D12-2025 - Credit Risk Roadmap

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D12/2025 To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act, 1990 (Act No. 94 of 1990) Implementation roadmap for the Basel III post-crisis reforms and the Directive on distressed restructured credit exposures Executive summary The purpose of this Directive is to direct banks, controlling companies and branches of foreign institutions (hereinafter collectively referred to as ‘banks’) on the rollout process for implementing the amendments to the Regulations relating to Banks (Regulations) and for implementing the Directive on distressed restructured credit exposures (Directive 11 of 2025). This Directive provides a roadmap that banks must follow when rolling out all processes and model-related changes required to comply with the requirements of the standardised and internal ratings-based approaches for credit risk set out in the amended Regulations. In addition, this Directive similarly directs banks on the implementation of Directive 11 of 2025.

2

1. Introduction 1.1 As a member of the Basel Committee on Banking Supervision (BCBS), the Prudential Authority (PA) has committed to the full, consistent and timely implementation of the Basel III post-crisis reforms. This commitment made it necessary for the PA to provide a roadmap to ensure that the Basel III post-crisis reforms are fully implemented. 1.2 The revisions to the standardised (STA) approach are, among other things, intended to reduce the reliance on external ratings and introduce more granular risk-weighting schemes for real estate exposures. 1.3 The revisions to the internal ratings-based (IRB) approaches are intended to reduce the scope of modelling for certain asset classes and introduce parameter floors to reduce the undue variability of risk-weighted assets (RWA) among banks. 1.4 The Directive on the prudential treatment of distressed restructured credit exposures (D11/2025)1 is intended to improve the management of risk relating to the definition and reporting of distressed restructured credit exposures. 1.5 This Directive directs banks on the implementation of the revisions to the STA and IRB approaches as well as the implementation of D11/2025, in a phased manner. 1.6 Implementing the revisions to the STA and IRB approaches as well as the revised credit restructures directive requires banks to make various changes, including updates to their systems, processes and the credit risk models used under the IRB approaches for calculating the required capital and reserve funds for their respective credit risk exposures. Some of these changes take time, effort and significant resources to implement. 1.7 Owing to the complexities of the IRB approach, changes require time to implement, both in terms of performing gap and expected impact analyses2 as well as making actual model changes and obtaining prior written approval from the PA. For instance, specific requirements relating to exposure at default (EAD) models may take time to incorporate appropriately. In addition, IRB banks must identify and remediate gaps arising from the regulatory modelling requirements for probability of default (PD) and loss given default (LGD) models. 1.8 The phased rollout approach takes into account the time needed to update the systems and process the changes required to incorporate the revisions into the IRB approach and the revised credit restructures directive. This approach also considers the often extensive internal governance processes which banks that have adopted the IRB approaches for credit risk must follow before submitting regulatory model changes to the PA for approval. It also considers the PA’s own internal review and governance processes as well as associated timelines. 1 In this Directive, D11/2025 is also referred to as ‘revised credit restructures directive’. 2 Phase 2 requires banks to assess IRB credit risk model gaps as a result of implementing Phase 1 as well as gaps arising from the regulatory requirements, including those stemming from the revised credit restructures directive.

3 2. Directive 2.1 Based on the aforesaid, and in accordance with provisions of section 6(6) of the Banks Act, 1990 (Act No. 94 of 1990) (Banks Act), banks are hereby directed as follows: 2.1.1 For banks using the STA approach to calculate their minimum required capital and reserve funds for their credit risk exposures: 2.1.1.1 banks are required to be fully compliant with the amended Regulations, specifically all requirements relating to the STA approach in regulation 23 of the amended Regulations; and 2.1.1.2 banks are required to be fully compliant with all requirements in the revised credit restructures directive by 1 January 2027 (refer to paragraph 2.3 of this Directive). 2.2 For banks that obtained approval to adopt the IRB approaches to calculate their minimum required capital and reserve funds for their credit risk exposures: 2.2.1 banks are required to implement the revised IRB approaches in three phases, ending 31 December 2028. The revised credit restructures directive and the requisite model changes will be implemented in a fourth phase, starting from 1 January 2029. 2.2.2 The phases and related timelines do not preclude banks that are able to meet the requirements of a particular phase ahead of the scheduled time frame from doing so. In this regard, the PA reserves the right to direct any bank to prioritise the implementation of certain changes, or model changes, earlier than the timelines for each phase and the rollout plans outlined in paragraph 2.2.6 of this Directive. 2.2.3 For regulatory reporting, all banks must start reporting distressed restructured credit exposures in accordance with the requirements of the revised credit restructures directive from the reporting calendar month of April 2027. As such, the PA requires that all requisite changes to reporting systems and processes must be in effect by 1 January 2027 to facilitate this. 2.2.4 Appendix A of this Directive provides the format for varied submission components as part of the phased process. 2.2.5 Phase 1: 0 to 6 months from the effective date of the amended Regulations 2.2.5.1 Banks using the IRB approaches are required to implement the requirements under the IRB approaches that do not require any changes to their models. The PA requires all banks using the IRB approaches to have fully implemented the following requirements: 2.2.5.1.1 the prescribed regulatory estimates outlined in regulations 23(11)(b)(vi)(B) and 23(11)(d)(ii) of the amended Regulations; 2.2.5.1.2 the application of threshold amounts as outlined in Directive 8 of 2025;

4 2.2.5.1.3 removal of the use of the advanced IRB approach for specified asset classes in accordance with the requirements specified in regulation 23(13) of the Regulations; and 2.2.5.1.4 removal of the 1.06 scaling factor that is applied in the credit RWA calculation. 2.2.6 Phase 2: 6 to 18 months from the effective date of the amended Regulations 2.2.6.1 During Phase 23 , banks using the IRB approaches are required to assess their IRB credit risk models to identify any gaps and introduce appropriate margins of conservatism (MoCs). 2.2.6.2 This phase will run for a period of 12 months and will include: 2.2.6.2.1 scoping gaps resulting from Phase 1 implementation or any other gaps in meeting the regulatory requirements and the revised credit restructures directive; 2.2.6.2.2 estimating and applying MoCs to mitigate the identified gaps; and 2.2.6.2.3 scoping sustainable remediation methods to be implemented in phases 3 and 4. 2.2.6.3 As part of Phase 2, the PA requires each IRB bank to submit a rollout plan outlining their approach for implementing all remaining changes to systems, processes and IRB credit risk models related to the regulatory requirements and the revised credit restructures directive. 2.2.6.4 The PA will engage with each IRB bank on a bilateral basis to review and approve the rollout plans as well as the relevant MoCs. 2.2.6.5 When planning model redevelopments for phases 3 and 4, banks must consider the demands on internal resources (including model development and model validation) and ensure sufficient time is allowed for internal approval processes. The model change planning must accommodate, among other things, the new requirements for the modelling of EAD, such as the adoption of the 12-month fixed-horizon approach. There are also several regulatory requirements relating to PD and LGD models that IRB banks must prioritise and accommodate in their redevelopment plans. 2.2.6.6 The rollout plans referred to in paragraph 2.2.6.3 of this Directive must be submitted by completing the template provided in Appendix A of this Directive, and accompanied by a cover letter signed by the Chief Risk Officer (CRO) of the relevant IRB bank. When prioritising model changes, the rollout plans must consider the materiality of the affected models. For instance, models with a higher materiality classification should be prioritised over models with a lower materiality classification. 2.2.6.7 However, if models with lower materiality display performance weaknesses and require urgent changes, the PA will accommodate the prioritisation of such models to mitigate the potential underestimation of RWA. 3 A breakdown of the timelines is available in Appendix A.

5 2.2.6.8 The PA requires each IRB bank to motivate their rollout plans, considering both materiality and prioritisation. In this regard, the PA reserves the right to direct an IRB bank to revise its rollout plan to prioritise certain changes over others. The bilateral engagements will be key for the PA in managing the inflow and review process of model change submissions to the PA. 2.2.6.9 If a bank chooses to integrate both the revised credit restructures directive and the changes arising from the amended Regulations into its model updates (as opposed to phasing these separately), the PA will require that all requisite model changes and submissions for prior written approval are finalised by the end of Phase 3. 2.2.6.10 In this regard, the PA wishes to reiterate that the implementation of the Basel III post-crisis reforms must take precedence over the revised credit restructures directive. 2.2.7 Phase 3: 18 to 42 months from the effective date of the amended Regulations 2.2.7.1 During Phase 3, IRB banks are required to implement the PA-approved plans developed in Phase 2. 2.2.7.2 Phase 3 is intended for the development and implementation of the Basel III post￾crisis reforms. This phase runs for two years and includes the time required by banks to conclude their internal governance processes as well as the PA’s prior written approval. Submissions for Phase 3 must be in the format prescribed in paragraph 2.2.9 of this directive. 2.2.7.3 If a bank anticipates that it will not meet the timelines designated for this phase, it must submit a request for extension, with a comprehensive motivation for its proposed timeline for the PA’s consideration. Additionally, if a bank is unable to meet the indicated timelines due to additional revisions directed by the PA on any of its models, the PA will issue specific directives to the affected bank on a case￾by-case basis. 2.2.8 Phase 4: 42 to 66 months from the effective date of the amended Regulations 2.2.8.1 Phase 4 is designated for the execution of model development plans (PA￾approved plans developed in Phase 2) to implement the revised credit restructures directive. 2.2.8.2 During this phase, banks must submit all model changes related to the revised credit restructures directive for the PA’s prior written approval. Submissions for Phase 4 must be in the format prescribed in paragraph 2.2.9 of this directive. 2.2.8.3 The revised credit restructures directive forms an integral part of the PA’s prudential framework for the regulation and supervision of banks’ exposure to credit risk. It remains a fundamental component of regulatory compliance, impacting data construction, default definition considerations and model frameworks.

6 2.2.8.4 Banks are required to make extensive updates to their policies, systems, processes and data to comply with the revised credit restructures directive. Accordingly, each bank’s starting point for amending the IRB models may differ, and this is accommodated in the additional timeline afforded by Phase 4. 2.2.9 Requirements regarding changes to IRB credit risk models 2.2.9.1 Banks using the IRB approach must obtain prior written approval from the PA before making any model changes to IRB credit risk models related to the rollout of the Basel III post-crisis reforms and the revised credit restructures directive. 2.2.9.2 For the duration of the rollout period, these model changes will remain subject to PA approval. Without detracting from the requirements of Directive 2 of 2014 (D2/2014), for the duration of the rollout period, the following requirements for model changes will apply: 2.2.9.2.1 Tier 1 model changes, that is, models proposed for decommissioning or proposed changes to the model application scope, without any changes made to the model itself, must be communicated to the PA. Additionally, even if no model changes are applicable, updates to the parameter estimate floor as indicated in the amended Regulations must be communicated to the PA. 2.2.9.2.2 Tier 2 model changes, that is, the recalibration of models, without any changes to the model methodology and where this does not result in a material impact,4 must be communicated to the PA. The model validation documentation presented to the approval committee(s) as well as the minutes of the approval committee(s) must be submitted as supporting documentation when communicating the model change. Should the update to the model result in a material impact, the model change must be considered as a tier 3 model change. 2.2.9.2.3 Tier 3 model changes, that is, updates to the model, without the full redevelopment of the model5 and where this results in a material impact, must be communicated to the PA. The model development documentation, validation documentation, model code, masked data, documentation presented to the approval committee(s) as well as the minutes of the approval committee(s) must be submitted as supporting documentation when communicating the model change. Should the update to the model not result in a material impact, the model change must be considered as a tier 2 model change. 2.2.9.2.4 Tier 4 model changes, that is, model developments or redevelopments, must be communicated to the PA. This includes the change in approach when estimating the credit conversion factor (CCF) for EAD using the fixed horizon approach. Submission requirements are the same as for tier 3 model changes. 2.3 Regulatory reporting requirements 2.3.1 To manage the transition process and mitigate the potential impact on the data reported in the statutory return, the following regulatory reporting requirements will apply: 4 Material impact is to be assessed as per paragraph 2.1.2 of D2/2014. 5 This may include changing an input variable, updating the segmentation applied or any other change where the model methodology is retained.

7 2.3.2 Regulatory reporting in accordance with D11/2025 will be from the April 2027 reporting month. This means that restructured credit exposures initiated after 1 January 2027 must be reported in accordance with the requirements of D11/2025 from the April 2027 reporting month. 2.3.3 The phase-in period will start from the date of publication until 31 December 2026 (phases 1 and 2). During this phase-in period, banks must continue to report all restructured credit exposures in accordance with the requirements of D7/2015 in the revised BA 210 return. At the same time, throughout the phase-in period, the PA also requires banks to make all the requisite changes to their systems, processes and policies to prepare for regulatory reporting in line with the requirements of D11/2025 for the April 2027 reporting month. 2.3.4 Restructured credit exposures that are in probation, in terms of paragraphs 5.11 to 5.16 of D7/2015, up to and including 31 December 2026 (D7/2015 stock), must continue to be reported in accordance with the requirements of D7/2015 until 31 December 2026. For D7/2015 stock exposures after 31 December 2026, banks must prospectively apply all the requirements relating to the treatment of restructured credit exposures as outlined in the D11/2025. 2.3.5 For restructured credit exposures initiated from 1 January 2027 (inflows), banks must report in accordance with the requirements of the D11/2025. 2.4 Communication 2.4.1 All proposed model changes, irrespective of the tier, must be communicated in writing to the PA in the format specified in Appendix A of this Directive, and must be signed by the CRO of the IRB bank. 2.5 Documentation 2.5.1 All submitted documentation must be the final, signed-off version thereof, and comply with the documentation standards specified in regulation 23(11)(b)(v)(I) of the Regulations. 3. Acknowledgement of receipt 3.1 Kindly ensure that a copy of this Directive is made available to your institution’s external auditors. In addition, the attached acknowledgement of receipt, duly completed and signed by both the Chief Executive Officer of the institution and the said auditors, should be returned to the PA at the earliest convenience of the aforementioned signatories. Fundi Tshazibana Chief Executive Officer Date: Encl. 1 The previous Directive issued was Directive 11/2025, dated 21 October 2025.