Central Bank of Libya

P.O. Box 1103 Telegraphic Address: MisrLibya - Tripoli - Libya

Reference Number / A.M / N ( )

Circular: C.B.L No. (8/2022) Date: 10 Rabi' al-Awwal 1444 AH Corresponding to: 06 October 2022 AD

---

To: General Managers of Banks

Greetings...

Based on the provisions of Law No. (1) of 2005 concerning Banks and its amendments, and within the framework of the supervisory and oversight role exercised by the Central Bank of Libya over banks operating in Libya, and referring to Circulars No. A.R.M.N (5/2004) and (5/2005), dated 07/06/2004 and 15/03/2005 respectively, regarding the necessity of establishing an Internal Audit Department, a Risk Management Department, and a Compliance Unit.

With reference to Circular A.R.M.N No. 13/2010 dated 27 September 2010, through which Decision No. (20) of 2010 of the Board of Directors of the Central Bank of Libya was circulated, concerning the Bankers’ Guide.

And with reference to the Core Principles for Effective Banking Supervision, specifically Principle No. (15) on Risk Management Processes in Commercial Banks, established by the Basel Committee on Banking Supervision, which states:

"The supervisory authority should require that banks have a comprehensive risk management process (including effective oversight by the board of directors and senior management) to identify, assess, report on, control, or mitigate all material risks in a timely manner. This also includes assessing the adequacy of banks' capital and liquidity relative to the size of their risks and market and economic conditions, including the establishment and review of contingency measures (including robust and reliable recovery plans). These measures take into account the specific circumstances of the bank. The bank's risk management process should be commensurate with the size and systemic importance of its risks."

Accordingly, the basic standards of the aforementioned principle are summarized as follows:

1. The Central Bank of Libya acknowledges that banks must have risk management strategies adopted by their boards of directors, and that these boards set appropriate risk appetite levels to determine the level of risk they can tolerate. Commercial bank management departments must provide the following requirements:

• Establish a sound risk management culture.
• Ensure that prepared risk policies are consistent with the adopted risk management strategies and defined risk appetite.
• Possess full knowledge of methods associated with risk measurement.

---

Page 1 of 4

Central Bank of Libya

• Set specific limits for reports submitted by banks to the Central Bank, based on the type and size of their risks and their capital strength, ensuring these limits are understood by relevant employees and communicated to them regularly.

• Senior management must take necessary steps to follow up and monitor all significant risks in accordance with the adopted strategies.

2. The Central Bank of Libya requires banks to have comprehensive risk management policies and processes to identify, measure, assess, monitor, report on, and control or mitigate significant risks. The Central Bank of Libya acknowledges that these processes are sufficient in order to:

(a) Provide a comprehensive view of the bank's level of significant risks of all types.

(b) Assess the volume of the bank's risks and its importance to the banking system.

(c) Evaluate risks arising from the macroeconomic environment affecting the market in which the bank operates.

And incorporate this assessment into the bank's risk management processes.

3. The Central Bank of Libya decides that the adopted risk management strategies, policies, processes, and limits:

(a) Are adequately documented.

(b) Are reviewed regularly and modified appropriately to reflect changes in risk appetite, risk size, market conditions, and macroeconomic circumstances.

(c) Are disseminated within the bank.

The Central Bank of Libya decides that exceptions to the established policies, processes, and limits receive due attention and are considered and approved by the appropriate level of management or even the bank's board of directors when necessary.

4. The Central Bank of Libya acknowledges that the bank's board of directors and senior management receive sufficient information regarding the nature and level of risks undertaken by the bank, and the appropriateness of these risks relative to adequate capital and liquidity levels. The Central Bank of Libya decides that the board of directors and senior management regularly review the risk management information sent to them and understand its dimensions and limitations (including uncertainties associated with risk measurement).

5. The Central Bank of Libya acknowledges that banks have appropriate internal processes to evaluate the overall adequacy of their capital and liquidity relative to their risk appetite and size. The Central Bank of Libya reviews the internal assessments of banks' capital and liquidity adequacy and their strategies.

6. When banks use models to measure components of risk, the Central Bank of Libya acknowledges the following:

(a) That banks adhere to supervisory standards when using them.

(b) That bank boards of directors and senior management are aware of the limitations and uncertainties associated with model outputs and the risks inherent in their use.

Page 2 of 4

Central Bank of Libya

P.O. Box 1103 Telegraphic Address: MisrLibya – Tripoli – Libya

(c) That banks conduct independent auditing and validation of models, and the Central Bank of Libya estimates whether model outputs are reasonable and reflect the risk borne by the bank.

7. The Central Bank of Libya decides that banks have sufficient information systems (for both normal conditions and stress periods) to measure, assess, and report on the size, composition, and nature of risk exposures, at the bank-wide level and for all types of risks. The Central Bank of Libya also acknowledges that these systems reflect the bank's risk volume and capital and liquidity requirements, and that these reports are provided on time to the board of directors and senior management in a format suitable for their use.

8. The Central Bank of Libya decides that banks have sufficient policies and processes to ensure that bank boards of directors and senior management are aware of the risks involved in new products, significant modifications to existing products, and major management initiatives (such as changes in systems, processes, business lines, and major acquisition operations). The Central Bank of Libya decides that boards of directors and senior management are capable of monitoring and managing these risks, and that bank policies and processes are updated continuously.

The Central Bank of Libya also decides that approval from their boards of directors or any specific committee within the board is required when undertaking any such large activities of the same nature.

9. The Central Bank of Libya decides that the bank has risk management functions covering all significant risks, with adequate resources, independence, authority, and the ability to access bank boards of directors to perform their duties effectively. The Central Bank of Libya decides that risk management functions are clearly independent from the risk-bearing departments in the bank, and that risk management functions report risk exposures directly to the board of directors and senior management. The Central Bank of Libya also decides that these functions are subject to regular internal audit review.

10. The Central Bank of Libya requests that the largest and most complex banks have a dedicated risk management department, supervised by a Chief Risk Officer or a similar management function. If the Chief Risk Officer is dismissed from their position for any reason, it must be done after obtaining prior approval from the board of directors, and generally, this dismissal must be announced. The bank must discuss the reasons for this dismissal with the Central Bank of Libya.

11. The Central Bank of Libya issues standards specifically relating to credit risk, market risk, liquidity risk, interest rate risk in the banking book, and operational risk.

12. The Central Bank of Libya requires banks to have forward-looking stress testing programs, consistent with the size of their risks and their importance in the banking system as part of their risk management processes. The Central Bank of Libya regularly evaluates the bank's stress testing program, monitors major sources of risk, builds scenarios for reasonable adverse conditions, and decides that the bank incorporates these results into its decision-making process and risk management processes (including contingency arrangements) and presents its capital and liquidity levels. The scope of the Central Bank of Libya's evaluation includes whether the stress testing program achieves the following:

Page 3 of 4

Central Bank of Libya

P.O. Box 1103 Telegraphic Address: MisrLibya – Tripoli – Libya

(a) Enhances monitoring and supervision of risks at the bank level.

(b) Ensures that strict and appropriate proposals are taken to address the impacts of findings and interactions between risks at the system level.

(c) Utilizes the active participation of the board of directors and senior management.

(d) Is properly documented, followed up, and updated regularly; if any deficiency in the program is identified, the Central Bank of Libya requires the bank to take corrective action for its stress testing program if stress test results are not considered in the bank's decision-making process.

13. The Central Bank of Libya evaluates whether banks appropriately explain risks (including the assessment of liquidity impacts) present in internal pricing, performance measurement, and new product approval procedures, for all major business activities.

Additional Standard: Banks are required to have appropriate policies and processes to assess other significant risks not directly addressed in the mandatory principles, such as reputation risk and strategic risk.

Through monitoring the performance of risk management departments in banks and the instability they face in the risk management process, you are requested to inform us of the measures taken by you in this regard within one month from the date hereof.

Peace be upon you...

Naji Muhammad Issa Director of Banking and Currency Supervision Department

Copy to:

• Mr. / The Governor
• Mr. / Deputy Director of Banking and Currency Supervision Department
• Mr. / Deputy Director of Banking and Currency Supervision Department for Office Supervision and Compliance Monitoring Affairs
• Mr. / Deputy Director of Banking and Currency Supervision Department for Inspection Affairs
• Mr. / Deputy Director of Banking and Currency Supervision Department for Islamic Banking Affairs
• Gentlemen / Heads of Risk Management Departments in Banks

Instructions by

Page 4 of 4