BCTL Instruction No. 15/2021 On Audits, Publication of Auditors Opinion and Annual Report

[Logo of Banco Central de Timor-Leste]

INSTRUCTION No. 15/2021¹

ON AUDITS, PUBLICATION OF AUDITOR'S OPINION AND ANNUAL REPORT

Considering that Banco Central de Timor-Leste (BCTL) has the responsibility of regulating and supervising financial institutions as prescribed by Article 5 (j) of Law nº 5/2011 of 14 June, on the Organic Law of the BCTL.

In accordance with the provisions of section 32 of Regulation nº 2000/8 of 25 February requires that each Bank shall appoint, upon the recommendation of its Audit Committee, an independent external auditor approved by the BCTL who shall assist the Bank in maintaining proper accounts and records, prepare an annual report together with an Audit Opinion as to whether the Financial Statements present a full and fair view of the financial condition of the Bank, review the adequacy of internal audit and control practices and procedures, and inform the BCTL in regard to any fraudulent act, irregularity or deficiency in the administration or operations that should be expected to result in a material loss to the Bank.

Section 46 of Regulation 2000/8 empowers the BCTL to issue instructions and guidelines, as deemed necessary or advisable to give effect to the provisions of that regulation.

Taking into consideration Banks shall maintain adequate and reliable records, prepare Financial Statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor's opinion. Banks shall also have adequate governance and oversight of the external audit function.

In view that the external auditors shall perform an Audit of the Financial Statements in accordance with the relevant auditing standards that will enhance the confidence of all users in the reliability of the audited Financial Statements and the quality of the information provided.

The Governing Board of Banco Central de Timor-Leste, pursuant to the authority granted in Article 31 paragraph 1 of Law no. 5/2011 of 15 June, hereby resolves to approve the following Instruction:

Article 1
Objective and Scope

1. The objective of this Instruction is to establish the rules for the external auditing of Banks financial reports, which will contribute to a safe and sound banking system and financial stability in Timor-Leste.
2. This Instruction shall apply to all Banks including branches of foreign entities licensed to operate in Timor-Leste including Other Deposit Taking Institutions.

Article 2
Definitions

In this Instruction the terms below shall have the following meaning:

a) "Audit" means a process conducted according to pre-established generally accepted auditing standards for objectively obtaining and evaluating evidence regarding assertions about economic actions and events, Financial Statements, financial systems, records, transactions, and operations, performed by professional accountants for the purpose of providing assurance of accountability, giving credibility to the Financial Statements and other management reports, identifying weaknesses in internal controls and financial systems, and making appropriate recommendations for improvement;

¹ Please refer to the Portuguese version for official use. This English version is prepared to facilitate the availability of information for the financial institutions.

b) "Home Country Supervisor" means the competent authority that supervises the financial activities in the country in which the head office of a foreign bank is located.

c) "Bank" means entities established under UNTAET Regulation no. 2000/8 on Bank Licensing and Supervision including Other Deposit Taking Institution established pursuant to Public Instruction 06/2010 of 29 December, and their agents;

d) "BCTL" means the Banco Central de Timor-Leste;

e) "Letter of Engagement" means a document addressed to the auditor to the Bank client confirming acceptance of the appointment, stating the objective and scope of the audit, the extent of the auditor's responsibilities to the Bank client, and the forms of any reports. It includes any special reports to be addressed to the supervisory authorities and, when applicable, any use and source of specialized accounting principles imposed by national laws and regulations applicable to Banks.

f) "Management Letter" means a letter to the Bank's Board of Directors (in addition to the basic opinion contained in the Audit Report) wherein the auditor addresses weaknesses and other limitations found in the Bank's internal control structure and operating procedures. The Management Letter shall meet the following minimum requirements:

i. provide comments and observations on the accounting records, operating systems, and internal controls that were examined during the course of the Audit;

ii. identify specific deficiencies and areas of weakness in operating systems and internal controls, and make recommendations for their improvement;

iii. communicate matters that have come to the Auditor's attention during the audit which might have a significant impact on the operations of the Bank, including:

• any fraudulent act by any administrator, employee, or agent of the Bank; or
• any irregularity or deficiency in the administration or operations that should be expected to result in a material loss for the Bank.

iv. bring to the attention of the Board of Directors any other matters that the Auditor deems to be pertinent.

g) "Professional Skepticism" means an attitude that includes a questioning mind and a critical assessment of Audit evidence. In exercising Professional Skepticism, the auditor should not be satisfied with less than persuasive evidence because of a belief that management is honest.

h) "Board of Directors or Board" means the body that supervises management, as required by Regulation 2000/8.

i) "Management" refers to the individuals or body responsible for managing the business on a day-to-day basis in accordance with strategies, policies and procedures set out by the Board;

j) "Financial Statements" means the balance sheet, comprehensive income statement, cash flow statement, statement of changes in equity, notes and other statements and explanatory material which are identified as being part of the Financial Statements.

k) "International Financial Reporting Standards" means the formal standards that specify how certain types of transactions or events are to be recorded in the Financial Statements and what disclosures should be made in the notes to Financial Statements, as published by the International Accounting Standard Board.

l) "International Standards on Auditing" means the formal standards on auditing which are issued by the International Auditing and Assurance Standards Board.

m) "Audit Opinion" is a formal report on an Audit which gives the auditor's conclusion, and which clearly sets forth a judgment upon the reasonability with which the Financial Statements present the Bank's financial position and results of operation and are presented in accordance with International Accounting Standards. This Audit Opinion may be (1) unqualified; (2) qualified; (3) adverse; or (4) disclaimer of opinion.

n) "Audit Report" is the expression of opinion rendered by the auditor in writing on the Bank's financial information. The Audit Report must contain (1) title; (2) addressee; (3) identification of financial

information audited; (4) reference to the auditing standards followed; (5) expression or disclaimer of opinion on the financial information; (6) signature; (7) auditor's address; and (8) date of report.

Article 3
Responsibility of the Board of Directors and Management

1. The Bank's Board and Management are responsible for ensuring that Financial Statements are prepared in accordance with the International Financial Reporting Standards, as determined by Instruction BCTL 11/2021, dated of October 27, and that these are supported by recordkeeping systems to produce adequate and reliable data.

2. Bank's Board and Management are responsible for ensuring that the Financial Statements issued annually to the public bear an independent external auditor's opinion as a result of an Audit conducted in accordance with internationally accepted auditing practices and standards.

Article 4
Audit Committee

1. In accordance with Section 19 (1) of Regulation 2000/8, each Bank shall establish an Audit Committee that shall consist of three (3) members appointed by the general meeting of shareholders of the Bank for periods of two (2) years.

2. The Audit Committee has the following responsibilities:

a) Establish appropriate accounting systems and accounting controls for the Bank, including those prescribed by the BCTL under Section 31 of the Regulation Nº.2000/8, supervise compliance with such procedures, and commission audits, as it deems appropriate and in compliance with this Instruction, at the expense of the Bank, of some or substantially all of the records of the Bank;

b) Provide oversight of the Bank's internal and external auditors;

c) Approve the appointment and dismissal of the Bank's internal and external auditors;

d) Review and approve the Audit scope and frequency;

e) Receive Audit Reports;

f) Ensure that Bank Management is taking appropriate corrective actions in a timely manner to address control weaknesses, non-compliance with policies, laws and regulations and other problems noted by auditors;

g) Monitor compliance with the Regulation Nº.2000/8, Instructions of the BCTL, and other laws applicable to the Bank, and report to the Board of Directors thereon;

h) Engage experts at the expense of the Bank to assist in the fulfillment of the responsibilities of the Audit Committee;

i) Deliver opinions on any matters submitted to it by the Board of Directors or that it wishes to address.

Article 5
Accreditation of External Auditors

1. Not later than the first day of each financial year, Banks shall submit to the BCTL the following information:

a) The auditing period;

b) Identification of the independent external auditor responsible for fulfilling the obligations of Section 32.1 of Regulation 2000/8, mentioning: name, address, telephone number, name of the partner in charge of the Bank's audit, and a copy of the Engagement Letter;

c) Certified excerpts from the minutes of the meeting of Audit Committee and of the Board of Directors of the Bank approving the appointment of the independent external auditor.

2. The audit contract between the Bank and the independent external auditor, or Letter of Engagement, must stipulate that the auditor shall:

a) Fulfill the requirements of Section 32.1 of the Regulation 2000/8, in accordance with this Instruction;

b) Prepare the annual Audit Report, Audit Opinion, and Management Letter in accordance with International Standards on Auditing;

c) Submit the annual Audit Report, Audit Opinion, and Management Letter simultaneously to the Bank and the BCTL no later than four months from the end of its financial year to enable the Bank to meet the publishing deadlines of Section 33 of Regulation 2000/8; and

d) Prepare all documents in the official languages of Timor-Leste and English.

Article 6
Branches of Foreign Banks

1. Notwithstanding with article 5, the branches of foreign banks shall submit to BCTL the following information not later than the first day of each financial year:

a) The auditing period;

b) The identification of the independent external auditor - name, address, telephone number, name of partner in charge of the Bank's Audit, and a copy of the audit contract or Engagement Letter which specifically states that:

i. the branch office in Timor-Leste will be subject to the external audit;

ii. the Audit Report will contain Financial Statements both on an individual (for the branch office in Timor-Leste) and consolidated basis; and

iii. the Audit will be conducted in accordance with International Standards on Auditing.

2. Within four months of the end of its financial year, the Audit Report, Audit Opinion, and Management Letter shall be submitted to the BCTL in the official language of Timor-Leste and in English.

Article 7
Publication of Financial Statements

1. Within thirty (30) days of each calendar quarter, every Bank shall publish in at least one national newspaper a fair and true summary of its quarterly balance sheet and income statements as at the end of the previous calendar quarter.

2. Within four months of the end of its financial year, every Bank shall publish in at least a national newspaper a summary of its annual balance sheet, Audit Opinion and income statement for the previous year.

3. Branches of foreign banks shall publish their balance sheets and income statements on both an individual and consolidated basis.

4. Within four months of the end of its financial year, every Bank shall publish on its website the annual report, Audit Opinion and Audited Annual Statements for the proceeding of financial year.

5. The published annual balance sheet and income statement, accompanied by a certification from director/s designated by the Board of Directors, shall be submitted to BCTL within four months of the end of each financial year.

Article 8
Qualification of the External Auditor

1. The external auditor of a Bank shall have specialized knowledge and competence in auditing Banks. Knowledge and competence are particularly important in an auditor's ability to exercise professional judgment and carry out key aspects of the audit, such as identifying and assessing the risks of material misstatement and designing and implementing appropriate responses to those risks.

2. Banks must apply robust processes for monitoring and assessing the independence of the external auditor and to ensure that the appointed external auditor has the necessary knowledge, skills, expertise, integrity and resources to conduct the Audit and meet any additional regulatory requirements.

3. The BCTL has the power to reject and rescind the appointment of an external auditor who is deemed to have inadequate expertise or independence or is not subject to or does not adhere to established professional standards.

4. In case a Bank fails to appoint an external auditor, the BCTL shall appoint the external auditor at the

expenses of the institution that failed to do so.

5. The duration of appointment of an external auditor in a Bank shall not exceed for cumulative period of five (5) years consecutively for the same financial institution.

Article 9
Obligations of an External Auditor

1. An external auditor shall have full compliance with these obligations to achieve the duties and meet its responsibilities:

a) Ensure that the audited Bank prepares Financial Statements in accordance with International Financial Reporting Standards (IFRS) and that those Financial Statements are supported by the financial institution's data systems, in accordance with the relevant laws and regulations;

b) Determine that a Bank has used valuation practices consistent with International Financial Reporting Standards (IFRS) and that the framework, structure and processes for fair value estimation are subject to independent verification and validation;

c) Document and disclose any significant differences between the valuations used for financial reporting purposes and for regulatory purposes in the Management Letter;

d) Ensure that the disclosure of the Financial Statements of financial institutions complies with the International Financial Reporting Standards (IFRS) and relevant provisions of laws and BCTL Instructions;

e) Disclose violations of laws and BCTL Instructions in the Management Letter;

f) Ensure that Financial Statements, including the explanatory notes, are audited in accordance with International Standards on Auditing issued by the International Auditing and Assurance Standards Board (IAASB).

2. In addition to the above obligations, the external auditor shall promptly inform the BCTL:

a) Any information or occurrence relating to the affairs of the institution that, in his or her opinion, could jeopardize the interest of the institution, depositors or any other creditors, or information that the institution is insolvent or is likely to be unable to meet its obligations;

b) Any criminal offence that has been or is being committed by the institution or in connection with the institution's business;

c) Transactions leading to suspicion of money laundering and financing terrorism;

d) Any breach or non-compliance with relevant laws or BCTL Instructions;

e) Any significant weaknesses in the Bank's internal control which may render it vulnerable to significant risks or any exposures that may potentially jeopardize its financial viability.

Article 10
Duties of an External Auditor

1. An external auditor shall carry out his/her duties in accordance with International Standards of Auditing as well as with regulations, instructions, and decisions of the BCTL.

2. The main duty of the external auditor is to form and provide an objective and written opinion on whether:

a) He/she has obtained all the necessary information and explanation for the Audit of books of accounts and have applied International Standards of Auditing;

b) Proper books of accounts have been kept and maintained by the institution;

c) The Financial Statements are in agreement with the books of account and are in conformity with applicable International Financial Reporting Standards;

d) The Financial Statements derived from the books of accounts give a "true and fair view" of the financial status of the institution in accordance with International Financial Reporting Standards.

3. The BCTL has the power to establish the scope of external audits of Banks and the standards to be followed in performing such Audits. These require the use of a risk and materiality-based approach in planning and performing the external audit.

4. The auditing standards shall determine that Audits cover areas such as the loan portfolio, expected credit loss, loan loss allowances, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation of and other involvement with off-balance sheet vehicles and the adequacy of internal controls over financial reporting.

Article 11
Other Responsibilities of External Auditors

1. While exercising their duty of care, protection of public interest, depositors, and other clients, an external auditor shall ensure that:

a) There is an appropriate disclosure of accounting policies to enable full understanding of the financial status and risks facing the financial institution;

b) All material factors affecting the ability of the Bank to continue as a going concern have been evaluated;

c) The institution's processes for identifying and managing risks (on and off-balance sheet) have been assessed;

d) Professional Skepticism has been exercised when planning and performing the Audit of the Bank, considering the particularities of their activities;

e) The risks of material misstatement in the institution's Financial Statements have been identified and assessed, including for the determination of expected credit losses, taking into consideration the complexities of its activities and the effectiveness of its internal control environment.

2. International Standards on Auditing (ISAs) of the International Auditing and Assurance Standards Board (IAASB) require the external auditor to obtain an understanding of control activities relevant to the audit, i.e. those activities necessary to assess the risks of material misstatement and to establish the audit strategy.

3. The external auditor, when obtaining an understanding of institution's internal control environment, shall:

a) Assess whether Management, with the involvement of those charged with governance, is promoting a robust control environment;

b) Assess whether the same or a similar control environment extends to all types of operations and offered services and encompasses all subsidiaries and branches of the group;

c) Assess the IT capability of facilitating the business operations;

d) Understand the institution's approach to outsourcing/offshoring of business activities and functions and assess how internal control over these activities is maintained;

e) Obtain an adequate understanding of the organization of key control functions within the Bank and its subsidiaries. At a minimum, key control functions include the internal audit, risk management, compliance and other monitoring functions; and

f) Assess whether there are any material gaps in the financial institution's control systems and understand the level of risk tolerance defined by those charged with governance.

Article 12
Audit Opinion

1. External auditor shall not be exonerated by disclaimer clauses in the statements they endorse if those statements contain material errors and gross misrepresentation.

2. An external auditor shall apply audit approaches, techniques and procedures designed to obtain reasonable assurance that material misstatements arising from fraud and errors are detected. When the auditor determines that such material misstatements exist, they are required to disclose this information to the BCTL.

3. When the external auditor discovers material misstatements related to the Financial Statements, including the use of an inappropriate accounting policy or asset valuation or a failure to disclose essential information,

the auditor must request Management to adjust the Financial Statements in order to correct the misstatement.

4. If the Management refuses to make the correction, the auditor must inform the BCTL and must issue a qualified or an adverse opinion on the Financial Statements.

5. Auditors who make any such reports in good faith cannot be held liable for breach of a duty of confidentiality.

6. External auditor shall issue a qualified opinion or a disclaimer of opinion if the Management failed to provide the auditor with all information or explanations that the auditor requires.

Article 13
Disclosure on Financial Statements

1. External auditors shall ensure that detailed information on related parties' transactions are disclosed in audited annual Financial Statements.

2. The methodology of credit risk classification, impairment allowances, including determination of expected credit losses, must be audited and disclosed.

3. Non-performing components shall be clearly stated in the Audit Report. The external auditor shall specifically identify and report any non-performing loan or any long outstanding receivables from the related parties.

4. The external auditor must verify whether transactions between financial institutions have value addition for the Bank and are at arm's length.

Article 14
Annual audited accounts

The external auditor shall submit to the BCTL a copy of the Audit Report which shall include:

a) A Statement of Financial Position;

b) A Statement of Comprehensive Income;

c) A Statement of Changes in Equity;

d) A Statement of Cash Flows;

e) Notes, comprising a summary of the significant accounting policies;

f) An opinion on the Financial Statements;

g) A copy of the external auditor's Management Letter on their Audit findings and concerns; and

h) Any other comments on the institution's risk profile and control environment.

Article 15
Additional report to BCTL

In addition to the obligations above provided for, the external auditor is required to report promptly to the BCTL any of the information concerning the following matters:

a) Matters of serious conflict within the decision-making bodies;

b) Intention of the auditor to resign or any threat of removal of the auditor from office;

c) Material adverse changes in current or potential risks in the institution's business;

d) Serious irregularities or significant losses which may jeopardize the interests of depositors or other creditors of the institution;

e) Information that indicate a material breach of the Bank's own policies, articles of association and memorandum of association.

Article 16
Quality assurance enforcement

1. External auditors should follow International Standards on Quality Control (ISQC) of the IAASB and ensure that they maintain appropriate internal quality control processes for their external Audits and to minimize Audit quality deficiencies.

2. The BCTL shall continuously monitor the quality of Audit of Banks and may investigate failures or weaknesses of the external auditor in the Audit.

3. The BCTL has the power to access external auditors' working papers, where necessary.

4. The BCTL may, where it is not satisfied with the external Audit Report, disqualify the auditor and appoint another auditor to carry out additional Audit or investigation as may be deemed necessary and submit a report on the matter concerned.

5. The audited Bank will be responsible for remunerating that auditor for the additional duties referred on above paragraph 4.

Article 17
Cancellation of external auditor appointment

1. When the BCTL determines that the external auditor failed to meet his/her obligations in accordance with relevant laws and regulations, or no longer fulfills the requirements to operate as an external auditor as per the provisions of this Instruction, the BCTL shall revoke the external auditor's appointment and inform the institution in writing of such a decision with request to that institution to appoint a new auditor.

2. The BCTL shall give the Bank a notice to immediately revoke the external auditor's appointment.

3. Bank should ensure that the contract with an external auditor should have the provisions that allow the BCTL to apply the cancellation of the appointment of external auditor.

Article 18
Obligations of Banks

A Bank must provide data, information and the necessary conditions to an external auditor to effectively perform his duties.

Article 19
Incompatibilities with the function of external auditor

1. The external auditor shall be deemed non-independent and, therefore, cannot be hired or kept as an external auditor of a Bank if:

a) the auditor or anyone with a management role in the team involved in the Audit is a direct or indirect shareholder of the Bank or any of its subsidiaries, affiliates or controlled institutions;

b) the auditor has shares in a listed Bank which they intend to audit;

c) the auditor or anyone with a management role in the team involved in the audit, has an asset or liability operation with the institution or any of its subsidiaries, affiliates or controlled institution.

2. The provisions in paragraph 1.c) does not apply to opening bank accounts, with no borrowing facilities.

3. The external auditor must have a policy that guarantees its independence in his/her audit services, which includes the situations which can hamper his/her independence and the internal controls he/she adopts to monitor, identify, and avoid these occurrences.

4. If the external auditor also provides non-audit services to the Bank, the audit committee of a Bank shall monitor the provision of such services to ensure that such provision does not impair the external auditor's objectivity and independence, taking into consideration factors as the skills and experience of the external auditor, safeguards in place to mitigate any threat to objectivity and independence, and the nature of and arrangements for non-audit fees.

5. Annual audited accounts shall include a statement disclosing whether the audit committee is satisfied that the provision of non-audit services is compatible with auditor independence. This disclosure shall include an explanation as to why the non-audit services do not compromise Audit independence. The non-audit services may include:

a) Preparing accounting records and Financial Statements;

b) Tax compliance services;

c) Valuation services;

d) Internal audit services;

e) IT systems services;

f) Temporary staff assignments;

g) Legal services and other pertinent activities.

Article 20
Meeting with an External Auditor

1. The BCTL may organize a meeting with an external auditor to discuss the scope of the work and to exchange information on the audited financial institution.

2. Where necessary the BCTL may invite the Management of the audited Bank.

Article 21
Adoption

This Instruction shall apply starting with the audited Financial Statements for the financial year ending December 31, 2022, and the appointment of the External Auditor from 2023.

Article 22
Administrative Penalty

1. Any bank or ODTI failure to comply with any provisions of this instruction, will be subject to an administrative penalty in an amount up to US$5,000 (US$ five thousand dollar) and it will be debited directly from the settlement account of the relevant entity held at BCTL.

2. For the entities that do not have a settlement account, the BCTL will notify the relevant entity and require the payment to be made by transfer to to BCTL's account held at a commercial bank, within 3 days.

3. Notwithstanding with the previous paragraphs, the BCTL may take additional remedial measures for any continues infraction in accordance with Article 36.3 of Regulation 2000/8 on Bank Licensing and Regulation.

Article 23
Repealing and Entry into Force

1. The Instructions CPO/B-2000/9 on Audit, Publication of Audit Opinion and Annual Report of Banks is hereby repealed.

2. The article 25 of the Public Instruction No. 06/2010 on the Licensing and Supervision of Other Deposit Taking Institution is hereby repealed.

3. This Instruction shall enter into force on the day of its publication in the Jornal da República.

Approved on 25 November 2021

The Governor,

[Signature]

Abraão de Vasconselos