Deferred remuneration’) according to the formats and frequencies specified in DIS 35. 2.18 Credit risk 2.18.1 Banks shall disclose all the relevant required information set out in the templates and tables related to credit risk according to the formats and frequencies specified in DIS 40 in Annexure B. Some of the credit risk templates have been revised to align the definitions and asset classes to the Regulations; all templates and tables related to credit risk are therefore included in Annexure B. 2.19 Counterparty credit risk 2.19.1 Banks shall disclose the relevant required information set out in table CCRA (‘Qualitative disclosure related to counterparty credit risk (CCR)’) as well as in templates CCR1 (‘Analysis of CCR exposures by approach’), CCR3 (‘Standardised approach – CCR exposures by regulatory portfolio and risk weights’), CCR4 (‘Internal ratings-based (IRB)-CCR exposures by portfolio and probability-of-default (PD) scale’), CCR5 (‘Composition of collateral for CCR exposures’), CCR6 (‘Credit derivatives exposures’), CCR7 (‘RWA flow statements of CCR exposures under the internal models method (IMM)’) and CCR8 (‘Exposures to central counterparties’) according to the formats and frequencies specified in DIS 42.

7 2.20 Securitisation 2.20.1 Banks shall disclose the relevant required information set out in table SECA (‘Qualitative disclosure requirements related to securitisation exposures’) as well as in templates SEC1 (‘Securitisation exposures in the banking book’), SEC2 (‘Securitisation exposures in the trading book’), SEC3 (‘Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor’) and SEC4 (‘Securitisation exposures in the banking book and associated capital requirements – bank acting as investor’) according to the formats and frequencies specified in DIS 43. 2.21 Sovereign exposure 2.21.1 Information related to the disclosure requirements for sovereign exposures is specified in DIS 45, templates SOV1 (‘Exposures to sovereign entities – country’), SOV2 (‘Exposures to sovereign entities – currency denomination breakdown’) and SOV3 (‘Exposures to sovereign entities – accounting classification breakdown’). 2.21.2 The PA has decided to defer the disclosure of sovereign exposures at this stage; and will communicate the implementation date of such disclosure in writing at a future date. 2.22 Market risk 2.22.1 Banks shall disclose the relevant required information set out in tables MRA (‘General qualitative disclosure requirements related to market risk’) and MRB (‘Qualitative disclosures for banks using the internal models approach (IMA)’) as well as in templates MR1 (‘Market risk under the standardised approach’), MR2 (‘Market risk for banks using the IMA’) and MR3 (‘Market risk under the simplified standardised approach’) according to the formats and frequencies specified in DIS 50. 2.23 Credit valuation adjustment risk 2.23.1 Banks shall disclose the relevant required information set out in tables CVAA (‘General qualitative disclosure requirements related to credit valuation adjustment (CVA)’) and CVAB (‘Qualitative disclosures for banks using the standardised approach (SA-CVA)’) as well as in templates CVA1 (‘The reduced basic approach for CVA’), CVA2 (‘The full basic approach for CVA’), CVA3 (‘The standardised approach for CVA (SA-CVA)’) and CVA4 (‘RWA flow statements of CVA risk exposures under SA-CVA’) in accordance with the formats and frequencies specified in DIS 51. 2.24 Operational risk 2.24.1 Banks shall disclose the relevant required information set out in table ORA (‘General qualitative information on a bank’s operational risk framework’) as well as in templates OR1 (‘Historical losses’), OR2 (‘Business indicator and subcomponents’) and OR3 (‘Minimum required operational risk capital’) according to the formats and frequencies specified in DIS 60.

8 2.24.2 With regard to the relevant required information set out in template OR1, the PA directs that a rand-denominated threshold of R50 000 be adopted. Banks are not required to complete lines 6–10 of the template OR1 until such time that the PA directs otherwise, as these sections are currently not applicable in South Africa. 2.24.3 Disclosure of the relevant required information in respect of prior periods is required from the implementation date of these templates. 2.25 IRRBB 2.25.1 Banks shall disclose the relevant required information related to IRRBB per Directive D1/2024 on Pillar 3 disclosure requirements on IRRBB. 2.26 Macroprudential supervisory measures 2.26.1 Banks shall disclose the relevant required information set out in template CCyB1 (‘Geographical distribution of credit exposures used in the calculation of the bank￾specific countercyclical capital buffer requirement’) according to the format and frequency specified in DIS 75. This relates to information on the geographical distribution of credit exposures relevant for the calculation of the countercyclical buffer (CCyB) in respect of jurisdictions where the CCyB rate is higher than zero. 2.26.2 Template G-SIB1 (‘Disclosure of global systemically important bank (G-SIB) indicators’) provides users of Pillar 3 data with details of the indicators used to assess how a G-SIB has been determined. This template is mandatory for a bank that was classified as a G-SIB in the previous year or a bank that was included in the assessment sample by the PA based on supervisory judgement. The PA is not the home supervisor to any G-SIB; banks are therefore not required to publish the templates that are required for G-SIBs (including template G-SIB1). 2.27 Leverage ratio 2.27.1 Banks shall disclose the relevant required information set out in templates LR1 (‘Summary comparison of accounting assets vs leverage ratio exposure measure’) and LR2 (‘Leverage ratio common disclosure template’) according to the formats and frequencies specified in DIS 80. 2.27.2 Banks may calculate the leverage ratio based on either daily or monthly average numbers. The disclosures shall include the basis for the calculation of the disclosed amount – daily averaging, monthly averaging or quarter-end averaging – subject to the approval of, and any conditions as may be specified in writing by, the PA. 2.28 Liquidity 2.28.1 Banks shall disclose the relevant required information set out in table LIQA (‘Liquidity risk management’) as well as in templates LIQ1 (‘Liquidity coverage ratio (LCR)’) and LIQ2 (‘Net stable funding ratio (NSFR)’) according to the formats and frequencies specified in DIS 85.

9 2.28.2 Banks shall calculate and disclose an average amount, in relation to template LIQ1, based on the average of daily observation amounts over the previous quarter in the local currency. Banks shall, in all cases, publish the number of data points used in the calculation of the aforesaid average amounts. 3. When banks are unable to comply with the disclosure requirements or any related matter, the bank shall communicate with the PA before publication date, in writing, for approval, indicating the affected templates and the reasons for non-compliance, as well as a detailed action plan to ensure compliance in future. 4. Acknowledgement of receipt Kindly ensure that a copy of this Directive is made available to your institution’s external auditors. The attached acknowledgement of receipt, duly completed and signed by both the Chief Executive Officer of your institution and said external auditors, should be returned to the PA at the earliest convenience of the signatories. Fundi Tshazibana Chief Executive Officer Date: Encl. 2 The previous Directive issued was Directive 9/2025 dated 1 August 2025.