Instruction No. 10/2021, of July 7

---

INSTRUCTION NO. 10/2021 of July 7 SUBJECT: FINANCIAL SYSTEM

• Internal Capital Adequacy Assessment Process (ICAAP) It being advisable to implement the Supervisory Review and Evaluation Process (SREP) in accordance with recommendations issued by international standard-setting bodies, aiming to assess and maintain on an ongoing basis the amount, type, and distribution of internal capital that Banking Financial Institutions consider adequate to cover risk levels, according to their nature, to which they are or may become exposed; Under the combined provisions of letters d) and f) of paragraph 1 of Article 21, and letter d) of paragraph 1 of Article 51, both of Law No. 16/10, of July 15 – the Law of the National Bank of Angola, and Articles 194 and 215 of Law No. 14/21, of May 19 – the General Regime of Financial Institutions Law. I HEREBY DETERMINE:

1. Object The present Instruction establishes the minimum terms and conditions to be observed in the internal capital adequacy assessment process, hereinafter abbreviated as “ICAAP”.

2. Scope The present Instruction applies to Banking Financial Institutions supervised by the National Bank of Angola, hereinafter abbreviated as Institutions.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 2 of 22 3. Definitions Without prejudice to the definitions established in Law No. 14/21, of May 19 – General Regime of Financial Institutions Law, for the purposes of this Instruction, it is understood that: a) Internal Capital: the total amount, quality, and distribution of capital held by an institution, which enables it to implement its business strategy sustainably, and may not be lower than its regulatory own funds; b) Risk Factor: an aspect or characteristic, notably of financial products and markets, participants in the business relationship, and existing processes within Institutions, with influence on risk; c) ICAAP (Internal Capital Adequacy Assessment Process): regular assessment of the amounts, types, and distribution of internal capital that an Institution considers sufficient to cover risk levels according to its nature, to which it is or may be exposed.

4. ICAAP Process 4.1. Institutions must have solid, effective, and complete strategies and processes to assess and maintain, on an ongoing basis, the amount, type, and distribution of internal capital they consider adequate to cover risk levels according to their nature, so as to ensure business viability, maintaining adequate capitalization levels and sound and prudent risk management. 4.2. The ICAAP must integrate the Institution's management process and culture, and be reviewed regularly, taking into account the economic environment in which the Institution operates, so as to ensure a credible and understandable assessment and outcome. 4.3. The ICAAP process must be forward-looking and consider the Institution's strategy, risk appetite, and the influence of macroeconomic factors.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 3 of 22 4.4. Institutions must ensure correct specification of the risk profile, based on updated and forward-looking information, ensuring that all materially relevant risks are duly mitigated. 4.5. Institutions must ensure that the internal capital they have is adequate relative to their respective risk profile, based on an assessment consistent and comparable with their own funds. 4.6. Institutions must ensure the existence of an adequate organizational and technological structure, as well as governance and internal control practices suitable for the assessment, management, and planning of internal capital and risks, and must ensure that the ICAAP and its respective management processes are formalized, with a historical information record maintained. 4.7. Institutions must have the capacity to demonstrate to the National Bank of Angola that the ICAAP is solid, effective, and comprehensive, as well as clarify the methodologies and calculations used and the risks to be incorporated.

5. Responsibilities The Management Body is responsible for the development, implementation, and reporting of the ICAAP process, and must approve and sign the report on said process.

6. Characterization of the ICAAP Process 6.1. In designing, implementing the ICAAP, and evaluating its results, Institutions must consider size, nature, and complexity, as well as the operational environment and risks inherent to their activities. 6.2. The ICAAP process must: a) Encompass the Institution's management structure and culture, regarding decision-making; b) Be formally documented and present a systematic and detailed configuration of the Institution's planning, notably in terms of adopted methodologies, scenarios, and procedures; c) Be based on adequate processes, quantitative and/or qualitative methods used in the assessment, quantification, and estimation of internal capital and assumed risks, on an individual or group level, duly justified and documented. d) Provide a consistent internal capital assessment comparable with the Institution's regulatory own funds; e) Cover all material risks to which the Institution is or may become exposed, namely credit, market, operational, liquidity, strategic, compliance, and reputation risks, among others considered relevant; f) Provide for a contingency plan to ensure business management and internal capital adequacy in the face of recession or crisis; and g) Be subject to annual review by an independent internal body, with respective conclusions approved and signed by the management body.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 4 of 22 7. Duties of Institutions 7.1. Institutions must define and document in their internal capital policy, which must be integrated into risk management, the objectives (current and future), period, processes, and strategies for planning the evolution of internal capital levels. 7.2. Planning must be forward-looking and encompass the evolution and expected behavior of risks, by category, and the adequacy of internal capital to its respective risk profile, own funds requirements, and eventual relevant limits. 7.3. Institutions must ensure the existence of an adequate organizational and technological structure, as well as governance and internal control practices suitable for the assessment, management, and planning of internal capital, and must ensure that the ICAAP and its respective management processes are formalized, with a historical information record maintained. 7.4. Institutions must consider the level of development of matters covered in the ICAAP report, the characteristics of the Institution, the activity performed, and the inherent risk to which it is subject. 7.5. Institutions must ensure that information submitted to the National Bank of Angola remains valid at the date of submission, even if the document preparation date differs from the reference date in question.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 5 of 22 8. Supervisory Assessment and Review Process 8.1. It is the responsibility of the National Bank of Angola to conduct the review and assessment of the ICAAP, including verifying how results are integrated into management decisions and corporate governance processes supporting the Institution's activity. 8.2. For the purposes of the preceding subsection, the nature and depth of the review depend on the application of the proportionality principle, that is, the type, size, and systemic importance of Institutions, as well as risk profile, management, strategy, complexity, and operational risk. 8.3. Without prejudice to the preceding subsections, the National Bank of Angola may request additional information whenever necessary regarding the defined strategy to ensure, on an ongoing basis, the maintenance of internal capital levels adequate to the risk profile to which Institutions are or may become exposed. 8.4. The National Bank of Angola communicates to the management bodies of Institutions its conclusions on the ICAAP assessment and respective procedures.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 6 of 22 8.5. In the review and assessment process, if the National Bank of Angola considers that the ICAAP does not adequately capture the Institution's overall risk profile or that internal capital adequacy is not ensured, it will determine the application of corrective measures, which shall be communicated to the respective management body. 8.6. If it is considered that adopting the measures referred to in the preceding subsection is insufficient to correct detected deficiencies, the National Bank of Angola may require a level of own funds higher than the minimum defined in current legislation.

9. Information Reporting 9.1. Institutions must submit annually to the National Bank of Angola the ICAAP report, on an individual or consolidated basis, by April 30 of each year, according to Annexes I and II of this Instruction, with reference to December 31 of the preceding year. 9.2. Institutions must submit semi-annually to the National Bank of Angola quantitative reporting on the ICAAP, by July 31 of each year, according to Annex II of this Instruction, with reference to June 30 of the reporting year. 9.3. For the purposes of the preceding subsections, Institutions must submit information through the Financial Institutions Supervision System (SSIF), observing the provisions, requirements, and specifications of the XML message contained in the PIF Portal. 9.4. Without prejudice to the preceding number, while the Financial Institutions Portal (PIF) is not available for sending and receiving information under this Instruction, Financial Institutions must submit the same in Excel format to the email address dsb@bna.ao.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 7 of 22 10.Sanctions Non-compliance with the mandatory rules established in this Instruction constitutes an offense punishable under Law No. 14/21, of May 19 – General Regime of Financial Institutions Law.

11. Doubts and Omissions Doubts and omissions resulting from the interpretation of this Instruction are resolved by the National Bank of Angola.

12. Entry into Force The present Instruction enters into force on the date of its publication. PUBLISH. Luanda, July 7, 2021. THE GOVERNOR JOSÉ DE LIMA MASSANO

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 8 of 22 Annex I Report on the Internal Capital Adequacy Assessment Process (ICAAP) A. Executive Summary a) Identification of the consolidation perimeter for ICAAP purposes and the reference date of the assessment performed; b) Indication of those responsible for developing the ICAAP and for its approval; c) Presentation of internal capital estimates to cover materially relevant risks, allocated by categories and, where applicable, subcategories of risks; d) Presentation of the results of aggregating internal capital estimates; e) Indication of own funds and internal capital levels, allocated by capital instrument; f) Presentation of quantitative results obtained through the execution of stress tests; g) Indication of main changes verified in the ICAAP and/or its results, compared to previous reporting; h) Main conclusions of the ICAAP regarding the Institution's risk profile, adequacy of internal capital levels, and assessment of capital needs.

B. General Scope Information B.1.Business Model and Strategy a) Description of the current business model, identifying main business lines, markets, geographies, branches, and products in which the institution operates, as well as including a description of main cost and revenue sources, allocated by business lines, products, markets, and branches, where applicable; b) Description of planned changes by the Institution to the current business model and respective underlying activities; c) Presentation of projections for key financial indicators for main business lines, markets, and branches, where applicable; d) Description of the relationship between business strategy and the ICAAP process.

B.2. Organizational Information a) Description of general internal governance procedures, including risk management and control functions, particularly those supporting the ICAAP; b) Description of reporting circuits and respective reporting frequency to the management body on risk management and control matters, particularly communication flows regarding ICAAP; c) Description of the interaction process between risk measurement and monitoring and risk-taking practices, including details on limit definition and monitoring, as well as the process and measures defined for treating limit breaches; d) Description of material risk management processes and respective evolution, detailing: capital and liquidity management interaction, including the interaction between ICAAP and ILAAP; interaction among various risk categories and institutional-level risk management; and integration of ICAAP and ILAAP into overall risk management and global Institution management.

B.3. Risk Appetite a) Description of risk appetite model integration into global and risk management, detailing its relationship with the Institution's business and strategy model, risk strategy, and ICAAP, including capital planning; b) Description of the process and general internal governance procedures, including functions and responsibilities in the management body and top management regarding design and implementation of the risk appetite model; c) Description of the process for identifying material risks to which the Institution is or may become exposed, including information on risk appetite/tolerance levels and limits defined for determining risk materiality; d) Description of the process for defining and allocating limits within the group, where applicable.

B.4. Stress Tests a) General description of the Institution's stress test program, including details on types of stress tests performed, set of assumptions, methodological aspects and models used, frequency, and technological infrastructure; b) Description of internal governance aspects governing the stress test program, particularly stress tests used for ICAAP purposes; c) Description of interaction between capital and liquidity stress tests, particularly specific ICAAP and ILAAP stress tests, and the function of reverse stress tests; d) Explanation of the use of stress tests and their integration into the risk control and management model.

B.5. Data and IT Systems a) Description of the process for collecting, storing, and aggregating risk information across different Institution structures, including data flows from branches to the group, where applicable; b) Description of data flow and technological structure for risk information used for ICAAP purposes; c) Description of data controls applied to risk information used for ICAAP purposes; d) Description of IT systems used for collecting, storing, aggregating, and disseminating risk information used for ICAAP purposes.

C. Specific ICAAP Information C.1. General Structure of the ICAAP a) Description of the consolidation perimeter for ICAAP purposes and justification of any differences relative to the scope of entities included for determining minimum own funds requirements and ICAAP; b) Description of general objectives and assumptions of the ICAAP, detailing how they ensure capital adequacy; c) Indication of the ICAAP time horizon and justification of any differences between risk categories and/or group entities; d) Indication of the ICAAP approach in terms of risk impact on accounting data or economic value of the institution, or both, where applicable; e) Description of the process for identifying materially relevant risks allocated by categories and subcategories, detailing risk categories and subcategories considered in the ICAAP and their definitions; f) Identification of techniques used for risk reduction, by risk category; g) Analysis of any differences between risks covered in the ICAAP and the Institution's risk appetite model; h) Description of differences in the ICAAP process, methodologies, or parameters used by the group and respective group entities, where applicable.

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 9 of 22 C.2. Assessment, Quantification and Aggregation of Risks a) Description of the characteristics of models and methodologies for risk quantification/assessment, detailing assumptions and parameters used (e.g., confidence intervals, holding periods, etc.) for all categories and subcategories of risks, accompanied by a sensitivity analysis of models to changes in assumptions and parameters; b) Specification of data and historical series used, detailing how data from each entity covered by the ICAAP is included in the models. c) Indication of internal capital estimates to cover materially relevant risks, allocated by categories and, where applicable, subcategories of risks. In case the Institution does not determine an internal capital estimate for certain material risk subcategories, it shall explain how these subcategories are incorporated into the quantification of the risk category; d) In case models used for ICAAP purposes present significant differences from those approved by the National Bank of Angola for calculating own funds requirements, a detailed risk-by-risk comparison between models shall be presented, including methodological and parametrization differences and how these differences affect the assessment of internal capital and risks; e) Description of the process for aggregating internal capital estimates for entities and risk categories covered in the ICAAP, including the approach to any inter- and intra-category diversification effects, describing how these correlations were determined; f) Indication of the results of aggregating internal capital estimates for entities and risk categories covered in the ICAAP,

CONTINUATION OF INSTRUCTION NO. 10/2021 Page 10 of 22 including the diversification effects inter- and intra-category of risk eventually ascertained. C.3. Internal capital and capital allocation a) Definition of internal capital used to cover ICAAP internal capital estimates, specifying all considered capital elements and respective amounts; b) Description of differences between internal capital elements and regulatory own funds instruments; c) Description of methodology and respective assumptions for allocating internal capital to group entities, business lines, and markets, where applicable; d) Indication of allocated internal capital amounts by risk category, group entity, business lines, and markets, where applicable; e) Description of the process for monitoring internal capital consumption, including planned escalation procedures; f) Presentation of a quantitative analysis between effectively used internal capital and allocated internal capital based on ICAAP estimates. This information shall be presented by risk category, group entity, business lines, and markets, where applicable, including an explanation for cases where effective capital utilization is close to or exceeds allocated capital. C.4. Capital Planning a) Description of the capital planning process, which must include a description of main assumptions, time horizon, capital instruments, and capital measures; b) Description of perspectives for the evolution of risks and internal and regulatory capital; c) Conclusions of the capital planning process, which must include a description of measures defined to overcome detected deficiencies and respective scheduling, notably regarding capital instrument issuances, other capital measures, and planned balance sheet structure changes. C.5. Stress Tests in the ICAAP a) Description of adverse scenarios considered in the ICAAP, detailing main assumptions, notably management actions, balance sheet assumptions, time horizon, and macroeconomic variables used for scenarios, including the function of reverse stress tests in calibrating scenario severity; b) Analysis of quantitative results obtained and assessment of their impact on key metrics, including profits and losses (P&L), internal capital and regulatory own funds, and prudential ratios; c) Explanation of the extent to which obtained results are relevant for defining the institution's business model and respective strategy, risk profile definition, and assessment of capital needs. C.6. ICAAP Conclusions and Independent Validation Processes a) Main conclusions of the ICAAP that allow forming a concise opinion on the Institution's risk profile, adequacy of internal capital levels, and assessment of capital needs, as well as a description of measures planned by the Institution to ensure capital remains at adequate levels on a forward-looking basis; b) Description of changes implemented/planned to internal processes resulting from ICAAP results, notably regarding risk management process, business model and strategy, risk appetite model, including scheduling for its application; c) Description of changes implemented/planned to the ICAAP process resulting from conclusions of independent model validation processes, internal audit reports, and supervisory reviews.