DCS Risk Appetite Statement Version 1.1

DEPOSITOR COMPENSATION SCHEME DCS Risk Appetite Statement Document owner: Contents Background____________________________________________________________________________________ 2 Objectives______________________________________________________________________________________ 2 DCS Risk Appetite Framework Guidance and Tolerance Levels ______________________________ 3 Risk Appetite Levels 3 Risk Impact Categories 4 Statements of Risk Appetite for the DCS _____________________________________________________ 4 Overarching Risk Tolerances 4 Appetite Statements 4 Structure of the DCS RAS framework _________________________________________________________ 5 Monitoring and reporting 5 Review 5 Delegations 6 Control 6 Document history _____________________________________________________________________________ 6 Version 1.1 Appendix 1

2 Background The Deposit Takers Act 2023 (the Act) introduces the Deposit Compensation Scheme (the DCS) and directs the Reserve Bank of New Zealand (the Bank) to manage and administer it. The aim of the Act is to contribute to protecting and promoting New Zealand’s financial stability. The DCS will protect each eligible depositor up to $100,000 per licensed deposit taker in the event of a deposit taker failure. The Act also establishes the Depositor Compensation Fund (the Fund) to support a resolution of a failing deposit taker and/or compensate the depositors of an entity that is closed down and liquidated. Section 195 of the Act states that one of the Bank’s functions is to manage and administer the DCS, including monitoring risks in connection with the DCS. The Statement of Funding Approach (SoFA), published in July 2024 by the Minister of Finance, sets out the framework for managing the liabilities of the DCS, and includes the overarching investment requirements for the Fund. It lays out the investment objectives and the constraints on the investment strategy and risk management. The SoFA requires this DCS Risk Appetite Statement (DCS RAS) to be agreed with Treasury and published by the Bank. The DCS will be managed within the Enforcement and Resolution Directorate of the Bank, with ultimate accountability residing with the Board of the Bank. This DCS RAS sets out how the Bank will manage the DCS within the boundaries set by the legislation and the SoFA. It provides transparency and accountability for the amount of risk the Bank is prepared to accept across the key risks to which the DCS is exposed. Objectives The DCS RAS sets out the Bank’s risk appetite with respect to the DCS. These risks result from our mandated responsibilities, as well as our day-to-day operational activities. A clearly articulated RAS will enable us to exercise appropriate oversight and governance by setting boundaries for the Bank’s activities and acceptable behaviours related to the DCS. The RAS will also empower the business to formulate actions, responses and decisions within pre-agreed boundaries – to either take more risk to achieve our objectives or limit taking excessive risks outside of our tolerances. Ultimately, the RAS promotes a culture of risk-awareness which supports our decision making and enables us to hold ourselves to account to achieve our stated goals. The RAS focuses on our externally delivered outputs or objectives, which are described below. These outputs and how we deliver them are founded on our statutory purpose, objectives and functions as documented in the Act and the SoFA. The Board expects Management to identify, monitor and mitigate the risks associated with our enabling functions and report and/or escalate to the Board as required. The Bank believes it is important to be transparent about the risks it is willing to accept with respect to the DCS. The DCS is levy funded by industry and compensates each eligible depositor up to $100,000 per licensed deposit taker. It is therefore entirely appropriate for stakeholders to have an understanding of what levels of risk the Bank will tolerate in the pursuit of its DCS related objectives.

3 The Bank must be ready at short notice to put in place a resolution action or to make a pay-out to the eligible depositors of an entity that has gone into liquidation. In order to be able to perform these functions, the Bank has to collect and process information quickly, and the DCS funds need to be readily available for use, i.e. liquid. At the same time, the DCS funds may not be used for long periods of time and it is appropriate to expect the Fund to generate a return. The Act requires the Bank to promote the DCS so that there is a broad understanding of it among depositors. All of these tasks expose the DCS to a broad range of risks. The following sections explain the risks at a high level and the tolerance level the Bank has in regard to each one of them. The Fund’s principal investment objectives are to: DCS Risk Appetite Framework Guidance and Tolerance Levels Risk Appetite Levels Level Description Expectations of Management High • High acceptance of uncertainty • Encouragement to take on more risk for reward • Encouraged tolerance for accepting high or medium risk • Minimal policy, controls and funding restrictions Medium • Moderate acceptance of uncertainty • Willingness to take managed risk • Measured tolerance for accepting high or medium risk • Moderate policy, controls and funding restrictions • Focus on performance monitoring Low • Low acceptance of uncertainty • Reluctance to take unnecessary risk • Very little tolerance for accepting low, medium or high risk Primary Safeguard the capital value of the Fund in real terms, ensuring that assets are immediately accessible to fulfil DCS obligations, thereby necessitating high liquidity Maintain New Zealand’s reputation as a responsible member of the world community. Secondary Maximise returns within its prescribed risk boundaries Objective

4 Level Description Expectations of Management • High policy, controls and funding restrictions • Focus on risk prevention and/or robust response Risk Impact Categories When assessing how a risk may impact the Bank, the following categories of risk impact should be considered. Operational The risk of loss or impact on delivering on planned objectives of the DCS, as a result of inadequate or failed internal processes, systems, the actions or inactions of people, or external drivers and events. Legal The risk that the Bank acts unlawfully and we are subject to legal challenge. Financial The possible or actual financial impact including all resulting costs for the Bank. Reputational Potential loss of reputation or credibility due to failure to fulfil the Bank’s mandate, resulting in a loss of stakeholder trust or confidence in the Bank. Statements of Risk Appetite for the DCS Overarching Risk Tolerances The RBNZ, in respect of the DCS, will not tolerate: • Fraud, bribery and corruption • Intentionally breaking the law • Not adhering to the expectations set out in the SoFA for the DCS. Not tolerating means that whilst we aim to minimise the likelihood and impact of these incidents, we acknowledge they may still happen. If they do occur, we will investigate the matters fully and take action to address any identified control gaps. Appetite Statements DCS Operations The Bank is tasked with the implementation and subsequent administration of the DCS. To achieve this the Bank will need to establish and maintain systems, processes, and controls to

5 enable the operations of the DCS and to meet legislative requirements. The Bank has a low appetite for risks to DCS operations. DCS Levies The Bank is tasked with the collection of levies due to the DCS from licensed deposit takers. Levy regulations provide for the levy requirements. The SoFA determines the aggregate level of levies across the system and the DCS Regulations outline the level of levies assessed to each deposit taker. The Bank has a low appetite for risks through action or inaction that result in DCS not collecting the appropriate levies. DCS Fund The Bank is tasked with managing the Fund on behalf of the Crown. We are committed to achieving our objectives and take investment related financial risks to the extent necessary to do so and in a financially responsible manner. We have a low appetite for not achieving our objectives and for any action or inaction in regard to the investment management of the Fund that materially reduces the Fund’s size. The financial risks include foreign currency, interest rate, credit and liquidity risks. DCS Compensation The Bank is tasked with paying compensation to eligible depositors in the event of the failure of a licensed deposit taker. The Bank acknowledges there is a tradeoff between the speed at which a payout can be enacted and the certainty with which entitlements can be determined. We have a low appetite for any action or inaction that materially prevents or inhibits our ability to provide compensation as soon as is practicable and a medium appetite for taking on risk in respect of certainty of entitlements to achieve a payout in a timely manner. Structure of the DCS RAS framework Monitoring and reporting Decisions made that result in taking risks outside of appetite will be reported and discussed as relevant, and significant issues escalated to the Executive Leadership Team and the Board. This is to help us build our confidence with the framework and understand how we are tracking as a programme. In accordance with the SoFA, the Treasury will be provided with comprehensive reports detailing the Fund’s performance, both quarterly and annually to facilitate effective monitoring. Review The DCS Risk Appetite Framework will be reviewed every two years, or whenever there is a significant change to the SoFA or the Bank's operating environment. This review is coordinated by the Enforcement and Resolution Directorate in conjunction with the Risk, Compliance and Audit Directorate. Any material changes to the DCS RAS will involve consultation with the Treasury and relevant business area/s, and will be approved by the Board.

6 Delegations All immaterial amendments to the DCS RAS must be approved by the Director of Enforcement and Resolution, in agreement with the Chief Risk Officer, as delegated by the Board of Directors. Control Approved by the Board this 24th day of October 2024. Document history Version Changes/Modifications Approved by Date 1.0 Initial version Board 24 Oct 2024 1.1 Immaterial changes made for the sake of clarity Director of E&R and CRO 9 Dec 2025