Regulation on Bank Liquidity Risk Management

1 of 34 Pursuant to Article 35, paragraph 1, subparagraph 1.1 of the Law No. 03/L-209 on Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No.77 / 16 August 2010), and Articles 19 and 85 of the Law No. 04/L-093 on Banks, Microfinance Institutions and Non-Bank Financial Institutions (Official Gazette of the Republic of Kosovo, No.11 / 11 May 2012), the Board of the Central Bank of the Republic of Kosovo, in its meeting held on 28 February 2023, approved the following: REGULATION ON THE BANK LIQUIDITY RISK MANAGEMENT CHAPTER I GENERAL PROVISION Article 1 Purpose and Scope

1. The purpose of this regulation is to determine the minimum standards and requirements for the effective management of liquidity risk by banks.
2. This Regulation shall apply to all banks and branches of foreign banks licensed by the CBK to operate in the Republic of Kosovo, hereinafter referred to as banks. Article 2 Definitions
3. All terms used in this Regulation shall have the same meaning as defined in Article 3 of the Law No. 04/L-093 on Banks, Micro-Finance Institutions and Non-Bank Financial Institutions (hereafter: the Law on Banks) and/or as further defined for the purpose of this Regulation: 1.1. Liquidity shortfall – means any situation, where the bank : 1.1.1. does not possess sufficient liquid assets or faces difficulties in securing them in the market, in order to meet its obligations as they fall due and to meet any unforeseen demand for funds from its depositors and other creditors; 1.1.2. is unable to fund increases in its assets; 1.2. Liquidity risk – means the possibility of incurring a financial loss owing to the liquidity shortfall; 1.3. Unusual circumstances/situations – means those situations in which there is a real threat that could lead the bank to a liquidity shortfall;

2 of 34 1.4. Liquidity contingency plan – means the document compiled by the bank, that clearly sets out the policies and procedures to be implemented under unusual conditions, and the procedures to secure emergency funds; 1.5. Net cash flow – means the difference between cash inflows and outflows for a defined period of time, thus reflecting an increase or decrease of cash amount; 1.6. Remaining contractual maturity – means the remaining period of time until the end of the maturity term of contractual assets and liabilities; 1.7. Concentration on funding sources – means the situation when a single decision-making or a single external factor can cause an immediate and significant withdrawal of funds, thus forcing the bank to significantly change its funding strategy; 1.8. Stress-testing – means the risk management technique employed to analyze the possible impact of one or more internal and external factors on financial stability and/or bank liquidity position; 1.9. Large depositors – shall be considered the twenty depositors with the highest value of deposits in the bank's total deposits; 1.10. Liquidity gap – means the difference between the bank's assets and liabilities, by maturity spans; 1.11. Haircut – is the percentage by which the value of liquid assets has been reduced for the purposes of calculating the liquidity indicator, in accordance with the provisions of this regulation. CHAPTER II LIQUIDITY RISK MANAGEMENT SYSTEM Article 3 Management System

1. A bank is responsible for sound liquidity risk management.
2. A bank should establish a robust liquidity risk management framework to ensure that it maintains sufficient liquidity, including the reserve of unencumbered, high-quality liquid assets, to withstand certain stress events, including those events involving the loss or impairment of unsecured and secured funding sources.
3. A bank should establish a robust liquidity risk management framework that is well integrated into the bank-wide risk management process.
4. The primary objective of the liquidity risk management framework should be to ensure a high degree of confidence that the bank is in a position to address its daily liquidity obligations and withstand a period of liquidity stress affecting both secured and unsecured funding, the source of which could be bank-specific or market-wide.

3 of 34 5. In addition to maintaining sound governance and liquidity risk management practices, a bank should hold an adequate liquidity cushion (reserve) consisting of readily marketable assets to be in na position to survive such periods of liquidity stress. 6. A bank should demonstrate that its liquidity cushion is commensurate with the complexity of its on- and off-balance sheet activities, the liquidity of its assets and liabilities, the extent of its funding mismatches and the diversity of its business mix and funding strategies. 7. A bank should use appropriately conservative assumptions about the marketability of assets and its access to funding, both secured and unsecured, during stress periods. Moreover, a bank should not allow competitive pressures to compromise the integrity of its liquidity risk management, control functions, limit systems and liquidity cushion. 8. A bank shall establish a liquidity risk management system, which is aimed at good management of their liquidity risk. Banks ensure that the liquidity risk management system, quantitatively and qualitatively, is consistent with the size of the bank, the type of activity and the level of exposure to liquidity risk. 9. The liquidity risk management system shall contain the following minimum elements: 9.1. liquidity risk management strategy and policies; 9.2. the organizational structure for liquidity risk management; 9.3. internal control system; 9.4. information management system; 9.5. liquidity stress test; 9.6. liquidity contingency plan. Article 4 Organizational structure, tasks and responsibilities for liquidity risk management

1. The appropriate organizational structure for liquidity risk management should clearly define the powers and responsibilities of the bank's bodies and define the duties and responsibilities of the relevant organizational part in the bank, authorized to monitor the bank's liquidity and manage the risk of liquidity.
2. A bank's Board of Directors, in relation to liquidity risk management, is responsible to: 2.1. approve the liquidity risk management strategy; 2.2. approve the liquidity risk management policies and monitor their implementation, including the approval and monitoring of the liquidity contingency plan; 2.3. review the adequacy of policies and procedures in place, at least on annual basis; 2.4. review liquidity risk reports; 2.5. approve liquidity risk exposure limits; 2.6. monitor the efficiency of internal control, as an integral part of the liquidity risk management system.

4 of 34 3. The Risk Management Committee is responsible to: 3.1. monitor liquidity risk management policies and provide proposals for their revision; 3.2. evaluate the liquidity risk management system; 3.3. analyze the bank's liquidity risk exposure reports and monitor risk management; 3.4. determine and periodically review internal liquidity indicators and liquidity risk exposure limits; 3.5. determine the possible exceptions from the set limits and designate the persons responsible for the implementation of these exceptions; 3.6. create procedures and methods for performing stress tests. 4. In addition to the Risk Management Committee, the bank may create a separate body (committee), which is responsible for the implementation of liquidity risk management operations through daily liquidity risk monitoring and control. 5. As defined in paragraph 4 of this Article, the special body (committee) should at least: 5.1. approve and monitor the implementation of liquidity risk management procedures; 5.2. create and maintain an efficient system for measuring, monitoring, controlling and reporting liquidity, according to currencies, which significantly affect the overall liquidity of the bank and monitoring the structure of assets and liabilities in euro and foreign currencies; 5.3. create an environment for monitoring the liquidity risk management policy; 5.4. create an adequate reporting system to the Board of Directors and the risk management committee for any non-compliance with liquidity risk exposure limits; 5.5. define financial instruments for liquidity risk management; 5.6. create procedures for determining and monitoring the stability of deposits; 5.7. create a procedure for evaluating the effects of new products on liquidity risk exposure; 5.8. monitor potential liabilities and exposures based on banks' off-balance sheet operations. 6. A bank should include liquidity costs, benefits and risks in the internal pricing, performance measurement and new product approval process for all significant business activities (both on balance sheet and off balance sheet items), thus aligning the risk-taking incentives of individual business lines with the exposures to liquidity risk that their activities create, for the bank as a whole. 7. Senior management should appropriately incorporate liquidity costs, benefits and risks in the internal pricing, performance measurement and new product approval process for all significant business activities (both on- and off-balance sheet). 8. Senior Management should ensure that the bank's liquidity management process includes the measurement of liquidity costs, benefits and risks implicit in all significant business activities, including activities that involve the creation of contingent exposures which may not immediately have a direct balance sheet impact. 9. The costs, benefits and risks, mentioned in this article, should be explicitly attributed to the relevant activity, so that line management incentives are consistent with reinforce the overarching

5 of 34 liquidity risk tolerance and strategy of the bank, with a liquidity charge assigned as appropriate to positions, portfolios, or individual transactions. 10. The assignment of liquidity costs, benefits and risks, according to paragraph 9 of this article, should include factors related to the anticipated holding periods of assets and liabilities, their market liquidity risk characteristics, and any other relevant factors, including the benefits from access to relatively stable sources of funding, such as some types of retail deposits. 11. The quantification and attribution of these risks should be explicit and transparent at the line management level and should include consideration of how liquidity would be affected under stressed conditions. 12. The analytical framework should be reviewed as appropriate to reflect changing business and financial market conditions and thus maintain the proper alignment of incentives. Moreover, liquidity risk costs, benefits and risks should be addressed explicitly in the new product approval process. Article 5 Strategy and policies

1. A bank should design the strategy and policies for liquidity risk management.
2. A bank should clearly define a liquidity risk tolerance that is appropriate for its business strategy and its role in the financial system.
3. A bank should set a liquidity risk tolerance that reflects its business objectives, strategic direction and overall risk appetite.
4. The board of directors is ultimately responsible for the liquidity risk assumed by the bank and the manner in which this risk is managed and therefore should establish the bank’s liquidity risk tolerance.
5. The tolerance, which should define the level of liquidity risk that the bank is willing to assume, should be appropriate for the business strategy of the bank and its role in the financial system and should reflect the bank’s financial condition and funding capacity.
6. Tolerance should ensure that the bank manages its liquidity strongly in normal times in such a way that it is able to withstand a prolonged period of stress.
7. The risk tolerance should be articulated in such a way that all levels of management clearly understand the trade-off between risks and profits.
8. Senior Management should develop a strategy, policies and practices to manage liquidity risk in accordance with the risk tolerance and to ensure that the bank maintains sufficient liquidity.
9. Senior Management should continuously review information on the bank's liquidity developments and report to the Board of Directors on a regular basis.
10. A bank's Board of Directors should review and approve the strategy, policies and practices related to liquidity management at least annually and ensure that Senior Management manages liquidity risk effectively.
11. The liquidity risk management strategy contains the following minimum elements:

6 of 34 11.1. strategy objectives; 11.2. principles for liquidity risk management; 11.3. the general methodology that the bank will apply for liquidity risk management in short￾term and long-term periods; 11.4. the bank's overall methodology and vision to operate in multiple markets and funding sources; AND 11.5. policies for liquidity risk management. 12. The strategy for liquidity risk management is drawn up as a separate document or as a part of the bank's strategic plan. The strategy should be reviewed on a regular basis, at least annually. 13. The strategy should include specific policies on liquidity management, such as: the composition and maturity of assets and liabilities; the diversity and stability of funding sources; the approach to managing liquidity in different currencies, across borders, and across business lines and legal entities; the approach to intraday liquidity management; and the assumptions on the liquidity and marketability of assets. 14. The strategy should take account of liquidity needs under normal conditions as well as liquidity implications under periods of liquidity stress, the nature of which may be caused by the bank itself or by the market in general, or a combination of both. 15. The strategy may include various high-level quantitative and qualitative targets. 16. The Board of Directors should ensure that senior management translates the strategy into clear guidance and operating standards (eg in the form of policies, controls or procedures). 17. The Board of Directors should also ensure that senior management and appropriate personnel have the necessary expertise and that the bank has processes and systems to measure, monitor, and control all sources of liquidity risk. 18. The liquidity strategy should be appropriate for the nature, scale and complexity of a bank’s activities. In formulating this strategy, the bank should take into consideration its subsidiaries or branches, main lines of business, the breadth and diversity of markets, products, and jurisdictions (countries) in which it operates, as well as local and foreign regulatory requirements. 19. Senior management should determine the structure, responsibilities and controls for managing liquidity risk and for overseeing the liquidity positions of all branches and subsidiaries in the jurisdictions in which it operates, and describe these elements clearly in the bank's liquidity policies. 20. The structure for managing liquidity (ie the degree of centralisation or decentralisation of a bank’s liquidity risk management) should take into consideration any legal, regulatory or operational restrictions on the transfer of funds. 21. Senior Management and the Board of Directors should have a thorough understanding of the close relationships between liquidity funding risk and market liquidity risk, as well as how other risks, including credit, market, operational and reputational risk, affect the bank's overall liquidity risk strategy. 22. The liquidity strategy, key policies for implementing the strategy, and the liquidity risk management structure should be communicated throughout the bank by senior management. All

7 of 34 business units conducting activities that have an impact on liquidity should be fully aware of the liquidity strategy and operate under the approved policies, procedures, limits and controls. 23. Individuals responsible for liquidity risk management should maintain close links with those monitoring market conditions, as well as with other individuals with access to critical information, such as credit risk managers. Moreover, liquidity risk and its potential interaction with other risks should be included in the risks addressed by risk management committees and/or independent risk management functions. 24. Senior management should ensure that the bank has adequate internal controls to ensure the integrity of its liquidity risk management process. 25. Senior management should ensure that operationally independent, appropriately trained and competent personnel are responsible for implementing internal controls. It is critical that personnel in independent control functions have the skills and authority to challenge information and modelling assumptions provided by business lines. 26. Senior Management should ensure that necessary changes are implemented in a timely manner when significant changes affect the effectiveness of controls and reviews or where improvements to internal controls are required. 27. The internal audit should regularly review the implementation and effectiveness of the agreed framework for controlling liquidity risk. 28. Senior management should closely monitor current trends and potential market developments that may present significant, unprecedented and complex challenges for managing liquidity risk so that they can make appropriate and timely changes to the liquidity strategy as needed. 29. Senior management should define the specific procedures and approvals necessary for exceptions to policies and limits, including the escalation procedures and follow-up actions to be taken for breaches of limits. 30. Senior management should ensure that stress tests, contingency funding plans and liquidity cushions are effective and appropriate for the bank. 31. The Board of Directors should review regular reports on the liquidity position of the bank. 32. The Board of Directors should be promptly informed of new or emerging liquidity concerns. These include increasing funding costs or concentrations, the growing size of a funding gap, the drying up of alternative sources of liquidity, material and/or persistent breaches of limits, a significant decline in the cushion of unencumbered, highly liquid assets, or changes in external market conditions which could signal future difficulties 33. The Board of Directors should ensure that senior management takes appropriate remedial actions to address the concerns. 34. Liquidity risk management policies should be reviewed on a regular basis, at least on an annual basis, and at least contain: 34.1. identification of liquidity risk arising from new products and operations; 34.2. liquidity risk measurement, especially of: 34.2.1. current liquidity position, including valuation of liquid assets and collateral;

8 of 34 34.2.2. forecasting incoming and outgoing cash flows; 34.2.3. matching between the term of maturity of the funds and the sources of funding; 34.2.4. the concentration of deposits and other funding sources according to maturities, type and structure of clients; 34.2.5. determination of liquidity indicators and their use in monitoring practice in the bank; 34.2.6. the use of stress test as elements/part of liquidity risk monitoring; 34.2.7. regular assessment of market development when liquidity needs are met. Article 6 Internal control system

1. A bank should establish appropriate internal control procedures to ensure the integration of the liquidity risk management process within the overall risk management process. The internal control of liquidity risk management will be an integral part of the general internal control system, established at the bank level.
2. For the purposes of internal control of liquidity risk exposures, the bank should establish: 2.1. cash flow approval limits on certain amounts and monitoring of compliance with the defined limits; 2.2. reporting of possible incompatibilities with the limits referred to in sub-paragraph 2.1. of this paragraph; 2.3. regular verification of the data and information used during the determination of the bank's liquidity; 2.4. ensuring compliance with all laws, regulations and other by-laws of the CBK, as well as the bank's internal rules.
3. A bank should actively monitor and control liquidity risk exposures and funding needs within and across legal entities, business lines and currencies, taking into account legal, regulatory and operational limitations to the transferability of liquidity.
4. Regardless of its organisational structure and degree of centralised or decentralised liquidity risk management, a bank should actively monitor and control liquidity risks at the level of individual legal entities, and foreign branches and subsidiaries.
5. For each country in which it is active, a bank should ensure that it has the necessary expertise about country-specific features of the legal and regulatory regime that influence liquidity risk management, including arrangements for dealing with failed banks, deposit insurance, and central bank operational frameworks and collateral policies. This knowledge should be reflected in liquidity risk management processes.
6. In the case of a localized systemic stress event, a bank should have processes in place to allow for allocation of liquidity and collateral resources to affected entities, to the extent that transferability is permitted.
7. The specific market characteristics and liquidity risks of positions in foreign currencies should be taken into account, particularly where fully developed foreign exchange markets do not exist. For

9 of 34 currencies trading in well-developed foreign exchange markets, a more global approach to management of the currency may be taken, including the use of swaps. However, the bank should critically assess the risk that the ability to swap currencies may erode rapidly under stressed conditions. 8. Assumptions regarding the transferability of funds and collateral should be transparent in liquidity risk management plans that are available for supervisory review. A bank’s assumptions should fully consider regulatory, legal, accounting, credit, tax and internal constraints on the effective movement of liquidity and collateral. They should also consider the operational arrangements needed to transfer funds and collateral across entities and the time required to complete such transfers under those arrangements. Article 7 Information management system

1. A bank should create an information system to provide timely and continuous measurement, monitoring, control and reporting in the decision-making process, to manage liquidity risk.
2. The information system is required to at least: 2.1. measure and monitor the bank's liquidity and liquidity risk on a daily basis and in a certain period of time; 2.2. measures and monitors the bank's liquidity, according to currencies that significantly affect the bank's overall liquidity, on an individual and consolidated basis; 2.3. monitors compliance with established liquidity risk exposure limits; 2.4. provide data for the determination of liquidity indicators and the preparation of reporting forms for the needs of the bank's entities and other persons involved in the liquidity risk management process; 2.5. analyze the developments of the deposit base and determine and monitor the stability of deposits; 2.6. perform stress tests. Article 8 Liquidity stress test
3. While liquidity will typically be managed under “normal” circumstances, the bank should be prepared to manage liquidity under stress conditions.
4. Banks should perform stress tests on a regular basis in order to identify and measure liquidity risk exposures, under normal conditions/situations of daily activity as well as in the occurrence of a stressed environment. For this purpose, banks should analyze the effects of cash flow, short-term and long-term solvency, preparedness to react to emergency conditions/situations and assess the ability to increase assets through the identification of available funding sources.
5. The frequency with which the bank will perform stress tests should be proportional to the size of the bank's activity, its liquidity risk exposure, as well as the relative importance of the bank within

10 of 34 the banking system, but not less than four times a year. The CBK may request the performance of stress tests in more frequent periods. 4. The bank's Board of Directors should analyze the results of the stress test at least every three months to: 4.1. improve liquidity risk management strategy and policy; 4.2. draft and improve regulatory framework necessary to solve the main issues related to the liquidity position of banks; 4.3. develop effective contingency plans to identify and quantify the bank's exposure to potential liquidity stress situations. 5. The stress tests carried out by the bank include the use of special scenarios based on internal factors, scenarios based on market conditions where the bank operates, as well as macroeconomic factors (external factors). 6. The results of these stress tests should be fully discussed by management and based on this discussion, should determine the basis for taking corrective or mitigating actions to limit the bank's exposures, create a liquidity reserve and adjust its liquidity profile with risk tolerance. 7. Scenarios for performing stress tests may include the following assumptions: 7.1. withdrawal of deposits; 7.2. possible deterioration of borrowers' ability to repay obligations, which means deterioration of the credit portfolio quality; 7.3. the inability to convert assets easily and without significant loss into cash; 7.4. the possibility of early repayment of obligations under the conditions of the existence of contractual options that enable this repayment; 7.5. operational risk and the degree of its impact on the liquidity risk increase; 7.6. changes in economic conditions in the sectors to which the bank is exposed and the deterioration of the economy as a whole; 7.7. deterioration of the functioning of the markets in which the bank operates and/or a significant reduction of confidence in these markets; 7.8. interest rate and exchange rate shocks; 7.9. the effect of significant changes in the value of the bank's assets and/or assets accepted by it as a guarantee (collateral); 7.10. partial or complete limitation of funding from the main funding sources, including the possibility of continuity of funding from the parent bank; 7.11. the impact of negative regional and global economic developments; 7.12. asset market illiquidity and loss of value of liquid assets; 7.13. the run-off of retail funding; 7.14. (un) availability of secured and unsecured wholesale funding sources;

11 of 34 7.15. the correlation between funding markets or the effectiveness of diversification across sources of funding; 7.16. additional margin calls and collateral requirements; 7.17. funding tenors; 7.18. contingent claims and more specifically, potential draws on committed lines extended to third parties or the bank’s subsidiaries or branches; 7.19. the liquidity absorbed by off-balance sheet vehicles; 7.20. the availability of contingent lines extended to the bank; 7.21. liquidity drains related to complex products / transactions; 7.22. the impact of credit rating triggers; 7.23. FX convertibility and access to foreign exchange markets; 7.24. the ability to transfer liquidity across entities, sectors and borders taking into account legal, regulatory, operational and time zone restrictions and constraints; 7.25. the access to central bank facilities; 7.26. the bank's operational ability to monetize assets; 7.27. the bank's remedial actions and the availability of the necessary documentation and operational expertise and experience to execute them, taking into account the potential reputational impact when executing these actions; 7.28. estimates of future balance sheet growth; and 7.29. any other possible situation deemed as a possible source of risk. 8. The assumptions listed in paragraph 7 of this article have a guiding value for the bank, while the bank can use those situations that best suit the complexity, risk profile and its participation in the banking system. 9. The bank defines the methodology for carrying out stress tests, the assumptions used, as well as the actions in response to the generated results, which include: 9.1. implementation, analysis of stress test scenarios and the frequency of their realization; 9.2. carrying out stress tests for individual scenarios and combined scenarios, in the conditions of the simultaneous occurrence of several scenarios; 9.3. documenting and periodically reviewing the assumptions used to perform stress tests; 9.4. the form and frequency of reporting the results of stress tests to management structures; 9.5. the actions that should be taken by the management structures and/or special structures in charge of liquidity risk management, based on the results of the stress tests. Article 9 Stress test process

12 of 34

1. Stress tests should enable the bank to analyze the impact of stress scenarios on its liquidity position of the bank's individual entities and business lines. Regardless of the bank's organizational structure and the degree of centralization of liquidity management, it is important for the bank to understand where risks may arise.
2. A bank should assess whether additional tests are necessary for its subsidiaries and branches that are exposed to significant liquidity risks. The tests should include the implication of scenarios in different time horizons, including those intraday.
3. The scale and frequency of testing should be appropriate to the size of the bank and its exposure to liquidity risk, as well as to the relative importance of the bank within the financial systems in which it operates.
4. The bank should build its capacity to increase the frequency of testing in special circumstances, such as in volatile market conditions or if required by the CBK.
5. The active involvement of the bank's Senior Management is vital to the stress test process. Senior Management should require that rigorous and challenging stress scenarios be considered, even when the bank's liquidity level is sufficient. Article 10 Scenarios and assumptions
6. In designing stress test scenarios, the bank should take into account the activities, vulnerabilities and the nature of its business, so that the scenarios incorporate the major funding and market liquidity risks to which the bank is exposed.
7. The scenarios should include risks related to factors such as the bank's business activities, products (including complex financial instruments and off-balance sheet items) and funding sources. The defined scenarios should allow the bank to assess the potential adverse impact these factors can have on its liquidity position.
8. A bank should carefully consider the designing of scenarios as well as the variety of shocks used.
9. A bank, in its stress tests, should include stress scenarios for short and long-term periods as well as specific for the bank and also for the market in general, including: 4.1. simultaneous drying up of market liquidity in several previously highly liquid markets; 4.2. severe constrains in accessing secured or unsecured funding; 4.3. restrictions on currency convertibility; and 4.4. severe operational or settlement disruptions affecting one or more payment or settlement systems.
10. A bank should consider the potential impact from severe stress scenarios, regardless of how stable its current liquidity position appears to be.
11. A bank should particularly consider the link between the reduction in market liquidity and the constraints on funding liquidity. A bank should also consider the insights and results of stress tests performed for other types of risk when testing its liquidity position and take into account possible interactions with these other types of risks.

13 of 34 7. A bank should recognise that stress events may simultaneously give rise to time-critical liquidity needs in multiple currencies and multiple payment and settlement systems. 8. Tests should reflect accurate time-frames for the settlement cycles of assets that might be liquidated, and the time required to transfer liquidity across borders. 9. In addition, if a bank relies upon liquidity outflows from one system to meet obligations in another, it should consider the risk that operational or settlement disruptions might prevent or delay expected flows across systems. 10. A bank should take into account in its stress tests the likely behavioral response of other market participants to events of market stress and the extent to which a common response might amplify market movements and exacerbate market strain. 11. A bank should also consider the potential impact of its behavior on other market participants. 12. A bank stress tests should consider how the behavior of counterparties (or their correspondents and custodians) would affect the timing of cash flows, including on an intraday basis. In cases where the bank uses a correspondent or custodian to perform settlement, the analysis should include the impact of those agents restricting their provision of intraday credit. A bank should also understand the impact of the stress event on the utilization of intraday loans by its customers and how these needs affect its own liquidity position. 13. The scenario design should be subject to regular reviews to ensure that the nature and severity of the tested scenarios remain appropriate and relevant to the bank. Reviews should take into account changes in market conditions; changes in the nature, size or complexity of the bank's business model and activities as well as the actual experiences in stress situations. 14. A bank may perform a sensitivity analysis of the stress test results to certain key assumptions in order to identify and analyze factors that may have a significant impact on its liquidity profile. Such sensitivity analyzes can provide additional indications of a bank's degree of sensitivity to certain factors. Article 11 Utilization of results

1. Senior management should review stress test scenarios and assumptions as well as the results of the stress tests. The bank's choice of stress test scenarios and assumptions should be well documented and reviewed together with the stress test results.
2. The stress tests results and vulnerabilities and any action taken should be reported and discussed with the bank's Board of Directors. Senior management should integrate the results of the stress test process into the bank's strategic planning process (eg the bank's management can adapt the asset-liability structure) and into the risk management practices on a daily basis (eg through monitoring sensitive cash flows or reducing concentration limits). The results of stress tests should be taken into account when setting internal limits.
3. Senior management should decide how to incorporate the results of stress tests in assessing and planning for related potential funding shortfalls in the institution's contingency funding plan. To the extent that projected funding deficits are larger than (or projected funding surpluses are smaller than) implied by the bank’s liquidity risk tolerance, management should consider whether to adjust

14 of 34 its liquidity position or to bolster the bank’s contingency plan in consultation with the Board of Directors. Article 12 Contingency Funding Plan

1. A bank should compile a contingency plan for liquidity risk management for emergency situations. A bank should review the contingency funding plan (CFP) at least on annual basis, in order to take into account possible changes in the internal and external conditions of the bank's operations. In cases where it is necessary, CBK reserves the right to ask the bank to test the plan.
2. The contingency funding plan is part of the liquidity risk management system and contains: 2.1. clear division of duties, powers, responsibilities and decision-making regarding the implementation of the plan; 2.2. early warning indicators used as signals for the development of extraordinary conditions as well as the determination of the responsible persons within the bank for monitoring and reporting these indicators; 2.3. the conditions under which the plan will be implemented; 2.4. determining the activities that should be undertaken, identifying potential sources of funds, their level and priorities in use, as well as determining the time intervals within which these activities should be undertaken; 2.5. communication with key depositors, business partners, other customers and the public; 2.6. contact details of the persons responsible for implementation of the plan.
3. In event of stressed economic and financial situations, the bank cooperates closely with the CBK and exchanges continuous information with it on its financial situation, as well as on the actions taken to restore it to satisfactory parameters.
4. A contingency funding plan (CFP) is the formulation of policies, procedures and action plans to respond to severe disruptions in a bank's ability to fund some or all of its activities on a timely basis and at a reasonable cost.
5. The contingency funding plan should be consistent with the complexity, risk profile, scope of operations and role of the bank in the financial systems in which the bank operates.
6. The contingency funding plan should include a clear description of a diverse set of possible contingency funding measures, readily available and flexibly applicable, to maintain liquidity and compensate for cash flow shortfalls in various unfavorable emergency situations.
7. The contingency funding plan should determine the possible sources of contingency funding available and the amount of funds that the bank estimates can be drawn from these sources; clear escalation / prioritization procedures detailing when and how each of the actions can and should be activated; and the appropriate timing to utilize additional funds from each of the contingency sources.
8. The contingency funding plan should provide a framework with a high degree of flexibility so that the bank can respond quickly to different situations.

15 of 34 9. The design, plans and procedures of the Contingency Funding Plan should be closely integrated with the bank's ongoing analysis of liquidity risk and with the results of scenarios and assumptions used in stress tests. As such, the plan should address issues over a series of different time periods, including intra-day ones. Article 13 Compilation of contingency plan and procedures, roles and responsibilities

1. Contingency funding plans should prepare the bank to manage a range of severe liquidity stress scenarios that include bank-specific stress and general market-wide stress, as well as the potential interaction between them.
2. The plan should include a diverse list of possibilities so that management has an overview of the contingency measures potentially available. The bank should also consider the time periods for which the measures can be performed under different assumptions and stresses.
3. Contingency funding plans should contain clear policies and procedures that will enable bank management to make timely and informed decisions, execute contingency measures with speed and skill, and communicate effectively to implement plan efficiently, including: 3.1. clear specification of roles and responsibilities, including the authority to request the Contingency Funding Plan. Establishing a formal "crisis team" can facilitate internal coordination and decision-making during a liquidity crisis; 3.2. the names and contact details of the team members responsible for the implementation of the Contingency Funding Plan and the locations of the team members; and 3.3. determining alternatives for the main roles.
4. To facilitate the timely response needed to manage disruptions, the plan should define a clear decision-making process about what actions to take at what time, who can take them, and which issues should be escalated in higher level in the bank.
5. The plan should clearly define procedures to provide effective internal coordination and communication across the bank's various business lines and locations. It should also address when and how to contact the CBK and external parties, such as supervisors of countries where it operates through a subsidiary or branch, central banks or payment system operators. Article 14 Communication plans
6. In any crisis situation, the flow of clear communications should provide certainty and information for market participants, employees, customers, creditors, shareholders and the CBK.
7. Banks should design a plan that will provide timely, clear, consistent and frequent communication with internal parties, as well as with the CBK, in a time of stress, to support general confidence in the bank. The plan should also address when and how to communicate with correspondents, custodians, counterparties and customers, since the actions of these parties can significantly affect the bank's liquidity position and may differ from the underlying source of a problem.

16 of 34 Article 15 Compilation of Contingency funding plans

1. In cases where the bank compiles the Contingency Funding Plan, it should take into account the following elements: 1.1. the impact of stressed market conditions on its ability to sell or securitize assets; 1.2. the relationship between the asset's market liquidity and the asset's funding liquidity (eg substantial or complete loss of typical potential market funding opportunities); 1.3. second round and reputational effects related to the execution of Contingency funding measures; and 1.4. the ability to transfer liquidity between group entities, borders and business lines, taking into account legal, regulatory, operational and time zone limits and restrictions.
2. The elements in paragraph 1 of this article should reflect the previous experiences of the bank or other institutions, expert judgment, market practice and the knowledge that the bank has gained through performing stress tests.
3. The bank's Contingency Funding Plan (as well as the bank's day-to-day liquidity risk management) should reflect CBK's lending programs and collateral requirements, if any, including facilities that are part of normal management operations of liquidity (eg availability of seasonal credit).
4. The inclusion of CBK lending in the Contingency Funding Plan should take into account the types of lending facilities, acceptable collateral, operational procedures for accessing CBK funds and potential reputational issues involved in accessing them.
5. The Contingency Funding Plan should also include possible steps to meet critical payments on an intraday basis. In situations where intraday liquidity sources become insufficient, the bank should have the ability to identify critical payments and order or schedule payments based on their priority.
6. In the event of severe disruptions, it is also important that the bank has the ability to obtain additional sources of intraday liquidity, including by identifying and mobilizing additional collateral.
7. As with stress tests, the Contingency Funding Plan should also anticipate that needs for timely repayment may arise not only from the bank's own transactions, but also from those of its customers, and from the provision of services to payment systems and settlements (eg acting as a Contingency liquidity provider).
8. The Contingency Funding Plan should take into account the risk management procedures of all relevant systems and therefore be robust enough to handle simultaneous disturbances in many payment and settlement systems.
9. It is particularly important that in the development and analysis of Contingency Funding Plans and stress scenarios, relevant bank personnel should be familiar with the operational procedures required for liquidity and collateral transfers to various institutions and systems and the restrictions governing such transfers. Realistic timelines for such transfers should be factored into liquidity modeling.

17 of 34 Article 16 Testing, updating and maintenance

1. Contingency Funding Plans should be regularly reviewed and tested to ensure their operational effectiveness and feasibility. Key aspects of this testing include ensuring that roles and responsibilities are appropriate and understood, confirming that contact information is up to date, proving the transfer of cash and collateral and reviewing that the necessary legal and operational documentation is in place to execute plan in a short notice.
2. The bank should regularly test key assumptions, such as the ability to sell or repurchase certain assets or periodically draw down credit lines.
3. Bank management should review all aspects of the plan after each exercise and ensure that follow￾up actions are carried out.
4. Senior Management shall review and update the Contingency Funding Plan at least annually for approval by the board, or more frequently as business or market circumstances change.
5. The Contingency Funding Plan should be consistent with the bank's business continuity plans and should be operational in situations where business continuity arrangements are required.
6. The bank should ensure effective coordination between teams managing issues related to liquidity and business continuity crises. Liquidity crisis team members and their deputies should have ready access to the Contingency Funding Plan both inside and outside the bank. CHAPTER III PRINCIPLES, INDICATORS AND MEASURES FOR LIQUIDITY RISK MANAGEMENT Article 17 The main elements for the identification, assessment and management of liquidity risk
7. A bank identifies, assesses and manages liquidity risk based on the following elements: 1.1. liquidity risk assessment principles; 1.2. planning and monitoring of incoming and outgoing cash flows; 1.3. determining and maintaining an appropriate maturity structure; 1.4. monitoring of funding sources and their concentration; 1.5. monitoring of guarantees (collateral) for liquidity purposes; 1.6. monitoring of funding lines; 1.7. liquidity indicators.
8. A bank should have a sound process for identifying, measuring, monitoring and controlling liquidity risk. This process should include a robust framework for comprehensively projecting cash flows arising from assets, liabilities and off-balance sheet items over an appropriate set of time horizons.

18 of 34 3. A bank should define and identify the liquidity risk to which it is exposed for all legal entities, branches and subsidiaries in the jurisdictions in which it is active. A bank’s liquidity needs and the sources of liquidity available to meet those needs depend significantly on the bank’s business and product mix, balance sheet structure and cash flow profiles of its on and off-balance sheet obligations. 4. A bank should assess each main position of balance sheet and off-balance sheet items, including the effects of embedded options and other contingent exposures that may affect the bank's sources of funding and their utilization and determine how they may affect the liquidity risk. 5. The bank should consider interactions between funding liquidity risk exposures and market liquidity risk. 6. A bank should ensure that assets are prudently valued according to International Financial Reporting Standards (IFRS) and CBK regulations. 7. A bank should fully factor into its risk management the consideration that valuations may deteriorate under market stress, and take this into account in assessing the feasibility and impact of asset sales during stress on its liquidity position. 8. A bank should recognise and consider the strong interactions between liquidity risk and the other types of risk to which it is exposed. 9. A bank should identify events that could have an impact on market and public perceptions about its soundness, particularly in wholesale markets. 10. A bank should be able to measure and forecast its prospective cash flows for assets, liabilities, off￾balance sheet commitments and derivatives over a variety of time horizons, under normal conditions and a range of stress scenarios, including scenarios of severe stress. 11. Regarding the time horizons over which to identify, measure, monitor and control liquidity risk, a bank should ensure that its liquidity risk management practices integrate and consider a variety of factors. These include vulnerabilities to changes in liquidity needs and funding capacity on an intraday basis; day-to-day liquidity needs and funding capacity over short and medium-term horizons up to one year; longer-term liquidity needs over one year; and vulnerabilities to events, activities and strategies that can put a significant strain on internal cash generation capability. 12. The should identify, measure, monitor and control a bank’s liquidity risk positions for: 12.1. future cash flows of assets and liabilities; 12.2. sources of contingent liquidity demand and related triggers associated with off-balance sheet positions; 12.3. currencies in which the bank is active; and 12.4. correspondent, custody and settlement activities. Article 18 Future cash flows of assets and liabilities

19 of 34

1. A bank should have a robust liquidity risk management framework providing prospective, dynamic cash flow forecasts that include assumptions on the likely behavioural responses of key counterparties to changes in conditions and are carried out at a sufficiently granular level.
2. A bank should make realistic assumptions about its future liquidity needs for both the short- and long-term that reflect the complexities of its underlying businesses, products and markets.
3. A bank should analyse the quality of assets that could be used as collateral, in order to assess their potential for providing secured funding in stressed conditions.
4. A bank also should attempt to manage the timing of incoming flows in relation to known outgoing sources in order to obtain an appropriate maturity distribution for its sources and uses of funds.
5. In estimating the cash flows arising from its liabilities, a bank should assess the “stickiness” of its funding sources – that is, their tendency not to run off quickly under stress.
6. A bank should assess the likelihood of roll-over of funding lines and the potential for fund providers to behave similarly under stress, and therefore consider the possibility that secured and unsecured funding might dry up in times of stress, in particular, for non-retail, secured and unsecured fund providers.
7. For secured funding with overnight maturity, a bank should not assume that the funding will automatically roll over
8. A bank should assess the availability of term funding contingency facilities and the circumstances under which they can be utilised. A bank should also consider factors that influence the “stickiness” of retail deposits, such as size, interest-rate sensitivity, geographical location of depositors and the deposit channel (eg direct, internet or brokered). Article 19 Sources of contingent liquidity demand and related triggers associated with off-balance sheet positions
9. A bank should identify, measure, monitor and control potential cash flows relating to off-balance sheet commitments and other contingent liabilities. This should include a robust framework for projecting the potential consequences of undrawn commitments being drawn, considering the nature of the commitment and credit worthiness of the counterparty, as well as exposures to business and geographical sectors, as counterparties in the same sectors may be affected by stress at the same time.
10. A bank’s processes for identifying and measuring contingent funding risks should consider the nature and size of the bank’s potential non-contractual “obligations”, as such obligations can give rise to the bank supporting related off-balance sheet vehicles in times of stress.
11. A bank should implement systems and tools to analyze these liquidity trigger events effectively and to measure how these changes to the underlying risk factors could cause draws to contracts that underlie undrawn commitments and off-balance sheet instruments, even in cases when there has been no historical evidence of such draws. This analysis should include appropriate assumptions on the behavior of both the bank and its obligors or counterparties.

20 of 34 4. For the purposes of this article, triggering events are the events that enable commitments to be drawn upon and thus may create a liquidity need. For example, triggering events may include changes in economic variables or conditions, credit rating downgrades, country risk issues, and specific market disruptions (e.g. commercial paper). 5. A bank should manage liquidity risk for certain off-balance sheet items that may materialize in periods of stress. These items include: 5.1. special purpose vehicles (SPV); 5.2. financial derivatives; AND 5.3. guarantees and commitments. 6. A bank should have a detailed understanding of its contingent liquidity risk exposure and event triggers arising from any contractual and non-contractual relationships with special purpose vehicles. A bank should determine whether a special purpose subsidiary or other special purpose vehicle (in either case an “SPV”) of a bank is considered to be a source or use of liquidity based upon the likelihood that such a source or use will occur if either the bank or special purpose vehicle experience adverse liquidity circumstances, irrespective of whether or not the special purpose vehicle is consolidated for accounting purposes. 7. Where the bank provides contractual liquidity facilities to an SPV, or where it may otherwise need to support the liquidity of an SPV under adverse conditions, the bank needs to consider how the bank’s liquidity might be adversely affected by illiquidity at the SPV. In such cases, the bank should monitor the SPV’s inflows (maturing assets) and outflows (maturing liabilities) as part of the bank’s own liquidity planning, including in its stress testing and scenario analyses. In such circumstances, the bank should assess the liquidity position of the bank with the SPV’s liquidity draws (but not its liquidity surplus) included. 8. A bank should consider whether the use of securitization special purpose vehicles as a source of funding will continue to be available to the bank even in adverse scenarios for the bank and should reflect this in future liquidity management. Article 20 Financial derivatives A bank should incorporate cash flows related to the repricing, exercise or maturity of financial derivatives contracts in its liquidity risk analysis, including the potential for counterparties to demand additional collateral in an event such as a decline in the bank’s credit rating or creditworthiness or a decline in the price of the underlying asset. Timely confirmation of OTC derivatives transactions is fundamental to such analyses, because unconfirmed trades call into question the accuracy of a bank’s measures of potential exposure. Article 21 Guarantees and commitments A bank should assess that undrawn loan commitments, letters of credit and financial guarantees represent a potentially significant drain of funds for a bank. A bank may be able to ascertain a "normal"

21 of 34 level of cash outflows under routine conditions, and then estimate the scope for an increase in these flows during periods of stress. Article 22 Currencies in which a bank is active

1. A bank should assess its aggregate foreign currency liquidity needs and determine acceptable currency mismatches. A bank should undertake a separate analysis of its strategy for each currency in which it has significant activity, considering potential constraints in times of stress.
2. The size of foreign currency mismatches should take into account: 2.1. the bank’s ability to raise funds in foreign currency markets; 2.2. the likely extent of foreign currency back-up facilities available in its domestic market; 2.3. the ability to transfer a liquidity surplus from one currency to another, and across jurisdictions and legal entities; and 2.4. the likely convertibility of currencies in which the bank is active, including the potential for impairment or complete closure of foreign exchange swap markets for particular currency pairs.
3. A bank should be aware of, and have the capacity to manage, liquidity risk exposures arising from the use of foreign currency deposits and short-term credit lines to fund domestic currency assets as well as the funding of foreign currency assets with domestic currency.
4. A bank should take account of the risks of sudden changes in foreign exchange rates or market liquidity, or both, which could sharply widen liquidity mismatches and alter the effectiveness of foreign exchange hedges and hedging strategies.
5. A bank should assess the likelihood of loss of access to the foreign exchange markets as well as the likely convertibility of the currencies in which the bank carries out its activities.
6. A bank should negotiate a liquidity back-stop facility for a specific currency, or develop a broader contingency strategy, if the bank runs significant liquidity risk positions in that currency. Article 23 Correspondent, custody and settlement activities
7. A bank should understand and have the capacity to manage how the provision of correspondent, custodian and settlement bank services can affect its cash flows.
8. A bank also should understand and have the capacity to manage the potential liquidity needs it would face as a result of the failure-to-settle procedures of payment and settlement systems in which it is a direct participant. Article 24 Measurement tools

22 of 34

1. A bank should employ a range of customised measurement tools, or metrics, which can determine the full amount of liquidity risk.
2. To obtain a forward-looking view of liquidity risk exposures, a bank should use metrics that assess the structure of the balance sheet, as well as metrics that project cash flows and future liquidity positions, taking into account off-balance sheet risks.
3. These metrics should span vulnerabilities across business-as-usual and stressed conditions over various time horizons. Under business-as-usual conditions, prospective measures should identify needs that may arise from projected outflows relative to routine sources of funding. Under stress conditions, prospective measures should be able to identify funding gaps at various horizons, and in turn serve as a basis for liquidity risk limits and early warning indicators.
4. Management should tailor the measurement and analysis of liquidity risk to the bank’s business mix, complexity and risk profile. The measurement and analysis should be comprehensive and incorporate the cash flows and liquidity implications arising from all material assets, liabilities, off-balance sheet positions and other activities of the bank.
5. The analysis should be forward-looking and strive to identify potential future funding mismatches so that the bank can assess its exposure to the mismatches and identify liquidity sources to mitigate the potential risks. In the normal course of measuring, monitoring and analysing its sources and uses of funds, a bank should project cash flows over time under a number of alternative scenarios. These "pro-forma" statements of cash flow are a crucial instrument for the adequate management of liquidity risk. These pro-forma cash flow statements are a critical tool for adequately managing liquidity risk. These projections serve to produce a “cash flow mismatch” or “liquidity gap” analysis that can be based on assumptions of the future behaviour of assets, liabilities and off￾balance sheet items, and then used to calculate the cumulative net excess or shortfall over the time frame for the liquidity assessment.
6. Measurement should be performed over incremental time periods to identify projected and contingent flows taking into account the underlying assumptions associated with potential changes in cash flows of assets and liabilities.
7. Given the critical role of assumptions in projecting future cash flows, a bank should take steps to ensure that its assumptions are reasonable and appropriate, documented and periodically reviewed and approved. The assumptions around the duration of demand deposits and assets, liabilities, and off-balance sheet items with uncertain cash flows and the availability of alternative sources of funds during times of liquidity stress are of particular importance. Assumptions about the market liquidity of such positions should be adjusted according to market conditions or bank-specific circumstances. Article 25 Liquidity risk control through limits
8. A bank should set limits to control its liquidity risk exposure.
9. A bank should regularly review such limits and corresponding escalation procedures. Limits should be relevant to the business in terms of its location, complexity of activity, nature of products, currencies and markets served.

23 of 34 3. Limits should be used for managing day-to-day liquidity within and across lines of business and legal entities under “normal” conditions. 4. The limit framework also should include measures aimed at ensuring that the bank can continue to operate in a period of market stress, bank-specific stress and a combination of the two. The objective of such measures is to ensure that, under stress conditions, available liquidity exceeds liquidity needs. Article 26 Early warning indicators

1. A bank should design a set of indicators to aid this process to identify the emergence of increased risk or vulnerabilities in its liquidity risk position or potential funding needs. Such early warning indicators should identify any negative trend and cause an assessment and potential response by management in order to mitigate the bank’s exposure to the emerging risk.
2. Early warning indicators can be qualitative or quantitative in nature and may include but are not limited to: 2.1. rapid growth in assets, especially when funded with potentially volatile liabilities; 2.2. growing concentrations in assets or liabilities; 2.3. increases in currency mismatches; 2.4. a decrease of weighted average maturity of liabilities; 2.5. repeated incidents of positions approaching or breaching internal or regulatory limits; 2.6. negative trends or increased risk associated with a particular product line, such as increased late payments on credit exposures; 2.7. significant deterioration of the bank's earnings, asset quality and overall financial condition; 2.8. negative publicity; 2.9. a credit rating downgrade; 2.10. stock price declines or rising debt costs; 2.11. widening debt or credit-default-swap spreads 2.12. rising wholesale or retail funding costs; 2.13. counterparties that begin requesting or request additional collateral for credit exposures or that resist entering into new transactions; 2.14. correspondent banks that eliminate or decrease their credit lines; 2.15. increasing retail deposit outflows; 2.16. increasing redemptions of certificates of deposit before maturity; 2.17. difficulty accessing longer-term funding; 2.18. difficulty placing short-term liabilities (eg commercial paper)

24 of 34 3. A bank also should have early warning indicators that signal whether embedded triggers in certain products (eg callable public debt, OTC derivative transactions) are about to be breached or whether contingent risks are likely to crystallise (such as back up lines to non-banking financial institutions that issue Asset-Backed Commercial Papers (ABCP conduits) which would cause the bank to provide additional liquidity support for the product or bring assets onto the balance sheet. Article 27 Monitoring system

1. A bank should have a reliable management information system designed to provide the board of directors, senior management and other appropriate personnel with timely and forward-looking information on the liquidity position of the bank.
2. The management information system should have the ability to calculate liquidity positions in all of the currencies in which the bank conducts business – both on a subsidiary/branch basis in all jurisdictions in which the bank is active. The information management system should capture all sources of liquidity risk, including contingent risks and the related triggers and those arising from new activities, and have the ability to deliver more granular and time sensitive information during stress events. To effectively manage and monitor its net funding requirements, a bank should have the ability to calculate liquidity positions on an intraday basis, on a day-to-day basis for the shorter time horizons, and over a series of more distant time periods thereafter.
3. The management information system should be used in day-to-day liquidity risk management to monitor compliance with the bank’s established policies, procedures and limits.
4. To facilitate liquidity risk monitoring, senior management should agree on a set of reporting criteria, specifying the scope, manner and frequency of reporting for various recipients (such as the board, senior management, asset – liability committee) and the parties responsible for preparing the reports. Reporting of risk measures should be done on a frequent basis (eg daily reporting for those responsible for managing liquidity risk, and at each board meeting during normal times, with reporting increasing in times of stress) and should compare current liquidity exposures to established limits to identify any emerging pressures and limit breaches.
5. Breaches in liquidity risk limits should be reported and reporting guidelines should be specified for escalation to higher levels of management, the board of directors and the CBK. Article 28 Funding strategy
6. A bank should establish a funding strategy that provides effective diversification in the sources and tenor of funding. It should maintain an ongoing presence in its chosen funding markets and strong relationships with funds providers to promote effective diversification of funding sources.
7. A bank should regularly gauge its capacity to raise funds quickly from each source. It should identify the main factors that affect its ability to raise funds and monitor those factors closely to ensure that estimates of fund raising capacity remain valid.

25 of 34 3. A bank should diversify available funding sources in the short-, medium- and long-term. Diversification targets should be part of the medium- to long-term funding plans and be aligned with the budgeting and business planning process. 4. Funding plans should take into account correlations between sources of funds and market conditions. The desired diversification should also include limits by counterparty, secured versus unsecured market funding, instrument type, securitisation vehicle, currency, and geographic market. 5. As a general liquidity management practice, banks should limit concentration in any one particular funding source or tenor. 6. Banks should ensure that wholesale funding sources are sufficiently diversified to maintain timely availability of funds at the right maturities and at reasonable costs. 7. A bank should have access to diversified sources of liquidity for each currency in cases where it is active in different currencies. 8. Senior management should be aware of the composition, characteristics and diversification of the bank’s assets and funding sources. Senior management should regularly review the funding strategy in light of any changes in the internal or external environments. Article 29 Managing market access

1. Senior management should ensure that market access is being actively managed, monitored and tested by the appropriate staff.
2. A bank should maintain an active presence within markets relevant to its funding strategy. This requires an ongoing commitment and investment in adequate and appropriate infrastructures, processes and information collection.
3. A bank should not assume it can access markets in a timely manner for which it has not established the necessary systems or documentation, or where these arrangements have not been periodically utilised or the bank has not confirmed that willing counterparties are in place. The inclusion of loan-sale clauses in loan documentation and the regular use of some asset-sales markets may help enhance a bank’s ability to execute asset sales with various counterparties in times of stress. In all cases, a bank should have full knowledge of the legal framework governing potential asset sales, and ensure that documentation is reliable and legally robust.
4. A bank should identify and build strong relationships with current and potential investors, even in funding markets facilitated by brokers or other third parties. The bank should take a careful look at how these relationships will be strained in times of stress.
5. Stress test scenarios and contingency funding plans should consider the effects that losses and the resulting reduction in capital can have on the bank’s ability to maintain funding relationships.
6. A bank needs to identify alternative sources of funding that strengthen its capacity to withstand a variety of severe yet plausible liquidity shocks to the bank and the market in general.
7. Depending on the nature, severity and duration of the liquidity shock, potential sources of funding include the following:

26 of 34 7.1. deposit growth; 7.2. the lengthening of maturities of liabilities; 7.3. new issues of short- and long-term debt instruments; 7.4. intra-group fund transfers, new capital issues, the sale of subsidiaries or lines of business; 7.5. asset securitisation; 7.6. the sale or repo of unencumbered, highly liquid assets; 7.7. drawing-down committed facilities; 7.8. borrowing from the central bank’s marginal lending facilities. 8. Bank management should regularly review and test its fund-raising options to evaluate their effectiveness at providing liquidity in the short-, medium- and long-term. 9. A bank should actively manage its intraday liquidity positions and risks to meet payment and settlement obligations on a timely basis under both normal and stressed conditions and thus contribute to the smooth functioning of payment and settlement systems. 10. A bank should adopt intraday liquidity management objectives that allow it to: 10.1. identify and prioritise time-specific and other critical obligations in order to meet them when expected, and 10.2. settle other less critical obligations as soon as possible. 11. A bank’s strategy to achieve its intraday liquidity management objectives should include at least six operational elements as follows: 11.1. A bank should have the capacity to measure expected daily gross liquidity inflows and outflows, anticipate the intraday timing of these flows where possible, and forecast the range of potential net funding shortfalls that might arise at different points during the day; 11.2. A bank should have the capacity to monitor intraday liquidity positions against expected activities and available resources (balances, remaining intraday credit capacity, available collateral); 11.3. A bank should arrange to acquire sufficient intraday funding to meet its intraday objectives; 11.4. A bank should have the ability to manage and mobilise collateral as necessary to obtain intraday funds. The bank should have sufficient collateral available to acquire the level of intraday liquidity needed to meet its intraday objectives. It should have operational arrangements in place to pledge or deliver this collateral to central banks, correspondents, custodians and counterparties. The bank should also understand the timeframes required to mobilise different forms of collateral, including collateral held on a cross-border basis; 11.5. A bank should have a robust capability to manage the timing of its liquidity outflows in line with its intraday objectives; 11.6. A bank should be prepared to deal with unexpected disruptions to its intraday liquidity flows. The also should understand the level and timing of liquidity needs that may arise as a result of the failure-to-settle procedures of payment and settlement systems in which it is a direct

27 of 34 participant. Robust operational risk management and business continuity arrangements are also critical to the effectiveness of a bank’s intraday liquidity management. 12. A bank should have policies, procedures and systems to support these operational objectives in all of the financial markets and currencies in which it has significant payment and settlement flows. The tools and resources applied should be tailored to the bank’s business model and role in the financial system, as well as how it conducts its activities for a particular market, (eg via direct participation in a payment or settlement system or via correspondent or custodian banks) and whether it provides correspondent or custodian services and intraday credit facilities to other banks, firms or systems. 13. A bank should recognize the potential for operational or financial disruptions at its correspondent or custodian to disrupt the bank’s own liquidity management, and it should have alternative arrangements in place to ensure it can continue to meet its obligations in such situations. 14. A bank should actively manage its collateral positions, differentiating between encumbered and unencumbered assets. 15. A bank should monitor the legal entity and physical location where collateral is held and how it may be mobilised in a timely manner. 16. A bank should have the ability to calculate all of its collateral positions, including assets currently pledged relative to the amount of security required and unencumbered assets available to be pledged. A bank’s level of available collateral should be monitored by legal entity, by jurisdiction and by currency exposure, and systems should be capable of monitoring shifts between intraday and overnight or term collateral usage. 17. A bank should be aware of the operational and timing requirements associated with accessing the collateral given its physical location (ie the custodian bank or securities settlement system with which the collateral is held). 18. A bank should assess the eligibility of each major asset class for pledging as collateral with central banks and the acceptability of assets to major counterparties and funds providers in secured funding markets. A bank should diversify its sources of collateral, taking into consideration capacity constraints, name-specific concentrations, the sensitivity of prices, haircuts and collateral requirements under conditions of name-specific and market-wide stress, and the availability of funds from private sector counterparties in various market stress scenarios. 19. A bank should adjust, as necessary, measures of available collateral to account for assets that are part of a “tied position” (eg assets used as part of a hedge of an off-balance sheet or derivative position, such as an equity/debt position as a hedge to a total return swap or a negative basis trade). 20. A bank should have a detailed understanding of, and be able to demonstrate, the estimated period of time to liquidate those assets or put on a substitute hedge. 21. A bank should have sufficient collateral to meet expected and unexpected borrowing needs and potential increases in margin requirements over different timeframes, depending upon the bank’s funding profile. 22. In determining the level of collateral to pledge or deliver, a bank should consider the potential for significant uncertainty around the timing of intraday flows. A bank also should consider the

28 of 34 potential for operational and liquidity disruptions that could necessitate the pledging or delivery of additional intraday collateral. 23. A bank, that uses derivatives should take into account the potential for contractually specified additional collateral requirements as a result of changes in market positions or changes in A bank’s credit rating or financial position. 24. A bank should also consider other trigger events. 25. A bank’s information systems should be able to report whether the bank has sufficient unencumbered assets of the right type and quality for such a contingency. Article 30 Liquidity risk management principles

1. A bank identifies, assesses and manages the liquidity risk based at least on the following principles: 1.1. relying on sustainable sources of funding; 1.2. minimizing the contractual maturity gap and the maturity gap according to real movements; 1.3. diversification of funding sources by type, currency, facilities, maturity, number of clients and markets, considering their liquidity level; 1.4. balanced/controlled expansion of activity and maintaining a sufficient value of liquid assets; 1.5. human resource availability principles for effective liquidity risk management. Article 31 Planning and monitoring of incoming and outgoing cash flows
2. A bank incoming and outgoing cash flows predicts and monitors the incoming and outgoing flow of funds for certain periods of time, which should be forecast for a period of 1 (one) year. This forecast considers all types of cash inflows and outflows, including cash inflows and outflows from off-balance sheet items. The bank should compare this forecast at regular intervals with the actual cash inflow and outflow values.
3. Cash inflow forecasts include at least: 2.1. current repayments of loans (where the level of repayments cannot be higher than the contracted cash inflows, as well as deducting the reserve funds created for possible losses); 2.2. current conversion into cash of assets that do not have a defined maturity date; 2.3. cash values generated by investment securities; 2.4. current asset sales opportunities (where equity investments, non-performing loans and tangible fixed assets are treated as less liquid assets, excluding cash inflows from the execution/s of collateral/s); 2.5. the expected increase in deposits;

29 of 34 2.6. A bank's ability to secure funds from other sources and the availability of market sources for funding; 2.7. other cash inflows, based on the analysis of historical data on the levels and performance of cash inflows in previous periods, taking into account the specifics of the bank's operations, seasonality, interest rate sensitivity and macroeconomic factors. 3. Cash outflow forecasts include at least: 3.1. maturing liabilities; 3.2. the future increase in the bank's lending level; 3.3. the levels of deposits and other stable liabilities based on their usual volatility and recognition of depositors' behavior and interests; 3.4. term deposits that can be withdrawn before maturity and demand deposits; 3.5. the impact of interest rate changes on the level of deposits; 3.6. the level of deposit concentration; 3.7. cash outflows from off-balance sheet items; 3.8. outflows based on historical data analysis on the level and performance of cash outflows in previous periods, taking into account seasonal impact, interest rate sensitivity and macroeconomic factors. Article 32 Defining and maintaining an appropriate maturity structure

1. Banks should monitor the maturity structure of assets and liabilities on a monthly basis in order to identify potential maturity gaps.
2. A bank, for the purpose of measuring and monitoring gaps, classifies the incoming and outgoing flows of cash from assets (rights), liabilities (claims) and off-balance sheet items, according to maturity intervals.
3. A bank uses the latest possible date of collection of assets as the date of collection, and the earliest possible date of settlement of liabilities according to the following intervals: 3.1. up to 7 days, 3.2. 7 days to 1 month, 3.3. 1 month to 3 months, 3.4. 3 months to 6 months, 3.5. 6 months to 12 months.
4. A bank continuously monitors the gaps according to the expected remaining maturity, using for this purpose forecasts about the expected inflows and outflows of cash, such as, among others, the probability of collecting the assets at the moment they mature, the probability of drawing deposits before maturity.

30 of 34 5. A bank, in the framework of cash-flow projections should be based on reasonable and appropriate assumptions that are properly documented, and periodically reviewed and approved. 6. In determining the remaining maturity of assets and liabilities, the bank should: 6.1. have a database of incoming and outgoing cash flows on which the assumptions are based; 6.2. review on a regular basis the assumptions used in order to reflect in the latter possible changes in internal and external conditions; and 6.3. ensure that assumptions take into account the seasonal and cyclical nature of cash inflows and outflows. 7. A bank, according to the approved methodology, can classify (group) cash flows according to the type of client, maturity, currency, sector, etc. 8. The CBK may request the application of different assumptions or correction factors in the forecasting and monitoring of cash flows according to the expected maturity, if it deems that these actions enable a better reflection of the bank's risk profile. 9. A bank performs the analysis of liquidity gaps based mainly on the following criteria: 9.1. classification of assets, liabilities and off-balance sheet items according to maturity; 9.2. assessment of deposit stability based on historical data and stress test results; 9.3. setting limits for liquidity gaps; 9.4. calculation of gaps on a monthly basis and according to currencies with a significant impact on the bank's liquidity; 9.5. predicting liquidity gaps in the future; 9.6. any other criteria deemed reasonable

Article 33 Monitoring of funding sources and their concentration

1. A bank periodically monitors funding sources in order to maintain a diversified base of these sources as well as to identify potential concentrations. Concentrations are analyzed by source of funding, type of funding, market, geographic concentration, currency and maturity.
2. Monitoring of funding sources and their concentration includes: 2.1. maintaining stable relations with large depositors, correspondent banks, other important customers, as well as with business partners; 2.2. determining the sustainability of deposits, taking into account the characteristics of depositors and the type of deposit; 2.3. monitoring the level of diversification of funding sources; 2.4. determining and monitoring movements in other funding sources.
3. A bank determines and monitors the level of concentration of current accounts and demand deposits in Euro currency and in foreign currency.

31 of 34 Article 34 Monitoring collateral for liquidity purposes

1. A bank monitors the size/value of its collateral, in order to distinguish between assets placed as collateral and free assets.
2. Effective collateral monitoring aims to fulfill a set of collateral requirements related to ensuring long-term, short-term or daily liquidity.
3. A bank should possess a sufficient amount of collateral in order to meet the expected or unforeseen needs for borrowing in the financial market, in the interbank market and from the CBK, based on its funding profile. Article 35 Monitoring of funding lines
4. A bank evaluates the possibility of possible re-negotiation of funding lines and the possibility that fund providers will react in the same way even in unusual circumstances/conditions.
5. A bank takes into account the probability of the exhaustion of possibilities for funding lines in unusual circumstances.
6. A bank cannot assume 100% (one hundred percent) safe automatic renegotiation of one-day maturity lines. Article 36 Liquidity Reserve (High Quality Liquid Assets)
7. A bank should maintain a reserve (cushion) of unencumbered, high-quality liquid assets to be held as insurance against a range of liquidity stress scenarios including those that involve the loss or impairment of typically available unsecured and/or secured funding sources. There should be no legal, regulatory or operational impediments to using these assets to obtain funding.
8. The size of the liquidity reserve should be in accordance with the established risk tolerance of the bank. Key elements include assumptions about the size of cash flow mismatches, the duration and severity of the stress, and the liquidation or borrowing of the assets (ie, the anticipated cash available to the bank if the assets are liquidated or used as collateral for secured funding) in stressed situations.
9. A bank should ensure that its reserve of liquid assets is of a size to maintain sufficient resilience against sudden stress while continuing to meet its daily payment and repayment obligations in a timely manner for the duration of the stress. The bank should also consider the instruments and other resources it has available to manage intraday risks.
10. A bank should maintain a more reliable liquid asset base in terms of the composition of its liquidity reserve, to protect itself against more severe stress scenarios.
11. To insure against less intense but longer duration stress events, the bank may choose to expand the reserve mix to hold other free liquid assets that are marketable (ie, can be sold or used as collateral in sale and repurchase agreements) without resulting in excessive losses or discounts.

32 of 34 6. The marketability of individual assets may vary depending on the stress scenario and time frame involved. However, there are some general characteristics that aim to increase the liquidity of a given asset including: transparency of its structure and risk characteristics; ease and security of assessment; central bank eligibility; the depth of the market for the asset, including bank holdings compared to normal market circulation; and the name and presence of the bank itself in the relevant markets. 7. A bank should not assume that a liquid market will exist for a particular asset in all stress scenarios simply because such a market exists in normal times. There should be no legal, regulatory or operational obstacles to using these assets to obtain funds, as these assets should be available at all times to meet liquidity needs as and when they arise. 8. A bank should be ready and prepared to use these assets in the event of severe stress. However, the reserve should provide additional protection in addition to the first line of defence. Article 37 Public disclosure

1. A bank should publicly disclose information on a regular basis that enables market participants to make an informed judgement about the soundness of its liquidity risk management framework and liquidity position.
2. A bank should disclose sufficient information about its liquidity risk management to enable stakeholders to make an informed judgment about the bank's ability to meet its liquidity needs.
3. A bank should disclose its organizational structure and framework for liquidity risk management. In particular, the disclosure should explain the roles and responsibilities of the relevant committees, as well as those of the various functional and business units.
4. As part of its periodic financial reporting, the bank should provide quantitative information about its liquidity position that enables market participants to form a picture of its liquidity risk.
5. A bank should provide sufficient qualitative explanation about its metrics to enable market participants to understand them, e.g. the time span covered, whether calculated under normal or stressed conditions, the organizational level at which the measurement indicators are applied as well as other assumptions used in measuring the bank's liquidity position, liquidity risk and liquidity reserve.
6. A bank should disclose additional qualitative information that gives market participants more insight into how it manages liquidity risk: 6.1. This list includes and not limited to: 6.1.1. aspects of liquidity risk to which the bank is exposed and monitors; 6.1.2. diversification of the bank's funding sources; 6.1.3. other techniques used to mitigate liquidity risk; 6.1.4. concepts used in measuring its liquidity position and liquidity risk, including additional measurement indicators for which the bank does not disclose data;

33 of 34 6.1.5. an explanation of how asset market liquidity risk is reflected in the bank's funding liquidity management framework; 6.1.6. an explanation of how the stress test is used; 6.1.7. a description of the modeled stress test scenarios; 6.1.8. a summary of the bank's funding backup plans and an indication of how the plan relates to the stress test; 6.1.9. the bank's policy for maintaining liquidity reserves; 6.1.10. regulatory restrictions on the transfer of liquidity between group entities; 6.1.11. frequency and type of internal liquidity reporting. CHAPTER IV TRANSITIONAL AND FINAL PROVISIONS Article 38 Enforcement, Remedial Measures and Civil Penalties Violations of this regulation shall be subject to remedial administrative measures and penalties provided for under the Law on the Central Bank of the Republic of Kosovo and the Law on Banks, Microfinance Institutions and Non-Bank Financial Institutions. Article 39 Transitional provisions Banks, no later than six (6) months after the entry into force of this regulation, should review and/or approve internal policies and procedures in accordance with the requirements of this regulation. Article 40 Repeal With the entry into force of this Regulation, the Regulation on liquidity risk management approved on 29.11.2012 shall be repealed. Article 41 Entry into Force This regulation shall enter into force fifteen (15) days from the date of its approval. Bashkim Nurboja

34 of 34 Chairman of the Board of the Central Bank of the Republic of Kosovo