Regulation on Audited Annual Financial Statements, 2016

2016 1 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 CBS/BS/REG/06

1. INTRODUCTION 1.1. Authority 1.2. Applicability
2. REQUIREMENTS FOR ANNUAL FINANCIAL STATEMENTS 2.1. Accounting Standards 2.2. Accounting Year 2.3. Certification of Audited Annual Financial Statements 2.4. Central Bank Approval of Audited Annual Financial Statements 2.5. Publication of Certified Audited Annual Financial Statements 2.6. Presentation at Annual Meeting of Shareholders
3. REQUIREMENTS FOR ANNUAL EXTERNAL AUDIT 3.1. Appoint an External Auditor 3.2. Execute a Letter of Engagement 3.3. Obtain Central Bank Approval of the Auditor Appointment 3.4. Eligibility Requirements for the External Auditor 3.5. Provide the External Auditor with Access to Information 3.6. Submit the Audit Report to the Central Bank
4. EXTERNAL AUDITOR’S DUTY TO REPORT TO THE CENTRAL BANK

2016 2 REGULATION ON ASSET CLASSIFICATION AND PROVISIONING, 2018

1. INTRODUCTION 1.1. Authority This regulation is made by the Central Bank pursuant to its authority set forth in Sections 20(3), 22(2) and 34 of the Financial Institution Law, 2012 (“FIL”), and Sections 38(1) and 52(1) of the Central Bank of Somalia Law, 2011, for the purpose of implementing Sections 19 – 28 and 32 of the FIL. 1.2. Applicability This regulation applies to all banks licensed by the Central Bank including branches and subsidiaries of foreign financial institutions, individually and on a fully consolidated basis.
2. REQUIREMENTS FOR ANNUAL FINANCIAL STATEMENTS Every year, each bank shall prepare a statement of accounts showing the state of affairs of all its operations and the income and expenditure of the bank. 2.1. Accounting Standards Each bank shall maintain its accounts and prepare its financial statements in accordance with accounting policies and practices that have been approved by the board of directors and that comply with the Financial Institutions Law, Central Bank regulations, and International Financial Reporting Standards. 2.2. Accounting Year Each bank’s accounting year shall be the same as the calendar year: January 1 – December 31. 2.3. Certification of Annual Financial Statements A bank’s annual financial statements shall be certified by the bank’s external auditor and approved by the bank’s board of directors. 2.4. Central Bank Approval of Certified Audited Annual Financial Statements No later than March 31, a bank shall submit its certified audited annual financial statements to the Central Bank for approval prior to publication in accordance with Subsection 3.3 of this regulation. 2.5. Publication of Certified Audited Annual Financial Statements Upon approval by the Central Bank and no later than April 30 of every year, the bank shall publish its certified audited annual financial statements in the Official Bulletin and in a newspaper of wide circulation. 2.6. Annual Meeting of Shareholders The certified audit report shall be read together with the reports of the audit committee and the board of directors at the annual meeting of the shareholders of the bank.

2016 3 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 3. REQUIREMENTS FOR ANNUAL EXTERNAL AUDIT 3.1. Appoint an External Auditor Subject to the written approval of the Central Bank, the board of directors shall, on an annual basis and upon the recommendation of its audit committee, appoint an external auditor to provide the following professional services: 3.1.1. Examine the books, records and internal controls of the bank; 3.1.2. Prepare and submit to the bank’s shareholders a report on the annual balance sheet and profit and loss account of the bank and of its results for the previous year; 3.1.3. Provide an opinion stating whether or not the balance sheet and profit and loss account give a true and fair view of the state of affairs of the bank and of its results for the previous year; and 3.1.4. Prepare and submit to the Central Bank a report of the audit of internal control of the bank. 3.2. Execute a Letter of Engagement The bank shall document its agreement for audit services with a letter of engagement addressed by the external auditor to the bank confirming acceptance of the audit appointment, and stating the objective and scope of the audit, the auditor’s responsibilities to the bank, management’s responsibilities to the auditor, and the format of all reports. The letter of engagement must stipulate that the duties of the auditor shall include, but are not limited to: 3.2.1. Fulfill the requirements of Section 22(1)-(2) of the FIL and this regulation. 3.2.2. Conduct the audit and prepare the audit report, audit opinion, management letter, and report of internal control audit in accordance with International Standards on Auditing issued by the International Accounting and Assurance Standards Board or another set of internationally accepted auditing standards. 3.2.3. Identify and assess the risks of material misstatement in the bank’s financial statements, taking into consideration the complexities of the bank’s activities and the effectiveness of its internal control environment. 3.2.4. Evaluate the statements provided by bank management in the representation letter to the external auditor. 3.2.5. When determining the thresholds of materiality in the audit process, take into consideration the accounts that comprise the Financial Soundness Indicators. 3.2.6. Test the bank’s controls over its financial reporting process and assess whether, and to what extent, they may be relied upon by the external auditor. 3.2.7. Assess whether, in which areas, and to what extent, the work of the internal audit function may be used by the external auditor. 3.2.8. Evaluate any identified audit differences, errors, and adjustments, and determine their impact on the bank’s regulatory capital and regulatory capital ratios. 3.2.9. Evaluate the bank’s financial statement disclosures for meaningfulness, consistency and sufficiency.

2016 4 REGULATION ON ASSET CLASSIFICATION AND PROVISIONING, 2018 3.2.10. Provide a written statement of the auditor’s conclusion and opinion as to whether or not the bank’s financial statements give a true and fair view of the bank’s state of affairs, financial position and results of operation, and are presented in accordance with International Financial Reporting Standards. 3.2.11. Submit the audit report, audit opinion, management letter, report of internal control audit, and other documents required by Section 22(1) of the FIL and this regulation to the bank no later than February 15 of each year. 3.3. Obtain Central Bank Approval of the Auditor Appointment 3.3.1. No later than December 31 every year, each bank shall submit to the Central Bank the following information: 3.3.1.1. The audit period. 3.3.1.2. Identification and contact information for the proposed external auditor or engagement partner. 3.3.1.3. A copy of the letter of engagement. 3.3.1.4. Certified excerpts from the minutes of the meeting of the Audit Committee whereat the recommendation for the appointment of external auditor was approved, after the Audit Committee first determined that the auditor was eligible for appointment pursuant to Sections 22(7), 23 and 24(1) of the FIL and this regulation. 3.3.1.5. Certified excerpts from the minutes of the meeting of the Board of Directors where approval of the appointment of the external auditor was decided; the minutes should provide evidence that the Board of Directors determined that the external auditor was eligible for appointment pursuant to Sections 22(7), 23 and 24(1) of the FIL and this regulation. 3.3.1.6. In cases where a bank is a branch or subsidiary of a foreign financial institution, a statement of either approval or no objection from the home country supervisor of the appointment of the external auditor by the parent foreign financial institution. 3.3.1.7. When a bank has failed to re-appoint an external auditor for reasons other than the expiry of the maximum appointment period of three consecutive years, the reason(s) for the decision to change auditors. 3.3.2. Within 15 days, the Central Bank shall notify the bank that the audit appointment is either approved or disapproved with reason(s).

2016 5 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 3.4. Eligibility Requirements for the External Auditor 3.4.1. The external auditor must be professionally qualified. 3.4.1.1. The external auditor is properly licensed and in good standing. 3.4.1.2. The external auditor is a member in good standing of a body of professional accountants. 3.4.1.3. The external auditor has specialized knowledge and experience in the audit of banks, specifically in the areas of bank accounting, International Financial Reporting Standards, capital, liquidity, valuations, information technology, the FIL and regulations of the Central Bank. 3.4.1.4. The external auditor possesses the necessary resources to undertake audits of banks on a consolidated basis. 3.4.1.5. The external auditor will conduct the audit in compliance with International Standards on Auditing. 3.4.1.6. Previous audit reports of licensed banks by the external auditor show that they were conducted in accordance with the requirements of the FIL and this regulation. 3.4.2. The external auditor must be Independent and objective – free from bias, conflict of interest, and the undue influence of other parties. 3.4.2.1. The external auditor: (i) Does not have any interest in the bank except as a depositor. (ii) Is not a related person or associate of the bank, as those terms are defined in the FIL; (iii) Is not an employee or agent of the bank or of any related person or associate of the bank; (iv) Is not a partner, employee, or employer of a director or officer of the bank or of any related person or associate of the bank; (v) Is not a director, officer, employee or agent of any other bank. 3.4.2.2. There is no evidence that the auditor failed to disclose any direct or indirect interests which may constitute a conflict of interest or loss of independence in the auditor’s duties. 3.4.2.3. In previous audits of licensed banks, the external auditor’s professional skepticism was documented in the audit work papers. 3.4.2.4. The sum of the consecutive audit terms for which the auditor has been appointed does not exceed three years. 3.4.3. The external auditor must be fit and proper. 3.4.3.1. The external auditor has never:

2016 6 REGULATION ON ASSET CLASSIFICATION AND PROVISIONING, 2018 (i) Conducted accounting business without the proper license. (ii) Made false or misleading statements, false or misleading entries, or false or misleading omissions, or altered, abstracted, concealed or destroyed any book of record or any report, slip, document, or statement of business affairs, transactions, condition, assets or account of a bank, or in applications, statements, reports, and returns to the Central Bank or other regulatory body in Somalia or elsewhere. (iii) Obstructed an audit, examination, inspection, or other control of a bank, money transfer business, or other activity. (iv) Been censured, disciplined or disqualified by any professional or regulatory body in relation to any trade, business or profession. (v) Been refused or restricted from the right to carry on any trade, business or profession for which a specific license, registration, or other authorization is required by law. (vi) Been convicted of the offense of fraud, dishonesty or misfeasance. (vii) Been convicted of a criminal offense or been the subject of unresolved criminal charges which are of direct relevance to fitness and properness. (viii) Violated a direction or order of the Central Bank, a court, or a regulatory body. (ix) Engaged in money laundering or in the financing of terrorism. 3.4.3.2. The auditor is not currently under investigation by a board of accountants and/or auditors or by any regulatory body. 3.4.3.3. The auditor agrees to comply with The Code of Ethics for Professional Accountants, issued by the Ethics Standards Board as part of the International Federation of Accountants (IFAC), or another internationally accepted code of ethics. 3.5. Provide the External Auditor with Access to Information The external auditor shall have the right of access to any records, files or data of the bank, including management information and the minutes of all committees of management and of the board and its committees, whenever it is deemed relevant to the performance of the external auditor’s duties.

2016 7 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 3.6. Submit the Audit Report to the Central Bank 3.6.1. No later than March 31 of every year, each bank shall submit to the Central Bank its annual financial statements which have been certified by the bank’s external auditor and approved by its board of directors, together with the external auditor’s audit report, audit opinion, management letter, and report of internal audit. 3.6.2. The audit report shall comply with International Standards on Auditing and shall include, but not be limited to, the following information: 3.6.2.1. Identification of the subject bank 3.6.2.2. Time period covered by the audit. 3.6.2.3. Scope of the audit – Application of agreed-upon procedures. 3.6.2.4. Financial statements audited. 3.6.2.5. Responsibilities of the auditor and of bank management 3.6.2.6. The internationally accepted auditing standards followed. 3.6.2.7. Qualifications – If applicable, when acceptable auditing procedures cannot be followed or have been limited. 3.6.2.8. The auditor’s opinion of the bank’s financial statements – A written statement of the auditor’s independent and objective opinion of the fairness and accuracy with which the bank’s financial statements present its true financial position and results of operation and that they are presented in accordance with International Financial Reporting Standards. (i) (Unqualified opinion – When the financial statements are a fair representation of the bank’s financial position (ii) Qualified opinion – When scope limitations are imposed on the auditor’s work. (iii) (iii) Adverse opinion – When financial statements are materially misstated (iv) (iv) Disclaimer of opinion – When the bank is no longer a going concern or in other such limited cases 3.6.2.9. Key audit matters – Those matters, in the auditor’s professional judgment, were of most significance in the audit of the financial statements of the current period and their effect on the financial statements. 3.6.2.10. Explanatory notes 3.6.2.11. Statement of Independence 3.6.2.12. Signature 3.6.2.13. Date of report

2016 8 REGULATION ON ASSET CLASSIFICATION AND PROVISIONING, 2018 3.6.3. The audit report shall be accompanied by a supplemental report on the audit of internal control in which the external auditor expresses an opinion on the effectiveness of the bank’s internal control. 3.6.4. The audit report shall be accompanied by a management letter addressed to the board of directors of the bank which shall disclose: 3.6.4.1. Weaknesses and other limitations found in the internal control structure and operating procedures of the bank and make recommendations for improvement. 3.6.4.2. Misstatements, irregularities, and fraud 3.6.4.3. Current or future activities which are likely to materially affect the bank’s financial position. 3.6.4.4. Any other matter deemed reportable by the external auditor. 3.6.5. Within 15 days of receipt, the Central Bank shall either: 3.6.2.1. Approve the bank’s certified accounts for publication. 3.6.2.2. Reject the bank’s certified accounts. 3.6.2.3. Direct the bank and external auditor to amend or rectify the accounts and/or 3.6.2.4. Request additional information with which to render a decision. 3.6.3. In the event that the bank and its external auditor have been directed by the Central Bank to amend or rectify the accounts or to re-audit the accounts and re-issue the audit report, they shall do so within the time period specified by the Central Bank. 4. EXTERNAL AUDITOR’S DUTY TO REPORT TO THE CENTRAL BANK A bank’s external auditor shall, upon becoming aware of or having reasonable grounds to believe, immediately report to the Central Bank in writing of the following matters: 4.1. The bank is insolvent, or there is a significant risk that the bank will become insolvent. 4.2. The bank has failed to comply with the requirements of the FIL, a regulation of the Central Bank, or a condition of its license. 4.3. There are existing facts about the bank which may be detrimental to the interests of depositors, including, but not limited to the following: 4.3.1. There has been a material change in the risks inherent in the business of the bank with the potential to affect the bank’s ability to continue safe and sound operations. 4.3.2. A serious criminal offence involving fraud or other dishonesty has been, or is likely to be, committed. 4.3.3. Measures to prevent money laundering or terrorist financing are not being properly implemented.

2016 9 REGULATION ON AUDITED ANNUAL FINANCIAL STATEMENTS, 2016 4.3.4. There is a material conflict within or between the board of directors and senior management officials of the bank. 4.3.5. A senior management official in a key function or the bank’s internal auditor has unexpectedly left the bank’s employ. 4.3.6. The external auditor intends to resign, or is removed, during the audit of the bank. 4.3.7. The auditor intends to issue a qualified audit opinion. 4.3.8. The bank has failed to comply with a recommendation by the auditor that a matter be communicated to the Central Bank.