Financial Inspection Rating System for Deposit-Taking Institutions

(Provisional translation) ＊This translation is provisionally prepared and subject to change without notice. Financial Inspection Rating System (Financial Inspection Rating System for Deposit-taking Financial Institutions) February 2007

Inspection Bureau No. 370 July 1, 2005 To: Director-Generals of Local Finance Bureaus Director-General, Okinawa General Bureau Inspection Administrator Chief Financial Inspectors Senior Financial Inspectors Special Financial Inspectors Financial Inspectors From: Masao Nishihara, Director-General, Inspection Bureau, Financial Services Agency Financial Inspection Rating System for Financial Inspections In December last year, the Financial Services Agency (FSA) developed and released the “Program for Further Financial Reform - Japan's Challenge: Moving toward a Financial Services Nation,“ which charted the course of its actions in the coming two years. Based on the recognition that the current financial system is “entering a new forward-looking phase aiming at establishing a desirable financial system for the future, having now moved beyond the emergency reaction against the non-performing loans problem,” the Program aims to create a desirable financial system through the efforts of the private sector, rather than under the initiative of the public sector. To that end, it proposed a “sharp, effective and selective administrative response through the introduction of a rating system into inspections that is based not only on the financial situation, but also on various viewpoints of financial institutions.” Based on the deliberation results, etc. of the Financial Inspection Rating System Study Group, we have developed and decided to implement the Financial Inspection Rating System for financial institutions as shown below, which you are asked to fully acquaint yourself with and internalize.

1. Purpose Through rating-based evaluation of the results of inspections of financial institutions, verified pursuant to the Financial Inspection Manual, the “Financial Inspection Rating System” aims to promote efforts by financial institutions toward voluntary and sustained improvement in their management, as well as dialogue between inspectors and institutions. It also aims to improve the efficiency of inspections and the transparency, etc. of financial administration by linking the rating results to selective regulatory measures. Please be advised that in implementing the “Financial Inspection Rating System,” you should pay full attention to the “Inspection Manual for Deposit-Taking Institutions (Inspection Bureau No. 79)” and the “Report of the Financial Inspection Rating System Study Group (May 25, 2005)” (Appendix).
2. Rating Items There are ten items subject to rating: “business management (governance) (for basic elements),” “legal compliance,” “customer protection management,” “comprehensive risk management,” “capital management,” “credit risk management,” “asset assessment management,” “market risk management,” “liquidity risk management” and “operational risk management.”
3. Rating Method A rating scale consisting of four grades (A, B, C and D) shall be applied to each rating item, in accordance with the “Rating Grades/Points of Attention in Rating” (Attachment).
4. Financial Institutions Subject to Rating

• Banks
• Shinkin Banks and federations of Shinkin Banks
• Credit cooperatives and federations of credit cooperatives

5. Administrative Processes, etc. (1) During an on-site inspection, the inspector shall first have an adequate exchange of views with the financial institution under inspection with regard to the facts relevant to the rating, as well as the evaluation thereof. As part of the procedures for completing the on-site inspection (“exit meeting”), the inspector shall also hear the financial institution’s opinions about the rating results, in order to confirm the points of agreement and disagreement between the chief inspector and the financial institution at that time. (2) If there is any disagreement regarding the rating results following completion of the on-site inspection, the inspected financial institution may, pursuant to the opinion submission process, file a statement to that effect with the Director-General of the

Inspection Bureau and request a review. (3) The final rating results shall be notified to the inspected financial institution as part of the inspection result report. 6. Reflection in Selective Regulatory Measures The rating results shall be reflected in the frequency, scope and depth of subsequent inspections. 7. Implementation Date, etc. The Financial Inspection Rating System shall be put into effect on April 1, 2007. Rating results based on inspections to be notified thereafter (or inspections to be started thereafter, in the case of inspections without notice) shall be reflected in selective regulatory measures. With regard to financial institutions other than major banks, however, rating results based on inspections to be notified on and after January 1, 2008 (inspections to be started on and after January 1, 2008, in the case of inspections without notice) shall be reflected in selective regulatory measures.

Rating Grades/Points of Attention in Rating (Financial Inspection Rating System) February 2007 (Attachment)

Rating Grades

1. Business Management (Governance) (for Basic Elements) A: A strong business management (governance) system suited to the scale and nature of the financial institution has been established by the management. Any recognized weakness is minor and has an insignificant effect on the appropriateness and soundness of the financial institution’s business operations. B: A sufficient business management (governance) system suited to the scale and nature of the financial institution has been established by the management. Although there are weaknesses in the system, they are not so serious as to have material effects on the appropriateness and soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The business management (governance) system established by the management is insufficient considering the scale and nature of the financial institution. The system needs to be improved because its inadequacy is deemed to be affecting the appropriateness and soundness of the financial institution’s business operations. D: The business management (governance) system established by the management is defective or seriously defective. The deficiency of the system is seriously affecting the appropriateness and soundness of the financial institution’s business operations and may threaten, or is threatening, the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Business Management (Governance).” ● With regard to the issues pointed out on the occasion of the last inspection, it is important for financial institutions to develop and implement effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on identifying the cause and context of this lack of sufficient improvement measures and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Negative Factor] ● If the financial institution is deemed to have intentionally avoided subjecting any particular division to audits, this shall be considered as a negative factor in giving a rating. [Other Points of Attention] ● In evaluating the business management (governance) system, the inspector shall not rely purely on the results of the examination of the “development and establishment of systems by the management” as specified in the checklists included in the sections regarding items other than business management. Rather, the inspector shall examine whether the financial institution is effectively exercising the functions of the four basic elements specified in the checklist for business management (governance) – (1) a system of business management (governance) by the representative, directors, non-representative directors and the Board of Directors, (2) a system of internal audits, (3) a system of audits by corporate auditors and (4) a system of external audits – so as to ensure the appropriateness and soundness of its business operations. ● In evaluating the business management (governance) system, the inspector shall bear in mind that the key point is whether the financial institution’s policies regarding management and other matters are effective and suited to the actual state of the financial institution’s business operations, considering the scale and nature of the financial

institution. It should be noted that the inspector shall take care to avoid making excessive intervention in matters that concern the management decisions of the financial institution. ● In evaluating the roles and responsibilities of directors and the Board of Directors, the inspector shall bear in mind that the key point is how the representative director is exercising leadership to establish the legal compliance and risk management systems, and how other directors are exercising their check-and-balance system. It should be noted that although the inspector shall examine the contents of discussions had at meetings of the Board of Directors, etc. from the viewpoint of judging whether sufficient discussions were had at those meetings, such examination is not intended to judge the appropriateness of management decisions made by the financial institution. ● In evaluating the development of the organizational framework and the establishment of a check-and-balance system by the Board of Directors, the inspector shall bear in mind that the key point is whether the organization and system thus improved and established are effective, considering the scale and nature of the financial institution. ● It is important for the representative director and the Board of Directors to recognize that the internal audit division acts as an important agent on their behalf and it is necessary for them to utilize reports made by this division, based on the recognition that the reports reflect checks conducted from the standpoint of an entity independent from all operational divisions. In evaluating the financial institution’s development and establishment of the internal audit system, the inspector shall bear in mind that the key point is whether the management is seeking to establish an effective internal audit system based on said recognition. ● In evaluating the establishment of the system of the internal audit division, the inspector shall bear in mind that the key point is whether the financial institution has established relevant arrangements and procedures, allocated necessary personnel and sought to ensure independence in an effective manner suited to its scale and nature. If the director in charge of internal audits and the personnel allocated to the internal audit division are not adept in the business operations in which the financial institution engages, the inspector shall examine how the management recognizes the current situation and what measures are being taken to deal with it. Moreover, if the personnel allocated to the internal audit division are deemed to lack adequate expert knowledge and skills, it is

important for the inspector to check whether measures have been taken to make up for this, through dialogue with the financial institution. Regarding the independence of the internal audit division, in cases where an employee allocated to the division works concurrently for another division, it is important for the inspector to identify the cause and background of this situation and examine whether it is undermining efforts to ensure the effectiveness of internal audits, through dialogue with the financial institution.

Rating Grades 2. Legal Compliance A: A strong compliance system has been established by the management of the financial institution. Any recognized weakness is minor and has an insignificant effect on the appropriateness of the financial institution’s business operations. B: A sufficient legal compliance system has been established by the management of the financial institution, although minor violations of Laws are recognized. Although there are weaknesses in the system, they are not so serious as to have material effects on the appropriateness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The legal compliance system established by the management of the financial institution is insufficient, as non-minor violations of Laws are recognized. The system needs to be improved because the efforts made by the management of the financial institution to ensure legal compliance are insufficient, and this inadequacy is deemed to be affecting the appropriateness of the financial institution’s business operations. D: The legal compliance system established by the management of the financial institution is defective or seriously defective, with violations of Laws involving the management itself being recognized, for example. The deficiency of the system may lead to, or has led to, the occurrence of a violation of Laws that could threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Legal Compliance.” ● In giving a rating, the inspector shall put priority on examining whether an effective legal compliance system has been established in light of the checklists contained in “I. Development and Establishment of Legal Compliance System by Management” and “II. Development and Establishment of Legal Compliance System by Manager.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the legal compliance system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If the evaluation and improvement activities of the Board of Directors, etc. and the manager in charge of the compliance control division are effective and create a virtuous circle of constant improvement efforts by officers and employers of the financial institution, this shall be considered as a positive factor in giving a rating. [Negative Factor]

● If any of the following is recognized through the process of inspection, it shall be considered as a negative factor in giving a rating, since it may be taken as evidence that the financial institution has no shortage of weaknesses in its legal compliance system but has taken insufficient improvement measures. (1) A case where the financial institution has concealed or tolerated a violation of Laws, or intentionally neglected to report it to the authorities. However, it should be borne in mind that it is necessary to determine the seriousness of the case by identifying its extent, the roles played by the management and the circumstances regarding how the concealed violation of Laws has come to light, and take account of the seriousness in giving a rating. (2) A case where the financial institution has intentionally made an inaccurate disclosure of the amount of non-performing loans. (3) A case where similar inappropriate incidents have occurred at two or more branches, etc. or a number of such incidents have occurred in succession, because measures for preventing the recurrence of inappropriate incidents are ineffective. [Other Points of Attention] ● In evaluating the financial institution’s policy regarding the legal compliance system, the inspector shall bear in mind that the key point is whether the policy prescribes a strict stance on anti-social forces, the prevention of money laundering and inappropriate incidents, etc. and whether the policies are effective and suited to the actual state of the financial institution’s business operations. It should be noted that the inspector shall take care to avoid making excessive intervention in matters that concern the management decisions of the financial institution. ● The inspector shall bear in mind that although the scale and nature of the financial institution need to be taken into consideration when evaluating the establishment of necessary arrangements and procedures at the compliance control division and the improvement of the control environment for legal compliance at individual operational divisions, sales offices, etc., these factors cannot constitute an excuse for any violation of Laws. With this in mind, the inspector shall grasp the effects of any detected violation of Laws on the management of the financial institution, as well as the cause and background of the violation, and give a rating in light of this.

● In giving a rating, the inspector shall take into consideration the cause and background of any detected violation of Laws, as well as its impact on the management of the financial institution, even if the violation concerns laws other than those specified in “III. Specific Issues.” ● With regard to response and improvement measures taken in relation to a violation of Laws, it is important for the management to take the initiative in developing and implementing rigorous and effective measures in light of the cause and background of the violation. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient measures, and give a rating in light of this.

Rating Grades 3. Customer Protection Management A: Systems for managing elements of customer protection, such as the Customer Explanation Management System, the Customer Support Management System, the Customer Information Management System and the Outsourcing Management System, have been strongly established by the management and are functioning properly. Any recognized weakness is minor and has an insignificant effect on the appropriateness of the financial institution’s business operations. B: Systems for managing elements of customer protection, such as the Customer Explanation Management System, the Customer Support Management System, the Customer Information Management System and the Outsourcing Management System, have been sufficiently established by the management. Although there are weaknesses in the systems, they are not so serious as to have material effects on the appropriateness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The systems established by the management for managing elements of customer protection, such as the Customer Explanation Management System, the Customer Support Management System, the Customer Information Management System and the Outsourcing Management System, are insufficient, as non-minor deficiencies of the systems are recognized. The systems need to be improved because the efforts made by the management of the financial institution to ensure customer protection are inadequate and this inadequacy is deemed to be affecting the appropriateness of the financial institution’s business operations. D: The systems established by the management for managing elements of customer protection, such as the Customer Explanation Management System, the Customer Support Management System, the Customer Information Management System and the Outsourcing Management System, are defective or seriously defective. For example, the systems are

insufficient. The deficiency of the system may lead to the defection of customers and threaten the ability of the financial institution to continue operating as such, or have already led to such a situation.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Customer Protection Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective customer protection management system has been established in light of the checklists contained in “I. Development and Establishment of Customer Management System by the Management” and “II. Development and Establishment of Customer Protection Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the customer protection management system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If any of the following is recognized through the process of inspection, it shall be considered as a positive factor in giving a rating. (1) Disclosure documents and other materials used by the financial institution for making explanations to customers take account of the customer’s standpoint and provide specific

descriptions to facilitate their understanding, rather than providing abstract explanations, and the financial institution reviews and revises these materials on an ongoing basis in order to make them easy-to-understand and suited to the needs of customers, by reflecting the opinions of customers in the revisions. (2) The Customer Explanation Management and Customer Support Management are effectively coordinated to produce synergy effects. For example, the financial institution promptly and properly reviews and revises the Customer Explanation Manuals in light of problems identified in the process of customer support management. (3) The financial institution not only makes proper efforts to enhance the Customer Explanation Management System, the Customer Support Management System, the Customer Information Management System and the Outsourcing Management System, but also ensures the effectiveness of customer protection by properly managing other processes it has determined to be essential to customer protection and improving customer convenience. (4) Assessment and improvement activities conducted by the Board of Directors, etc. and the managers in charge of customer protection produce effective results, leading customers to constantly appreciate improvements made by the financial institution. [Negative Factor] ● If similar customer complaints and problems or inappropriate incidents such as leakage of customer information occur at two or more branches simultaneously or successively due to the financial institution’s failure to correct inappropriate explanations to customers or an inappropriate management of customer information, or its failure to consider effective measures to prevent their recurrence, this shall be considered as a negative factor in giving a rating.

Rating Grades 4. Comprehensive Risk Management A: A strong comprehensive risk management system suited to the scale and nature of the financial institution has been established by the management. All major risks have been consistently identified, kept track of and managed in an effective manner, and any recognized weakness is minor and has an insignificant effect on the soundness of the financial institution’s business operations. B: A sufficient comprehensive risk management system suited to the scale and nature of the financial institution has been established by the management. Most major risks and problems have been identified, kept track of and managed. Although there are weaknesses in the system, they are not so serious as to have material effects on the soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The comprehensive risk management system established by the management is insufficient considering the scale and nature of the financial institution. The system needs to be improved because the management’s comprehensive risk management capability is inadequate and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations. D: The comprehensive risk management system established by the management is defective or seriously defective. The deficiency of the system may lead to, or has led to, an inappropriate incident or an unexpected loss that could threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Comprehensive Risk Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective comprehensive risk management system has been established in light of the checklists contained in “I. Development and Establishment of Comprehensive Risk Management System by Management” and “II. Development and Establishment of Comprehensive Risk Management System by Manager.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the comprehensive risk management system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If the management actively involves itself in efforts to identify the risks that the financial institution is facing and to grasp and analyze weaknesses and problems in the comprehensive risk management system, thereby helping to enhance the system, this shall be considered as a positive factor in giving a rating.

[Negative Factor] ● If the financial institution has intentionally excluded what are deemed to be important risks from the calculation of the risk made in the process of integrated risk management, or intentionally underestimated such risks in said calculation, this shall be considered as a negative factor in giving a rating. [Other Points of Attention] ● If a financial institution mainly engaged in traditional banking business is conducting integrated risk management on a trial basis and does not use the risk measured in this risk management process as a basis for making management decisions, the results of examination of the appropriateness of this method shall not be reflected into the rating. In the case of a financial institution conducting integrated risk management and using the risk measured in the process as a basis for making management decisions, meanwhile, the risk management method shall be examined in light of “III. Specific Issues” and the results shall be reflected in the rating.

Rating Grades 5. Capital Management A: A strong capital management system suited to the scale and nature of the financial institution has been established by the management, and the financial institution has a strong level of capital in terms of both quality and quantity. B: A sufficient capital management system suited to the scale and nature of the financial institution has been established by the management, and the financial institution has a sufficient level of capital. Although there are weaknesses in the system, they are not so serious as to have material effects on the soundness of the financial institution's business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The capital management system established by the management is insufficient considering the scale and nature of the financial institution, or the financial institution has an insufficient level of capital. The system needs to be improved because the management’s capital management capability is inadequate and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations. D: The capital management system established by the management is defective or seriously defective. The deficiency of the system may reduce, or has reduced, the financial institution’s capital amount to such a low level as to threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Capital Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective capital management system has been established in light of the checklists contained in “I. Development and Establishment of Capital Management System by Management” and “II. Development and Establishment of Capital Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the capital management system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If the financial institution has a strong level of capital in terms of both quality and quantity in light of its risk profile, this shall be considered as a positive factor in giving a rating. [Negative Factor] ● If either of the following cases is recognized as a result of examination of the accuracy of its capital adequacy ratio, this shall be considered as a negative factor in giving a rating.

(1) The discrepancy between the capital adequacy ratios before and after the inspection is 10% or higher. (2) Although the discrepancy between the capital adequacy ratios before and after the inspection is less than 10%, a significant defect is recognized in the calculation process. For example, there are a number of incorrect calculations regarding the amounts of credit risks and assets that may be offsetting the erroneous effects of one another, thus limiting the discrepancy in the capital adequacy ratio. ● If either of the following cases is recognized as a result of examination of the status of deliberations on measures to be taken in the case of the capital adequacy becoming insufficient, this shall be considered as a negative factor in giving a rating. (1) The management has failed to conduct sufficient deliberations on how to maintain the capital adequacy ratio at an appropriate level, because it has no clear strategy in this regard. (For example, the management has failed to conduct deliberations on what measures to take even though the capital adequacy ratio is expected to fall substantially within a certain period of time (e.g. three years).) (2) Even though the capital adequacy ratio is expected to fall close to or below the trigger level for prompt corrective actions in the next fiscal year, the management has not addressed the situation, or the measures to address the situation are unlikely to be implemented within the current fiscal year. [Other Points of Attention] ● If the capital adequacy ratio after the inspection falls below the “Criteria for Judging Whether a Financial Institution’s Own Capital is Sufficient in Light of the Assets Held, etc. under the Provision of Article 14-2 of the Banking Law” (8% for financial institutions operating internationally and 4% for financial institutions operating domestically), the rating regarding capital management should be C or lower.

Rating Grades 6. Credit Risk Management A: A strong credit risk management system suited to the scale and nature of the financial institution has been established by the management. Any recognized weakness is minor and has an insignificant effect on the soundness of the financial institution’s business operations. B: A sufficient credit risk management system suited to the scale and nature of the financial institution has been established by the management. Although there are weaknesses in the management of the screening process, they are not so serious as to have material effects on the soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The credit risk management system established by the management is insufficient considering the scale and nature of the financial institution. The system needs to be improved because the management’s credit risk management capability is inadequate and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations, as problems are recognized in the management of the screening process or excessive credit concentration is being detected, for example. D: The credit risk management system established by the management is defective or seriously defective. The deficiency of the system may threaten, or is threatening, the ability of the financial institution to continue operating by further credit concentration or by the deterioration of asset quality due to the worsening business performance of the borrowers where credit is concentrated.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Credit Risk Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective credit risk management system has been established in light of the checklists contained in “I. Development and Establishment of Credit Risk Management System by Management” and “II. Development and Establishment of Credit Risk Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the credit risk management system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If any of the following is recognized through the process of inspection, it shall be considered as a positive factor in giving a rating. (1) The management actively involves itself in efforts to grasp and analyze weaknesses and problems in the credit risk management system, thereby helping to enhance the system.

(2) Through thoroughly communicating to the Marketing and Sales division the purpose of the supplement to the financial inspection manual: treatment of classifications regarding credits to small and medium-sized enterprises, the financial institution makes efforts to grasp the management status of SMEs and support their business rehabilitation, thereby enhancing the credit risk management system. (3) Through activities such as monitoring, management consultations and advice, the financial institution seeks to maintain close communications with SME borrowers, precisely grasp their management status and properly reflect the results in its credit risk management. (4) The financial institution engages in efforts to support the rehabilitation of SMEs that have fallen into a business slump or that are about to do so, thereby reducing the overall credit risk of the financial institution. (5) With regard to the future business potential of SMEs, the financial institution engages in efforts to enhance the ability to make appropriate judgment and strengthen the credit screening system, thereby preventing the occurrence of problem loans, or increasing the chance to discover companies with promising potential.

[Other Points of Attention] ● When evaluating the credit management system of regional financial institutions, the inspector shall bear in mind that the key point is whether the risk management system is effective given the fact that the scale and nature of such financial institutions may make it necessary for them to allocate a relatively large proportion of their overall credit to a particular business sector or region. ● When evaluating the credit risk management system in relation to loans to SMEs, the inspector shall bear in mind that the key point is whether the risk management system is effective in light of the business model of the financial institution. For example, if the business model of the financial institution is based on the assumption of a certain proportion of its loan portfolio becoming non-performing loans, the inspector shall examine whether the risk management system is suited to this assumption.

Rating Grades 7. Asset Assessment Management A: Strong systems for elements of asset assessment management, such as self-assessment, write-offs and loan loss provision, suited to the scale and nature of the financial institution have been established by the management. Any recognized weakness is minor and has an insignificant effect on the soundness of the financial institution’s business operations. B: A sufficient asset assessment management system suited to the scale and nature of the financial institution has been established by the management, ensuring a sufficient level of write-offs and loan loss provision suited to the credit risk level. Although there are deficiencies regarding the accuracy of self-assessment, they are not so serious as to have material effects on the soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The asset assessment management system established by the management is insufficient considering the scale and nature of the financial institution, or the level of write-offs and loan loss provision is not suited to the credit risk level. The system needs to be improved because the management’s asset assessment management capability is inadequate, and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations, as deficiencies are recognized in the systems for self-assessment and write-offs and loan loss provision. D: The asset assessment management system established by the management is defective or seriously defective. The deficiency of the system may threaten or is threatening the ability of the financial institution to continue operating as such, with a substantial shortfall being recognized in the amount of write-offs and loan loss provision, for example.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” of the “Checklist for Asset Assessment Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective asset assessment management system has been established in light of the checklists contained in “I. Development and Establishment of an Asset Assessment Management System by Management” and “II. Development and Establishment of an Asset Assessment Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the establishment of the asset assessment management system and the review of the system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Other Points of Attention] ● When evaluating the asset assessment management system, the inspector shall avoid focusing only on the rates of increase of the amounts of classified loans, risk-management loans, loan write-offs and loan loss provisions, and also examine the pre-inspection amounts of classified loans, write-offs and loan loss provisions, the impact on the capital adequacy ratio and any improvement made since the previous inspection, while keeping

the scale and nature of the financial institution in mind. If an improvement is not recognized, it is necessary to identify the cause and background of the lack thereof, fully examine what kind of problem there is with regard to the asset assessment management system and reflect the findings in the rating. ● When evaluating the asset assessment management system in relation to loans to small and medium-size enterprises (SMEs), the inspector shall bear in mind that it is important to examine whether the financial institution has checked the management status of SME borrowers in particular detail and grasped it accurately in accordance with the purpose of the supplement to the financial inspection manual: treatment of classifications regarding credits to small and medium-size enterprises, and reflected the findings in self-assessment.

Rating Grades 8. Market Risk Management A: A strong market risk management system suited to the scale and nature of the financial institution has been established by the management. Any recognized weakness is minor and has an insignificant effect on the soundness of the financial institution’s business operations. B: A sufficient market risk management system suited to the scale and nature of the financial institution has been established by the management. Although there are weaknesses in the system, they are not so serious as to have material effects on the soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The market risk management system established by the management is insufficient considering the scale and nature of the financial institution. The system needs to be improved because the management’s market risk management capability is inadequate, and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations. D: The market risk management system established by the management is defective or seriously defective. The deficiency of the system may lead to, or has led to, an inappropriate incident or an unexpected loss that could threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” of the “Checklist for Market Risk Management.” In particular, it is important to examine all items deemed necessary in light of the financial institution’s asset management strategy, investment style, risk profile, risk management method and measurement technique, as well as the amount of transactions it handles. ● In giving a rating, the inspector shall put priority on examining whether an effective market risk management system has been established in light of the checklists contained in “I. Development and Establishment of a Market Risk Management System by Management” and “II. Development and Establishment of a Market Risk Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes －the formulation of the policy regarding the market risk management system, the establishment of the system, and the review of the policy and the system－involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If the management actively involves itself in efforts to grasp and analyze the

weaknesses of and problems in the market risk management system, thereby helping to enhance the system, this shall be considered as a positive factor in giving a rating.

Rating Grades 9．Liquidity Risk Management A: A strong liquidity risk management system suited to the scale and nature of the financial institution, particularly its urgency level of funds needs and its liquidity status, has been established by the management. Any recognized weakness is minor and has an insignificant effect on funds management by the financial institution. B: A sufficient liquidity risk management system suited to the scale and nature of the financial institution, particularly its urgency level of funds needs and its liquidity status, has been established by the management. Although there are weaknesses in the system, they are not so serious as to have material effects on funds management by the financial institution, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The liquidity risk management system established by the management is insufficient considering the scale and nature of the financial institution, particularly its urgency level of funds needs and its liquidity status. The system needs to be improved because the management’s liquidity risk management capability is inadequate, and this inadequacy is deemed to be affecting funds management by the financial institution. D: The liquidity risk management system established by the management is defective or seriously defective in relation to the scale and nature of the financial institution, particularly its urgency level of funds needs and its liquidity status. The deficiency of the system may lead to or has led to funds management problems, etc. that could threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” of the “Checklist for Liquidity Risk Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective liquidity risk management system has been established in light of the checklists contained in “I. Development and Establishment of a Liquidity Risk Management System by Management” and “II. Development and Establishment of a Liquidity Risk Management System by Managers.” ● In giving a rating, the inspector shall take account of which of the relevant processes －the formulation of the policy regarding the liquidity risk management system, the establishment of the system, and the review of the policy and the system－involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection. [Positive Factor] ● If the management actively involves itself in efforts to grasp and analyze the weaknesses of and problems in the liquidity risk management system, thereby helping to enhance the system, this shall be considered as a positive factor in giving a rating. [Other Points of Attention]

● The inspector shall determine how much importance should be attached to the market liquidity risk in giving a rating, by taking account of the nature and scale of the financial institution’s risk, based on the recognition that this type of risk is a particularly important item when the relevant financial institution has a large amount of over-the-counter derivatives positions (relative to the market size), for which liquidity is limited. ● When evaluating the funds operation and management, the inspector shall bear in mind that the key point is whether the management method is effective in light of the scale and nature of the financial institution.

Rating Grades 10．Operational Risk Management A: A strong operational risk management system suited to the scale and nature of the financial institution has been established by the management. Any recognized weakness is minor and has an insignificant effect on the soundness of the financial institution’s business operations. B: A sufficient operational risk management system suited to the scale and nature of the financial institution has been established by the management. Although there are weaknesses in the system, they are not so serious as to have material effects on the soundness of the financial institution’s business operations, and the financial institution has already taken appropriate measures to address them on a voluntary basis, or can be expected to do so in the future. C: The operational risk management system established by the management is insufficient considering the scale and nature of the financial institution. The system needs to be improved because the management’s operational risk management capability is inadequate, and this inadequacy is deemed to be affecting the soundness of the financial institution’s business operations, as non-minor administrative errors or a system breakdown affecting customers are recognized. D: The operational risk management system established by the management is defective or seriously defective. The deficiency of the system may lead to or has led to a serious system breakdown or administrative error that could threaten the ability of the financial institution to continue operating as such.

Points of Attention in Rating, etc. [Basic Points of Attention] ● In giving a rating, the inspector shall pay due consideration to the “Checkpoints” in the “Checklist for Operational Risk Management.” ● In giving a rating, the inspector shall put priority on examining whether an effective operational risk management system has been established in light of the checklists contained in “I. Development and Establishment of Comprehensive Operational Risk Management System by Management,” “I. Development and Establishment of Administrative Risk Management System by Management,” “I. Development and Establishment of Information Technology Risk Management System by Management,” “II. Development and Establishment of Comprehensive Operational Risk Management System by Manager,” “II. Development and Establishment of Administrative Risk Management System by Manager,” “II. Development and Establishment of Information Technology Risk Management System by Manager” and “Development and Establishment of Other Operational Risks.” ● In giving a rating, the inspector shall take account of which of the relevant processes – the formulation of the policy regarding the operational risk management system, the establishment of the system, and the review of the policy and system – involves a problem. ● With regard to the issues pointed out on the occasion of the last inspection (non-minor issues in particular), it is important for the management to take the initiative in developing and implementing effective improvement measures. If only stop-gap measures or insufficient improvement measures have been taken, the inspector shall focus on grasping how the management recognizes the current situation and on identifying the cause and background of the lack of sufficient improvement measures, and give a rating in light of this. It should be noted that the evaluated improvement in the issues pointed out on the occasion of the last inspection shall be considered as a factor when judging whether the financial institution can be expected to take improvement measures on a voluntary basis with regard to the issues pointed out in the current inspection.

[Positive Factor] ● If either of the following cases is recognized through the process of inspection, it shall be considered as a positive factor in giving a rating. (1) The management actively involves itself in efforts to identify the operational risks that the financial institution is facing and to grasp and analyze the weaknesses of and problems in the operational risk management system, thereby helping to enhance the system. (2) The financial institution has established a system for promptly detecting errors in administrative processes and taking corrective measures, thereby preventing accidents and extraordinary incidents.

[Other Points of Attention] ● Based on the recognition that management strategies and information technology strategies of financial institutions have become intrinsically related to each other, as the financial industry has become heavily dependent on computer systems, the inspector shall take care to avoid making excessive intervention in matters that concern the management decisions of the financial institution when examining its policy for setting information technology strategies. ● Since any inadequacy of the system integration risk management could cause a systemic risk, the inspector shall give due consideration on this item in giving a rating in the case of a financial institution planning such an integration.

Inspection Bureau No. 81 February 16, 2007 To: Director-Generals of Local Finance Bureaus Director-General, Okinawa General Bureau Inspection Administrator Chief Financial Inspectors Senior Financial Inspectors Special Financial Inspectors Financial Inspectors From: Masao Nishihara, Director-General, Inspection Bureau, Financial Services Agency Partial Revision of the Financial Inspection Rating System for Deposit-Taking Financial Institutions The Financial Services Agency (FSA) formulated the Financial Inspection Rating System for Deposit-Taking Financial Institutions (Inspection Bureau No. 370) (hereinafter referred to as the “Financial Inspection Rating System”) on July 1, 2005, and has been applying it on a trial basis since January 2006. Following the complete revision of the Inspection Manual for Deposit-Taking Institutions (Inspection Bureau No. 177) recently, the FSA has partially revised the Financial Inspection Rating System as follows, and asks that you acquaint yourself with the revisions and make sure to act accordingly.

1. The Financial Inspection Rating System for Deposit-Taking Financial Institutions has been partially revised as follows: *Revision Concerning “1. Purpose” The title of the inspection manual referred to in the “Purpose” section is changed from the “Inspection Manual for Deposit-Taking Institutions (Inspection Bureau No. 177)” to the “Inspection Manual for Deposit-Taking Institutions (Inspection Bureau No. 79).” *Revision Concerning “2. Rating Items” (a) A new item called “business management (governance) (for basic elements)” is placed before “compliance system.” (b) “Risk management (common items)” is changed to “comprehensive risk management.” (c) “Market-related risk management” is changed to “market risk management.” (d) “Nine items” is changed to “ten items.”

*Revision Concerning “3. Rating Method” “Rating Grades and Evaluating Points (Examples)” is changed to “Rating Grades/Points of Attention in Rating.” *Revision Concerning “7. Implementation Date, etc.” The following is the revised text. “The Financial Inspection Rating System shall be put into effect on April 1, 2007. Rating results based on inspections to be notified thereafter (or inspections to be started thereafter, in the case of inspections without notice) shall be reflected in selective regulatory measures. With regard to financial institutions other than major banks, however, rating results based on inspections to be notified on and after January 1, 2008 (inspections to be started on and after January 1, 2008, in the case of inspections without notice) shall be reflected in selective regulatory measures.” 2. The Rating Grades and Evaluation Points (Examples), an attachment to the “Financial Inspection Rating System for Deposit-Taking Financial Institutions”, is revised as the Rating Grades/Points of Attention in Rating. 3. Implementation Date The Financial Inspection Rating System shall be applied to inspections to be notified on and after April 1, 2007 (inspections to be started on and after April 1, 2007, in the case of inspections without notice).