Circular on Pillar II Guidelines for Basel II Supervisory Review

No.: 10/1533 Date: 18/2/1431 Hijri Corresponding to: 3/2/2010 Circular to banks operating in the Kingdom After Greetings, Based on the provisions of Article (99/B) of the Banking Law No. (28) of the year 2000 and its amendments, and later to the Capital Adequacy in accordance with Basel II Standard Instructions No. (39/2008) dated 24/3/2008. In addition to the Central Bank’s endeavor to implement all the pillars of the Basel II Standard, and with the aim of strengthening and activating the control system in banks and the role of their risk departments. Attached hereto the instructions related to the pillar II of the Basel II standard (Supervisory Review). Accordingly, I emphasize the need for banks to abide by these guidelines and to provide the Central Bank with the required at the times specified in it. Respectfully, Governor Dr. Umayyah Toukan

2 Pillar II Guidelines for Basel II supervisory review ــــــــــــــــــــــــــــــــــــــــــــــ Introduction:

• The supervisory review process aims to encourage banks to develop and use better risk management methods, in addition to ensure that banks have adequate capital to support all the risks in their business.
• The supervisory review process is concerned with addressing the risks that were not covered within the pillar 1, and therefore either reducing them substantially or allocating capital against them. In this regard, banks should review the main principles of the supervisory review process in order to ensure that capital is beyond the minimum requirements.
• The supervisory review process recognises the responsibility of the bank’s board of directors and its executive management in developing an internal capital assessment process, and setting capital targets that are commensurate with the bank’s risk profile and control environment. The bank’s management bears responsibility for ensuring that the bank has adequate capital to support its risks beyond the minimum requirements.
• The supervisory review process includes two main dimensions. The first relates to the banks’ internal assessment process for the capital necessary to meet the risks they are exposed to, which is called the “Internal Capital Adequacy Assessment Process” (ICAAP) as explained in Annex No. (1). The second relates to the role of the supervisory authority in assessing the adequacy of that process, which is called Supervisory Review and Evaluation Process (SREP).
• Despite the relationship between the capital held by the bank against its risks, and the strength and effectiveness of the bank’s risk management and the internal control processes. However, increased capital should not be viewed as the only option for addressing increased risks facing the bank. Other means for addressing risk, such as strengthening risk management, applying internal limits, strengthening the level of provisions and reserves, and improving internal controls, must also be considered. Furthermore, capital should not be regarded as a substitute for addressing fundamentally inadequate control or risk management processes.
• The three pillars of Basel II are complementary to each other in order to ensure the stability and safety of banking institutions. While the pillar 1 aims to develop the accuracy of risk measurement, improve the risk management function and overcome the deficiencies in determining capital adequacy requirements, the pillar 2 comes to cover the risks that were not covered within pillar 1, to reduce these risks or allocate capital to meet them.

3 Risk management:

• The necessity for the bank’s board of directors to have a basic and effective role in controlling risks, especially with regard to the following:

1. Determining the bank's risk appetite.
2. Full understanding of the bank's risk profile.
3. Determining all risks associated with the bank's activities and with existing and new products.

• The necessity for the bank’s board of directors and the executive management to have regular contact with the risk department manager. This is through the risk department manager submitting direct reports to the general manager and the board of directors.
• It is necessary to link the remunerations granted to the executive management, including the units’ managers and their employees, with the degree of risks involved in their activities. So that these remunerations are adjusted based on the degree of risk and its compatibility with the bank’s risk profile and its degree of appetite, in order to avoid giving incentives to engage in activities and transactions that may involve high risks that are not consistent with the bank’s degree of risk appetite.
• The need to manage the process of evaluating the bank’s financial assets and investments in a prudent and consistent manner among all business units within the bank, provided that this process is well documented. Proportionality:
• The Central Bank will adopt the concept of proportionality when applying pillar II, where the nature and scope of the bank’s work, the complexity of its operations, the quality of products, cross-border establishment, the extent to which it implements operations that involve high risks, the effectiveness of risk management and internal control systems in the capital assessment process will be taken into consideration.
• This process involves a dialogue between the bank's management and the Central Bank to reach an agreement on the necessary capital, and the procedures to be taken to reduce risks and to ensure control over the risks met by the bank in its various business and activities. The main principles of supervisory review: In applying the second pillar (supervisory review), the Central Bank will take into consideration the principles below in order to ensure that the intended results of this process are achieved: Principle One: Banks should have clear procedures for a comprehensive assessment of capital adequacy in relation to their risk profile, as well as a strategy for maintaining the necessary capital levels. When estimating the capital adequacy, the bank’s management must take into consideration the current stage of the business cycle, and carry out stress testing, which enables the bank to identify possible events or changes in market conditions, which could have an adverse impact on the bank. Principle Two: The Central Bank will review and evaluate the internal capital adequacy assessment and strategies for maintaining it, as well as their ability to monitor

4 and ensure their compliance with regulatory capital ratios. Supervisors should take appropriate supervisory action if they are not satisfied with the results of this process. Principle Three: The Central Bank expects banks to operate above the minimum regulatory capital ratios, and it may require banks to hold capital in excess of the minimum, at the level of each individual bank and/ or at the level of all banks. Principle Four: The Central Bank will intervene in the early stages to prevent the capital from falling below the minimum levels required to support the risk characteristics of a particular bank, and it will ask for rapid remedial actions to be taken in accordance with the Corrective Action Memorandum No. (4/2004) dated 11/1/2004 or any instructions that may replace it in the future. The risks covered by pillar II:

• The framework specified in pillar 1 deals with credit risk (excluding concentration risk) and market risks associated with the trading in financial markets activity, in addition to its treatment of operational risks. The pillar II comes to address the risks that were not covered within the pillar 1. These risks are divided into three main categories: The first category: deals with risks that were not covered within the Pillar 1 process, including the concentration risks and the risks that may result from the bank's use of risk mitigation and transfer methods. The second category: includes the risks not taken into account by the Pillar 1 process at all, for example, the interest rate risk in the banking book, the liquidity risk, the strategic risk and the reputational risk. Annex No. (2) and Annex No. (3) explain the guidelines related to the management of interest rate risk in the banking book and the management of liquidity risk. The third category: deals with risks that may arise from external factors such as the business cycle effects and the economic environment at the macro level. The contents of the pillar II are added to the above risk categories, taking into account the qualitative assessment of the bank’s risk management elements, which covering the following aspects: Corporate governance, the role of the board of directors and executive management, risk management systems and internal control. If the Central Bank proves, through the evaluation process, the strength of these controls, it can be reflected on the overall assessment of the risk level of the concerned bank.
• The Central Bank expects from banks operating in the Kingdom, after implementing these guidelines, the following:

1. Deep understanding by all management levels of all risks met by the bank, identifying other risks within the pillar II of Basel II with an assessment of the Bank's ability to adequately hedge these risks.

5 2. Work on developing a detailed plan to measure capital requirements internally commensurate with the risk profile of the bank, and provide the Central Bank with this plan no later than the end of the first half of 2010. 3. Reaching the self-assessment of the bank’s capital requirements, and providing the Central Bank with the results of this process by the end of 2010 based on the data of the bank’s branches in Jordan and the consolidated financial statements as on 30/6/2010. Noting that the Central Bank will issue its instructions regarding the periodicity of providing it with the results of this process after completing the evaluation of these results and on the basis of each bank separately. Respectfully, Governor Dr. Umayyah Toukan

• Attachment.

6 Annex No. (1) Guidelines for Internal Capital Adequacy Assessment Process (ICAAP) The Bank's primary responsibility is to develop an internal capital adequacy assessment process (ICAAP). The bank’s management is responsible for ensuring the capital adequacy needed to meet the risks to which the bank is exposed. The procedures for the comprehensive capital assessment process are based on the following pillars:

1. Supervision of the Board of Directors and Senior Management: The Bank's management has responsibility for understanding the nature and level of risk assumed by the bank and how that level of risk is consistent with its capital levels. The process of analyzing the current and future capital requirements of the bank in relation to its strategic objectives is one of the vital elements in the strategic planning process. The strategic plan should clearly state the bank's capital needs, expected capital expenditures, the appropriate level of capital and the external sources of capital. The bank’s board of directors is responsible for determining the level of acceptable risks, and the board has to ensure that the management puts in place a framework for evaluating various risks, establishes a system linking risks and the level of the bank’s capital, and finds means to monitor compliance with internal policies. It is also important for the board of directors to adopt and support strong internal control and written policies and procedures, and to ensure that the executive management effectively disseminates these standards in the bank.

• The board of directors ensures that the internal capital adequacy assessment process takes place at least once a year, so that it is convinced that this assessment process has taken into account all aspects, and that there are no fundamental changes in the bank’s business lines and risk profile that require make adjustments to the evaluation process.

2. Proper Capital Valuation: A proper capital valuation includes the following:

• The existence of policies and procedures to ensure that the bank identifies, measures and reports all risks of material impact.
• There is a link between the capital and the level of risk.
• Determining capital adequacy objectives based on risks, taking into consideration the focus of the bank's strategy and business plan.
• Existence of internal control procedures, reconsidering and reviewing them periodically to ensure the comprehensiveness of the work of the administration in general and the integrity of all other administrative methods.

3. Comprehensive risk assessment: All risks of material impact to which the bank is exposed should be taken into account in the capital adequacy assessment process. While not all risks can be measured accurately, practical procedures should be developed to assess these risks. Therefore, the following risks must be taken into consideration:

• Credit risk.
• Operational risks.
• Market risk.
• Interest rate risk in the banking book.

7

• Liquidity risk.
• Other risks (such as concentration risk, reputational risk, strategic risk, business cycle risk and any other risks related to the Bank's business).

4. Supervision and Reporting: The bank should put in place an adequate system for supervising the reporting mechanism on the concentration of risks and the extent of the impact of the quality of risks on the capital. Periodic reports should be submitted to the banks’ board of directors about the type of risks that the bank may be exposed to and its needs for capital, so that these reports allow the senior management to do the following:

• Assessing the level and trends of risks that have a material impact and their impact on capital levels.
• Evaluating the sensitivity and reasonableness of the assumptions used in evaluating the capital measurement system.
• Determining the extent to which the bank maintains sufficient capital to meet risks.
• Assessing the future needs of the bank's capital based on the risk profile, and making the necessary adjustments in the strategic plan accordingly.

5. Internal Control Review: The bank's internal control structure is considered essential in the capital assessment process. The effective control over this process includes an independent review, in which, if necessary, the internal and/ or external audit participates. The bank’s board of directors is responsible for ensuring that the executive management puts in place a system for assessing various risks, as well as a system for linking risks and the level of the bank’s capital, and a clear mechanism for monitoring compliance with internal policies. The board of directors should regularly check whether the internal control system is sufficient to ensure that the work is carried out regularly. This should include the following as a minimum:

• The bank’s board of directors must ensure that an appropriate level of capital is maintained which commensurate with the level and scope of risks to which the bank is exposed.
• Ensuring that the bank has on an ongoing basis sufficient systems and procedures to determine the measurement, control and management of the risks to which the bank is exposed.
• Documenting the mechanism used to determine the target capital to support the level of risks arising from the bank's activities, as well as the overall business plans.
• Documenting the bank's strategy to maintain adequate and appropriate sources of capital, including defining the method by which the target level of capital will be met and the means available to ensure that additional sources of capital are found if required.

6. The bank shall document the steps and procedures followed to comply with the Central Bank's requirements regarding minimum regulatory capital.
7. The internal capital assessment process must be subject to a comprehensive and effective review process, so that the periodicity and scope of this review is commensurate with the size of the bank's business and the complexity of its operations, as well as the extent of change in the nature and work environment and its level of risk.

8 Annex No. (2) Guidelines for managing interest rate risk in the banking Book First: The terms mentioned in these instructions shall have the meanings assigned to them below:

1. Banking Book: All positions held by the bank Off and On the balance sheet, except for those held for trading purposes, in accordance with the definition of the trading book contained in the market risk instructions contained in the capital adequacy instructions in accordance with Basel II Standard No. (39/2008) dated 24/3/2008.
2. Interest Rate Risk in the Banking Book: It is the losses that the bank may incur and/ or the decrease in the economic value of the positions held within the banking book as a result of any changes in interest rates. Second: Responsibilities of the Bank's Board of Directors
3. Adopting a clear strategy for interest rate risk management, to be circulated to the various organizational units within the bank.
4. Adopting the main policies related to the interest rate risk management strategy.
5. Ensuring that the executive management of the bank takes the necessary steps to identify, measure, monitor and control interest rate risks in accordance with the set strategy and policies.
6. Obtaining periodic reports on the level of interest rate risks to which the bank is exposed, to evaluate the effectiveness of monitoring and controlling these risks by the executive management and comparing them with the level of risks acceptable to the bank.
7. Reviewing the strategies and policies used to manage interest rate risks, to ensure their continuity. Third: Responsibilities of the Executive Management
8. Defining the policies and procedures related to interest rate risk management in line with the nature, size and complexity of the bank's operations, so that these policies are clearly and consistently applied. These policies and procedures should be reviewed periodically.
9. Develop a special system for measuring interest rate risks to enable the bank from collecting all data related to these risks in order to assess the impact of interest rate changes on the profitability and economic value of the positions held within the banking book. So that the assumptions used in this system are clear to the risk managers and the bank’s management.
10. Identify the persons and/ or committees that are responsible for managing interest rate risks taking into account the separation of duties in the main elements of the risk management process, in order to avoid any potential conflict of interest.
11. Determining the interest rate risks related to any new products that the bank will offer to its customers and ensuring that there are sufficient procedures to reduce these risks before offering these products.

9 5. Ensure that the interest rate risk measurement system includes methods for measuring all types of interest rate risk sources (re-pricing risk, yield curve risk, basis risk, options risk). Fourth: Responsibility for managing interest rate risks

1. Determine the level of interest rate risk acceptable to the bank.
2. Adopting a system for measuring interest rate risks capable of identifying and measuring all sources of these risks.
3. Review the interest rate risk measurement system annually in partnership with other parties in the bank, such as the treasury department, to evaluate the effectiveness of this system and prepare a report on the results of this evaluation for the executive management and the board of directors of the bank.
4. Develop an adequate information system that helps identify, measure, monitor and control interest rate risks.
5. Submitting periodic reports on the level of interest rate risks that the Bank is exposed to the board of directors and the executive management. Fifth: Measuring the interest rate risk in the banking book Banks may use one or more methods to measure interest rate risks in the banking book (such as the Gap Analysis method or the Basis Point Value method or the Value at Risk method, or the Duration method), depending on the size, nature and complexity of the bank’s operations. Provided that the bank discloses the methods used in detail, including an explanation of the used assumptions. Sixth: General Provisions
6. The bank has an appropriate internal control system for the interest rate risks in the banking book, provided that a periodic evaluation of this system is carried out.
7. The bank shall provide the Central Bank with quarterly data according to the measurement method or methods used by the bank about the level of interest rate risk in its banking book, including a detailed explanation of the methodologies and assumptions used, provided that we receive these data no later than the fifteenth of the month following the date of those data.
8. The bank must maintain sufficient capital that is appropriate to the level of interest rate risk in the banking book to which it is exposed.
9. In the event that the Central Bank is convinced that the bank does not maintain sufficient capital to meet the interest rate risks in the banking book, it will ask the bank, at its discretion, any or all of the following: a. Reducing the interest rate risk in its banking book. b. Maintaining additional capital to meet these risks.
10. The Central Bank will assess the adequacy of the internal banks systems in calculating the interest rate risks in the banking book, and in the event that the bank’s internal calculation system is not sufficient to identify and measure these risks, the bank shall amend this system to reach the required standard.
11. Banks that are exposed to interest rate risks in more than one currency must do the same procedure mentioned in item Fifth above for each currency that constitutes (5%) or more of the assets or liabilities of the banking book, so that the remaining exposures (which are less than 5%) are combined and applied to them the same procedure applies for each currency separately.

10 Annex No. (3) Liquidity Risk Management Guidelines First: Responsibilities of the Board of Directors

1. Approving the liquidity management strategy and related policies and procedures, provided that they are reviewed at least once a year.
2. Ensure that the executive management takes the necessary steps to implement the approved strategy and policies related to liquidity risk management.
3. Determining the degree of liquidity risk that the bank can bear or accept by setting the so-called “liquidity risk appetite” in line with its strategy and its ability to obtain funding sources and its ability to manage its liquidity in various circumstances.
4. Ensuring that the executive management and the persons concerned with liquidity management have the necessary expertise.
5. Ensuring that systems are in place to measure and monitor all sources of liquidity risk.
6. Reviewing the periodic reports on the bank's liquidity position and obtaining immediate reports in the event of material changes to its current or future liquidity.
7. Understanding the nature of the relationships between liquidity risk and other risks such as credit, market, operational and reputational risks.
8. Ensure that the executive management takes appropriate corrective measures to meet any new events affecting liquidity. Second: Responsibilities of the Executive Management
9. Develop and implement a liquidity management strategy in line with the degree of liquidity risk appetite, and so that the following is taken into account when preparing this strategy: a. The structure of assets and liabilities. b. The degree of diversity and stability of the bank's funding sources, so that all forms of concentration in these sources are avoided. c. The method of managing liquidity in different currencies at the local and external levels and for different lines of business and various units within the same banking group. d. Daily liquidity management method. e. The criteria used to consider assets as liquid and tradable. f. Liquidity requirements in the normal and stressful situations, whether these situations are caused by bank-specific conditions and/ or market-specific conditions. g. The depth and diversity of the markets the bank deals with and the geographical areas in which it operates.
10. Circulating the liquidity management strategy and the policies necessary to apply it to the various related units within the bank.
11. Determining the administrative structure, responsibilities and controls related to liquidity management and monitoring the liquidity position of the bank, its branches

11 and subsidiaries, taking into consideration any obstacles or restrictions that may affect the transfer of funds. 4. Inform the Board of Directors immediately in the event of any new events affecting liquidity. 5. Managing and monitoring liquidity risks and liquidity needs at the bank level and banking group level, and respond quickly to any material developments within the group. 6. Ensuring that the employees involved in setting internal controls regarding liquidity management have the expertise, competencies and independence, and that they have the authority to object to the information and assumptions provided by business units regarding liquidity. 7. Ensuring that the necessary approvals are obtained to deviate from the policies and ceilings, and ensure that the follow-up actions that must be taken in case the ceilings are exceeded. 8. Approving the standards set related to submitting liquidity reports, including their scope and periodicity for submission to the Board of Directors, the Risk Management Committee, the Asset and Liability Management Committee or to the Executive Management, with the need to specify the entity responsible for preparing these reports. 9. Ensuring the bank's ability to access funding sources and ensuring that these resources are managed effectively 10. Maintaining a sufficient amount of high-quality, unencumbered liquid assets, so that they are used to enhance the bank’s liquidity when needed [through selling or mortgaging them], provided that they are consistent with the degree of complexity of the bank’s activities, the degree of liquidity of its assets and liabilities, and the extent of the mismatch between the due of its sources of funds. So that the size of these assets is linked with the estimates related to the required liquidity needs and the degree of liquidity risk tolerance. 11. Measuring and estimating the future cash flows of assets, liabilities and off-balance sheet liabilities within different time periods and under different circumstances. 12. Using realistic assumptions about the bank's future needs of liquidity in the short and long term, and using conservative assumptions regarding the degree of the bank's assets trading and its ability to obtain financing during the periods in which it faces liquidity problems. 13. Determining the liquidity needs of various foreign currencies and determining the acceptable gap at the level of each currency separately, taking into consideration the extent of the bank's ability to raise funds in foreign currencies, the extent of its ability to convert the surplus in one currency to another currency, and its ability to transfer the surplus from one geographical area to another area, or from any unit within the group to another. 14. Managing liquidity risks resulting from the use of deposits in foreign currencies to finance investments in local currency or vice versa, taking into consideration the risks arising from changes in exchange rates or changes in market liquidity.

12 15. Using several measures to quantitatively measure liquidity risk (including but not limited to: legal liquidity ratio, liquidity according to maturity scale, stress tests and other methods of measuring liquidity risk). 16. Using an approved management information system designed for the purpose of providing senior management in a timely manner with all necessary information about the bank's liquidity position. 17. Ensuring the presence of employees with experience in the characteristics of each country in which the bank operates, in order to know the legal and regulatory aspects that may affect liquidity management and to know the restrictions on transferring funds within the same group. 18. Ensuring the existence of a mechanism that allows the distribution of liquidity to the bank's units that may meet emergency events. With the need to take into account the possibility that these events affect the group as a whole. 19. Maintaining an active presence in the markets that the bank relies on as a source of bank financing by maintaining good relations with the parties that provide it with funds, with the need to know their willingness to provide funds in critical times. 20. Managing intraday liquidity positions and risks by measuring the expected daily cash flows (incoming or outgoing), including anticipating the date of these flows during the day, determining the priority in paying obligations according to their due date, forecasting the potential liquidity deficit during the day and making the necessary arrangements to obtain the financing necessary to meet emergency needs during the day, with the necessity of having policies, procedures and systems to support the liquidity management process during the day. 21. Develop a Contingency Funding Plan that explains the necessary procedures to address the shortage of liquidity in contingency situations, taking into account the following as a minimum: a. The plan should include a clear description of the procedures that must be followed to maintain liquidity and to address liquidity shortfalls, and to clarify the priority actions that must be taken in emergencies, with an explanation of when and how to activate each procedure. b. The plan should clarify the potential sources of funding in contingency situations, the estimated amounts that can be collected from these sources, as well as the time required to provide funds from these sources. c. The plan should be able to meet liquidity issues within a series of different times, including intraday liquidity. d. The plan should contain policies and procedures that would enable the bank’s management to take decisions in a timely manner. So that these decisions are based on prior information, and enable it to implement emergency procedures quickly and skillfully. e. To define roles and responsibilities, including the authority to implement the plan, with the formation of a “Crisis Management Team” to facilitate internal coordination and the decision-making process during periods of liquidity crises.

13 f. The plan should clarify the necessary procedures to achieve the greatest degree of coordination and effective internal communication between the various sites and lines of work in the bank, and also clarify the cases and the mechanism in which communication with external parties such as the Central Bank is carried out. g. Establishing a mechanism that ensures the delivery of consistent, clear, frequent and timely information to internal and external entities such as the Central Bank, shareholders, creditors, employees and any other market participants, in order to support public confidence in the bank in the event of any problems. h. The plan should indicate when and how to communicate with the correspondents, the entities that carry out safe custody, and the clients. i. The plan should reflect the Central Bank's lending programs, guarantee requirements, and procedures to be able to obtain financing from the Central Bank. j. The plan should include the possible steps to meet critical payments at the one-day level, and that critical payments are defined and arranged in order of priority, in the event of scarcity of daily liquidity sources. k. Regularly reviewing and examining the plan to ensure its operational effectiveness, and to ensure that roles and responsibilities are appropriate and understandable, the information sources are kept up-to-date, and to ensure that funds and collateral can be transferred within the group. l. The plan should be consistent with the business continuity plan and be operable when implementing arrangements related to business continuity. With the need to ensure effective coordination between the managing liquidity crises team and the business continuity plan team. m. Maintaining the names of the team members responsible for implementing the plan and detailed information about them such as their locations and how to contact them. In addition to identify the employees who represent the employees who undertake the main tasks. With the need to give the members of the liquidity crisis management team and their representatives the ability to access the plan, whether from inside or outside the bank. n. Review and update the plan at least once a year, after the board of director’s approval or when there is a change in work conditions or in the market, with the need to review all aspects of the plan after each implementation of it and to ensure that follow-up actions have been taken. 22. The bank must effectively manage the available collateral in order to meet the expected or unexpected needs for borrowing and to meet the possible increase in the required collateral, with the need to monitor the place of keeping these collateral and assess the adequacy of some assets as collateral and the extent to which the Central Bank and the money providers accept these assets as collateral and diversify the collateral (assets). So that the concentration in them, their price sensitivity and the hair cut rates that may occur in their values in the event of emergency events are taken into consideration. 23. Develop a set of indicators (quantitative or qualitative) to help early identify of liquidity problems.

14 24. The internal audit department must periodically review the extent to which the framework governing liquidity risk management has been applied and its effectiveness. 25. Disclosure through periodic reports of quantitative information about the bank's liquidity position, in addition to qualitative information about the portfolio of liquidity risk management in a way that clarifies the roles and responsibilities of the board of directors, executive management and various organizational units. Third: General provisions The bank shall provide the Central Bank at the end of the first month of each year with the following:

1. The contingency funding plan and when there are any major amendments to it during the year.
2. Liquidity management strategy.