Principles for the effective management of climate-related financial risks

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-1 1 Principles for the effective management of climate-related financial risks Contents Issue Page number Chapter A: General 345-1 Introduction 345-1 Application 345-2 Definitions 345-2 Chapter B: Principles for the effective management of climate-related financial risks 345-3 Corporate governance 345-3 Internal control framework 345-5 Capital and liquidity adequacy 345-5 Risk management process 345-6 Monitoring and reporting 345-7 Comprehensive management of credit risk 345-7 Comprehensive management of market, liquidity, operational, and other risks 345-8 Scenario analysis 345-9 Commencement 345-10 Chapter A: General Introduction

1. Climate change may result in physical and transition risks that could affect the safety and soundness of a banking corporation and have broader financial stability implications for the banking system. To address climate-related financial risks within the banking sector, the Basel Committee on Banking Supervision (BCBS) published in June 2022 a principles document for the effective management and supervision of climate-related financial risks.1
2. The publication of the principles for the effective management of climate-related financial risks is intended to promote a principles-based approach to improving management of these risks. The approach at the basis of this Directive is based on the current Basel Framework, particularly the BCPs and SRP, and draws from existing supervisory initiatives undertaken by individual prudential authorities and other international bodies.

1 Principles for the effective management and supervision of climate-related financial risks, Basel Committee on Banking Supervision, June 2022. Note that the numeration of sections in this Directive is aligned with the numeration of sections in the Based Committee document, beginning from Principle 1.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-2 2 3. This document includes 12 high-level principles, which provide banking corporations with guidance on effective management of climate-related financial risks. The principles seek to achieve a balance in improving practices related to the management of climate-related financial risks and providing a common baseline for internationally active banking corporations, while maintaining sufficient flexibility given the degree of heterogeneity and evolving practices in this area. 4. The principles are intended to be applied on a proportionate basis depending on the size, complexity and risk profile of the banking corporation. 5. In addition to climate risks, a banking corporation is liable to be exposed as well to other environmental risks as defined in Section 7. Therefore, it is expected that the banking corporation will also implement, to the extent possible, the principles in this Directive when managing other environment-related financial risks. Application 6. This Directive shall apply to the following entities (to be termed herein as “banking corporation”): (a) A banking corporation, auxiliary corporation, and corporations controlled by the banking corporation listed in Sections 11(a)(3a) and 11(a)(3b) of the Banking (Licensing) Law, 5741-1981. (b) An acquirer as defined in Section 36i of the Banking (Licensing) Law, 5741-1981. Definitions2 7. “Environment-related financial risks/environmental risks” Financial risks that derive from exposure to activities that have the potential for a negative environmental impact or to be affected by such negative impact (“negative environmental impact”—events or processes such as air pollution, land contamination, scarcity of fresh water, desertification, loss of biodiversity, deforestation, earthquake). “Climate-related financial risks/climate risks” Financial risks that derive from exposure to physical risks or transition risks that are caused by, or related to, climate change. Physical risks Financial risks that derive from exposure to the demages of acute climate-related or weather￾related extreme events (such as heat waves, droughts, landslides, floods, fires, or storms)— and/or to damages from chronic processes related to gradual shifts in climate (such as rising sea levels and increased average temperature). Transition risks Financial risks that derive from exposure to the process of adjustment to an economy with low greenhouse gas emissions, which can include, for example, changes in climate and

2 The definitions are based on reports by the NGFS organization, particularly: “Guide for Supervisors: Integrating climate-related and environmental risks into prudential supervision, NGFS, May 2020”.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-3 3 environmental policy, technology, or consumer preferences. Liability risk Financial risks deriving from exposure to lawsuits in which the plaintiffs seek to impose responsibility and/or to receive compensation for damages or losses related to climate change. Chapter B: Principles for the effective management of climate-related financial risks 8. Banking corporations are potentially exposed to climate-related financial risks regardless of their size, complexity or business model. Climate-related financial risk drivers can translate into traditional financial risk categories.3 Banking corporations should therefore consider the potential impacts of climate-related risk drivers on their individual business models and assess the financial materiality of these risks. Banking corporations should manage climate-related financial risks in a manner that is proportionate to the nature, scale and complexity of their activities and the overall level of risk that each banking corporation is willing to accept. 9. Climate-related risk can have wide-ranging impacts in terms of the sectors and geographies it affects. Banking corporations should take into account the unique characteristics of such risks, including but not limited to potential transmission channels, the complexity of the impact on the economy and financial sector, uncertainty related to climate change and potential interactions between physical and transition risks. 10. While some physical and transition risks are already evident, the impacts of climate change could materialize over varying time horizons and are likely to worsen over time. Some climate-related risks may also materialize beyond a banking corporation’s traditional two- to three-year capital planning horizon but within the maturities of longer-dated positions. Other climate risks may materialize over a much longer time horizon. The high degree of uncertainty around the timing of these risks suggests that banking corporations should take a prudent and dynamic approach to developing their risk management capacities. Different time horizons should be considered in the process of risk identification and assessment as well as in scenario analysis. The board of directors and senior management are also expected to take a long-term consideration of climate-related financial risks. 11. The management of climate-related financial risks, and the methodologies and data used to analyze these risks, are currently evolving and are expected to mature over time. Banking corporations should therefore continuously develop their capabilities and expertise on climate-related financial risks commensurate with the risks they face and ensure they have appropriate resources allocated to managing these risks. Corporate governance Principle 1: Banking corporations should develop and implement a sound process for understanding and assessing the potential impacts of climate-related risk drivers on their businesses and on the environments in which they operate. Banking corporations should consider material climate-related financial risks that could materialize over various time horizons and incorporate these risks into their overall business strategies and risk management frameworks.

3 See BCBS, Climate-related risk drivers and their transmission channels, April 2021.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-4 4 12. Banking corporations should take material physical and transition risk drivers into consideration when developing and implementing their business strategies. This includes understanding and evaluating how these risks could impact the resilience of a banking corporation’s business model over the short, medium and longer terms and considering how these drivers may affect a banking corporation’s ability to achieve its business objectives. This also includes understanding and assessing a banking corporation’s exposure to structural changes in the economy, financial system and competitive landscape in which the banking corporation operates as a result of climate-related risk drivers. The board and senior management should be involved in relevant stages of the process, and the approach established by the board should be clearly communicated to the banking corporation’s managers and employees. 13. The board and senior management should consider whether the incorporation of material climate￾related financial risks into the banking corporation’s overall business strategy and risk management frameworks may warrant changes to its compensation policies, taking into account that these should be in line with the business and risk strategy, objectives, values and long-term interests of the banking corporation. 14. Banking corporations’ risk management frameworks should be consistent with their stated goals and objectives. Hence, the board and senior management should ensure that their internal strategies and risk appetite statements are consistent with any publicly communicated climate-related strategies and commitments. Principle 2: The board and senior management should clearly assign climate-related responsibilities to members and/or committees and exercise effective oversight of climate-related financial risks. Further, the board and senior management should identify responsibilities for climate-related risk management throughout the organizational structure. 15. Responsibilities for managing climate-related financial risks should be clearly assigned to board members and/or committees to ensure material climate-related financial risks are appropriately considered as part of the banking corporation’s business strategy and risk management framework. 16. Banking corporations should ensure that the board and senior management have an adequate understanding of climate-related financial risks and that senior management is equipped with the appropriate skills and experience to manage these risks. Where necessary, banking corporations should build capacity and train the board and senior management on climate-related topics, such as through internal workshops or external collaboration with expert organizations. 17. Banking corporations should clearly define and explicitly assign roles and responsibilities associated with identifying and managing climate-related financial risks throughout the banking corporation’s organizational structure and ensure relevant functions and business units have adequate resources and expertise to effectively fulfil responsibilities regarding climate-related financial risk management. Where dedicated climate units are set up, their responsibilities and interaction with existing governance structures should be clearly defined. Principle 3: Banking corporations should adopt appropriate policies, procedures and controls that are implemented across the entire organization to ensure effective management of climate-related financial risks.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-5 5 18. Management of material climate-related financial risks should be embedded in policies, processes and controls across all relevant functions and business units, including, for example, in client onboarding and transaction assessment. Internal control framework Principle 4: Banking corporations should incorporate climate-related financial risks into their internal control frameworks across the three lines of defense to ensure sound, comprehensive and effective identification, measurement and mitigation of material climate-related financial risks. 19. The internal control framework should include a clear definition and assignment of climate￾related responsibilities and reporting lines across the three lines of defense, as noted in Proper Conduct of Banking Business Directive no. 310 on “Risk Management” (hereinafter, Directive 310). 20. In the first line of defense, climate-related risk assessments may be undertaken during the client onboarding, credit application and credit review processes, and in ongoing monitoring and engagement with clients as well as in new product or business approval processes, as noted in Directive 310. Staff in the first line of defense should have adequate awareness and understanding to identify potential climate-related financial risks. 21. The second line of defense, the risk function, should be responsible for undertaking climate related risk assessment and monitoring independently from the first line of defense. This includes challenging the initial assessment conducted by the first line of defense, while the compliance function should ensure adherence to applicable rules and regulations. 22. The third line of defense, the internal audit function, should provide an independent review and objective assurance of the quality and effectiveness of the overall internal control framework and systems, the first and second lines of defense and the risk governance framework in the light of changes in methodology, business and risk profile, as well as in the quality of underlying data. Capital and liquidity adequacy Principle 5: Banking corporations should identify and quantify climate-related financial risks and incorporate those assessed as material over relevant time horizons into their internal capital and liquidity adequacy assessment processes, including their stress testing programs4 where appropriate. 23. Banking corporations should develop processes to evaluate the solvency impact of climate-related financial risks that may materialize within their capital planning horizons. Banking corporations should include climate-related financial risks assessed as material over relevant time horizons that may negatively affect their capital position (i.e., through their impact on traditional risk categories) in their internal capital adequacy assessment process (ICAAP). 24. Banking corporations should assess whether climate-related financial risks could cause net cash outflows or depletion of liquidity buffers, assuming both business-as-usual and stressed conditions (considering severe yet plausible scenarios). Banking corporations should include climate-related

4 As defined in the BCBS report Climate-related financial risks - measurement methodologies, the term stress test is understood as an evaluation of a financial institution’s financial position under a severe but plausible scenario.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-6 6 financial risks assessed as material over relevant time horizons that may impair their liquidity position in their internal liquidity adequacy assessment process. 25. Incorporating climate-related financial risks assessed as material over relevant time horizons into banking corporations’ internal capital and liquidity adequacy assessment processes includes, where appropriate, incorporating physical and transition risks that are relevant to a banking corporation’s business model, exposure profile and business strategy, and are assessed as material over relevant time horizons, into their stress testing programs in order to evaluate the banking corporation’s financial position under severe but plausible scenarios. 26. It is recognized that climate-related financial risks will probably be incorporated into banking corporations’ internal capital and liquidity adequacy assessments iteratively and progressively, as the methodologies and data used to analyze these risks continue to mature over time and analytical gaps are addressed. To this end, banking corporations should start building risk analysis capabilities by identifying relevant climate-related risk drivers that may materially impair their financial condition, developing key risk indicators and metrics to quantify exposures to these risks, and assessing the links between climate-related financial risks and traditional financial risk types such as credit and liquidity risks. Risk management process Principle 6: Banking corporations should identify, monitor and manage all climate-related financial risks that could materially impair their financial condition, including their capital resources and liquidity positions. Banking corporations should ensure that their risk appetite and risk management frameworks consider all material climate-related financial risks to which they are exposed and establish a reliable approach to identifying, measuring, monitoring and managing those risks. 27. The board and senior management should ensure that climate-related financial risks, where material, are clearly defined and addressed in the banking corporation’s risk appetite framework. 28. Banking corporations should regularly carry out a comprehensive assessment of climate-related financial risks and set clear definitions and thresholds for materiality, bearing in mind that a banking corporation’s risk management framework should enable it to recognize all material risks with an integrated firm-wide perspective on risk. These risks may include those posed by concentrations5 in particular those related to industry, economic sectors and geographic regions. As with other material risks, banking corporations should develop appropriate key risk indicators for effective management of material climate-related financial risks that align with their regular monitoring and escalation arrangements. 29. Where appropriate, banking corporations should consider risk mitigation measures such as, but not limited to, establishing internal limits for the various types of material climate-related financial risks to which they are exposed, e.g., in their credit, market, liquidity and operational risk profiles.

5 A risk concentration is any single exposure or group of similar exposures with the potential to produce (i) losses large enough to threaten a bank’s creditworthiness or ability to maintain its core operations or (ii) a material change in a bank’s risk profile. In the context of climate-related financial risks, concentrations could be within and between risk types associated with climate-related financial risks (e.g., between physical risk and transition risk, or between traditional financial risk types) and they could include, but not limited to, geographies, sectors and counterparties.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-7 7 30. Given the evolving nature of climate-related risks, additional channels for transmitting these risks to traditional financial risk categories may yet be undiscovered. As such, banking corporations should monitor future developments and seek to understand and, where possible, manage the impacts of climate-related risk drivers on other material risks should additional transmission channels be identified. Management monitoring and reporting Principle 7: Risk data aggregation capabilities and internal risk reporting practices should account for climate-related financial risks. Banking corporations should seek to ensure that their internal reporting systems are capable of monitoring material climate-related financial risks and producing timely information to ensure effective board and senior management decision-making. 31. A banking corporation’s risk data aggregation capabilities should include climate-related financial risks to facilitate the identification and reporting of risk exposures, concentrations and emerging risks. Banking corporations should have systems in place to collect and aggregate climate￾related financial risk data across the banking group as part of their overall data governance and IT infrastructure. Banking corporations should also put in place processes to ensure that the aggregated data is accurate and reliable. Banking corporations may consider investing in data infrastructure and enhancing existing systems where appropriate to make it possible to identify, collect, cleanse and centralize the data necessary to assess material climate-related financial risks. 32. Banking corporations should consider actively engaging clients and counterparties and collecting additional data in order to develop a better understanding of their transition strategies and risk profiles. Where reliable or comparable climate-related data are not available, banking corporations may consider using reasonable proxies and assumptions as alternatives in their internal reporting as an intermediate step. 33. The reporting should be timely and updated regularly. Banking corporations may consider an appropriate interval for updating internal risk reports, taking into account the evolving nature of climate-related financial risks. 34. Banking corporations should develop qualitative and/or quantitative metrics or indicators to assess, monitor, and report climate-related financial risks. Limitations that prevent full climate risk data assessment should be made explicit to stakeholders where relevant. Comprehensive management of credit risk Principle 8: Banking corporations should understand the impact of climate-related risk drivers on their credit risk profiles and ensure that credit risk management systems and processes consider material climate-related financial risks. 35. Banking corporations should have clearly articulated credit policies and processes to address material climate-related credit risks. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate the impacts of material climate-related risk drivers on their credit risk exposures (including counterparty credit risk) on a timely basis. Banking corporations should incorporate consideration of material climate-related financial risks into the entire credit life cycle, including client due diligence as part of the onboarding process and ongoing monitoring of clients’ risk profiles.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-8 8 36. Banking corporations should also identify, measure, evaluate, monitor, report and manage the concentrations within and between risk types associated with climate-related financial risks. For example, banking corporations could use metrics or heatmaps to assess and monitor concentration of exposure to geographies and sectors with higher climate-related risk. 37. Banking corporations should consider a range of risk mitigation options to control or minimize material climate-related credit risks. These options may include adjusting credit underwriting criteria, deploying targeted client engagement, or imposing loan limitations or restrictions such as shorter￾tenor lending, lower loan-to-value limits or discounted asset valuations. Banking corporations could also consider setting limits on or applying appropriate alternative risk mitigation techniques to their exposures to companies, economic sectors, geographical regions, or segments of products and services that do not align with their business strategy or risk appetite. Comprehensive management of market, liquidity, operational and other risks Principle 9: Banking corporations should understand the impact of climate-related risk drivers on their market risk positions and ensure that market risk management systems and processes consider material climate-related financial risks. 38. Banking corporations should identify and understand how climate-related risk drivers could affect the value of the financial instruments in their portfolios, evaluate the potential risk of losses on and increased volatility of their portfolio, and establish effective processes to control or mitigate the associated impacts. 39. Given the specific characteristics of market risk, analysis of a sudden shock scenario could serve as a useful tool for better understanding and assessing the relevance of climate-related financial risks to a banking corporation’s trading book. Such a scenario could, for example, feature variation in liquidity across assets exposed to climate-related risk and assume variation in the speed at which exposures could reasonably be closed out. 40. In evaluating mark-to-market exposure to climate-related risks, banking corporations may consider how the pricing and availability of hedges could change given different climate and transition pathways, including in the event of a disorderly transition. Principle 10: Banking corporations should understand the impact of climate-related risk drivers on their liquidity risk profiles and ensure that liquidity risk management systems and processes consider material climate-related financial risks. 41. Banking corporations should assess the impacts of climate-related financial risks on net cash outflows (e.g., increased drawdowns of credit lines, accelerated deposit withdrawals) or the value of assets comprising their liquidity buffers. Where material and appropriate, banking corporations should incorporate these impacts into their calibration of liquidity buffers and into their liquidity risk management frameworks. Principle 11: Banking corporations should understand the impact of climate-related risk drivers on their operational risk6 and ensure that risk management systems and processes consider material climate-related risks. Banking corporationsshould also understand the impact of climate-

6 Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-9 9 related risk drivers on other risks7 and put in place adequate measures to account for these risks where material. This includes climate-related risk drivers that might lead to increasing strategic, reputational, and regulatory compliance risk, as well as liability costs associated with climate￾sensitive investments and businesses. 42. Banking corporations should assess the impact of climate-related risk drivers on their operations in general and their ability to continue providing critical operations. Banking corporations are expected to analyze how physical risk drivers can impact their business continuity and to take material climate-related risks into account when developing business continuity plans. 43. Banking corporations should assess the impact of climate-related risk drivers on other risks, such as strategic, reputational, regulatory compliance and liability risk, and take such risks, where material, into account as part of their risk management and strategy-setting processes. Scenario analysis Principle 12: Where appropriate, banking corporations should make use of scenario analysis8 to assess the resilience of their business models and strategies to a range of plausible climate-related pathways and determine the impact of climate-related risk drivers on their overall risk profile. These analyses should consider physical and transition risks as drivers of credit, market, operational and liquidity risks over a range of relevant time horizons. 44. The objective(s) of climate scenario analysis should reflect the banking corporation’s overall climate risk management objectives as set out by its board and senior management. These objectives could include, for example: (1) exploring the impacts of climate change and the transition to a low￾carbon economy on the banking corporation’s strategy and the resiliency of its business model; (2) identifying relevant climate-related risk factors; (3) measuring vulnerability to climate-related risks and estimating exposures and potential losses; (4) diagnosing data and methodological limitations in climate risk management; and (5) informing the adequacy of the banking corporation’s risk management framework, including risk mitigation options. 45. Scenario analysis should reflect relevant climate-related financial risks for banking corporations. This should include the physical and/or transition risks that are relevant to a banking corporation’s business model, exposure profile and business strategy. Scenarios should cover a range of plausible pathways, as appropriate. Banking corporations should consider the potential benefits and limitations of selected scenarios and assumptions (e.g., balance sheet assumption). 46. Banking corporations should build sufficient capacity and expertise to conduct climate scenario analysis that are proportionate to their size, business model and complexity. Larger and more complex banking corporations should be expected to have more advanced analytical capability. 47. Scenario analysis should employ a range of time horizons, from short- to long-term, in order to address different risk management objectives. For instance, shorter time frames may be used to analyze the crystallization of risk within a banking corporation’s typical business planning horizon at a lower level of uncertainty.

7 Examples include strategic, reputational, regulatory, and litigation or liability risk. 8 As stated in the BCBS report Climate-related financial risks - measurement methodologies, scenario analysis is a tool that challenges assumptions made for the purposes of risk analysis. A key feature of the scenarios analyzed is to explore alternatives that may significantly alter the basis for “business-as-usual” assumptions. Accordingly, they need to consider extreme but plausible scenarios.

Supervisor of Banks: Proper Conduct of Banking Business [1] (06/23) Principles for the effective management of climate-related financial risks Page 345-10 10 Longer time frames, which carry higher levels of uncertainty, may be used to evaluate the resiliency of existing strategies and business models to structural changes in the economy, financial system or distribution of risks. 48. The field of climate scenario analysis is highly dynamic, and practices are expected to evolve rapidly, especially as climate science advances. Climate scenario models, frameworks and results should be subject to challenge and regular review by a range of internal and/or external experts and independent functions. Commencement This directive shall go into effect within 24 months from the day it is published. Updates Circular no. 06 Version Details Date 2747 1 Original circular June 11, 2023 Respectfully, Yair Avidan Supervisor of Banks