BCTL Instruction No. 16/2021 On Credit Risk Management

# INSTRUCTION No. 16/2021¹
## ON CREDIT RISK MANAGEMENT

Banco Central de Timor-Leste (BCTL) has the responsibility of regulating and supervising financial institutions as prescribed by Article 5 (j) of Law no. 5/2011 of 15 June, on the Organic Law of the BCTL.

Besides, paragraph 16.2 of Regulation 2000/8 of 25 February determines that the Governing Board of a Bank shall be responsible for establishing the policies for the operations of the bank and for supervision of their implementation.

The paragraph 19.3 of Regulation 2000/8 of 25 February requires that each bank shall establish a Risk Management Committee, responsible to establish and monitor implementation of procedures for credit appraisal, loan administration, and asset and liability management, including those prescribed by the BCTL, including such matters as underwriting standards, approval of large extensions of credit and all equity investments, requirements for collateral for credit, classification of and provisioning for value-impaired assets, pursuit of borrowers and issuers in default, and managing interest rate and market risk; and monitor compliance with the laws and regulations applicable to credit and other risks.

Furthermore, Paragraph 23.1 of the same Regulation determines that banks shall conduct their administration and operations in accordance with sound administrative and accounting procedures, the requirements of that regulation, and the instructions or guidelines issued by the BCTL, and Section 26 establishes prudential requirements to be observed by banks.

Section 46 of Regulation 2000/8 empowers the BCTL to issue instructions and guidelines, as deemed necessary or advisable to give effect to the provisions of that regulation.

The best international practices on banking supervision are defined by the Basel Committee on Banking Supervision (BCBS), and Principles 17 and 18 of the Core Principles for Effective Banking Supervision (Basel Core Principles) emphasize that banks must have an adequate Credit Risk management process, including prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate Credit Risk on a timely basis, and covering the full credit life cycle (credit underwriting, credit evaluation and the ongoing management of the bank’s portfolios), as well as adequate policies and processes must be in place for the timely identification and management of problem assets and the maintenance of adequate provisions and reserves in accordance with the applicable accounting framework.

Taking into consideration the above referred best international practices and essential principles on Credit Risk set on the document *Principles for the management of Credit Risk*, September 2000, among others.

In view of the best international practices and in the interest of protecting the Timorese banking system, the depositors and the institutions, enhancing a sound and safe financial and banking sector.

The Governing Board of Banco Central de Timor-Leste, in accordance with Section 46 of Regulation 2000/8 of 25 February and Article 31 paragraph 1 of Law no. 5/2011 of 15 June, hereby resolves to approve the following Instruction:

## Article 1
### Objective and Scope

---

¹ Please refer to the Portuguese version for official use. This English version is prepared to facilitate the availability of information for the financial institutions.

1. The objective of the present BCTL Instruction is to establish a sound and consistent standard of Credit Risk management, which will contribute to a safe and sound banking system and financial stability in Timor-Leste.

2. This Instruction shall apply to all Banks including branches of foreign entities licensed to operate in Timor-Leste.

Article 2

Definitions

In this Instruction the terms below shall have the following meaning:

a) “A credit decision on an arm’s length terms” means that the terms of the contract are at least as favourable to the bank as could reasonably be obtained from an independent third party. The bank has not entered into a contract on less favourable terms and conditions than used for normal customers;

b) “Bank” means entities established under UNTAET Regulation 2000/8 on Bank Licensing and Supervision including Other Deposit Taking Institution established pursuant to Public Instruction 06/2010 of 29 December, and their agents;

c) “Corporate Governance” means a set of relationships between a company’s management, its board, its shareholders and other stakeholders which provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance. It helps define the way authority and responsibility are allocated and how corporate decisions are made;

d) A financial asset is “credit-impaired” when one or more events that have a detrimental impact on the estimated future cash flows of that financial asset have occurred. Evidence that a financial asset is credit-impaired include observable data about the following events: (a) significant financial difficulty of the issuer or the borrower; (b) a breach of contract, such as a default or past due event; (c) the Bank, for economic or contractual reasons relating to the borrower’s financial difficulty, have granted to the borrower a concession(s) that the lender(s) would not otherwise consider; (d) it is becoming probable that the borrower will enter bankruptcy or other financial reorganization; (e) the disappearance of an active market for that financial asset because of financial difficulties; or (f) the purchase or origination of a financial asset at a deep discount that reflects the incurred Credit Losses. It may not be possible to identify a single discrete event—instead, the combined effect of several events may have caused financial assets to become credit-impaired;

e) “Credit Loss” means the difference between all contractual cash flows that are due to a Bank (or other entity) in accordance with the contract and all the cash flows that the Bank expects to receive (i.e., all cash shortfalls), discounted at the original effective interest rate (or credit-adjusted effective interest rate for purchased or originated credit-impaired financial assets). A Bank shall estimate cash flows by considering all contractual terms of the financial instrument (for example, prepayment, extension, call and similar options) through the expected life of that financial instrument. The cash flows that are considered shall include cash flows from the sale of collateral held or other credit enhancements that are integral to the contractual terms;

f) “Credit Risk” is the risk that a borrower or counterparty will fail to meet obligations in accordance with agreed terms. Credit Risk could stem from both on- and off-balance sheet transactions. An institution is also exposed to Credit Risk from diverse financial instruments such as trade finance products and acceptances, foreign exchange, financial futures, swaps, bonds, options, commitments and guarantees. Thus, sources of Credit Risk exist throughout the activities of a Bank both in the banking book as well as in the trading book;

g) The term “expected Credit Losses” (ECL) means the weighted average of Credit Losses with the respective risks of a default occurring as the weights. “12-month ECL” means the portion of lifetime expected Credit Losses that represent the expected Credit Losses that result from default events on a financial instrument that are possible within the 12-month period after the reporting date. “Lifetime

ECL” are the expected Credit Losses that result from all possible default events over the expected life of a financial instrument;

h) “Internal Control System” or “Internal Control(s)” means a set of rules and controls governing the Bank’s organizational and operational structure and processes, including those addressing efficiency and effectiveness, reporting processes, and functions for risk management, compliance and internal audit;

i) “International Auditing and Assurance Standards Board” (IAASB) sets international standards on auditing (ISAs) and standards for other assurance engagements, as well as International Standards on Quality Control (ISQC);

j) “International Financial Reporting Standard” (IFRS) is a standard issued by the International Accounting Standards Board;

k) “Loan Loss Provisioning” means the determination of the loss allowance for expected Credit Losses for financial assets, particularly with respect to loans, loan commitments and financial guarantee contracts, as defined in the IASB’s International Financial Reporting Standard No. 9, Financial Instruments, (hereinafter referred to as IFRS 9);

l) “Loss allowance” means the allowance for expected Credit Losses on financial assets measured in accordance with IFRS 9, lease receivables and contract assets, the accumulated impairment amount for financial assets measured in accordance with IFRS 9 and the provision for expected Credit Losses on loan commitments and financial guarantee contracts;

m) “Risk Appetite” means the aggregate level and types of risk a Bank is willing to assume, decided in advance and within its Risk Capacity, to achieve its strategic objectives and business plan;

n) The “Risk Appetite Framework (RAF)” means the overall approach, including policies, processes, controls and systems, through which Risk Appetite is established, communicated and monitored. It includes a Risk Appetite statement, Risk Limits and an outline of the roles and responsibilities of those overseeing the implementation and monitoring of the RAF. The RAF should consider material risks to the Bank, as well as to its reputation vis-à-vis policyholders, depositors, investors and customers. The RAF aligns with the Bank’s strategy;

o) The “Risk Appetite Statement (RAS)” means the written articulation of the aggregate level and types of risk that a Bank will accept, or avoid, in order to achieve its business objectives. It includes quantitative measures expressed relative to earnings, capital, risk measures, liquidity and other relevant measures as appropriate. It should also include qualitative statements to address reputation and conduct risks as well as money laundering and unethical practices;

p) “Risk Capacity” means the maximum amount of risk a Bank is able to assume given its capital base, risk management and control capabilities as well as its regulatory constraints;

q) “Risk Culture” means a Bank’s norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks. Risk Culture influences the decisions of management and employees during the day-to-day activities and has an impact on the risks they assume;

r) “Risk Governance Framework” means, as part of the overall Corporate Governance framework, the framework through which the board and management establish and make decisions about the Bank’s strategy and risk approach; articulate and monitor adherence to Risk Appetite and Risk Limits vis-à-vis the Bank’s strategy; and identify, measure, manage and control risks;

s) “Risk Limits” are specific quantitative measures or limits based on, for example, forward-looking assumptions that allocate the Bank’s aggregate risk to business lines, legal entities as relevant, specific risk categories, concentrations and, as appropriate, other measures;

t) “Risk Management” means the processes established to ensure that all material risks and associated risk concentrations are identified, measured, limited, controlled, mitigated and reported on a timely and comprehensive basis;

u) “Risk Profile” means a point-in-time assessment of a Bank’s gross risk exposures (i.e., before the application of any mitigators) or, as appropriate, net risk exposures (i.e., after considering mitigators)

aggregated within and across each relevant risk category based on current or forward-looking assumptions.

Article 3

Credit Risk Management System

1. Banks should have in place a system for Credit Risk management, adequate for the nature, volume, and complexity of the Bank’s activities, that provide a comprehensive bank-wide view of Credit Risk exposures.

2. Credit Risk management system shall consist of the policies, procedures, rules, and Banks’ structures used to manage the Credit Risk.

3. The processes shall be consistent with the Risk Appetite, Risk Profile, systemic importance, and capital strength of the Bank, taking into account market and macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, administration and monitoring.

4. Credit Risk management system should provide the ongoing assessment of credits and other assets’ quality on a timely basis, including determining the adequacy of reserves to cover losses related to this risk.

5. The effective management of Credit Risk is a critical component of a comprehensive approach to risk management underpinned by effective board and management oversight, well-defined policies and procedures, strong Management Information System and adequate Internal Control Systems.

Article 4

Board of Directors

1. The Board of Directors shall be responsible for providing overall strategic direction to the institution through approving and reviewing the Credit Risk strategy and significant policies and processes for assuming, identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating Credit Risk (including counterparty Credit Risk and associated potential future exposure) and that these are consistent with the Risk Appetite set by the Board.

2. A Credit Risk strategy shall clearly set the acceptable Risk Appetite and tolerance of the institution.

3. The Credit Risk strategy shall adequately cover all the activities of the institution in which credit exposure is a significant risk.

4. It shall also encompass the need to maintain sound credit quality, diversification, profits and business growth and allow for economic cycles and their effects on the credit portfolio during different stages of an economic cycle.

5. Reviews of the Credit Risk strategy and policies shall be done at least annually in line with international best practices and any changes and concerns should be effectively communicated to all relevant staff.

6. To establish an appropriate and properly controlled Credit Risk environment the Board shall ensure that:

a) a well-documented and effectively implemented strategy and sound policies and processes for assuming Credit Risk, without undue reliance on external credit assessments;

b) well defined criteria and policies and processes for approving new exposures (including prudent underwriting standards) as well as for renewing and refinancing existing exposures, and identifying the appropriate approval authority for the size and complexity of the exposures;

c) effective credit administration policies and processes, including continued analysis of a borrower’s ability and willingness to repay under the terms of the debt (including review of the performance of underlying assets in the case of securitization exposures); monitoring of documentation, legal covenants, contractual requirements, collateral and other forms of Credit Risk mitigation; and an appropriate asset grading or classification system;

d) effective information systems for accurate and timely identification, aggregation and reporting of Credit Risk exposures to the Bank’s Board and management on an ongoing basis;

e) prudent and appropriate credit limits, consistent with the Bank’s Risk Appetite, Risk Profile and capital strength, which are understood by, and regularly communicated to, relevant staff;

f) exception tracking and reporting processes that ensure prompt action at the appropriate level of the Bank’s management or Board where necessary;

g) effective controls (including in respect of the quality, reliability and relevancy of data and in respect of validation procedures) around the use of models to identify and measure Credit Risk and set limits.

7. The Board of Directors shall also ensure that:

a) the Credit Risk strategy has a statement on acceptable levels of exposure to the various economic sectors, currencies and maturities. It should also include the target markets and overall characteristics that the institution would want to achieve in its credit portfolio (including levels of diversification and concentration tolerances);

b) the Credit Risk strategy and Credit Risk policies are reviewed, approved and effectively communicated throughout the institution;

c) the Credit Risk strategy of the institution provides for continuity and proves viable in the long run as well as take cognizance of cyclically (upturns and downturns in economic cycles) which results in shift in the composition and quality of the overall credit portfolio;

d) the financial results of the institution are periodically reviewed to determine if changes need to be made to the Credit Risk strategy;

e) the institution’s remuneration policies shall avoid contradicting and jeopardizing the Credit Risk strategy;

f) the institution’s capital level is adequate for the Credit Risks assumed;

g) management team is fully capable of managing the Credit Risk activities conducted by the institution and that such activities are done within the risk strategy, policies and procedures approved by the board;

h) there is an internal audit function capable of assessing compliance with the credit policies and management of the entire credit portfolio;

i) the delegation of authority and approval levels are clearly defined; and

j) management provides periodic reports on insider loans, provisioning and write-offs on credit loan losses and audit findings on the credit granting and monitoring processes.

8. The Board of Directors shall, in accordance with Section 19(3) of Regulation 2000/8, establish a Risk Management Committee that consist of three members of the Governing Board who shall respond for the above responsibilities.

Article 5
Management

1. The Bank’s management has the responsibility to implement the Credit Risk strategy and Credit Risk policies approved by the Board of Directors and develop procedures that include identifying, measuring, monitoring and controlling Credit Risk.

2. Management shall ensure that:

a) the credit granting activities conform to the laid down procedures;

b) written policies and procedures are developed, implemented and responsibilities of the various functions are clearly defined;

c) the credit policies are implemented on a consolidated basis and at the individual Bank or affiliate level, communicated throughout the institution and its affiliates, monitored and reviewed periodically to address any changes;

d) compliance with internal exposure limits, prudential limits and regulatory requirements is enforced; and

e) internal audit reviews of the Credit Risk management system and credit portfolio are undertaken regularly.

Article 6
Risk Management Structure

1. Each Bank shall adopt a risk management structure that is commensurate with the size and the nature of its activities. The organizational structure should facilitate effective management oversight and execution of Credit Risk management and control processes.

2. A management committee shall be formed to establish and oversee the Credit Risk management framework.

3. The framework shall cover areas such as recommendation of business and Credit Risk strategy and Credit Risk policy to the board, review of the credit portfolio and profile, delegation of credit approving authority within board approved limits and evaluation of the credit processes.

4. The committee shall comprise of management from the business line and control functions.

5. Banks shall also establish risk management and control functions independent of the credit originating function. Such functions include policy formulation, limit setting, exposure and exception monitoring and reporting, custody and monitoring of documentation, and input of credit limits.

6. Staff performing sensitive functions with potential impact on the risk level such as custody of key documents, funds transfer, and limit inputs shall report to managers who are independent of business origination and the credit approving process.

7. There should be adequate measures to address potential conflicts of interest where individuals performing the loan origination function are also involved in credit reviews and analyses.

8. While there may be separate departments responsible for credit origination and Credit Risk control, the credit origination department should also be mindful of Credit Risk in its pursuit of business opportunities.

Article 7
Policies, Procedures and Limits

1. The Board shall approve credit policies, including concentration limits and lending to related parties. It shall also be the approving authority for changes and exceptions to such policies. The management shall set out operational processes and procedures to implement the credit policies.

2. Credit policies shall set out the conditions and guidelines for the granting, maintenance, monitoring and management of credit, at both the individual transaction and portfolio levels. Such policies shall be documented, well-defined, consistent with prudent practices and regulatory requirements, and adequate for the nature and complexity of the institution’s activities.

3. Every Bank shall be very clear about its Credit Risk tolerance, including the nature and level of risk it is prepared to undertake. Risk tolerance should be compatible with the institution’s strategic objectives.

Article 8
Credit Granting

1. Each Bank shall make credit decisions free of conflicts of interest and on an arm’s length basis.

2. Banks shall have a clearly established process for approving credit facilities. This includes amending, renewing and refinancing of existing credit facilities.

3. At a minimum, the credit policy shall document the following:

   a) roles and responsibilities of business units and staff involved in the granting, administration and monitoring of credit facilities;

   b) delegation of credit authority to various levels of management and staff (including authority to approve deviations and exceptions);

   c) Credit Risk acceptance criteria;

   d) general terms and conditions of the facility structure, such as pricing, tenure and limit;

   e) acceptable types of collateral and security documents;

   f) standards for credit review and monitoring; and

   g) guidelines on management of concentration risk and stress testing.

4. Credit approvals shall be made in accordance with the institution’s written guidelines and granted by the appropriate level of management. There shall be an audit trail documenting the approval process and identifying the individuals and committees providing input and making the credit decision.

5. Credit analysis requires that management should have a clear understanding of the borrower or counterparty and obtain adequate information to enable a comprehensive assessment of the Risk Profile of the customer. This will include the purpose of the loan, repayment sources, financial statements, integrity and reputation of the borrower or counterparty. The policies should articulate the principle of Know Your Customer even for existing clients.

6. Lending authority delegated to staff with clearly established limits shall be documented. It is important to include the functions and reporting procedures of the various committees and individual lending officers.

7. In addition, Banks shall establish checks and balances that ensure all credit facilities are granted at arms’ length in all respects.

8. Extension of credit to directors, management and other influential parties shall comply with Regulation 2000/8, and the shareholders shall not override the established credit granting and monitoring processes of the Bank.

Article 9
Credit Limits

1. A Bank shall have sound and well-defined policies and procedures incorporating credit concentrations, limits and level of Credit Risk a Bank is willing to assume.

2. The limits shall ensure that credit activities are adequately diversified.

3. Banks are expected to develop their own limit structure while remaining within the exposure limits set by the BCTL Instruction.

4. The policy on large exposures shall be well documented to enable the Bank to take adequate measures to ensure that concentration risk is limited. The policy shall prescribe that major Credit Risk exposures exceeding a certain amount or percentage of the Bank’s capital are to be decided by the Bank’s Board of Directors or management and the same applies to Credit Risk exposures that are especially risky or otherwise not in line with the mainstream of the Bank’s activities.

5. The policy shall stipulate the percentage of the institution’s capital that can be lent to any individual or related entities in compliance with the applicable regulation.

6. The credit policy shall provide for close monitoring and reporting of lending and writing-off of loans to related parties.

7. Credit transactions with related parties shall comply with Regulation 2000/8 and BCTL Instruction CPQ/B-2000/6 on Transactions with Related Persons and be subject to the approval of the Board of Directors (excluding Board members with potential conflicts of interest).

8. Such transactions must also be disclosed to the public as part of the Bank’s financial reporting disclosure.

9. The main exposure limits covered under the policies should include the following:
    a) acceptable exposure to individual borrowers; b) maximum exposure to connected groups and insider dealings; c) the overall limit on the credit portfolio in relation to capital, assets or liabilities; d) maximum exposure to individual economic sectors (e.g., commercial, consumer, real estate, agricultural); and e) acceptable limits on specific products.

10. Credit Risk Limits shall, among other factors, take account of the Bank’s:
     a) historical loss experience; b) capital adequacy; c) desired level of return; and

d) diversification objectives.

11. The Bank shall consider the results of stress tests in its overall limit setting and monitoring. Limits should be based on the interrelationship of risk and reward and may be stated in absolute terms e.g., an established ceiling for each loan category, or expressed in relative proportions, such as a percentage of capital, total loans or total assets, or a combination of these.

12. Credit limits shall be reviewed on a periodic basis to consider changes in the counterparty’s credit strength and environmental conditions.

13. All requests to increase credit limits shall be substantiated.

Article 10
Credit Products

1. Each Bank shall maintain adequate documentation relating to various types of loan products and credit instruments. The products should also have a maturity profile and the pricing of these products should be included and reviewed periodically.

2. Prior approval for all new products should be obtained from the Board of Directors as well as clearance from independent control functions such as audit and risk management. All material risks arising from new products should be assessed before introduction to the customers.

Article 11
Credit Risk Mitigation

1. In controlling Credit Risk, a Bank can use a variety of mitigating techniques which include collateral, guarantees and netting off of loans against pledged deposits of the same counterparty. While the use of these techniques will reduce or transfer Credit Risk, other risks may arise which include legal, operational, liquidity and market risks. Therefore, an institution should have comprehensive procedures and processes to control these risks and have them well documented in the policies.

2. Security held by a Bank to mitigate against Credit Risk should satisfy the following conditions:

a) there must be legal certainty: all documentation used for collateralized lending must be binding to all parties and be legally enforceable;

b) the legal environment must provide for right of liquidation or right of possession in a timely manner in the event of default;

c) necessary steps must be taken for obtaining and maintaining an enforceable security, for example registration, right of set-off or transfer of title must meet all the legal requirements;

d) procedures for timely liquidation of collateral should be in place;

e) on-going valuations of the collateral should be undertaken to confirm that it remains realizable; and

f) guidance on the various acceptable forms of collateral should be documented.

3. The Bank shall primarily assess the borrowers’ capacity to repay and shall not use collateral to compensate for insufficient information.

Article 12
Management of Problem Credits

1. The Bank’s credit policy shall establish the procedures for dealing with problem credits.

2. Early recognition of weaknesses in the credit portfolio is important and allows for effective determination of loan loss potential.

3. Banks must have clearly articulated and documented policies in respect of past due credit facilities. At a minimum, they shall have approval levels and reporting requirements in respect of granting extensions, deferrals, renewals and additional credits to existing accounts.

4. The policy shall define a follow-up procedure for all loans and identify the reports to be submitted both to management and Board of Directors.

Article 13
Provisioning Policy

1. The credit policy must clearly outline the provisioning procedures for all credit facilities and the capital charge to be held. This should comply at a minimum with the International Financial Reporting Standards and the Instruction no. 17/2021 on Credit Classification, Regulatory Provision and Reserves, in special when determining the ECL.

2. A Bank’s aggregate amount of allowances, regardless of whether allowance components are determined on a collective or an individual basis or are deemed to be general or special provisions for capital purposes, should be adequate and consistent with the objectives of IFRS 9.

3. A Bank shall have policies and procedures in place to appropriately validate models used to assess and measure ECL.

4. A Bank’s use of experienced credit judgment, especially in the robust consideration of reasonable and supportable forward-looking information, including macroeconomic factors, is essential to the assessment and measurement of ECL.

Article 14

Measuring Credit Risk

1. Each Bank shall have procedures for measuring and monitoring actual exposures against established limits including exposures to related parties, products, customers, market segments and industries for appropriate risk management decisions to be made.

2. A Bank shall have a Credit Risk rating process in place to appropriately group lending exposures on the basis of shared Credit Risk characteristics.

3. Banks must have comprehensive internal systems and models that effectively measure Credit Risk.

4. The Bank’s internal Credit Risk rating system must be categorized in a manner that allows comparison with the BCTL’s asset classification categories and external credit ratings.

5. A Bank shall have a sound Credit Risk assessment and measurement process that provides it with a strong basis for common systems, tools and data to assess Credit Risk and to account for ECL.

6. Banks shall have robust Management Information System capable of providing timely, accurate and detailed reports to the board and management.

7. Credit Risk measurement tools and techniques shall take into account the nature of the credit, maturity, exposure profile, existence of collateral or guarantees and potential for default and environmental circumstances.

Article 15

Monitoring Credit Risk

1. Banks shall have policies and processes to monitor the total indebtedness of entities to which they extend credit and any risk factors that may result in default including significant unhedged foreign exchange risk.

2. The internal risk rating system that comprises methods, processes, controls, data collection and Information Technology systems shall support the quantification of default and loss estimates.

3. An effective monitoring system shall ensure that the institution:

   a) understands the current financial condition of the borrower;

   b) monitors compliance with the existing terms and conditions;

   c) assesses collateral in relation to the borrowers current condition; and

   d) identifies non-performing accounts and enforces proper classification and loan loss allowances.

4. Banks shall undertake a detailed credit portfolio review which covers the following:

   a) loans to borrowers with aggregate exposure larger than 10 percent of the institution’s capital;

   b) loans to shareholders and connected parties;

   c) loans for which interest or repayment terms have been restructured since the granting of the loan;

d) loans for which cash payment of interest and/or principal is more than 30, 60, 90 and 180 days past due, including those for which interest has been capitalized or suspended; and e) loans classified as impaired and loans classified as substandard, doubtful or loss according to the Credit Risk Classification Instruction.

5. The frequency of credit portfolio review shall reflect the level of Credit Risk.

6. The specific objective of these reviews is to assess the likelihood that the credit will be repaid, and the classification of the loan is adequate. When the amount exceeds 10% of a Bank’s capital, the analysis should also consider the borrower’s business plans for the future and the potential consequences for debt service capacity and principal repayment.

Article 16

Credit Administration

1. Each Bank shall have a system for the on-going administration of its various portfolios containing Credit Risks.

2. Management shall set-up a credit administration team to ensure that credit portfolios are properly maintained and administered. This will include record keeping, preparation of the terms and conditions as well as perfection and safe custody of the securities.

3. Credit files shall at a minimum contain the following information:
   a) credit application; b) evidence of approval; c) latest financial information; d) record and date of all credit reviews; e) record of all guarantees and securities; f) record of terms and conditions of facility; g) evidence of securities validation function that should include, legal validity, existence, valuation, registration of charge and safekeeping; h) internal rating; and i) any other requirement from specific Instruction.

4. Banks shall develop controls to ensure compliance with the applicable laws and regulations and internal policy.

5. Adequate segregation of duties between approval and administration process shall be maintained.

Article 17

Stress Testing of the Credit Portfolio

1. Each Bank shall include their Credit Risk exposures into their stress testing programmes for risk management purposes.

2. The stress test of a Bank’s credit portfolio involves the identification of possible events or future changes that could have a negative impact on the institution’s credit portfolio and the institution’s ability to withstand the changes.

3. Banks shall subject their credit portfolios to changes relating to:
   a) economic or industry developments; b) market risk events; and c) liquidity conditions.

4. As a minimum, stress testing parameters shall include the following:
   a). Increases in non-performing loans and provisioning levels: This type of shock is used to assess the impact of such increases on profitability and capital adequacy. In estimating the additional provisions

resulting from the applied shocks, Banks may use their internal systems, and/or the provisioning levels prescribed by the BCTL;

b). Failure of major counterparties: This shock is used to estimate the impact of failure of a Bank’s major counterparties, including corporate and inter-bank counterparties, on its profitability and capital adequacy. The test can be extended to cover aggregate exposures to major industries, market sectors, countries and regions, e.g., by assuming that a significant number of defaults occur within such aggregate exposures. This could also refer to assessing the impact of a certain number of the top borrowers defaulting, e.g., default of the top three borrowers;

c). Economic downturn: This shock is used to assess the impact of adverse changes in selected macroeconomic variables - e.g., GDP growth, unemployment rate - on a Bank’s asset quality, profitability and capital adequacy; and

d). Decline in the real estate market: This shock is used to assess the impact of decline in property prices on collateral coverage, default risk and provisioning needs for loans secured by properties. In the case of a residential mortgage portfolio, Banks can assess the impact of resultant increase in loans in negative equity and specific provisions (based on assumptions of the probability of default for such loans).

5. Banks must be able to analyse the various situations in the economy or certain sectors to determine the event that could lead to substantial losses or liquidity problem.

6. Whatever methods are used for stress testing the output of the tests shall be reviewed periodically, and appropriate action taken by management in cases where results exceed agreed tolerance.

Article 18
Credit Exposure and Risk Reporting

1. Credit Risk information shall be provided to Board of Directors and management with sufficient frequency and should be reliable with appropriate desegregation.

2. Reports shall be generated on the on-balance sheet and off-balance sheet credit activities. The reports shall show credit exposures:

a) by business line such as commercial, industrial sector, real estate, construction, credit cards, mortgage and leasing;

b) relating to the composition of on and off-balance sheet credits by major types of counterparties, including government, foreign corporate, domestic corporate, consumer and other financial institutions;

c) in relation to significant individual borrowers or counterparties, related borrowers or group of borrowers;

d) by major asset category showing impaired and past due amounts relating to each category;

e) restructured during a certain period and credits which special conditions have been granted; and

f) other required by specific instruction of BCTL.

Article 19
Internal Controls and Audit

1. Banks shall have an independent internal system for assessment of the Credit Risk management process in order to assist the Board of Directors to determine the effectiveness of the risk management process.

2. A review of the lending process shall include analysis of the credit manuals and other written guidelines applied by various departments of a Bank, and the capacity and actual performance of all departments involved in the credit function. It shall also cover origination, appraisal, approval, disbursement, monitoring, collection and handling procedures for the various credit functions provided by the institution.

3. Internal audit reviews shall assess compliance with the Bank’s credit policies and procedures. This will require confirming the following:

a) the credit granting function is carried out effectively;

b) the credit exposures are within the prudential and internal limits set by the Board of Directors;

c) validation of significant change in the risk management process;

d) verification of the consistency, timeliness and reliability of data used for internal risk rating system;

e) adherence to internal risk rating system;

f) identification of areas of weaknesses in the Credit Risk management process; and

g) exceptions to the policies, procedures and limits.

4. Internal audit reviews shall be conducted periodically and ideally not less than once a year.

5. The audits shall also identify weaknesses in the Credit Risk management process and any deficiencies with the policies and procedures.

6. Banks shall establish Internal Control practices which ensure that deviations from policies, procedures, limits and prudential guidelines are promptly reported to the appropriate level of management.

7. The internal audit function must follow specific instructions of BCTL.

Article 20
Disclosure

1. A Bank shall have a policy of public disclosure that should promote transparency and comparability by providing timely, relevant, and decision-useful information.

2. Disclosures shall follow specific Instructions of BCTL.

Article 21
Access to Information

The BCTL shall have full access to information in the credit and investment portfolios and to the Bank officers involved in assuming, managing, controlling, and reporting on Credit Risk, in accordance with Regulation 2000/8 and specific Regulations.

Article 22
Implementation

The effective implementation shall be within six (6) months after the entry into force of this Instruction.

Article 23
Administrative Penalty

1. Any bank or ODTI failure to comply with any provisions of this instruction, will be subject to an administrative penalty in an amount up to US$5,000 (US$ five thousand dollar) and it will be debited directly from the settlement account of the relevant entity held at BCTL.

2. For the entities that do not have the settlement account, the BCTL will notify the relevant entity and require the payment to be made by transfer to a BCTL account.

3. Notwithstanding with the previous paragraphs, the BCTL may take additional remedial measures for any continues infraction in accordance with Article 36.3 of Regulation 2000/8 on Bank Licensing and Regulation.

Article 24
Entry Into Force and Publication

This instruction shall come into force on the day following its publication in the Jornal da República.

Approved on 25 November 2021

The Governor,
Abraão de Vasconselos