D8/2016 Reporting Requirements for Material Outsourced and Critical Third-Party Service Providers

SELECTED INFORMATION IN RESPECT OF OUTSOURCING AND THIRD PARTY SERVICE PROVISION - INFORMATION TECHNOLOGY PROVIDERS Current 12-month rolling period R'000 Prior 12-month rolling period R'000 1 2 3 4 5 6 7 8 9 10 11 12 13 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 *** Amounts should be stated in R'000 and if foreign currency was used for payments the ruling exchange rate should be applied. 1 Based on the definition of material as set out in Guidance Note 5/2014. Select from the drop-down list and if not listed add the name in column 'Additional names to the MOSP list' 2 Based on the following specified keys: 1 = financial; 2 = strategic; 3 = operational. 3 Based on the majority of services rendered and the following specified keys: 1 = communication; 2 = construction; 3 = electricity, gas and water; 4 = financial; 5 = manufacturing; 6 = security (other than technology related); 7 = technology; 8 = transport; 9 = other (details provided in column 4). 4 If "Other" was selected in column 3 5 Please specify in which segment, cluster or business unit the Material Outsourced Service Provider (MOSP) is used. 6 Relates to any further information in respect of the MOSP that is regarded as significant. 7 Based on the specified keys where 1 = yes and 2 = no, state whether an alternate provider/s has been identified to continue key functions /services should existing outsourcing arrangement fail. 8 If "yes" was selected in column 7, state the full name of the alternate service provider/s. 9 Please specify the total contract period agreed with the relevant service provider. 10 Please specify the expiry date of the current contract with the relevant service provider. 11 Please specify the total value of the contract with the relevant service provider, for the entire duration of the contract. 12 Please specify the value of the contract with the relevant service provider, for the respective specified periods. Name of alternate service provider/s 8 Contingency plans in place 7 Primary reason for classification as 'material'2 Line no. Full name of top 15 material outsourced service providers (MOSP)1 ANNEXURE A ***(All amounts to be rounded off to the nearest R'000) (Confidential and not available for inspection by the public) Name of bank/controlling company Period ended (yyyy-mm-dd) Additional names to the MOSP list1 Short description of services provided Industry 3 Specify 4 Segment/cluster/ business unit 5 Additional comments 6 Exposure value 12 Total contract value 11 R'000 Contract expiry date 10 Contract period 9

Current 12-month rolling period R'000 Prior 12-month rolling period R'000 1 2 3 4 5 6 7 8 9 10 11 12 13 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 *** Amounts should be stated in R'000 and if foreign currency was used for payments the ruling exchange rate should be applied. 1 In order to identify any mutual or common exposure to operational risk or potential vulnerability within the banking sector, please include in items 16 to 30 the relevant full names of key infrastructure service providers, such as Eskom and Telkom (since banks are unable to produce their own electricity and telecom lines; and banks cannot control these service providers). Select from the drop-down list and if not listed add the name in column 'Additional names to critical third party service providers'. 2 Please also include banking industry service providers, such as SBV and Bankserv. 3 Based on the following specified keys: 1 = financial; 2 = strategic; 3 = operational. 4 Based on the majority of services rendered and the following specified keys: 1 = communication; 2 = construction; 3 = electricity, gas and water; 4 = financial; 5 = manufacturing; 6 = security (other than technology related); 7 = technology; 8 = transport; 9 = other (details provided in column 4). 5 If "Other" was selected in column 3 6 Please specify in which segment, cluster or business unit the critical third-party service provider is used. 7 Relates to any further information in respect of the critical third-party service provider that is regarded as significant. 8 Based on the specified keys where 1 = yes and 2 = no, state whether an alternate provider/s has been identified to continue key functions /services should existing arrangement fail. 9 If "yes" was selected in column 7, state the full name of the alternate service provider/s. 10 Please specify the total contract period agreed with the relevant service provider. 11 Please specify the expiry date of the current contract with the relevant service provider. 12 Please specify the total value of the contract with the relevant service provider, for the entire duration of the contract. 13 Please specify the value of the contract with the relevant service provider, for the respective specified periods. Full name of top 15 critical third party service providers1; 2 ***(All amounts to be rounded off to the nearest R'000) Primary reason for classification as 'critical'3 Short description of services provided Industry 4 Specify 5 Segment/cluster/business unit 6 Additional comments 7 Contingency plans in place 8 Name of alternate service provider/s 9 Contract period 10 Contract expiry date 11 Total Contract value 12 R'000 Exposure value 13 Line no. Additional names to critical third party service providers1; 2