Regulation on External Audit of Pension Funds and Pension Providers

1 of 11 Pursuant to Article 35, paragraph 1, subparagraph 1.1 of Law no. 03/L-209 on Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, no. 77 / 16 August 2010), Article 5, paragraph 5.3, subparagraph f, and paragraph 5.4, as well as Article 15, paragraph 15.7, subparagraph e, Article 20, paragraph 1, subparagraph d, Article 22, paragraph 22.7, subparagraph e of Law No. 04/L-101 on Pension Funds of Kosovo (Official Gazette of the Republic of Kosovo, no. 10 / 8 May 2012), as well as Article 11 of Law no. 05/L-116 on amending and supplementing the Law no. 04/L-101 on Pension Funds of Kosovo, amended and supplemented by the Law no. 04/L-115 and Law no. 04/l-168 (Official Gazette of the Republic of Kosovo no. 3 / 17 January 2017), the Board of the Central Bank of the Republic of Kosovo, at the meeting held on 30 June 2022, adopted the following: REGULATION ON EXTERNAL AUDIT OF PENSION FUNDS AND PENSION PROVIDERS Article 1 Purpose and scope

1. The purpose of this Regulation shall be to determine the conditions and requirements for the approval of external auditors for performing the external audit of pension funds, as well as the relations between the external auditor, the Fund and the Central Bank of the Republic of Kosovo (CBK).
2. This Regulation shall apply to the Kosovo Pension Savings Trust (hereinafter KPST), other pension funds and pension providers licensed by CBK to operate in the Republic of Kosovo. Article 2 Definitions
3. All terms in this Regulation shall have the same meaning as the terms defined in Article 1 of Law no. 04/L-101 on Pension Funds of Kosovo and Article 1 of Law no. 04/L-168 on amending and supplementing the Law 04/L-101 on Pension Funds of Kosovo, or as defined below for the purpose of this Regulation: 1.1. Audit firm – shall mean a legal entity or any other entity, regardless of its legal form, which is licensed, in accordance with Law no. 06/L-032 on Accounting, Financial Reporting and Auditing (hereinafter: the Law on Financial Reporting) to perform statutory audit; 1.2. External auditor – shall mean only the audit firm;

2 of 11 1.3. External audit - shall mean the audit of annual accounts or consolidated accounts, in accordance with the legislation of pension funds in Kosovo; 1.4. Pension fund – shall mean the KPST, other pension funds licensed by the CBK, including pension providers; 1.5. Pension provider – shall mean financial institutions, banks, instruments for open investments and insurance companies providing supplementary individual pensions in accordance with the Law on Pension Funds; 1.6. Financial statement – shall mean the balance sheet, income statement, cash flow statement, statement of changes in equity, supplementary notes and explanatory material, which are an integral part of the financial statements; 1.7. ISA – shall mean International Standard on Auditing. Article 3 Conditions and required documentation

1. The external auditor of a pension fund shall be approved by CBK.
2. Based on the written application, the CBK shall grant approval to the pension fund's external auditor only if the following conditions are satisfied: 2.1. The external auditor is licensed in Kosovo in line with the Law on Financial Reporting and who is also a regular member of an association dedicated to professional accounting and auditing in Kosovo. 2.2. The external auditor has at least 3 (three) years of experience in the field of auditing financial statements of financial institutions, or its participating staff which carries out the audit has such an experience.
3. In order to continue serving as an external auditor of a pension fund, the external auditor shall: 3.1. Be suitable and appropriate; 3.2. Have integrity, honesty and commitment in performing the tasks; 3.3. Have competence, professional skills and sound judgment in performing the tasks; 3.4. Possess specific professional qualifications, as evidenced by a diploma or certificate from a university or other recognized professional organization certifying the successful completion of the whole cycle of external auditor qualifications; 3.5. Be a member of a professional accounting and auditing association or organization that meets the requirements for license in compliance with the Law on Financial Reporting; 3.6. Have and possess professional knowledge in accordance with the applicable laws currently in effect, as well as knowledge of ethics and best practices for pension funds.
4. In addition to the aforementioned provisions, the CBK shall assess the person in question's prior actions and behaviour in business and financial matters, and specifically shall examine at whether there is evidence to support that the person was or is:

3 of 11 4.1. Convicted within the last 10 years of any criminal offence; 4.2. Complicit in, or connected to, any financial loss brought on by dishonest, reckless, or negligent behaviour in the provision of financial services or the management of other companies; 4.3. Engaged in bad commercial business practices, such as tax evasion, that the CBK deems fraudulent, improper, or threatening and that, in a manner, represent a person's lack of values to perform financial services and other business operations; 4.4. Or failed to comply with, delayed, or failed to pay taxes and other government obligations. 5. The approval granted to the external auditor shall be particular to a single pension fund and valid for a single financial year. 6. Applications for approval shall be submitted to the CBK before June 30 of each year. 7. Pension funds shall submit the following documentation in order to get CBK approval for the external auditor: 7.1. The proposal of the audit committee and the decision of the Governing Board for the appointment of the external auditor; 7.2. Pension fund audit program; 7.3. The external auditor's engagement letter or the contract of supplied service; The document attesting to the external auditor's or its staff's adequate experience—at least three (3) years—in the area of auditing pension funds or other financial institutions; 7.4. A certificate issued by the Kosovo Council for Financial Reporting (KCFR) regarding the results of the latest quality control for the external auditor (this certificate shall not be required by the CBK, as far as the KCFR can issue such certificates); 7.5. A written declaration of the external auditor for meeting the criteria defined in Article 6 of this Regulation; 7.6. The audit program and the use of resources during the audit service shall be appropriate in relation to the character and size of the pension funds; 7.7. Other specific data requested by the CBK. 8. Continuous employment of the same external auditor shall be limited to five years or five consecutive audits and the same may participate in the external audit of the pension fund after the expiry of the time limit of at least three years from the last audit. Article 4 Approval or rejection of external auditors

1. The CBK shall approve or reject the external auditor within 20 working days after the date the complete documentation required by Article 3 of this Regulation was submitted.
2. In cases where the submitted documentation is incomplete, the CBK shall notify the external auditor within 15 days from the date of receipt of the application with incomplete

4 of 11 documentation. The pension fund shall make up any deficiencies within 20 working days of receiving the CBK notification. 3. The CBK shall approve the external auditor of a pension fund who has a solid reputation and is not involved in any activities that are not in line with the functions of an external audit. 4. If CBK determines that the external auditor did not perform in accordance with the requirements specified in the written requirements or with the provisions of this Regulation during the preliminary audit, it may reject the external auditor. Article 5 Re-doing the audit If the current external auditor of the pension funds performed the audit or submitted a report that did not meet the requirements of the Law on Pension Funds, CBK regulations, International Standard on Auditing (ISA), and did not accurately reflect the financial situation of the pension funds, the CBK shall be entitled to request that the audit be redone by a different external auditor at the expense of the pension funds. Article 6 Professional ethics The external auditor shall be subject to the professional ethics principles defined by the “Code of Ethics for Professional Accountants” of International Federation of Accountants. Article 7 Independence and objectivity

1. When carrying out an audit, the external auditor shall be independent from the audited entity and shall not in any way be involved in management decisions of pension funds being audited. The external auditor shall not carry out an audit if there is any direct or indirect financial, business, employment or other relationship including the provision of additional non-audit services between the external auditor and the pension funds being audited from which an objective, reasonable and informed third party would conclude that the independence of the external auditor is compromised.
2. The external auditor shall document in the audit working papers, all threats to their independence, as well as the safeguards applied to mitigate those threats. Article 8 Independence and objectivity of the external auditor carrying out the audit on behalf of audit firms The owners or shareholders of an approved audit firm, as well as the members of the administrative, management and supervisory bodies of such a firm, or an affiliated firm, shall not

5 of 11 intervene in the execution of an audit in any way that might jeopardize the independence and objectivity of the auditor who carries out the audit on behalf of the audit firm. Article 9 Audit fees

1. Fees for audit services: 1.1. shall be adequate to enable proper audit quality; 1.2. shall not be influenced or determined by the provision of additional services of the pension funds being audited, and 1.3. cannot be based on any form of conditioning. Article 10 Requirements to external auditors
2. The external auditor shall perform all audits of pension funds in accordance with the ISA.
3. The external auditor shall assess whether the annual accounts of the pension fund have been prepared and finalized in accordance with International Financial Reporting Standards (IFRS), the Law on Pension Funds and the relevant CBK regulations.
4. The external auditor shall assess whether the management of the pension fund has fulfilled its obligation to provide clear and appropriate records, as well as the documentation of accounting information in accordance with the Law on Pension Funds and CBK regulations.
5. The external auditor shall assess the adequacy of pension fund risk management systems, based on the assessment of: 4.1. Compliance with the requirements for organizational structures related to the management of any specific risk; 4.2. Policies and procedures for the management of each specific risk as well as their implementation; 4.3. Adequacy of identification, measurement and monitoring of each specific risk; 4.4. The adequacy and efficiency of the internal audit system in relation to the management of any specific risk.
6. The external auditor shall assess the sufficiency and quality of the sub-legal acts and procedures with which the funds operate, as well as their implementation. In this sense, the external auditor shall assess the following: 5.1. The organization and effectiveness of the internal control system of the pension fund; 5.2. The quality and implementation of the internal regulations of the pension fund for the management of assets and liabilities; 5.3. The organization of the information technology system and its coordination with the objectives of the pension fund and with the preservation of data integrity.

6 of 11 6. The external auditor shall inquire in advance and assess the CBK's concerns on particular aspects of the activity of the pension funds. 7. The external auditor shall prepare a report in which they express their opinion and assessment of the results obtained for the organization and effectiveness of the internal control of the funds in terms of the quality of the regulations and internal acts of the funds and their implementation, which they deliver to the managers of the funds. 8. For the purposes of the subparagraph 4.4 of this Article, specific risks shall include: investment risk, market risk, operational risk, liquidity risk and other risks to which pension funds are exposed. 9. Audit working papers shall be prepared and maintained in accordance with the respective ISA. 10. The external auditor shall assess how the pension funds are managed and if the appropriate internal controls have been put in place for the fund. 11. The audit of pension funds shall cover areas such as portfolios of pension funds, investment performance, non-performing assets, and valuation of assets, trading and other activities of securities, derivatives of financial instruments, security of assets and adequacy of internal controls over financial reporting. Article 11 Duties of the external auditor

1. The external auditor shall perform audits according to their professional judgment, including the assessment of the risk posed by the inclusion of incorrect information in the annual accounts due to irregularities and errors.
2. The external auditor shall ensure that they have sufficient basis to assess whether there has been any violation of the Law on Pension Funds and the relevant CBK regulations, which are materials related to the annual accounts.
3. The external auditor shall check the regularity, accuracy and completeness of the pension fund reports submitted to the CBK, in accordance with the current regulatory requirements approved by the CBK and whether they realistically and objectively reflect the financial condition of the pension fund.
4. The external auditor shall point out the following circumstances in writing to the Board of Directors of the fund: 4.1. Deficiencies related to the obligation to ensure proper registration, clear disclosure and documentation of accounting information; 4.2. Errors and deficiencies in the organization and control of asset management; 4.3. Irregularities and errors that may cause incorrect information in the annual accounts; and 4.4. Events that may cause liabilities to the members of the Board of Directors, the General Assembly of Shareholders or Senior Management.

7 of 11 Article 12 Documentation of Assignment As required by ISA 230, “Audit Documentation”, the external auditor shall document how an audit was carried out, as well as the results of an audit. Matters which indicate that irregularities or errors may be present shall be documented separately. Article 13 Report of the external auditor

1. The external auditor shall prepare an annual audit report with an audit opinion in accordance with ISA.
2. The audit report shall confirm that the audit services have been carried out in accordance with the provisions of the Law on Pension Funds, this Regulation and other relevant CBK regulations.
3. The audit report shall verify and disclose at least the following matters: 3.1. Financial balance sheet, including the entries; 3.2. Profit and loss account, including the entries; 3.3. Report on net assets of the fund; 3.4. Report on the changes in the net assets of the fund 3.5. Report on pension quotas and investment structure; 3.6. Internal control activity; 3.7. Keeping accounting records; 3.8. Evaluation of balance sheet and off-balance sheet items; 3.9. Distribution of profit; 3.10. Cash flow statement.
4. If the report was not made in accordance with the provisions of this Regulation, the CBK shall be entitled to return it to the external auditor and, at the expense of the pension fund, to engage a different external auditor to prepare the report in accordance with the provisions of this Regulation.
5. If the accounts do not provide information related to the result and the state of the pension funds, which shall be ensured, the external auditor shall make this evident or determine the reserved opinion of the auditors and possibly provide the necessary supplementary information in the audit report.
6. If the external auditor concludes that the accounts should not be finished in their current form, this conclusion shall be made known clearly.
7. If the external auditor finds issues during the audit that can cause liabilities to the members of the Board of Directors, the General Assembly of Shareholders, or Senior Management, this

8 of 11 information shall be included in the audit report. The external auditor shall be required to provide other information on the events that they think the Board of Directors or the pension fund's shareholders should be made aware of. 8. The external auditor shall evaluate the implementation of the recommendations given by the external auditor for the previous financial year. Article 14 Management Letter

1. The external auditors shall prepare the final management letter for the pension fund, for the conclusions of the audit process. The management letter shall include all the conclusions that the external auditor may have reached regarding the activity or financial condition of the pension fund, as well as information regarding their care in the audit mission.
2. In the final management letter, the external auditor shall make a specific statement concerning the assessment of the internal control system in order to disclose material matters in the internal control structure. The specific statement shall also include the internal audit function.
3. In the management letter, the external auditor shall a specific statement whether he/she concludes that the pension fund is in compliance with the Law on Pension Funds, the relevant CBK regulations and whether the pension fund has acted according to the latest recommendations of CBK to improve the findings. Article 15 Confidentiality
4. The external auditor and its associates have the obligation of keeping the confidentiality regarding any knowledge obtained during their activities, unless otherwise stipulated by law or in cases where the information concerns a person, the duty of which does not require professional secrecy. The external auditor and its associates may not use such information for their own activities or in the service or employment of others.
5. Regardless of paragraph 1 of this Article, the information may only be disclosed to the CBK or in other cases when required according to the legislation in force.
6. The obligation of keeping the confidentiality shall continue to apply even after such assignment has ended. Article 16 Obligation to inform
7. The external auditor, within the framework of his duties, shall provide information on the issues related to pension funds, which the external auditor has learned during the audit, when this is requested by the General Assembly of Shareholders, the Board of Directors, Senior Management, Audit Committee or any person authorized by CBK.
8. The external auditor shall immediately communicate to the Audit Committee or Board of Directors of the pension fund, any matters of governance interest, which comes to the

9 of 11 attention of the auditor during the performance of the audit. The external auditor shall immediately notify the governing bodies of the pension fund and the CBK, where during the performance of the audit, notices: 2.1. Information that indicates a failure to fulfil the requirements of the license granted by CBK; 2.2. A serious conflict within the decision-making bodies or the unexpected departure of a manager in a key function; 2.3. Information indicating that there may be a material breach of the laws, regulations, instructions and orders of the CBK, as well as the charter and bylaws of the pension funds; or 2.4. The intention of the internal auditor to resign or leave and the negative or material changes that pose a risk to the work of the pension fund and the possibility that the risk will continue. 3. The external auditor shall, on the CBK's request, provide the CBK with any information during the entire audit mission, in terms of his performance auditing a fund. 4. The CBK shall maintain regular contacts and may initiate meetings with the external auditor of pension funds at any time, when such contacts are deemed necessary. Article 17 Quality control and its review

1. The external auditor approved by CBK shall apply adequate quality control policies and procedures that address all important aspects of the audit.
2. The external auditor approved by the CBK shall be subject to quality review by the CBK.
3. The quality review of an approved external auditor shall include a specific audit assignment and shall be performed by the CBK or by a reviewer appointed by the CBK.
4. During the quality review, the CBK or the reviewer shall determine to what extent the external auditor has applied adequate quality control rules and procedures that address all important aspects of the audit. During the review, the CBK or the reviewer shall have access to all working documents of the external auditor to the extent necessary to perform an adequate quality control.
5. Concerning obligations on keeping confidentiality, Article 15 of this Regulation shall be applied to the CBK and to the reviewer appointed by the CBK.
6. Aggregate results of the quality review of an approved external auditor shall be published by the CBK, including recommendations, follow up of recommendations, if the case arises, sanctions. Article 18 Professional liability insurance

10 of 11 The external auditor shall be required to procure a professional liability insurance policy, as defined by Administrative Instruction 01/2019 on Licensing Statutory Auditors and Local and Foreign Statutory Audit Firms, of the Kosovo Council for Financial Reporting (KCFR). Article 19 Dismissal and Resignation

1. The external auditor of a pension fund may be dismissed from the pension fund only when there is sufficient ground for this. Divergence of opinions on accounting treatments or audit procedures shall not be a proper ground for dismissal.
2. Both the audited pension fund and the external auditor must inform the CBK in case of dismissal or resignation and must provide adequate explanations of the reasons thereof. Article 20 Withdrawal of approval
3. The CBK shall withdraw the approval of the external auditor in cases where: 1.1. the CBK determines that the approval was obtained on the basis of deliberate false data; and 1.2. the good reputation of an auditing firm is seriously compromised or if one of the requirements of this Regulation and the Law on Pension Funds is no longer met. Article 21 Measures against the external auditor
4. If the external auditor of a pension fund violates the duties of the auditor defined by the Law on Pension Funds, this Regulation and other relevant regulations of the CBK, the CBK may issue a written warning to the external auditor, a copy of which is sent to the audited pension fund.
5. If the violations in paragraph 1 of this Article are repeated, the CBK shall be entitled to refuse the approval of the external auditor to engage in the audit of pension funds supervised and licensed by the CBK, for a period of up to three (3) years.
6. If the external auditor or the pension fund does not meet the requirements of this Regulation or if the CBK is reasonably not satisfied with the auditor's performance, the CBK shall have the power to: 3.1. request the dismissal or replacement of the auditor; 3.2. directly appoint, dismiss or replace the auditor; 3.3. request a re-audit of the pension fund with pension fund expenses.
7. The measures defined in this article do not exclude the measures and other actions foreseen under the Law on Pension Funds and the legislation in force.

11 of 11 Article 22 Repeal With the entry into force of this Regulation, the Rule 24 shall be repealed, which prescribes the requirements in the engagement letter of the external auditor of the Pension Fund and Pension Insurers, dated March 23, 2002, as well as it supplements the Rule on External Auditing and External Auditors of Financial Institutions licensed by the Central Banking Authority of Kosovo Authorized under Section 62 of UNMIK Regulation 2006/47, dated March 1, 2008. Article 23 Entry into force This Regulation shall enter into force fifteen (15) days from the date of its approval. Flamur Mrasori Chairperson of the Board of the Central Bank of the Republic of Kosovo