Banks Criminal Background Check Directive for Directors and Executive Officers

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D7/2022 To: All banks, controlling companies, branches of foreign institutions, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act 94 of 1990 Matters related to fit and proper assessment requirements pertaining to directors and executive officers Executive summary The purpose of this Directive is to direct banks, controlling companies, branches of foreign institutions, eligible institutions and auditors of banks or controlling companies to make available criminal background check reports when submitting a statement relating to the attributes of a serving or prospective director or executive officer to the Prudential Authority (PA). Section 60(5)(a)1 of the Banks Act 94 of 1990 (Banks Act) requires that all banks, controlling companies or branches of foreign institutions (hereinafter collectively referred to as ‘banks’) shall give the PA written notice of the nomination of any person in respect of the appointment as a chief executive officer (CEO), director or executive officer by furnishing the PA with the information prescribed in regulation 422 of the Regulations relating to Banks (Regulations). Regulation 42 of the Regulations requires banks to submit to the PA particulars of each person to be appointed in a key position, in the form of a completed statement relating to the attributes of a serving or prospective director or executive officer (form BA 020) together with a curriculum vitae (CV).

1. Introduction 1.1 The responsibilities of banks 1.1.1. Banks are ultimately responsible for ensuring that they select, nominate and appoint fit and proper individuals to the board of directors (board) or for senior management positions. Banks are required to conduct their due diligence and assessment of the members of the board and senior management not only prior to their appointment but also on a regular basis. 1 Directors and officers of a bank or controlling company 2 Statement relating to attributes of serving or prospective directors or executive officers

2 1.1.2. Such due diligence and assessment must include processes to ensure that the above-mentioned individuals have no criminal records. 1.2 International standards 1.2.1 The Core Principles for Effective Banking Supervision (Core Principles) of the Basel Committee on Banking Supervision (BCBS) and, more specifically, the Essential Criteria 7 of Principle 5 states that a licensing authority, at authorisation, should evaluate a bank’s proposed board members and senior management as to their expertise and integrity (a fit and proper test) as well as any potential for conflict of interest. The fit and proper criteria should include: • an assessment of the skills and experience in relevant financial operations commensurate with the intended activities of the bank; and • confirmation that no record of criminal activities and/or adverse regulatory judgments exist that would make the person unfit to hold important positions in a bank. 1.2.2 South Africa, as a member of the Financial Action Task Force (FATF), has a duty to conform to the FATF’s 40 Recommendations against money laundering and terrorism financing. FATF Recommendation 26 states that countries should ensure that financial institutions3 (FIs) are subject to adequate regulation and supervision, and that they are effectively implementing the FATF Recommendations. Furthermore, financial supervisors should take the necessary legal and/or regulatory measures to prevent persons holding criminal records or their associates from holding a management function in an FI. 1.3 Legislative requirements 1.3.1 Section 60(5)(a) of the Banks Act requires that every bank give the PA written notice of the nomination of any person in respect of the appointment as CEO, director or executive officer by furnishing the PA with the information prescribed in regulation 42 of the Regulations. 1.3.2 Regulation 42 of the Regulations requires banks to submit to the PA, particulars of each person to be appointed in a key position, in the form of a completed statement relating to the attributes of a serving or prospective director or executive officer (form BA 020) together with a CV. 1.3.3 Regulation 36(17)(b)(ii)4 of the Regulations provides that every relevant foreign branch, subsidiary, or operation of the bank or controlling company implements and applies anti-money laundering and counter-financing of terrorism 3 A financial institution as per the Financial Action Task Force definition means any natural or legal person who conducts as a business one or more of the following activities or operations for or on behalf of a customer: 1. Acceptance of deposits and other repayable funds from the public. 2. Lending. 3. Financial leasing. 4. Money or value transfer services. 5. Issuing and managing means of payment (e.g. credit and debit cards, cheques, traveller's cheques, money orders and bankers' drafts, electronic money). 6. Financial guarantees and commitments. 7. Trading in: (a) money market instruments (cheques, bills, certificates of deposit, derivatives etc.); (b) foreign exchange; (c) exchange, interest rate and index instruments; (d) transferable securities; (e) commodity futures trading. 8. Participation in securities issues and the provision of financial services related to such issues. 9. Individual and collective portfolio management. 10. Safekeeping and administration of cash or liquid securities on behalf of other persons. 11. Otherwise investing, administering or managing funds or money on behalf of other persons. 12. Underwriting and placement of life insurance and other investment related insurance. 13. Money and currency changing. 4 Matters related to corporate governance, risk management and internal controls

3 (AML/CFT) measures consistent with the relevant FATF Recommendations (which includes Recommendation 26). 1.4 The duties of the Prudential Authority 1.4.1 The PA in the execution of its mandate requires that banks comply with legislative requirements by implementing robust governance arrangements, including fit and proper requirements for the appointment of directors or persons responsible for the senior management of banks. 1.4.2 The PA requires banks to implement the necessary measures to prevent persons holding criminal records and other unfit persons from being appointed into positions which would allow such individuals to hold a position as a director or oversee any management function in the mutual bank and undermine the integrity of the bank. 2. Directive 2.1 Based on the aforesaid, and in accordance with the provisions of section 6(6)5 of the Banks Act, to enable the PA to effectively execute its responsibilities under applicable financial sector legislation and in consideration of its ongoing commitment to give effect to the aforementioned, banks are hereby directed as follows: 2.1.1 Banks must at the written request of the PA submit criminal background check reports6 (CBCRs) of their existing, interim and prospective directors and executive officers, in support of the information already prescribed in terms of regulation 42 of the Regulations. 2.1.2 Banks must submit CBCRs in support of the form BA 020 effective from 1 September 2022. Thus, each BA 020 form submitted to the PA on and after the said date in respect of interim and prospective persons identified in paragraph 1.4.1 must be accompanied by a CBCR. 2.1.3 CBCRs in respect of all persons identified in paragraph 1.4.1 must be furnished to the PA within 6 months of the date of this Directive. 2.1.4 Persons listed in paragraph 1.4.1 who are unable or unwilling to undergo a criminal background check (CBC) will be disqualified for appointment to such a position. 2.1.5 CBCRs in respect of South African nationals must not be older than 30 calendar days from the date of submitting the form BA 020 to the PA. 2.1.6 CBCRs or equivalent document in respect of foreign nationals must not be older than 60 calendar days from the date of submitting the form BA 020 to the PA. 2.1.7 CBCRs can be requested or sourced from CBC service providers nationwide for local directors and executive officers and persons in key positions (hereafter 5 Powers of inspection of, and guidelines by, Registrar 6 A police clearance certificate or a report issued by a service provider having an arrangement in place with a Police Department to issue a statement in respect of a natural person’s criminal status on its behalf will be acceptable

4 referred to as a key person). These CBCRs will contain a unique CBCR reference number7 . Banks must ensure that this unique CBCR reference number is clearly visible when submitting the documentation to the PA. 2.1.8 CBCRs must be requested or sourced from local or recognised foreign CBC service providers for foreign directors, executive officers and persons in key positions. 2.1.9 Banks with foreign nationals as directors, executive officers and key persons are advised that some of the domestic CBC service providers have arrangements in place with foreign governments and foreign third-party service providers to source CBCRs from such parties in foreign jurisdictions. Thus, banks may use these domestic service providers to source CBCRs or an equivalent document for persons mentioned in paragraph 1.4.1 who are foreign nationals. 2.1.10 Applications in terms of section 128 of the Banks Act, which are for the authorisation to establish a bank, must include CBCRs for each of the prospective directors, executive officers and key persons. 2.1.11 The CBCR requirement is also applicable to all appointments of directors and executive officers in respect of any cross-border banking operations established by banks in terms of section 52(1)(a) and 52(1)(b)9 of the Banks Act. 2.1.12 Foreign CBC service providers may be approached to produce CBCRs in respect of foreign nationals serving in key positions at banks. If not already captured on a CBCR, banks must submit the following information in respect of the CBC service provider in support of the CBCR or equivalent document to the PA: • registered name • registration number; • postal address if available, and domicile address; • contact person; • telephone number; • email address; and • website address. 2.1.13 The PA may require banks to submit CBCRs periodically and in line with the PA’s application of a risk-based approach to supervision. Similarly, banks must re-screen their active directors, executive officers, and key persons on a periodic basis to ensure that the information they hold is up to date and accurate. The CBCRs should be provided to the PA within 30 calendar days of completing such screenings. 7 Unique CBCR reference numbers are only applicable to criminal background check screenings performed against the South African Police Service fingerprint database. 8 Application for authorization to establish bank 9 Refers to cross border banking subsidiaries and branches of South African banking groups

5 3. Acknowledgement of receipt 3.1 Kindly ensure that a copy of this Directive is made available to your institution’s independent auditors. In addition, the attached acknowledgement of receipt duly completed and signed by both the chief executive officer of the institution and the said auditors should be returned to the PA at the earliest convenience of the aforementioned signatories. Fundi Tshazibana Chief Executive Officer Date: 2022-08-12 The previous Directive issued was Directive 06/2022, dated 12 August 2022.