Form (1/1/01/11)

Central Bank of Jordan

CENTRAL BANK OF JORDAN

Number: 12296/4/2/10
Date: 4/12/1427 AH
Corresponding to: 26/1/2006 AD

---

Compliance Monitoring Instructions

Number (32/2006)
Issued in accordance with the provisions of Article (99/b) of the Banks Law

Given the recent banking developments that confirm the importance of establishing sound management principles in banks and the importance of having mechanisms and frameworks that develop correct practices and preserve sound values and practices in banking operations, and reaffirming the vision of the Central Bank of Jordan in creating a banking system that operates efficiently and competitively and adheres to international standards, we present below the instructions regarding the Compliance Function that banks must follow and take the necessary measures to implement what is contained therein.

---

First: Definitions:

1- Compliance Monitoring:

It is an independent function aimed at ensuring that the bank and its internal policies comply with all laws, regulations, instructions, orders, codes of conduct, standards, and sound banking practices issued by local and international regulatory authorities. It determines, evaluates, advises, monitors, and reports to the Board of Directors regarding the extent of compliance in the bank.

---

2- Compliance Risk (Compliance Risk):

It is the risk of legal or regulatory sanctions, financial losses, or reputational damage that the bank may face due to non-compliance with laws, regulations, instructions, orders, codes of conduct, standards, and sound banking practices.

---

3- Executive Management:

General Managers, their deputies and assistants, consultants, and those in similar positions in the bank or in any subsidiary of the bank.

---

Second: Responsibilities of the Board of Directors and Executive Management:

a- Board of Directors:

1. Approve the compliance monitoring policy and evaluate the effectiveness with which the bank manages "compliance risks" at least once a year, and review it whenever any changes are made to it.

2. Monitor and follow up on the implementation of this policy, and it may appoint a committee emanating from it to undertake this task.

3. Take necessary measures to enhance values of integrity and sound professional practice within the bank in a manner that makes compliance with applicable laws, regulations, instructions, orders, and standards a fundamental objective to be achieved.

b- Executive Management:

1. Develop a written compliance monitoring policy and obtain its approval from the Board of Directors, specifying the procedures to be followed by management and employees and clarifying the main processes regarding identifying and managing "compliance risks" at all levels of the bank, and review this policy periodically and update it if necessary.

2. Disseminate the compliance monitoring policy to all departments and employees of the bank, so that every employee who discovers or suspects violations of laws, regulations, instructions, orders, and sound banking practices or non-conformity of work procedures with them must report this to the Head of Compliance.

3. Ensure that appropriate corrective and/or disciplinary measures have been implemented in case of violations resulting from non-compliance, and report this to the Board of Directors or the Compliance Committee emanating from it immediately (especially in cases of violations that expose the bank to legal sanctions, significant financial losses, or reputational damage), and the bank must inform the Central Bank about them, informing it of each case separately.

4. Observe the separation between the compliance monitoring function and internal audit activities, provided that internal audit policies and programs include auditing compliance monitoring activities.

5. Develop an annual plan at least for managing "compliance risks" in cooperation with the compliance monitoring function. This plan must take into account any deficiencies in the policy, procedures, or implementation, be linked to the effectiveness of the existing "compliance risk" management, and specify the need for any additional policies or procedures to deal with new "compliance risks" resulting from the annual assessment of these risks.

P.O. Box 37 • Amman 11118 Jordan • Phone 4630301 • Email bankcentral / Amman • Fax 4638889, 4634973, 4613308

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

4

6- Establish a permanent and effective compliance monitoring department in the bank as part of the compliance policy, tasked with identifying and evaluating the basic "compliance risks" faced by the bank, ensuring the following requirements are met:

a- It must be independent of other bank activities and operations.

b- The compliance monitoring function must exist in the bank's organizational structure and have a tangible presence.

c- Establish a clear and organized framework of responsibilities and procedures that ensure effective operation in this function, and define its relationship with other functions and departments in the bank.

d- Ensure the availability of sufficient authorities empowering compliance monitoring staff to communicate with any bank employee and access files and records, as well as access to necessary information enabling them to perform their duties.

e- Provide authorities to conduct necessary investigations to determine the causes of violations, and request assistance from bank specialists (Legal Department, Internal Audit Department) or any external body without violating the banking secrecy provisions in the Banks Law.

f- Define the duties of the heads of this function in preparing reports, which are submitted to the Board of Directors or the Compliance Committee emanating from it, with a copy to the Executive Management.

g- Provide the Compliance Monitoring Department with sufficient human resources to enable it to execute its responsibilities efficiently and effectively.

h- There must be a Head of Compliance who assumes comprehensive responsibilities to coordinate the management of "compliance risks" in the bank and is responsible for managing the daily tasks of the compliance monitoring function and supervising the activities performed by other compliance monitoring staff.

i- Do not assign compliance monitoring staff, specifically the Head of Compliance, to executive tasks where there is a potential conflict between their compliance monitoring responsibilities and any other responsibilities or functions they are assigned.

Form (1/1/09)

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

5

j- Staff executing the responsibilities of the compliance monitoring function must possess the following:

1. Qualifications, experience, and personal and professional characteristics that enable them to perform their duties efficiently.

2. Proper understanding of the laws, rules, and standards the bank must comply with and their impact on bank operations.

3. Keep abreast of developments in the laws, rules, and standards the bank must comply with through continuous learning and training.

Third: Tasks of the Compliance Function:

1- Assist Executive Management and bank employees in managing the "compliance risks" faced by the bank.

2- Advise Executive Management on applicable laws, regulations, and standards, and any amendments thereto.

3- Provide the Board of Directors with the results reached in case of a breach of a specific law or certain policies, and place necessary recommendations to mitigate associated risks, and provide a copy to Executive Management.

4- Evaluate the adequacy of the bank's compliance procedures and guidelines, track any identified deficiencies, and formulate appropriate suggestions for amendments.

5- Identify, document, and evaluate "compliance risks" related to bank activities based on pre-studied principles, including "compliance risks" associated with developing or introducing a new banking product.

Form (1/1/09)

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

7

6- Educate employees on compliance topics and prepare written guidelines on this matter, such as establishing a compliance manual commensurate with the size, nature, and complexity of the bank's operations and internal organization, a code of practice guidelines, and a code of professional conduct.

7- Ensure adherence to the established compliance monitoring policy through conducting tests and reporting to the Board of Directors or the Committee emanating from it, with a copy to Executive Management. Reports must include an assessment of "compliance risks," tests conducted during the reporting period, violations, identified deficiency aspects, and corrective measures taken.

8- Develop a compliance program specifying the planned activities and tasks referred to in items (1-7) above.

Fourth: General Provisions:

1- The bank must provide the Central Bank with its policies approved by the Board of Directors when these instructions come into force, upon making any amendments to them, and at each assessment.

2- The compliance monitoring policy for foreign banks operating in the Kingdom and any amendments thereto must be approved by the Regional Manager in Jordan and the Group's Head of Compliance, to be presented to the bank's Board of Directors subsequently.

3- The Central Bank must be provided with the names, qualifications, and experience of the Head and staff of Compliance, and any changes thereto as they occur.

4- Based on the size and complexity of their operations, organize the compliance function as a separate unit or assign employees to accompany compliance in their various departments, ensuring no conflict in tasks assigned to them.

Form (1/1/09)

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

7

5- Banks must comply with the laws and instructions in force in all areas where they conduct their activities, and the organization and structure of the compliance function and its responsibilities must be consistent with regulatory and legal requirements.

6- These instructions apply to banks operating in the Kingdom and their subsidiaries.

Fifth: These instructions come into force three months after their issuance.

The Governor
Dr. Amneh Tukan

Compliance Monitoring 2013-7-2002

Form (1/1/09)