Bank of Namibia Correspondence to: P.O. Box 2882, Windhoek, Namibia Tel: +264-61-220486 Fax: +264-61-220154 Swift Code: CBKNNANX

Financial Institutions Department 13th Floor, Sanlam Centre 154 Independence Avenue Windhoek, Namibia

BANK OF NAMIBIA

CIRCULAR - BIA 11/98

TO: ALL BANKING INSTITUTIONS

DATE: 21 OCTOBER 1998

INFORMATION TECHNOLOGY- "YEAR 2000" COMPLIANCE

1. BACKGROUND

A "year 2000" questionnaire was issued under cover of Circular 2/98. The said questionnaire, which was completed by all registered banking institutions, was intended to be used by the banking institutions as a tool to stimulate thought about the possible impact of Y2K non-compliance on a banking institution.

The responses to the questionnaire were summarised by this Office, in order to obtain banking sector statistics and to help assess the risks to the banking institution as a whole. In addition, the completed questionnaire and additional documentation furnished by individual banking institutions were analyzed and used as an agenda for discussion at special meetings held with some of the institutions during the third quarter of 1998. Although meetings have not yet been held with all of the banking institutions, these are planned for the end of the year. These meetings will have to be attended by the managing director, chief internal auditor, and project co-ordinator.

---

2. RESPONSIBILITY FOR RISK MITIGATION

This Office wishes to stress that it is the responsibility of each individual banking institution to take timeous steps in order to mitigate the risks associated with the Y2K computer problem in respect of its own computer systems and data.

In particular, the following should be noted:

2.1

This circular does not purport to provide an exhaustive check-list of all reasonable steps that could be taken in order to achieve such risk mitigation, nor does it purport to guarantee a successful elimination of all risks associated with the Y2K computer problem if the guidelines implicit in this circular are followed.

2.2

Neither this Office nor the Bank of Namibia ("BON") is empowered to assume any liability in respect of the consequences of any Y2K related failure of any computer based solution employed by any banking institution or other institution, and neither this Office nor the BON purports to assume, by virtue of the guidance provided in this or any circular, any such liability.

3. RESULTS OF THE Y2K QUESTIONNAIRE

Although the majority of the banking institutions appear to have implemented the necessary action plans in order to ensure that their systems will be Y2K compliant, some institutions do not yet appear to have made sufficient progress, a matter that is of great concern to this Office. The relevant institutions will be advised of this Office’s concern in this regard.

Possible measures that may be considered for banking institutions that do not comply include the following:

• The banking institution may be prohibited from advancing any further loans.

---

4. TESTING

The importance of testing of computer systems in order to ensure Y2K compliance cannot be overemphasized. Clearly, a critical time for testing has arrived, since the remaining period until the year 2000 allows little time for any necessary corrective measures to be taken.

Banking institutions are hereby urged to start their compliance testing, especially testing of their mission-critical computer systems, as early as possible, but by no later than October 1998. It should be noted that seventy percent of banking institutions have indicated that they would start compliance testing by June 1998.

Attached, as Annexure B, is a copy of a document, titled "Year 2000 testing: a global perspective", issued by the Joint Year 2000 Council of the Bank For International Settlements, in July 1998.

In view of the time scales for Y2K testing in the international literature, it would be appropriate to expect Namibian financial institutions to have completed the Y2K testing of their internal systems, both stand alone and integrated, by the end of December 1998, and to have completed the Y2K testing of their industry wide systems by the end of June 1999.

---

5. COUNTERPARTY RISK

It is of the utmost importance that, when doing business with clients and other counterparties, banking institutions take account of the Y2K compliance issues, in order to ensure that they identify the risks and implement appropriate measures in order to manage such risks. Attached, as Annexure C, is a counterparty risk questionnaire that banking institutions may wish to use as a tool in order to stimulate thought regarding the possible impact of Y2K compliance. The questionnaire is an extract from a checklist compiled by the Institute of International Finance, Inc, in March 1998.

Extreme care should be taken by all banking institutions not to increase their risk profile by doing business with clients whose business has been turned down by another banking institution owing to the client’s Y2K compliance risk being unacceptable.

Each banking institution should have a program in place to review its loans and advances in order to establish whether the Y2K readiness of a client increases the riskiness of a loan or advance, with a view to enabling the banking institution to take the necessary measures to manage these risks.

6. REPORTS BY THE BOARD OF DIRECTORS OF EACH BANKING INSTITUTION

The board of directors of each banking institution is hereby requested to furnish this Office with the following three reports:

6.1

A progress report on the particular institution’s Y2K project, stating whether the project is progressing according to plan and detailing any problems experienced to date, including due dates missed or any project dates that have been rescheduled, as well as the reasons for rescheduling such dates. The report should contain a statement on whether all indications are that the particular banking institution will be in a position to continue with its business as usual after 1 January 2000. The said report should reflect the status as at 30 November 1998 and should reach this Office by no later than 31 December 1998.

---

6.2

Over time, as banking institutions have made their Y2K inventories and have assessed the impact of Y2K non-compliance on their systems, it has become clear that not all systems would be renovated in order to be Y2K compliant before 1 January 2000. It is therefore very important that this Office receives written confirmation from the board of directors of each banking institution that at least the mission-critical systems have been renovated, tested and implemented, in order to ensure that the particular banking institution will be able to continue with its business after 1 January 2000.

In this regard, the board of directors of each banking institution is hereby requested to furnish this Office with a report, stating that the phase entailing renovation, testing, and implementation of the particular banking institution’s mission critical computer systems has been completed successfully. The said report, which has to be signed by the chairman of the board of directors, is to be submitted within a month after the aforementioned phase of the particular institution’s Y2K project has been completed.

6.3

The board of directors of each banking institution will be required to certify that the Y2K project has been completed to its satisfaction and that the computer systems of the institution concerned address the Y2K compliance problem and ensure that the risks undertaken by the institution can be unbundled and managed. The aforementioned report is to be submitted to this Office when the particular institution’s entire Y2K project has been completed.

7. NEGATIVE PERCEPTIONS

The media is continually highlighting the Y2K compliance issue. This Office, therefore, regards it as essential that banking institutions should pro-actively implement measures to counter any potentially negative perceptions, in order to minimise the risk of the public losing confidence in the banking sector’s ability to be Y2K compliant. Such negative perceptions may in themselves be sufficient to introduce systemic risk to the industry.

---

8. CONTINGENCY PLANNING

As each day passes, the need for Y2K contingency plans becomes greater.

Attached as Annexure D, is an extract from "Century Date Change News" issued by the Federal Reserve in 1998, and detailing five components to be considered when Y2K contingency plans are developed.

9. ACKNOWLEDGEMENT OF RECEIPT

Two additional copies of this circular are enclosed for the use of your institution’s independent auditors. The attached acknowledgement of receipt, duly completed and signed by both the chief executive officer of the institution and the said auditors, should be returned to this Office at the earliest convenience of the aforementioned signatures.

S Müller (MS) ACTING SENIOR MANAGER BANK SUPERVISION DEPARTMENT