Directive 2 of 2026 – Regulation 46 Reporting Requirements for Banks

CONFIDENTIAL P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za File ref. no.: 15/8/1/3 D2/2026 To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act, 1990 (Act No. 94 of 1990) Reporting requirements in terms of regulation 46 of the Regulations relating to Banks Executive summary Regulation 46 of the Regulations relating to Banks (Regulations) outlines specific reporting responsibilities for the auditors of banks, controlling companies and branches of foreign institutions (collectively, auditors of banks). The purpose of this Directive is to detail the references to the Banks Act (BA) returns that must be audited, reviewed or concluded upon under a limited assurance framework, as part of the auditors’ reporting duties under regulation 46 of the Regulations. This Directive includes changes to the specified BA returns resulting from the amendments to the Regulations under section 90 of the Banks Act, 1990 (Act No. 94 of 1990) (Banks Act) as published in Government Gazette No. 52907 on 26 June 2025 and implemented with effect from 1 July 2025. This Directive replaces Directive 2 of 2024, dated 8 March 2024.

1. Introduction 1.1 Regulation 46(1) of the Regulations requires the auditor of a bank to report annually, within 120 days of the financial year-end, on the bank’s financial position and operational results, as reflected in the regulatory returns specified in regulation 46(6). 1.2 Beside quantitative reporting, the auditor must also address qualitative aspects of the bank and its operations, including, but not limited to, the bank’s system of internal controls. 1.3 Regulation 46(6) also stipulates that the auditor’s reports must be prepared using the wording and practices agreed upon by the Prudential Authority (PA), the South African Institute of Chartered Accountants and the Independent Regulatory Board for Auditors (IRBA). 1.4 IRBA’s Committee for Auditing Standards is mandated to review and approve the illustrative regulatory reports referred to in regulation 46(6), in line with the required

2 due process. The most recent versions are published on the IRBA website1 for auditors to use in meeting the reporting requirements set out in regulation 46. 1.5 For South African operations, the illustrative regulatory reports referenced above comprise Parts A to I, with Parts A to E addressing the reports required in terms of regulation 46(6) and structured according to the type of audit, review or limited assurance engagement conducted and the related assurance levels. These are: • Part A – Audit report on the year-end BA returns; • Part B – Review report on the year-end BA returns; • Part C – Limited assurance report on risk returns at year-end; • Part D – Limited assurance report on risk returns at year-end derived from internal models; and • Part E – Limited assurance report on BA 325 daily market risk returns. 1.6 For foreign operations, the illustrative regulatory reports referenced above comprise Parts A to H, with Parts A to D addressing the reports required in terms of regulation 46(6) and structured according to the type of audit, review or limited assurance engagement and the related assurance levels. These are: • Part A – Audit report on the year-end BA 610 return; • Part B – Review report on the year-end BA 610 return; • Part C – Limited assurance report on risk lines of the BA 610 return at year-end; and • Part D – Limited assurance report on risk lines of the BA 610 return at year-end derived from internal models. 2. Directive 2.1 Based on the above and in accordance with the provisions of section 6(6) of the Banks Act, auditors of banks are directed as follows: 2.1.1 Conduct an audit, review or limited assurance engagement on the respective regulatory returns specified in regulation 46(6) of the Regulations, in line with the detailed audit matrix provided in Annexure 1 for reports submitted to the PA for financial years ending on or after 1 July 2025, for reporting purposes in terms of Parts A to E or Parts A to D of the illustrative regulatory reports for South African and foreign operations, respectively. 2.1.2 Submit reports to the PA in accordance with the illustrative regulatory reports published by IRBA, as updated from time to time. 2.1.3 Ensure that Parts A to E and Parts A to D of the respective reports submitted to the PA refer to this Directive regarding the detail of audit, review or limited assurance work performed. 3. Acknowledgement of receipt 3.1 Please ensure that a copy of this Directive is provided to your institution’s external auditors. The attached acknowledgement of receipt, completed and signed by both 1 IRBA website, ‘Reports to the Prudential Authority and the Exchange Control Department’.

3 the Chief Executive Officer and the auditors, must be returned to the PA at the earliest convenience of the signatories. Fundi Tshazibana Chief Executive Officer Date: Encl.: 1 The previous directive issued was Directive 1/2026, dated 25 February 2026.