Circular to Banks and Financial Institutions No. 2025-08 of May 16, 2025

1 Tunis, May 16, 2025. CIRCULAR TO BANKS AND FINANCIAL INSTITUTIONS No. 2025-08 Subject: Preliminary measures for the adoption of prudential and regulatory reforms.

The Governor of the Central Bank of Tunisia, Having regard to Law No. 2016-35 of April 25, 2016 establishing the status of the Central Bank of Tunisia, Having regard to Law No. 2016-48 of July 11, 2016 on banks and financial institutions, Having regard to Circular to Credit Institutions No. 91-24 of December 17, 1991 on risk division, coverage and monitoring of commitments, as amended and supplemented by subsequent texts, Having regard to Circular to Credit Institutions No. 2006-19 of November 28, 2006 on internal control, Having regard to Circular to Banks and Financial Institutions No. 2016-06 of October 11, 2016 on the counterparty rating system, Having regard to Circular to Banks and Financial Institutions No. 2017-06 of July 31, 2017 on accounting, prudential and statistical reporting to the Central Bank of Tunisia, Having regard to Circular to Banks and Financial Institutions No. 2018-06 of June 5, 2018 on capital adequacy standards, Having regard to Circular to Banks and Financial Institutions No. 2020-01 of January 29, 2020 on preliminary measures for the adoption of international financial reporting standards (IFRS), Having regard to Circular to Credit Institutions No. 2021-05 of August 19, 2021 on the governance framework for banks and financial institutions, Having regard to Circular to Banks and Financial Institutions No. 2023-05 of October 10, 2023 on the implementation of consolidated-based supervision, Having regard to the letter from the Central Bank of Tunisia to banks and financial institutions dated April 11, 2025 on the broad consultation regarding the draft prudential and regulatory reforms, Having regard to the opinion of the Compliance Control Committee No. 2025-08 of May 15, 2025 as provided for in Article 42 of Law No. 2016-35 of April 25, 2016 cited above.

Decides:

Article 1: This circular applies to banks and financial institutions as defined in Law No. 2016-48 cited above, with the exception of payment institutions.

Article 2: Banks and financial institutions are required to take all necessary measures in preparation for the implementation of the prudential and regulatory reforms subject of the aforementioned letter from the Central Bank of Tunisia, covering the following components: • The new capital adequacy standards. • The new rules for the classification and coverage of exposures. • The application guide for IFRS 9 standard.

Article 3: The management body of the bank or financial institution must establish a strategic and operational plan for managing the overall project of prudential and regulatory reforms. This plan must be approved by the administrative body and include at least the following elements: • The strategic and operational project management process, as well as the action plan covering all components of the reforms to be undertaken and the roadmap for its implementation. • The composition of the steering committee referred to in Article 5 of this circular, the internal structures involved and the identification of teams by reform component. • The necessary measures to adapt the internal control system, information system and accounting system to meet the requirements for implementing the prudential and regulatory reforms. • A project to establish a data governance framework with reference to the principles set out in Article 6 of this circular. • A project to adopt an expected credit losses (ECL) calculation model in accordance with the methodological guidelines defined in the IFRS 9 application guide. • A training plan covering all project stakeholders, including members of the governance bodies. The aforementioned strategic and operational plan must be adapted to the size of the institution, its risk profile as well as the nature and complexity of its activities and operations.

Article 4: The administrative body ensures the effective implementation of the strategic and operational plan referred to in Article 3 of this circular. To this end, it ensures the allocation of necessary resources for the proper management of the project. The audit committee and the risk committee support the board of directors in exercising this mission, each within its respective responsibilities. They ensure, in a coordinated manner, the monitoring of the steering committee's work referred to in Article 5 of this circular.

Article 5: The bank or financial institution must establish a dedicated steering committee for managing the prudential and regulatory reform project provided for by this circular. This steering committee is responsible for: • The establishment and organization of project teams; • Monitoring project progress and controlling its implementation in accordance with the established objectives; • Supervising the achievement of objectives in line with the strategic orientations of the bank or financial institution; • Coordinating among the different business lines and support functions involved in the project; • Validating key project phases; and • Providing regular reporting to the risk and audit committees.

Article 6: The bank or financial institution is required to establish a structured and cross-functional data governance framework, in support of the implementation of prudential and regulatory reforms. This framework aims to ensure the quality, integrity, traceability, security and availability of data used for prudential calculations, expected credit losses (ECL) modelling and regulatory and financial reporting. To this end, the bank or financial institution must notably: • Develop an internal data governance policy, approved by the management body, defining:

• the responsibilities of stakeholders,
• the guiding principles regarding data quality, security and compliance, and
• the related control systems. • Appoint a Chief Data Officer (CDO) or an equivalent structure, equipped with the necessary resources and responsibilities to steer the data governance strategy. • Implement regular data quality control processes, including periodic validations, internal audits, consistency tests, independent reviews and monitoring of quality indicators accompanied by remediation plans in case of deviations. • Ensure complete traceability of the data lifecycle, from its origin to its use, including transformation and storage. • Guarantee secure archiving of data, ensuring accessibility to internal and external control and audit functions. • Adopt technological solutions compliant with international standards in information security and data governance, notably enabling the automation of critical data flows to limit manual error risks and strengthen processing reliability.

Article 7: The bank or financial institution is required to transmit to the Central Bank of Tunisia, within a maximum period of three (3) months from the date of publication of this circular, the strategic and operational plan referred to in Article 3.

Article 8: This circular enters into force from the date of its publication and repeals Circular to Banks and Financial Institutions No. 2020-01 on preliminary measures for the adoption of international financial reporting standards (IFRS).

THE GOVERNOR, Fethi Zouhaier NOURI