Instructions on Internal Control and Supervision Systems for Microfinance Companies No. (11/2020)

In the Name of Allah, the Most Gracious, the Most Merciful

[Logo of the Central Bank of Jordan]

Number: 15556 / 2 / 28
Date: 6 / 4 / 1442 AH
Corresponding to: 22/11/2020 AD

Instructions on Internal Control and Supervision Systems for Microfinance Companies No. (11/2020)

Issued pursuant to the provisions of Article (4/b/4) of the Central Bank of Jordan Law No. (23) of 1971 and its amendments, and the provisions of Article (26) of the Microfinance Companies System No. (5) of 2015.

Article (1): Scope of Application
These Instructions shall be known as the "Instructions on Internal Control and Supervision Systems for Microfinance Companies," and shall apply to all microfinance companies operating in the Kingdom. They shall come into force one year from the date of their issuance.

Article (2): Definitions
The words and phrases contained in these Instructions shall have the meanings specified below, unless the context or indication suggests otherwise:

• The Central Bank: The Central Bank of Jordan.
• The Company: The microfinance company.
• The Board: The Board of Directors or the Board of Trustees of the Company.
• Compliance Monitoring: An independent function aimed at ensuring that the Company and its internal policies comply with all laws, systems, instructions, orders, codes of conduct, standards, and sound practices issued by local and international regulatory authorities. It identifies, evaluates, advises, monitors, and reports to the Board regarding the extent of compliance within the Company.

Article (3): Internal Control and Supervision Systems A. The Company shall establish internal control and supervision systems commensurate with the size of the Company and the nature of its operations. These systems shall include, at a minimum, the following:

1. An effective role for both the committees emanating from the Board and the executive committees.
2. The existence of approved policies and work procedures.
3. Financial and administrative systems that ensure the maintenance of accurate and comprehensive financial and administrative records.
4. A clear organizational structure with defined job descriptions.
5. Segregation of functions and tasks.
6. Clear and defined financial and administrative authorities.
7. Dual control over all major financial and administrative operations.
8. Controls on the use and handling of cash.
9. Protection of the Company's assets from any intrusion or use by any unauthorized or unappointed person.
   B. The Company shall review its internal control and supervision systems and verify their effectiveness at least once a year by the internal auditor and the external statutory auditor of the Company.
   C. The Board shall disclose in the annual report the effectiveness and adequacy of the Company's internal control and supervision systems in preparing its financial data and reports. This disclosure shall include the following:
10. The responsibility of senior executive management for establishing internal control and supervision systems and ensuring their adequacy.
11. The assessment by senior executive management of the effectiveness of internal control and supervision systems up to the date of preparation of the financial statements included in the annual report.
12. Any material weaknesses in the internal control and supervision systems.
13. The key aspects of its risk management.

Article (4): Tasks and Responsibilities of the Board In addition to what is stipulated in related legislation, the Board shall bear the following tasks and responsibilities at a minimum:
A. Ensuring the existence of appropriate and effective internal control and supervision systems and monitoring their implementation.
B. Being aware of the main risks facing the Company and supervising senior executive management to ensure they are aware of those risks and work to control and monitor them.
C. Reviewing reports from regulatory authorities, internal and external audit, and ensuring that senior executive management takes the necessary measures to follow up on violations and observations contained therein, and to rectify and address them to ensure they are not repeated.
D. Approving the Company's organizational structure, forming committees, approving financial and administrative systems, and authorizing authorities and powers.
E. Approving procedures that ensure periodic and regular review of operational performance and compliance of all Company employees with internal policies and procedures.
F. Approving a risk management system suitable for the size and operations of the Company, to be implemented by senior executive management under their supervision, such that:

1. The system is based on the identification and analysis of main risks, including credit risks, market risks, operational risks, and any other risks. It must include the identification of acceptable risk levels and the setting of limits based on that.
2. The system clearly defines the role, tasks, and responsibilities of the Board, the Audit Committee, the Internal Audit Department, and risk management staff.
3. The system defines the methodologies to be followed in the measurement, monitoring, and continuous control of each type of risk, as well as mechanisms for identifying and dealing with risks associated with change.
4. The effectiveness of the Company's system is reviewed at least annually.
   G. Approving strategies, the annual budget, and the code of business ethics, and reviewing them periodically.
   H. Approving an internal audit charter that includes the tasks, authorities, responsibilities, and work methodology of the internal audit department, and disseminating it within the Company.
   I. Allocating sufficient resources for senior executive management to perform its responsibilities independently and effectively, and ensuring that all Company activities are subject to internal audit, including risk management, compliance, branches, and the evaluation of the Company's procedures for combating money laundering and financing of terrorism.

Article (5): Tasks and Responsibilities of Senior Executive Management In addition to what is stipulated in related legislation, the responsibilities of senior executive management shall include, at a minimum, the following:
A. Preparing, developing, and implementing strategies and policies after their approval by the Board.
B. Preparing and developing a work procedures manual that ensures the identification, measurement, control, and monitoring of risks facing the Company.
C. Preparing policies that ensure the existence of appropriate internal control and supervision systems, ensuring their implementation, and providing the Board with periodic reports on the implementation and effectiveness of these systems at least once a year.
D. Ensuring compliance with regulatory authority requirements and the Company's internal policies, and providing regulatory authorities, internal audit, and the external statutory auditor of the Company with the required information and data at their specified times. E. Following up on observations and violations contained in reports from regulatory authorities, the external statutory auditor, and internal audit, and taking necessary steps to address them and prevent their recurrence. F. Preparing an organizational structure suitable for the size and activities of the Company, which shall include, at a minimum, the following:

1. All organizational units and activities for all functional levels, in addition to sub-organizational structures for those units, and the job description for each.
2. Committees emanating from the Board and other committees.
3. Separation and definition of duties to avoid conflicts of interest and reduce risks.
   G. Taking all necessary steps to effectively implement the risk management system, including verifying that any new product, process, or system is consistent with the Company's general strategy, and that all related risks have been identified and are within acceptable risk limits according to Company policies. H. Providing periodic reports to the Board on all financial and administrative matters of the Company and the level of risk at which it operates.
   I. Preparing the financial statements and final accounts of the Company.
   J. Preparing estimated budgets in accordance with budget preparation policies approved by the Board.
   K. Developing the skills and professional behavior of Company employees to keep pace with developments.

Article (6): Internal Audit
A. The Company shall be committed to establishing an internal audit department that is independent of executive management and reports directly to the Audit Committee emanating from the Board, as follows:

1. Providing the department with sufficient resources and a sufficient number of qualified human resources commensurate with the size and operations of the Company, and working to train them, without assigning any of them to any executive work or tasks.
2. Granting internal auditors full authority to access the Company's records and ledgers, and to communicate directly with all Company employees, the Board, and the Audit Committee, enabling them to perform their assigned tasks.
   B. The department shall submit its reports directly to the Audit Committee on a regular periodic basis, and simultaneously provide a copy of those reports to the Company's General Manager.
   C. The scope of the department's work must include a review of all Company works and activities, including the work of the risk department, compliance monitoring department, and branches. It shall perform the following tasks in particular:
3. Preparing an annual audit plan, which shall be approved by the Audit Committee.
4. Performing necessary audit work on financial matters and ensuring the reliability of related information and the mechanism for accessing it.
5. Performing audit work commensurate with risks to review accounting and administrative systems.
6. Preparing an annual report on the adequacy of internal control and supervision systems to reduce the risks faced by the Company and their effectiveness in reducing conflicts of interest and any fraud or corruption.
7. Following up on violations and observations contained in reports from regulatory authorities and the external statutory auditor, and ensuring their resolution and the existence of appropriate controls to prevent their recurrence.
8. Ensuring the existence of appropriate procedures for receiving and processing customer complaints in accordance with related legislation.
9. Evaluating the Company's procedures for combating money laundering and financing of terrorism, including compliance with requirements of applicable legislation.
10. Storing audit reports and related documents in accordance with applicable legislation, in an organized and secure manner so that they are available for review by regulatory authorities and external statutory auditors.

Article (7): External Audit
A. The Company shall sign an "Engagement Letter" with the external statutory auditor to perform all matters falling within his responsibility in line with International Standards on Auditing requirements, in addition to the following:

1. Providing the Board with a detailed report including weaknesses in accounting systems and internal control and supervision systems, and any other matters with a negative impact that the external statutory auditor becomes aware of during the audit process.
2. Verifying the accuracy and integrity of data provided to him during the audit process.
3. Providing the Central Bank with copies of any reports he submits to the Company while performing his duties.
4. Reporting directly to the Audit Committee or the Board and the Central Bank about any fraud detected, suspicions of fraud, or any suspicious or illegal operations.
   B. The Company shall be committed, at a minimum, to the following:
5. Not appointing the same external statutory auditor for more than eight consecutive years, with the audit partner changing every four years.
6. Obtaining Board approval, upon the recommendation of the Audit Committee, to provide any non-audit services such as accounting services or consulting, provided that it does not affect the independence of the external statutory auditor.

Article (8): Compliance Monitoring
A. The Company shall establish an independent compliance monitoring department responsible for implementing the policies, procedures, and mechanisms necessary to ensure that the Company and its internal policies comply with all applicable legislation and the standards and sound practices issued by regulatory authorities. It shall document and disseminate the tasks and authorities of the department within the Company. It shall not perform any executive work and shall undertake the following tasks:

1. Evaluating the suitability of the Company's compliance procedures and guidelines, tracking any deficiencies discovered, and formulating appropriate proposals to make necessary corrective modifications.
2. Identifying, documenting, and evaluating "compliance risks" associated with the Company's activities according to pre-studied bases.
3. Educating employees on compliance topics and preparing written guidelines on this matter.
4. Ensuring adherence to the established compliance monitoring policy by conducting tests and reporting to the Board or the committee emanating from it, if any. A copy shall be provided to the General Manager, including reports on the evaluation of "compliance risks," tests conducted during the reporting period, violations, aspects of deficiencies discovered, and corrective measures taken.
   B. The Compliance Monitoring Manager shall be the contact officer responsible for providing all requirements of the Central Bank in various fields.

Article (9): Risk Management
A. The Company shall establish an independent risk management department that does not exercise any executive tasks, and which shall undertake the following tasks:

1. Reviewing the Company's risk management framework before its approval by the Board.
2. Implementing the risk management strategy, in addition to developing policies and work procedures for managing all types of risks.
3. Developing methodologies for identifying, measuring, monitoring, and controlling each type of risk.
4. Submitting reports to the Board through the Risk Management Committee and a copy to the General Manager, containing information on the actual risk system for all Company activities compared to the acceptable risk document, and following up on the resolution of negative deviations.
5. Studying and analyzing all types of risks facing the Company.
6. Providing recommendations to the Risk Management Committee regarding the Company's risk exposures, and recording exceptions to the risk management policy.
7. Providing necessary information on Company risks for use in disclosure purposes.
8. Ensuring, before commencing the provision of any new (product/process/system), that it is consistent with the overall strategic development policy, that all resulting risks, including operational risks, have been identified, and that new supervisory controls and procedures or modifications thereto have been implemented commensurate with the acceptable risk limits of the Company.
   B. The Board, before approving any expansion in the Company's activities, shall study the risks resulting from that and the capabilities and qualifications of the risk management department staff.
   C. The Board shall ensure the independence of the risk management department in the Company by having it report to the Risk Management Committee, and granting the department the necessary authorities to enable it to obtain information from other Company departments and cooperate with other committees to perform its tasks.
   D. The Board shall approve an acceptable risk document for the Company and supervise senior executive management in the Company to ensure taking the necessary measures to identify, measure, monitor, and control each type of risk.

Article (10): Requirements for Financial and Accounting Systems and Information Management Systems A. The Company must have, at a minimum, the following:

1. Financial and accounting systems that ensure the proof of any financial transactions immediately upon occurrence and enable the Company to show its true financial position.
2. Periodic audit procedures for data and accounting entries to ensure that their recording has been done correctly.
3. Written procedures to ensure the preservation of books and records in an organized and secure manner for a period of no less than the legal period stipulated in applicable legislation.
4. Internal review and audit procedures to ensure the quality and reliability of information and data provided to Company management and regulatory authorities.
5. An information management system using modern information technology that ensures the availability, integrity, security, and confidentiality of information for senior executive management and the Board, including that related to significant risks, risk metrics, the quality of risk management system implementation, and corrective steps.
6. Qualified human resources to ensure the effectiveness of financial and accounting systems, in addition to the necessary technical means and alternatives that ensure operational continuity.
   B. Internal control and supervision systems must ensure the effectiveness and integrity of information and technology management systems accompanying the Company. This includes, at a minimum, the following:
7. Mechanisms for evaluating system performance, identifying, measuring, and controlling information-related risks.
8. Senior executive management ensuring that information and management systems are sufficient to enable the Company to proceed according to its work plan, organizational requirements, and internal control and compliance needs.
9. Senior executive management ensuring the appointment of qualified technical staff to deal with information systems and accompanying technologies.
10. Obtaining evaluation reports on the risks and controls of information and accompanying technologies from independent bodies such as external audit, and working to address weaknesses for improvement and development.
11. Finding appropriate mechanisms for dealing with service providers to maintain a high-quality information system commensurate with the size and activities of the Company.
12. Establishing appropriate controls to ensure the adequacy, accuracy, and validity of data entered, processed, and extracted from programs and systems, and ensuring the continuation of the data update process, taking backups, checking their reliability and compatibility between Company systems, and storing them in a way that reduces risks that may negatively affect them.
13. Ensuring the availability of reports upon request and as needed.

Article (11): Security and Safety Requirements Each company must adopt appropriate procedures to maintain its security and safety. The Board shall be responsible for ensuring the effectiveness of these procedures, which shall include, at a minimum, the following:
A. Selecting appropriate security and protection means and working to test and maintain them periodically. This shall include the following:

1. Reinforced safes that are difficult to tamper with for storing cash, with dual control guaranteed.
2. Using protection means to control entry and exit operations to and from the Company's various sites, especially places for storing, receiving, and delivering cash.
3. Anti-tamper locks on external doors and windows of the Company and its branches.
4. Cameras to record all works and activities carried out within the Company's branches.
   B. Providing necessary training for all Company employees on the security and protection means adopted.
   C. Selecting a cash safe location that is away from customer gathering places.
   D. Providing necessary security measures for the transport of cash to and from the Company or any of its branches.
   E. Setting ceilings for holding cash in the Company's various branches and working to comply with those ceilings.
   F. Insuring all Company assets against all hazards to which those assets may be exposed.

Article (12): The Company shall provide the Central Bank with a detailed report explaining all circumstances of any incident of embezzlement, forgery, theft, fraud, or significant shortage in assets immediately upon its occurrence, stating the measures the Company takes to recover its rights and ensure that such does not recur in the future.

The Governor
Dr. Ziad Faris