GOVERNOR

Pursuant to Article 223, paragraph (10) and Article 224, paragraph (7) of the Credit Institutions Act (Official Gazette 22/2026) and Article 43, paragraph (2), item (10) of the Act on the Croatian National Bank (Official Gazette 75/2008, 54/2013 and 47/2020), the Governor of the Croatian National Bank hereby issues the

Decision on the refusal of annual financial statements of credit institutions and the content of an audit for the purposes of the Croatian National Bank

TITLE I GENERAL PROVISIONS

Article 1

(1) This Decision governs in detail:

1) the reasons for the refusal of annual financial statements or annual consolidated financial statements of credit institutions;

2) the content of an audit for the purposes of the Croatian National Bank;

3) the manner of issuing assessments and the range of assessments provided by an audit firm;

4) the reasons for the refusal of audit firms' assessments provided in accordance with the provisions of Article 224, paragraph (1) of the Credit Institutions Act (Official Gazette 22/2026, hereinafter referred to as ‘Act’).

(2) The terms used in this Decision shall have the meaning as laid down in the Credit Institutions Act, with the exception of the term 'ICT system', which shall have the same meaning as the term 'network and information system' as defined in the Credit Institutions Act.

(3) 'Securitisation' and the terms related to 'securitisation' shall have the meaning as defined in Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017), as last amended by Regulation (EU) 2021/557 of the European Parliament and of the Council of 31 March 2021 amending Regulation (EU) 2017/2402 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation to help the recovery from the COVID-19 crisis (OJ L 116, 6.4.2021) (hereinafter referred to as ‘Regulation (EU) 2017/2402').

TITLE II REASONS FOR THE REFUSAL OF ANNUAL FINANCIAL STATEMENTS AND ANNUAL CONSOLIDATED FINANCIAL STATEMENTS OF CREDIT INSTITUTIONS

Article 2

(1) The Croatian National Bank shall refuse annual financial statements or annual consolidated financial statements:

1) where it determines that annual financial statements and annual consolidated financial statements have been prepared contrary to regulations; or

2) where it determines that the annual financial statements and annual consolidated financial statements that received an unqualified opinion in the audit report fail to provide a true and fair view of a financial position and performance.

(2) For the purposes of this Decision, annual financial statements or annual consolidated financial statements have been prepared contrary to regulations:

1) if such statements have been prepared contrary to the provisions of regulations governing the structure and content of annual financial statements of credit institutions or if they have not been prepared in such a way that the forms prescribed under these provisions of regulations are an integral part of annual financial statements, following the statements themselves, and if there is no clear reference between published and prescribed annual financial statements with an explanation of differences;

2) if such statements have been prepared contrary to the applicable financial reporting framework and contrary to the provisions of Regulation (EC) No 1606/2002 of the European Parliament and of the Council of 19 July 2002 on the application of international accounting standards (OJ L 243, 19.7.2002) and Commission Regulation (EU) 2023/1803 of 13 August 2023 adopting certain international accounting standards in accordance with Regulation (EC) No 1606/2002 of the European Parliament and of the Council (OJ L 237 26.9.2023, p. 1); and

3) if the Croatian National Bank determines that the delivered annual financial statements or annual consolidated financial statements have not been mutually reconciled or have not been prepared correctly in terms of calculation and logic.

(3) For the purposes of this Decision, the annual financial statements and annual consolidated financial statements that received an unqualified opinion in the audit report fail to provide a true and fair view of a financial position and performance, and of cash flows of a credit institution or a group where, in the exercise of supervision, the Croatian National Bank identifies illegalities, irregularities and weaknesses in the operation of the credit institution or the group of credit institutions in the RC that materially influence a statement of a financial position and performance, and of cash flows in annual financial statements or annual consolidated financial statements or where it establishes the existence of facts that jeopardise the ability of the credit institution or the group to continue as a going concern.

TITLE III AUDIT FOR THE PURPOSES OF THE CROATIAN NATIONAL BANK

Article 3

For the purposes of this Decision, 'audit for the purposes of the Croatian National Bank' means a procedure for the verification and assessment of the following, carried out by the audit firm of a credit institution:

1) compliance with risk management rules;

2) the adequacy of operations of the risk control function, the compliance function and the internal audit function;

3) the state of digital operational resilience and the adequacy of ICT risk management, in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) (OJ L 333, 27.12.2022) (hereinafter referred to as Regulation (EU) 2022/2554) and the Act on the Implementation of

Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (Official Gazette 136/2024);

4) the compliance of securitisations with the STS criteria provided for in Articles 19 to 22, Articles 23 to 26 or Articles 26(a) to 26(e) of Regulation (EU) 2017/2402, if the credit institution participates in such securitisation; and

5) the regularity, accuracy and completeness of the reports delivered by a credit institution to the Croatian National Bank.

Article 4

(1) An audit firm shall assess whether a credit institution complies with risk management rules in accordance with the provisions of Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013) and delegated regulations adopted under the provisions of that Regulation, the provisions of the Act and rules adopted pursuant to the Act.

(2) An audit firm shall assess whether a credit institution adequately manages the following risks:

1) credit risk;

2) liquidity risk;

3) market risks;

4) interest rate risk arising from non-trading book activities;

5) operational risk;

6) risk of money laundering and terrorist financing; and

7) other risks to which a credit institution or a group is significantly exposed in its operation, and which might affect the safety and stability of the operation of the credit institution or the group.

(3) An audit firm shall provide an assessment of compliance with the rules on the management of the risks referred to in paragraph (2) of this Article based on an assessment of:

1) compliance with prescribed organisational requirements regarding the management of a particular risk;

2) compliance with prescribed requirements regarding policies and procedures for the management of a particular risk;

3) the implementation of adopted policies and procedures;

4) the adequacy of identifying, measuring and monitoring a particular risk; and

5) the adequacy and efficiency of internal control systems relating to the management of a particular risk.

(4) An audit firm shall also assess the regularity and accuracy of the calculation of asset impairment and provisions for off-balance sheet items of a credit institution in accordance with International Financial Reporting Standard 9 – Financial Instruments, for the following:

1) models for the calculation of expected credit losses on exposures for which the credit risk on a debtor’s individual exposure has not increased significantly after initial recognition and for exposures for which the credit risk on a debtor’s individual exposure has significantly increased after initial recognition;

CROATIAN NATIONAL BANK
EUROSYSTEM

2) indicators for establishing a significant increase in the credit risk on a debtor’s individual exposure after initial recognition;

3) the quality of data obtained from the information system for the purposes of calculating expected credit losses;

4) conversion factors the credit institution applies in the calculation of expected credit losses on off-balance sheet items; and

5) the adequacy of the calculation of impairment or provisions for defaulted exposures.

Article 5

(1) When providing an assessment of internal control functions, an audit firm shall verify and assess at a minimum whether:

1) a credit institution has established stable and efficient internal control functions;

2) the credit institution has organised an internal audit function as a separate organisational unit, functionally and organisationally independent both from the activities it audits and from other organisational units of the credit institution;

3) a credit institution has established internal control functions so as to avoid conflicts of interest;

4) the bylaw on internal control functions is adequate and adopted by the management board subject to the prior approval of the supervisory board;

5) a credit institution has ensured, proportionally to its size and the nature, scale and complexity of its activities, a sufficient number of persons with adequate knowledge and experience for the carrying out of internal control function activities;

6) annual internal control function work plans are adopted and appropriate;

7) internal control functions prepare internal control function work reports; and

8) internal control functions perform the activities assigned to them.

(2) An audit firm shall provide an assessment of the internal control functions referred to in paragraph (1) of this Article with respect to the requirements laid down in the Act and subordinate legislation adopted under the Act.

Article 6

(1) An audit firm shall carry out an audit of ICT risk management and ICT systems and provide an assessment of the state of a credit institution's digital operational resilience and the adequacy of the ICT risk management, in accordance with Regulation (EU) 2022/2554 and the Act on the Implementation of Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector.

(2) An audit firm shall:

1) apply the methods and procedures for an audit of ICT risk management and ICT systems based on risk assessment;

2) define the scope of an audit of ICT risk management and ICT systems based on risk assessment prior to the beginning of an audit;

3) define the depth of an audit of ICT risk management and ICT systems, depending on the current state of digital operational resilience and ICT systems; and

4) verify whether the credit institution complies with:

a) the Act and subordinate legislation adopted under the Act relating to ICT risk management and ICT systems;

b) Regulation (EU) 2022/2554 and implementing and regulatory technical standards adopted under that Regulation and the Act on the Implementation of Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector.

    (3) Based on an audit of ICT risk management and ICT systems, an audit firm shall warn of significant risks to which the credit institution is exposed.

Article 7

(1) If the credit institution participates in a securitisation as an originator, original lender, sponsor or founder of an SSPE, the credit firm shall assess compliance with the STS criteria and requirements provided for in Articles 19 to 22, Articles 23 to 26 or Articles 26(a) to 26(e) of Regulation (EU) 2017/2402, depending on the type of securitisation.

(2) When providing the assessment, the audit firm shall describe how the STS criteria provided for in Articles 19 to 22 or Articles 24 to 26 or Articles 26(b) to (26)e have been complied with.

(3) An audit firm shall warn in the audit report if it identifies risks to which the credit institution is exposed arising from securitisation which are not appropriately addressed by the credit institution’s existing risk management system.

Article 8

(1) In auditing the reports delivered to the Croatian National Bank, an audit firm shall verify the regularity, accuracy and completeness of the reports delivered in accordance with:

1) the Decision on supervisory reports of credit institutions (Official Gazette 100/2026), for the following reports:

• Report on credit risk exposure by risk categories (RS4)

• Report on investment in companies’ capital (UKT5)

• Report on tangible assets (MIKI4)

• Report on tangible assets acquired by the credit institution in exchange for its claims (PIKI2)

• Report on exposure to protection providers (IDZ2)

• Report on exposures to persons in special relationship with the credit institution (POKI3)

• Balance Sheet Statement: assets (F 01.01)

• Balance Sheet Statement: liabilities (F 01.02)

• Balance Sheet Statement: equity (F 01.03)

• Statement of profit or loss (F 02.00)

• Performing and non-performing exposures (F 18.00)

CROATIAN NATIONAL BANK
EUROSYSTEM

• Forborne exposures (F 19.00)

  2) Commission Implementing Regulation (EU) 2024/3117 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to supervisory reporting of institutions and repealing Commission Implementing Regulation (EU) No 2021/451 (hereinafter referred to as 'Regulation (EU) 2024/3117') for the following reports:

• Own funds (C 01.00)

• Own funds requirements (C 02.00)

• Capital ratios (C 03.00)

• Detailed information on securitisations (C 14.00)

• Exposures and losses from lending collateralised by immovable property (C 15.00)

• Large exposure limits (C 26.00)

• Identification of the counterparty (C 27.00)

• Exposures in the non-trading and trading book (C 28.00)

• Details of the exposures to individual clients within groups of connected clients (C 29.00)

• Leverage ratio calculation (C 47.00)

• Balance Sheet Statement: assets (F 01.01)

• Balance Sheet Statement: liabilities (F 01.02)

• Balance Sheet Statement: equity (F 01.03)

• Statement of profit or loss (F 02.00)

• Performing and non-performing exposures (F 18.00)

• Forborne exposures (F 19.00)

• Evaluation of the IRRBB: – EVE/NII SOT and MV changes (J 01.00).

  (2) An audit firm shall verify the regularity, accuracy and completeness of the reports referred to in paragraph (1) of this Article by assessing whether they have been prepared in accordance with the Act and subordinate legislation adopted under the Act and Regulation (EU) 2024/3117.

  (3) An assessment of the reports referred to in paragraph (1) of this Article shall be provided in the form of a statement that the reports have been prepared in accordance with the Act and subordinate legislation adopted by the Croatian National Bank and Regulation (EU) 2024/3117.

  (4) Individual reports referred to in paragraph (1) of this Article shall also be signed by a person from the credit institution's management board responsible for reporting.

Article 9

(1) Based on an audit for the purposes of the Croatian National Bank, an audit firm shall prepare an audit report.

(2) Assessments of an audit for the purposes of the Croatian National Bank shall range from completely satisfactory to completely unsatisfactory, in particular: satisfactory, mostly satisfactory, partly satisfactory, and unsatisfactory.

(3) The assessments provided should be reasoned.

(4) The audit report referred to in paragraph (1) of this Article shall contain:

1) a separate assessment of compliance with rules on the management of each individual risk referred to in Article 4, paragraph (2) of this Decision;

2) a separate assessment in accordance with the requirements of Article 4, paragraph (4) of this Decision;

3) a separate assessment of the adequacy of the operations of the risk control function, the compliance function and the internal audit function referred to in Article 5 of this Decision;

4) a separate assessment of the state of a credit institution's digital operational resilience and the adequacy of the ICT risk management in accordance with Article 6 of this Decision;

5) a separate assessment of compliance of securitisation with the STS criteria in accordance with the requirements of Article 7 of this Decision.

6) a separate assessment of the regularity, accuracy and completeness of the reports delivered to the Croatian National Bank in accordance with the provisions of Article 8, paragraph (1) of this Decision;

7) a list of deficiencies identified in the course of an audit for the purposes of the Croatian National Bank;

8) recommendations for the improvement of policies, procedures and processes relating to the management of the risks referred to in Article 4, paragraph (2) of this Decision; and

9) a statement as regards recommendations and deficiencies identified by auditors in preceding years.

(5) The audit report referred to in this Article shall be prepared and signed by certified auditors and a legal representative of the audit firm and shall be accompanied by the reports referred to in Article 8, paragraph (1) of this Decision that were subject to audit.

TITLE IV REFUSAL OF AN AUDIT FIRM’S ASSESSMENT FOR THE PURPOSES OF THE CROATIAN NATIONAL BANK

Article 10

Pursuant to the powers referred to in Article 224, paragraph (4) of the Credit Institutions Act, the Croatian National Bank may refuse an audit firm’s assessment and require the credit institution to obtain another assessment by certified auditors of a different audit firm where:

1) it establishes that the assessment is not based on true and objective facts;

2) it establishes that an assessment has not been appropriately justified;

3) in the exercise of supervision of a credit institution or a group of credit institutions in the RC, it identifies significant risks and deficiencies that have not been included in the audit report;

4) the audit firm failed to correct or supplement its assessment pursuant to the request of the Croatian National Bank.

TITLE V TRANSITIONAL AND FINAL PROVISIONS

Article 11

(1) On the date of the entry into force of this Decision, the Decision on the refusal of annual financial statements of credit institutions and the content of an audit for the purposes of the Croatian National Bank (Official Gazette 22/2019, 139/2022 and 150/2024).

(2) This Decision shall enter into force on the eighth day after the day of its publication in the Official Gazette and shall be first applied to annual financial statements and annual consolidated financial statements prepared as at 31 December 2026.

No.:402-091/09-26/AŽ
Zagreb, 28 September 2026

Ante Žigman
Governor

CROATIAN NATIONAL BANK
EUROSYSTEM