Directive No. 03-DRO-DSI-2018 of 12 July

THE GOVERNOR Whereas it is necessary to regulate the implementation of a stress testing program by financial institutions, oriented towards the control and management of material risks, as well as the definition and assessment of risk factors considered relevant, under the provisions of Instruction No. 02/17 of 30 January on Stress Tests; Under the combined provisions of points (d) and (f) of Article 21 and point (d) of paragraph 1 of Article 51 of Law No. 16/10 of 15 July, Law of the National Bank of Angola, and Article 93 of Law No. 12/15 of 17 June, Law of the Bases of Financial Institutions. This Directive serves to establish the following:

1. This Directive establishes the guidelines and implementation program for stress tests regarding the criteria adopted by financial institutions.
2. This Directive applies to banking and non-banking financial institutions that develop credit activities, under the supervision of the National Bank of Angola, under the terms and conditions set forth in the Law of the Bases of Financial Institutions, hereinafter collectively referred to as institutions.

DIRECTIVE No. 03/DRO/DSI/18 ORIGIN: - Department of Regulation and Organization of the Financial System (DRO)

• Banking Supervision Department (DSB) DATE: 12/07/2018 SUBJECT: Guide on the implementation of a stress testing program

Directive No. 03/DRO/DSI/2018 Page 2 of 20 3. The National Bank of Angola publishes the “Guide on the implementation of a stress testing program”, as set out in Annex I, which forms an integral part of this Directive, with the aim of contributing to the identification of possible risk sources, regarding various specific types of risk, in order to determine comprehensive or plausible stress scenarios, taking into account all impacts that a given crisis scenario may eventually generate, notably at the level of own funds and the institution's liquidity position. 4. The Guide on the implementation of a stress testing program has a guiding character for the assessment of risks and expectations of economic evolution in the macroeconomic aspect, as well as the main risks inherent to that same evolution, including the impact of the macroeconomic environment on financial risks themselves. 5. Financial institutions must also carry out scenario and sensitivity analyses (ad hoc stress tests) in accordance with subpoint 6.5 of point 6 of Instruction No. 02/17 of 30 January on Stress Tests and according to the parameters established in Annex II, which forms an integral part of this Directive. 6. In the event that financial institutions do not carry out stress tests in accordance with the guidelines issued by the National Bank of Angola, considering them inapplicable, they must submit their respective justifications. 7. Institutions must report the results of the analyses carried out, along with the criteria followed by them for risk management and in accordance with the criteria defined by the National Bank of Angola, as set out in points 11.7 and 11.8 of paragraph 11 of the Instruction on stress tests. 8. For the purposes of the preceding paragraph, institutions must submit the information within 20 (twenty) days from the publication of this Directive.

Directive No. 03/DRO/DSI/2018 Page 2 of 20 9. The stress tests carried out by financial institutions must assure the National Bank of Angola that solvency and liquidity levels are adequate, that relevant specific vulnerabilities are identified, and that institutions have the capacity to absorb the impact of adverse events, in accordance with point (d) of paragraph 5 of the Instruction on stress tests. 10. Failure to comply with the mandatory standards established in this Directive constitutes an offense provided for and punishable under the Law of the Bases of Financial Institutions. 11. Doubts and omissions resulting from the interpretation and application of this Directive are resolved by the National Bank of Angola. 12. This Directive enters into force on the date of its publication. Luanda, 12 July 2018. Department of Regulation and Organization of the Financial System

---

Carla Gomes Director Banking Supervision Department

---

Elavoko João Deputy Director

Directive No. 03/DRO/DSI/2018 Page 3 of 20 ANNEX I GUIDE ON THE IMPLEMENTATION OF A STRESS TESTING PROGRAM Table of Contents Scope and objectives ................................................................................... 6

1. Stress tests ............................................................................ 7 1.1 Typologies of stress tests............................................................ 7 1.1.1 Sensitivity analyses.................................................................. 7 1.1.2 Scenario analyses.......................................................................... 8 1.1.3 Reverse stress tests................................................................ 9 1.2 Stress testing methodology...................................................... 10
2. Specific stress tests.......................................................... 13 2.1 Financial risks ............................................................................. 13 2.1.1. Credit risk........................................................................ 13 2.1.2. Market risk..................................................................... 14 2.1.3. Operational risk ..................................................................... 16 2.1.4. Liquidity risk....................................................................... 18
3. Macroeconomic environment .............................................................. 20
4. Final recommendations .................................................................... 21

Directive No. 03/DRO/DSI/2018 Page 4 of 20 Scope and objectives This Guide aims to guide institutions in conducting their stress tests, particularly in determining stress scenarios that best suit the economic-financial environment prevailing during a given period of time. The Guide presents a set of practices and examples that institutions should consider in the context of conducting stress tests, notably for the identification of possible risk sources, regarding various specific types of risk, in order to determine comprehensive or plausible stress scenarios, taking into account all impacts that a given crisis scenario may eventually generate, notably at the level of own funds and the institution's liquidity position. In general, stress tests should reflect the most pertinent financial risks for the banking sector, namely, credit risk, market risk, operational risk, and liquidity risk. Notwithstanding the importance of each institution's specific characteristics in determining stress scenarios, the assessment of the aforementioned risks must also consider expectations of economic evolution in the macroeconomic aspect, as well as the main risks inherent to that same evolution, including the impact of the macroeconomic environment on financial risks themselves. The document is structured into two fundamental parts, with the first presenting options for conducting stress tests and the second offering examples of risk factors to consider in the preparation of stress tests, first by type of financial risk – credit risk, market risk, operational risk, and liquidity risk, and second by macroeconomic risk factor. In this regard, it is important to highlight the interdependence between financial risks and the macroeconomic environment for the determination of scenario analyses that consider multiple risk factors simultaneously.

Directive No. 03/DRO/DSI/2018 Page 5 of 20

1. Stress tests Stress tests consist of analyses or simulations designed to assess an institution's capacity to withstand adverse scenarios. In this sense, each institution defines a specific adverse scenario, but possible in occurrence, in order to study the viability and robustness of its solvency and liquidity position. Within the scope of stress tests, several analyses may be carried out that, depending on the objective, differ in complexity, as presented below. 1.1 Typologies of stress tests 1.1.1 Sensitivity analyses Sensitivity analyses correspond to the assessment of the impact resulting from the variation of a single risk factor, notably on the adequacy of own funds and the liquidity of institutions. For example, an institution may wish to test the impact resulting from a variation in the interest rate, an increase in default by its main counterparties, or a decrease in the value of liquid assets. This type of analysis allows for a more in-depth understanding of the main risks to which the institution is exposed, as well as obtaining a better understanding of potential risk concentrations in one or more risk factors. For the purpose of conducting sensitivity analyses, it is essential that institutions identify the relevant risk factors for their activity, presented in this document. Once the risk factors are identified, the institution must calculate the impact that a variation in them would cause, using different levels of stress for this purpose. The stress level assigned to each risk factor must consider its historical evolution, but institutions must complement the analyses with assumptions that may better suit the current situation and future prospects, in order to correctly reflect the institution's vulnerability to risk factors specific to it.

Directive No. 03/DRO/DSI/2018 Page 6 of 20 In the context of conducting sensitivity analyses, institutions may opt to consider various types of granularity¹, from the level of individual exposure of asset portfolios, business units, to the level of specific risk areas or the level of the institution as a whole. Additionally, the simple analysis of a single factor may be complemented by simple analyses of multiple factors, where combined occurrences are assumed, without necessarily tracing a scenario. 1.1.2 Scenario analyses Scenario analyses are assessments of the impact of a given economic-financial environment, represented by the calibration of a set of risk factors, on the financial condition of the institution, notably at the level of own funds and liquidity. Scenario analyses play a crucial role in the stress testing program of institutions. In this sense, institutions must ensure that scenario analyses are dynamic, incorporate perspectives on the future, and incorporate the simultaneous occurrence of events across the entire institution. Considering the importance of scenario analyses, institutions must consider a variety of scenarios covering different events and levels of stress, and it is important that these: a) Cover all types of material risk of the institution; b) Address the main risk factors to which the institution is exposed. Regarding this aspect, the results obtained in simple single-factor analyses, which aim to provide information on sensitivity to certain risk factors, may be used to develop scenarios that include a combination of plausible risk factors; 1 Granularity is understood as the level of detail of the data considered in a model. The higher the level of granularity, the greater the detail of the data. Granularity is generally used to characterize the scale or level of detail of a set of data.

Directive No. 03/DRO/DSI/2018 Page 7 of 20 c) Address the main specific vulnerabilities of the institution in question. Regional and sectoral characteristics of the institution, as well as exposures associated with specific products and business lines or financing policies, must be considered; d) Contain a description that includes the causes underlying the events, for example, monetary policy, developments in the financial sector, prices of basic commodities, evolution of the political situation, and natural disasters; e) Be internally consistent, that is, the identified risk factors must behave coherently with each other under a stress situation; f) Take into account technological and financial evolution, notably the development of new sophisticated financial products, as well as their interaction with the assessment of more traditional products; g) Be prospective and include serious consequences. 1.1.3 Reverse stress tests Reverse stress tests aim to identify situations under which the viability of institutions would be compromised. Thus, it is necessary to first define which are the critical points for the viability of an institution (e.g., regulatory solvency and liquidity ratios below the minimum required). Subsequently, one or more scenarios that could cause one of the defined critical viability points must be outlined. The construction of one or more scenarios that compromise the viability and sustainability of an institution's business model may be useful as a risk management tool, as it allows identifying possible combinations of events and risk concentrations in an institution, which typically would not be considered in common stress tests.

Directive No. 03/DRO/DSI/2018 Page 8 of 20 2. Stress testing methodology Institutions must define and formalize the methodology for conducting stress tests, considering the following aspects: a) Definition of tests to be carried out – the type and complexity of tests required depends on the type of institution, as set out in Article 8 of the Instruction on stress tests; b) Delegation of relevant tasks – the Management Body must delegate the various tasks necessary to conduct stress tests to relevant areas (i.e., financial, information technology, risk management areas, among others). Notwithstanding the delegation of tasks, the definition, formalization, and implementation of stress tests is the responsibility of the Management Body; c) Creation of a team to coordinate stress tests – this team must be responsible for coordinating activities, ensuring compliance with the stress testing methodology, and aggregating the work developed by all involved parties, in order to gather all relevant information and data; d) Identification of relevant risk factors – the institution must identify systemic risk factors and risk factors specific to the institution. Specific risk factors will depend on the individual business characteristics of the institution, such as concentration in terms of activity sectors, regional areas, or foreign currency. If one of the risks is considered immaterial to the institution, it may decide to exclude it from the stress tests it will conduct, justifying the reasons for this exclusion to the National Bank of Angola; e) Segmentation of different tests according to risk factors – the institution must define the level of analysis to be carried out for each specific risk area, considering the level of individual exposures, activity sectors, asset portfolios, and business units.

Directive No. 03/DRO/DSI/2018 Page 9 of 20 Segmentation may include analyses of an individual factor, analyses of multiple factors, and scenario analyses. The aforementioned stress tests must be carried out at appropriate levels, according to the institution's needs, which will cause different types of results and the involvement of different people and areas (e.g., business unit A may conduct an analysis on an individual factor for a relevant risk position, while business unit B may conduct several different scenario analyses); f) Definition of granularity level and data collection – the institution must consider what the appropriate level of granularity is for the data used for stress tests. The data must provide quick responses to a series of scenarios and maintain sufficient analytical depth so that analyses remain meaningful. Additionally, the institution must adapt the level of data to be used considering its technological capabilities, in order to be able to collect and process it. The institution must also define the temporal horizon that the data will cover; g) Data validation – the institution must ensure the quality of the information that will be used in stress tests, through a data validation process that consists of verifying whether the collected data meet previously defined requirements, present the correct format, are complete, can be reconciled with other institution data (accounting and management data), and have integrity. Data must be processed in a way that makes them uniform and comparable for different sources/areas of the institution, where applicable; h) Shock simulation – for sensitivity analysis, the institution must estimate the impact derived from shocks on individual or multiple previously defined factors, taking into consideration the magnitude and temporal horizon underlying the referred shocks;

Directive No. 03/DRO/DSI/2018 Page 10 of 20 i) Definition and simulation of scenarios – institutions must develop plausible scenarios that include the joint impact of multiple risk factors on institution conditions (e.g.: a reduction in oil prices together with other aspects, such as an x% budget deficit), considering different levels of severity and including at least one scenario that reflects a strong economic collapse. Scenarios must be based on historical data and include forward-looking hypothetical scenarios. Including only historical scenarios has proven insufficient, as their purely past-oriented nature does not allow capturing changing economic conditions. Scenarios must consider all types of material risk, the institution's main specific vulnerabilities, and the interaction and second-order effects of the system. The institution must adapt the mechanisms that allow transforming the macroeconomic variables used in scenario analysis into internal risk factors; j) Conducting reverse stress tests – having defined viability conditions, institutions may use causes, consequences, and impacts as a starting point to develop reverse stress tests, which may include qualitative and quantitative approaches, depending on the size and complexity of the institution. For example, a reverse stress test for simple and small-sized institutions may be a qualitative assessment of key risk factors and their relationship with the institution's risk profile, conducted at the top management level. Alternatively, a more sophisticated quantitative approach may be used to identify the specific level of loss or other impact on the balance sheet (e.g., movements in capital ratios) and work backwards, quantitatively, in order to identify the sources of macroeconomic risk and the magnitude of movements that would cause them; k) Assessments on the effectiveness of management actions – the institution must define management actions that can be triggered in times of stress in advance, which must be evaluated to ensure they will have the desired effect if and when needed;

Directive No. 03/DRO/DSI/2018 Page 7 of 20 l) Formalization of reports – the institution must prepare reports on the main activities carried out related to stress tests and disseminate them to relevant persons, including the head of the unit that conducted the test, the head of the risk management area, and the Management Body. Additionally, a report must be developed that includes the main activities and conclusions on each stress test conducted; m) Automation – depending on their size and complexity, institutions must make efforts to automate stress testing procedures; n) Methodology review – the stress testing methodology applied by the institution must be reviewed regularly, with a minimum annual frequency. 3. Specific stress tests 3.1 Financial risks 3.1.1. Credit risk Credit risk arises from the failure to fulfill financially contractual commitments, by a borrower or a counterparty in operations. Also, underlying the concept of credit risk is the possibility of risk concentrations arising from interactions between different exposures all belonging to the credit risk category. Examples of situations to consider within the scope of stress tests • Credit risk

Source of risk	Financial and economic impacts
Increase in default rate	• A scenario in which an increase in the default rate occurs forces the Institution to set aside provisions, which impacts the results of the period(s) in question. As a consequence, own funds are also impacted through the results.
• The increase in the default rate can be materialized, within the scope of conducting stress tests, in various ways and with different degrees of granularity, for example:
• Consider that the institution loses x% of the value of credits;
• Migrate credit quality and calculate estimated losses considering the possibility of migration of risk position classifications (A to G), whenever applicable, at the level of the credit quality grade assigned by recognized external rating agencies;
• Disaggregate by different risk classes (referred to in the previous point), according to specific vulnerabilities or according to their relevance in the institution's credit portfolio, among others;
• Additionally, the estimation of future unexpected losses can also be calculated using variations in the institution's internal credit risk parameters (PD 2 , LGD 3 , EAD 4 ) that the institution may eventually consider for internal purposes, even if these are not considered for the purpose of calculating regulatory own funds requirements.
Decrease in collateral value	• A drastic decrease in the market value of collateral associated with granted credits is another factor that can be considered in the conduct of stress tests for risk

Directive No. 03/DRO/DSI/2018 Page 12 of 20

Source of risk	Financial and economic impacts
of collateral. A significant drop in collateral values directly affects the institution's capital position and liquidity, as it reduces the recovery rate in case of default and may trigger margin calls or additional collateral requirements, thereby straining the institution's funding capacity.

Directive No. 03/DRO/DSI/2018 Page 13 of 20 2 Probability of Default 3 Loss Given Default 4 Exposure at Default