Regulation on Country and Transfer Risk Management Principles

1 of 3 Based on Article 35, paragraph 1, subparagraph 1.1, of Law No. 03/L-209 on Central Bank of the Republic of Kosovo, as amended and supplemented by Law No. 05/L-150, and Article 85, paragraph 1, of Law No. 04/L-093 on Banks, Microfinance Institutions and Non-Bank Financial Institutions, the Board of the Central Bank of the Republic of Kosovo, in its meeting held on 30 April 2024, approved the following: REGULATION ON COUNTRY AND TRANSFER RISK MANAGEMENT PRINCIPLES Article 1 Purpose and scope

1. The purpose of this regulation is to establish the minimum acceptable standards for banks' approach to the management of country and transfer risks in order to ensure the resilience of banks and contribute to financial stability.
2. This regulation shall apply to all banks and branches of foreign banks licensed by the CBK to operate in the Republic of Kosovo. Article 2 Definitions
3. All terms used in this regulation shall have the same meaning as defined in Law No. 04/L-093 on Banks, Microfinance Institutions and Non-Bank Financial Institutions (hereinafter: Law on Banks) and/or according to the following definitions for the purpose of this regulation: 1.1. Country risk – means the risk of loss caused by events in a foreign country, which may include changes in economic, social, political or regulatory conditions that affect natural or legal persons who have obligations in that country and, potentially, obligations denominated in the currency of that country. 1.2. Risk management framework – means the framework whereby the Board of Directors and Senior Management create and take decisions related to the bank's strategy and risk approach, articulate and monitor compliance with the bank's risk appetite and risk limits related to the bank's strategy; and identify, measure, manage and control risks. 1.3. Risk limits – means specific quantitative measures that cannot be exceeded, based on assumptions that distribute the bank's risk appetite at a general level to business lines, legal entities or management units within the bank or banking group in the form of separate risk categories, concentrations, or other measures, as the case may be. 1.4. Risk management system – means altogether, the systems, structures, policies, procedures and individuals that measure, monitor and report risk within the bank in general or, if applicable, within the banking group in general. 1.5. Transfer risk – means the risk that the borrower will not be able to convert local currency into foreign currency and thus will not be able to make debt service payment in foreign currency.

2 of 3 Article 3 Risk management framework

1. The bank's Board of Directors and senior management shall ensure that the country and transfer risk management framework includes effective independent risk management, internal controls and audit processes.
2. The independent risk management and internal controls and audit system shall adequately cover all activities and exposures in a foreign country.
3. The bank's risk management framework shall include policies and procedures for identifying, measuring, monitoring and reporting on country and transfer risk in the bank's international funding, lending and investments on a timely basis.
4. The risk management framework shall provide a bank-wide, or if applicable, banking group-wide overview of country and transfer risks, including, where appropriate, intra-group exposures.
5. For banks with exposure to country and transfer risks, the risk management framework shall, at least, include the following items: 5.1. Country and transfer risk limits defined in the bank's risk appetite statement approved by the board of directors; 5.2. Documentation of the roles and responsibilities of the bank's various units involved in managing country and transfer risk; 5.3. Definition of country and transfer risks taking into account the size and nature of cross-border exposures relative to the total activity of the bank; 5.4. Policies and procedures to ensure that all country and transfer risks are identified, measured, managed, mitigated and reported upon in a timely and comprehensive manner; 5.5. Policies and procedures to ensure that developments affecting country and transfer risks are monitored, and where required, appropriate countermeasures such as reducing exposure limits or other techniques are used; and 5.6. Policies and procedures to ensure that provisioning reflects prudent minimums based on internal standards for exposure to each relevant country or through explicit consideration of country and transfer risk in the provisioning for individual exposures. Article 4 Risk management system
6. The bank shall identify, measure, monitor and control risk by implementing an effective risk management system appropriate to the size and complexity of its operations.
7. The risk management system shall include policies, procedures, systems and controls for monitoring and reporting to ensure that exposures to country and transfer risk are consistent with the bank's strategy and business plan and consistent with the bank's risk appetite and individual risk limits approved by the Board of Directors.
8. Country and transfer risk management shall be part of the bank's overall risk management function. Article 5 Stress test

3 of 3 A bank with exposure to country and transfer risks shall include in its stress tests appropriate scenarios that reflect potential shocks in order to assess their potential impact on the bank's earnings, operations and capital. Article 6 Information systems and internal reporting The bank shall have information systems that enable it to accurately aggregate, monitor and report country exposures. Reports shall be provided to the Board of Directors and senior management in a timely manner, in formats suitable for their use. Article 7 Reporting to the Central Bank of the Republic of Kosovo

1. The bank shall provide, upon request, any specific information related to country and transfer risk that the CBK may request.
2. The bank shall immediately notify the CBK when it discovers a significant deviation from the country and transfer risk limit defined in the policies approved by the Board of Directors, or when it discovers that a country or transfer risk has not been adequately addressed. Article 8 Enforcement, remedial measures and civil penalties Any violation of the provisions of this regulation shall be subject to remedial and punitive measures, as defined in the Law on Central Bank and the Law on Banks. Article 9 Entry into force This regulation shall enter into force on 30 September 2024. Bashkim Nurboja Chairman of the Board of the Central Bank of the Republic of Kosovo