Circular NBB_2023_09: Inspection Scope and Procedures

boulevard de Berlalm0nt 14 — 1000 Brussels n ' Ba n q ue Nationale Ba nk telephone +32 2 221 48 66 .. company number: 0203.201.340 DE BEŒ'QUE VAN BELGE RLP Brussels E urosystem www.nbb.be C | rcu lar Pu blic Brussels, 14 November 2023 Reference: NBB_2023_09 your correspondent: Marc Verleye telephone +32 2 221 51 83 marc.vefleye@nbh.be Inspection circular Scope of Application — Leaal Basis This circular concerns inspections carried out by the National Bank of Belgium (hereinafter "the NBB”), in its capacity as a prudential supervisory authority, a supervisory authority for the prevention of money laundering and terrorist financing1 or an authority entrusted with the tasks referred to in Article 8 of the Act of 22 February 1998 establishing the organic statute of the National Bank of Belgium (hereinafter the "Organic Act”), for the following institutions: — credit institutionsz; - branches of Belgian credit institutions established in another Member State of the European Economic Area (EEA)3; - branches registered in Belgium of credit institutions governed by the law of an EEA Member State4; — branches registered in Belgium of credit institutions governed by the law of a State that is not a member of the EEA5; — stockbroking firmsô; - branches of Belgian stockbroking firms established in another EEA Member State7; — branches registered in Belgium of stockbroking firms governed by the law of an EEA Member States; - branches registered in Belgium of stockbroking firms governed by the law of a State that is not a member of the EEA9; " Article 91 of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and on restriction of the use of cash (hereinafter, the ”Anti-Money Laundering Act“). 2 Article 135 of the Act of 25 April 2014 on the legal status and supervision of credit institutions (hereinafter the “Banking Act”). ' Articles 140 and 162 of the Banking Act. Articles 324 and 325 of the Banking Act. Article 337 of the Banking Act. Article 121 of the Act of 20 July 2022 on the legal status and supervision of stockbroking firms (hereinafter the "Brokerage Supervision Act“). 7 Articles 129 and 157 of the Brokerage Supervision Act. 8 Articles 219 and 220 of the Brokerage Supervision Act. 9 Article 229 of the Brokerage Supervision Act. Public NBB_2023_09 — 14 November 2023 Circular — Page 1I12 ODO‘I-Àü!

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 n‘\ insurance or reinsurance companies”; branches of Belgian insurance or reinsurance companies established in another EEA Member State“; branches registered in Belgium of insurance or reinsurance companies governed by the law of an EEA Member State”; branches registered in Belgium of insurance or reinsurance companies governed by the law of a State that is not a member of the EEA”; payment institutions”; branches of Belgian payment institutions established in another EEA Member State”; branches registered in Belgium of payment institutions governed by the law of an EEA Member State16; branches registered in Belgium of payment institutions governed by the law of a State that is not a member of the EEA”; electronic money institutions”; branches of Belgian electronic money institutions established in another EEA Member State“); branches registered in Belgium of electronic money institutions governed by the law of an EEA Member State20; branches registered in Belgium of electronic money institutions governed by the law of a State that is not a member of the EEA“; central securities depositories”; institutions providing support to central securities depositories and custodian banks”; foreign branches of Belgian institutions providing support to central securities depositories and custodian banks”; Articles 304 to 309 of the Act of 13 March 2016 on the legal status and supervision of insurance and reinsurance companies (hereinafter the "Insurance Supervision Act”). Article 310 of the Insurance Supervision Act. Articles 566, 567 and 578 € 1 of the Insurance Supervision Act. Article 595 of the insurance Supervision Act. Article 103 5 1 of the Act of 11 March 2018 on the legal status and supervision of payment institutions and electronic money institutions and access to the activity of payment service provider, to the activity of issuing electronic money and to payment systems (hereinafter “the PIIEMI Supervision Act”). Article 106 of the PIIEMI Supervision Act, Article 138 $ 1 of the PIIEMI Supervision Act. Article 144 of the PIIEMI Supervision Act, it being understood that, at the time of writing, there was as yet no royal decree regulating the legal status and supervision of such branches. Article 208 € 1 of the PIIEMI Supervision Act. Article 210 of the PIIEMI Supervision Act. Article 226 of the PIIEMI Supervision Act. Article 228 of the PIIEMI Supervision Act, it being understood that, at the time of writing, there was as yet no royal decree regulating the legal status and supervision of such branches. Articles 12bis @ 1, 36/2 55 1, first subparagraph, and 2, 36/26/1 and 36/29 of the Organic Act and Article 22(5) of Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories. Articles 12bis @ 1, 36/2 @@ 1 , first subparagraph, and 2, 36/26/1 @@ 5 and 6 and 36/29 of the Organic Act and Article 21 of the Royal Decree of 26 September 2005 on the legal status of winding-up bodies and bodies treated as such (hereinafter the “Royal Decree of 26 December 2005”). Articles 12bis 5 1, 36/2 55 1, first subparagraph, and 2, 36/26/1 @@ 5 and 6 and 36/29 of the Organic Act and Article 23 of the Royal Decree of 26 September 2005. Public NBB_2023_09 — 14 November 2023 Circular — Page 2l12

n‘\ - institutions providing support to central securities depositories operating in Belgium in the form of a branch of a foreign institution25; — custodian banks operating in Belgium in the form of a branch of a foreign credit institution26; - systemically important processors of payment transactions and payment scheme operators”; — operators of card schemes”; — financial holding companies, investment holding companies and insurance or reinsurance groups29; — financial services groups headed by a regulated undertaking under Belgian law30 or a mixed holding company or mixed financial holding company under Belgian law“. In addition, Article 36/19 of the Organic Act allows the NBB to request all necessary information from institutions carrying out transactions or activities covered by the laws and regulations whose application it is responsible for supervising and from any third party that makes possible or facilitates the conduct of such transactions or activities. The NBB may verify, or have verified, the accuracy of the information provided to it in the books and documents of the parties concerned. This circular applies to all inspections carried out by the NBB, including those relating to the evaluation of internal models used by supervised institutions to calculate their capital requirements. That being said, the inspection processes described in this circular do not apply to one-off and/or specific inspections to meet targeted objectives in the context of permanent supervision. This circular applies to inspections carried out by the NBB at institutions subject to its direct supervision. lt does not apply to inspections carried out by the European Central Bank (hereinafter the “ECB") in which . NBB staff participate in the framework of the Single Supervisory Mechanism (SSM) set up by Council ' Regulation 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions. For the sake of consistency, this circular is nevertheless compatible with the principles set out in the Guide to on-site inspections and internal model investigations, published by the ECB in September 2018 and applicable to inspections carried out by the latter. This circular replaces circular NBB_2013_15 of 11 December 2013. 25 Articles 12bis 5 1, 36/2 @@ 1, first subparagraph, and 2, 36/26/1 @ 5 and 36/29 of the Organic Act and Article 36 of the Royal Decree of 26 September 2005. 26 Articles 12bis, 36/2 @@ 1, first subparagraph, and 2, 36/26/1 @ 6 and 36/29 of the Organic Act and Article 36 of the Royal Decree of 26 September 2005. 27 Article 15 of the Act of 24 March 2017 on the supervision of payment transaction processors. 28 Article 160 of the Pl/EMI Supervision Act. 29 Article 183 $ 2 and Article 214 5 1 of the Banking Act, Article 160 5 1, 184 g 1 and 192 5 1 of the Brokerage Supervision Act, and Article 428 of the Insurance Supervision Act. 3° Article 214 @ 1 of the Banking Act, Articles 160 g 1, 184 5 1, 187 5 2 and 192 of the Brokerage Supervision Act, Articles 428 and 486 @ 1 of the Insurance Supervision Act. 31 Articles 183 5 2 and 214 5 1 of the Banking Act, Articles 160 5 1, 171 5 2, 184 5 1, 187 5 2 and Article 192 of the Brokerage Supervision Act, Articles 450 $ 2 and 486 g 1 of the Insurance Supervision Act. Public NBB_2023_09 — 14 November 2023 Circular — Page 13/12

m Summaml0biective The purpose of this circular is to inform institutions of the NBB’s working methods for the performance of inspections, how inspections are carried out and the conduct expected of inspected institutions. Structure 1 . Introduction 2. General framework for inspections 3. Inspection processes and practices 4 Expectations regarding the conduct of inspections Dear Sir or Madam, In order to ensure a transparent approach and the efficient conduct of inspections, it is essential that supervised institutions understand the NBB’s approach in this regard.

1. Introduction
2. The purpose of supervision by the NBB is to ensure that institutions subject to supervision by law comply with the requirements laid down by and pursuant to the applicable supervisory legislation”.
3. In the exercise of its supervisory duties, the NBB has the right to access information. In particular, it may request all information necessary for the purposes of its supervision and carry out on-site inspections.
4. General framework for inspections Purpose and organisation
5. Inspections are carried out by NBB employees for whom this is their main function (hereinafier referred to as “inspectors"). They may be accompanied by other NBB staff and/or external experts. The inspection team is responsible for issuing a report containing the findings and conclusions of the inspection.
6. Inspectors assess the way in which institutionscomply with legal requirements, particularly with regard to the organisation of their activities and risk management, taking into account the financial impact and consequences for their business and reputation. Based on the findings, recommendations are made to remedy any shortcomings identified. 32 For purposes of this circular, "supervisory legislation” means all laws referred to in footnotes 1 to 32. Public NBB_2023_09 — 14 November 2023 Circular — Page 4/12

n‘\ 5. Inspections are carried out in accordance with the following criteria and principles: - they are risk—based, focusing efforts on issues for which a higher level of risk or lower level of monitoring was detected; - they are proportionate, meaning they are adapted to the size, activities and risk profile of the area under review and the institution; - they are intrusive and are based on an in-depth examination of the area or activity under review; - in addition to identifying shortcomings existing at the time of the inspection, inspections are prospective in that they aim to anticipate changes to the risk profile of the inspected area or activity; - the inspectors work in a pragmatic manner and aim to formulate recommendations enabling corrective measures and actions which will form the object of follow—up by the NBB. 6. The inspection report is an essential source of information for the overall assessment of the institution, in particular its risk profile. In this way, inspections constitute an important supervisory tool intended to identifier any possible shortcomings by the institution in terms of compliance with the applicable statutory and regulatory framework. Ethical framework, professional secrecy and confidentiality 7. The NBB shall put in place the necessary framework to ensure that inspectors demonstrate the utmost probity and professionalism in the performance of their duties. Inspectors must therefore comply with the NBB’s code of conduct, in particular to avoid conflicts of interest. 8. it should also be noted that any person taking part in an inspection is subject to the professional secrecy rules referred to in Article 35 of the Organic Act. 9. The inspection report and correspondence relating to its follow—up shall be kept confidential (see also point 34 below). This duty of confidentiality is provided for by (i) Article 136I2 of the Banking Act, (ii) Article 125 of the Brokerage Supervision Act, (iii) Article 306 of the Insurance Supervision Act, (iv) Article 103 5 3 of the PIIEMI Supervision Act, and (v) Article 91/2 of the Anti—Money Laundering Act. Breach of this duty constitutes a criminel offence. Scope 10. The scope of the information to be gathered and the checks to be carried out is determined during the planning and preparation phases of the inspection and influences the duration of the inspection and the resources placed at the disposal of the inspectors. 11 . In addition to cases where it acts pursuant to Article 36/19 of the Organic Act, the NBB may, when , exercising supervision over a financial holding company on a consolidated basis or supplementary supervision of a financial services group or an insurance or reinsurance group, carry out, within the limits of its powers, inspections of all undertakings (regulated or not) included, as the case may be, in the scope of consolidation or in the supplementary supervision of the group concerned. Public NBB_2023_09 — 14 November 2023 Circular - Page 5/12

m 3. Inspection processes and practices 3.1. Overview of the stages of an inspection The following diagram illustrates the various stages of an inspection (preparatory, investigation and reporting phases), each of which is described in more detail below. Preparatory phase [ ' !:|'f;r»'fiij—'r:ifiêlu,‘3’äi‘-=-ñz:—- ' . 1 ! ' ' , , , “ l Kick—off meeting Fieldwork Debñefing Reporting phase !‘-‘ÎËΟ ' . ' jg_ g"_‘ ‘ Reportdmffing Draftreport Exitmeeüng Reaction from institution final report -'Ê% î , i Follow—up phase (Led by permanent supervision) RecommendationÿAflion plan Draft follow-up letter Goslng meeting Final follow—up letter 3.2. Description of the main stages of an inspection 3.2.1. Pregaratog phase Notification letter 12. The institution is notified of the inspection by way of a letter (addressed to the chairperson of the management committee33 and the chairperson of the board of directors). The letter shall indicate the purpose of the inspection, the names of the inspectors, the estimated timeframe needed to carry out the inspection, and the date agreed for the kick—off meeting (see point 16)“. 13. The institution’s external (statutory) auditor and head of internal audit shall receive a copy of the notification letter. — 14. The inspectors have several tools at their disposal to prepare and carry out their tasks. At the beginning of the assignment, the inspectors shall familiarise themselves with all information in the NBB’s possession about the institution. 33 In the absence of a management committee. the letter shall be sent to the persons responsible for effective management of the institution. 34 This is without prejudice to the possibility for the NBB to carry out an inspection, when the circumstances so require, without sending a prior notification to the institution. Public NBB_2023_09 — 14 November 2023 Circuler — Page 6/12

m First request for information 15. Prior to — or during - the kick-off meeting, the inspection team may transmit to the institution a first request for information, indicating the items of information needed to begin its work. This request may, where appropriate, relate to documents already submitted to the NBB by the institution in order to ensure that the latest version has been provided and/or concern detailed data files, to be submitted in a predetermined format35_ The institution may be asked to submit requested information prior to the kick—off meeting and/or to present a list at the meeting. 3.2.2. Investigation phase Kick—off meeting 16. All inspections begin with a kick—off meeting. This meeting is the first direct contact between the inspectors, effective management of the institution and possibly other people from the institution who will be directly involved in the inspection. The purpose of the kick—off meeting is mainly to: — present the abovementioned persons; - explain the legal bases pursuant to and with regard to which the inspection will be conducted (ie. the applicable criteria, the protection of personal data, professional secrecy, etc.); — present the area, scope and objectives of the inspection; — indicate the various phases and deadlines; - identify the individuals within the institution who will serve as the inspectors’ main contact persons; — provide an initial presentation of the general organisation of the institution with regard to the area or activity that forms the object of the inspection; - define the communication channels to be used (both by the NBB and within the institution) and the procedures for the exchange of information and to access files relating to the inspected area or activity in the various systems used by the institution; — determine the arrangements for presence at — and access to — the institution as well as for the organisation of interviews. Fieldwork 17. Durinq the inspection, the inspectors shall carrv out work/take steps necessau to verify compliance with the requirements the NBB |s responsible for overseeing and to collect necessary and relevant information to document their findings (an audit trail). 35 When they relate to customers, data files and detailed information provided by the institution to the NBB must not include sensitive personal data. Nonetheless, individual files must always be identifiable by way of a number or another reference provided by the institution. It may be necessary to identify customers, particularly in the context of inspections to prevent money laundering and the financing of terrorism. Anonymisation is mandatory when medical data are transmitted. Public NBB_2023_09 — 14 November 2023 Circular — Page 7/12

n‘\ lnspectors may use a variety of inspection techniques, including: — observation, verification and analysis of information; — interviews; - analysis of processes and their practical implementation (walk—through}; - analysis of a sample and/or files on a case-by-case basis; — verification of the integrity, accuracy and consistency of information and data provided by the institution; - implementation of tests on models developed by the institution, based on concrete situations defined by the inspectors, etc. The inspection team shall determine the most appropriate inspection techniques in light of the objectives of the inspection. 18. During the investigation phase, the inspection team has the possibility to organise progress meetings with management or operational staff in order to discuss preliminary facts and findings, prior to the informal debriefing held at the end of the investigation phase (see point 19 below). During the inspection, the institution may also reasonan request progress meetings with the inspection team. Informal debriefing 19. An informal debriefing is held at the end of the investigation phase. The purpose of this meeting is for the inspectors, on the one hand, and effective management of the institution and individuals within the institution who were directly involved in the inspection, on the other hand, to discuss the main findings of the inspection. _ The informal debriefing is generally the last point in time at which additional information provided by the institution may be taken into account (cut—off date) with a view to the drafting of the inspection report laying out the findings. 3.2.3. Reporting phase Draft inspection report 20. An inspection results in the preparation of an inspection report. This report includes conclusions, a table summarising the findings and/or recommendations and a main section describing the findings and/or recommendations in detail. Appendices may be added. Each finding mentioned in the inspection report is assigned a score based on its actual or potential impact on the institution (low/medium/highlcritical). For inspections carried out further to a request for the approval of internal models, the score for each finding is indicated in the letter containing the decision. Public NBB_2023_09 — 14 November 2023 Circular — Page 8/12

n‘\ An overall opinion is also provided for the area under review, in accordance with the following scale: Overall opinion Evaluation Description 1 Generally sufficient The impact of the identified shortcomings exposes the area under review to a minimum (aggregate) level of risk. 2 Limited improvements required The impact of the identified shortcomings exposes the area under review to a limited (aggregate) level of risk. 3 Significant improvements The impact of the identified required . shortcomings exposes the area under review to a serious (aggregate) level of risk. 4 _ Very serious shortcomings I The impact of the identified generally insufficient shortcomings exposes the area under review to an unacceptable (aggregate) level of risk. The overall opinion will depend on the findings of the inspection. The opinion does not take into account any positive effects of actions planned by the institution the execution of which is not guaranteed at the date of the inspection report. An overall opinion is not included in the draft inspection report when the inspection is carried out further to a request for the approval of internal models. In this case, a letter notifying the refusal or approval decision will be sent to the institution. Exit meeting 21. The draft inspection report will be sent to the institution to facilitate preparation for the exit meeting with the institution's effective management. The purpose of this meeting is to present the findings and conclusions of the inspection, as set out in the draft report, and to give the institution an opportunity to comment on these findings and conclusions before the report is finalised. The draft report will be sent to the institution sufficiently far in advance of the scheduled exit meeting. Public NBB_2023_09 — 14 November 2023 Circular — Page 9/12

n‘\ Response by the institution 22. Following the exit meeting, the institution will be given the opportunity to submit comments in writing. These comments will be incorporated into the final report. Final report 23. The final report will be sent along with a cover letter which may detail the next steps to be taken by the institution to address the identified shortcomings. 24. The final report and cover letter will be sent to the chairperson of the management committee and to the chairperson of the board of directors of the institution. The external (statutory) auditor and the head of internal audit shall also receive a copy of the report. 25. Where an inspection reveals shortcomings within the institution, the latter is expected to draw up and implement an action plan to remedy them. 3.2.4. Follow—up phase 26. The follow—up phase for the action plans will be organised in accordance with the various processes in place within the Bank departments concerned. 4. Expectations regarding the conduct of inspections In order to ensure that inspections are carried out smoothly.‘ it is recommended that institutions and the NBB meet the expectations set out below. Compliance with the institution ’s internal rules 27. Inspectors shall comply with the institution’s internal rules, in particular with regard to data protection and access to premises and information systems, to an extent compatible with the needs of the inspection. Guarantee of logistical support _ 28. The institution shall ensure that the inspectors, who are required to carry out a large share of their activities within the institution, have adequate onsite logistical support to ensure the smooth conduct of the inspection. The institution shall ensure that inspectors can work under appropriate operational conditions, by providing them with secure workspaces and a secure and stable Internet connection, in a room that can be |ocked and that is located in close proximity to the inspected areas. Logistical support shall include IT support to the extent necessary for the smooth conduct of the inspection. Public NBB_2023_09 — 14 November 2023 Circular — Page 10/12

n‘1 Production of all information and documents 29. The institution shall ensure, in accordance with the applicable statutory provisions35, that inspectors are given access to all information necessary for the performance of their duties. 30. If the processing of personal data proves necessary in the course of an inspection, such processing shall be carried out in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals With regard to the processing of personal data and on the free movement of such data and the relevant provisions laid down in the supervisory legislation”. 31. The institution is expected to take all necessary measures to ensure that information is transmitted efficientIy. This means that requested documents and files must be provided within the timeframe agreed with the inspection team, while ensuring that the information they contain is accurate”. The efficient provision of information implies moreover that the institution is expected to facilitate contact with the appropriate people. 32. Insofar as possible, preference shall be given to the exchange of documents in electronic form via the secure data transfer means provided by the NBB, unless otherwise indicated by the inspectors or contraindi0ated by the institution's general policy on the communication of information in electronic form. 33. The institution and the inspectors are expected to agree during the kick—off meeting on unambiguous arrangements for the transmission of information (see point 16 above). Confidentiality of documents exchanged during the inspection 34. Institutions are expected to preserve the confidentiality of documents produced by the NBB in the context of an inspection and its follow—up39. Likewise, the NBB shall take the necessary measures to ensure the confidentiality of documents provided to it by the institution“. Conduct of directors, persons responsible for effective management and employees of the institution 35. The NBB has the power to request all information necessary for the performance of its supervisory tasks. Directors, effective management and employees of the institution are expected not to obstruct the investigation and to answer correctIy and completely the questions put to them. This implies that they shall inform the inspectors of any information relevant to the questions asked“. 36 See footnotes 1 to 29 above. 37 See in particular Book III1 “Processing and protection of personal data" of the Anti-Money Laundering Act. 38 It should be noted that the supervisory legislation and the Organic Act provide for the imposition of criminal sanctions in cases where persons obstruct inspections and verifications or refuse to provide information they are required to provide by law or knowine provide inaccurate or incomplete information. 39 See point 9 above. 40 See in particular Articles 35 and 36/12/4 of the Organic Act. 41 This is information which it can be assumed would have an impact on the inspectors‘ opinion if it were known. Public — NBB_2023_09 — 14 November 2023 Circular — Page 11/12

n‘\ 36. Directors, persons responsible for effective management and employees of the institution are expected to adopta courteous and professional attitude when answering questions. Availability of the institution ’s staff 37. lnspectors may summon all persons, both employees and external parties, performing a function within the institution, to the extent necessary for the accomplishment of their assignment‘”. The institution is expected to take all necessary measures to ensure that interviews are conducted efficiently. The institution is also responsible for the efficient organisation of meetings with external consultants or service providers. Presence at the institution ’s premises 38. The teleworking rules in effect within the institution may not constitute an obstacle to the proper conduct of the inspection. Thus, insofar as the inspection team deems it necessary, it may request that meetings and interviews be organised at the premises of the institution, with the physical presence of the person(s) indicated in the request. Where the inspection work so permits, inspectors may agree to hold certain meetings by video conference. in this context, it is preferable that all participants agree to use their camera, to ensure that communication is as efficient as possible. Should the recording of such meetings prove necessary, it may only take place with the express written consent of all participants. Appointment of a contact person 39. lnspectors may ask the institution to designate a contact person to ensure that the appropriate individuals are contacted and that requests are dealt with efficiently. The contact person should be of a functional and hierarchical level sufficient to respond to the inspectors’ requests and interact with them. A copy of this letter is being sent to the auditor of your institution. Tim Herin)ms Executive Director Secretary Yours faithfully, Pierre Wunsch Governor 42 See in particular Article 136 of the Banking Act, Article 123 of the Brokerage Supervision Act, Article 305 of the Insurance Supervision Act, Articles 103 5 2 and 208 5 2 of the Pl/EMI Supervision Act, and Article 91, fourth subparagraph, of the Anti—Money Laundering Act. Public NBB_2023_09 — 14 November 2023 Circuler - Page 12/12