Decision on the Scope of Audit of Bank's Annual Financial Statements and Operations

Pursuant to Article 47 paragraph 1 item 6 of the Law on the National Bank of the Republic of North Macedonia (Official Gazette of the Republic of Macedonia No. 158/10, 123/12, 43/14, 153/15, 6/16 and 83/18 and Official Gazette of the Republic of North Macedonia No. 110/21) and Article 106 paragraph 4 of the Banking Law (Official Gazette of the Republic of Macedonia No. 67/07, 90/09, 67/10, 26/13, 15/15, 153/15, 190/16 and 7/19 and Official Gazette of the Republic of North Macedonia No. 101/19 and 122/21), the National Bank of the Republic of North Macedonia Council has adopted the following DECISION on the scope of audit of bank's annual financial statements and operations (Official Gazette of the Republic of North Macedonia No. 83/22)
I. GENERAL PROVISIONS

1. This Decision sets out the scope of audit of bank's annual financial
   statements and operations, conducted by an audit company.
2. For the purposes of this decision, bank audit shall mean:

• audits of annual financial statements prepared by banks on the basis
  of the applicable accounting regulations, and
• audit of bank's operations.
  The audit referred to in paragraph 1 of this item shall be carried out in accordance with the Audit Law, this decision and other audit regulations and standards.

3. Issues not defined in this Decision shall have the meaning of the
   terminology defined in the Banking Law and the bylaws adopted on the basis of this law.
   II. SCOPE OF BANK AUDIT

4. After the bank audit, the audit company shall prepare a Bank's Financial
   Statements Report, i.e. an opinion on whether the bank's annual financial statements are prepared in consistence with the applicable accounting regulations, whether the financial statements provide realistic and impartial view or whether they impartially present, from all material aspects, the bank's financial standing on the date of the financial statements and operating results, and the cash flows for the year ended on the date of financial statements.

5. The audit company shall enclose with the Report (opinion) referred to in
   item 4 of this Decision, bank's audited financial statements (income statement, statement of comprehensive income, balance sheet, statement of changes in equity and reserves, cash flow statement and notes to financial statements), drawn up under the applicable accounting regulations.

6. The audit company shall also enclose the following with the Report
   (opinion) referred to in item 4 of this Decision and to the financial statements referred to in item 5 of this Decision:
   6.1. Letter of the audit company to the bank's board of directors.
   6.2. Review of adjustments in bank's financial statements advised by the audit
   company, grouped into adjustments accepted by the bank, respectively recognized in the financial statements, and adjustments unaccepted by the bank, and a review of unfulfilled disclosure requirements in the financial statements.
   6.3. Review of the level of materiality of financial statements as a whole,
   materiality levels for particular classes of transactions, account balances and disclosures (if any) and the materiality for performing audit, which are determined and applied by the auditor during the bank audit.
   6.4. Reports the bank submits to the National Bank of the Republic of North
   Macedonia (hereinafter: the National Bank) for supervisory purposes as of the date of financial statements that refer to capital adequacy, open foreign exchange position, credit risk, liquidity risk, interest rate risk in the banking book and other risks subject to special reporting defined by the National Bank. These reports shall be prepared by the bank and shall be in compliance with the financial statements referred to in item 5 of this Decision. In the case of adjustments of the annual financial statements, the differences shall be recognized separately.
   6.5. Annex including at least:
   6.5.1. Description of the process of determining internal capital for covering
   risks and description of the process of determining internal liquidity according to the bank's risk profile and/or its environment. The description of the process of determining internal capital for covering risks also contains data and information on the capital adequacy ratio as of the date of the financial statements, the required capital adequacy ratio and activities of the bank to achieve and maintain the required level of own funds and the required capital adequacy ratio (capital plan), and any recommendations of the audit company related to the bank's capital management. The description of the process of determining internal liquidity contains data and information for the determined internal liquidity and current liquidity and their comparison, plan of activities of the bank aimed to achieve and/or maintain the required internal liquidity in accordance with the current and future needs for liquid funds and sources of funds, as well as any recommendation of the audit company related to liquidity risk management by the bank;
   6.5.2. Description of the bank's risk management system, i.e. description of
   the risk management process that is based on the risk appetite and risk culture (risk appetite statement, policies and other internal acts for risk identification, measurement or assessment, control or mitigation and monitoring, stress testing rules, rules for launching new product, activity or system in the bank, rules for using outsourcing, information system) as well as risk management organizational setup, including audit company’s recommendations with regard to risk management, if any. It shall include at least risks covered by regulations of the National Bank concerning risk management methodology, as well as other material risks the bank is exposed to in its operations;

6.5.3. Description of bank's methodology for classifying credit exposures and
calculating expected credit loss on an individual and group basis, i.e. impairment / special reserve; any differences in the level of impairment/special reserve provisions on the date of financial statements between audit company and the bank (on an individual and group basis); criteria on establishing loan portfolios; significant restructuring and write offs of credit exposures performed; bank's methodology for evaluating foreclosed assets and any differences in the level of impairment losses; evaluation of the significant items of the trading book, and significant litigations;
6.5.4. Description of the banks’ compliance with regulations as of the
reporting date of the bank's financial statements. If the audit company becomes aware of considerable irregularities and inconsistencies with the bank's legislation and internal acts in the audited period, it shall indicate them in this part of the annex, including any bank's measures to overcome such inconsistencies;
6.5.5. Description of accuracy and completeness of reports referred to in item
6subitem 6.4 of this Decision, submitted by the bank to the National Bank for supervisory purposes;
6.5.6. Description of the functioning of the internal control systems and the
performance of the internal audit function in accordance with the regulations and any recommendations for improvement;
6.5.7. Description of the information security with respect to its compliance
with the bank's operations and objectives, protection of data and control systems in place as well as any recommendations for improvement. The audit company should provide a commentary on whether the bank has adopted and implemented information security policies and internal acts;
6.5.8. Description of the accuracy and completeness of data the bank is
required to publish as defined by the National Bank regulation on publishing reports and data by the bank;
6.5.9. Description of the bank's anti-money laundering system;
6.5.10. Description of significant changes in the legal and organizational
structure of the bank, significant changes in the scope and structure of financial activities of the bank, and description of the cases and the reasons for sudden resignation of a person with special rights and responsibilities from the bank;
6.5.11. Questionnaires given in Annex 1 to this Decision and constitute its
integral part, filled in and signed by the audit company.
7. Audit of the annual financial statements and of the operations of a banking
group should include:
7.1. Description of the applied consolidation method. If the parent entity of the
banking group changed the consolidation method in the year of auditing the financial statements and operations, the auditor shall emphasize the change, indicate the reasons behind such change and present the effects of such change on the consolidated financial statements;
7.2. Effects of consolidation;

7.3. Description of the banking group composition, indicating the following for
each group member: name, head office, main activity, amount of assets and equity, share of the parent entity in the total number of shares and in the voting shares of each member of the banking group;
7.4. Name of the audit company/companies that audited the banking group
members and the auditor's opinion on their financial statements;
7.5. List of other financial institutions and ancillary banking service companies
which are subordinated entities in the banking group, but are not part of the consolidation for supervisory purposes, indicating the reasons behind their exemption from the consolidation;
7.6. Description of the banking group's risk management systems by describing
the adopted risk management policies and internal acts for risk identification, measurement or assessment, control or mitigation, and monitoring, including audit company's recommendations for risk management.
III. COOPERATION AND REPORTING
8. The audit company shall submit the Report (opinion) referred to in item 4
of this Decision, the financial statements referred to in item 5 of this Decision and the elements of item 6 of this Decision, in accordance with the provisions of the Banking Law.
9. If the bank accepts the adjustments in the annual financial statements of
item 6 subitem 6.2 of this Decision, it shall make respective changes in its business books within the deadline specified for submission of the monthly report on the stock and flow of all accounts as of 30 June of the current year.
10. The bank shall, within 15 days upon adoption of the Report by the meeting
of shareholders, publish the Audit Report on the financial statements, as follows:

• on its website, it shall publish the Report (opinion) of the audit company
  referred to in item 4 of this Decision and the financial statements stated of item 5 of this Decision. They shall be posted on the bank's website at least until the publishing of the Report for the next year;
• in at least one daily newspaper, it shall publish the Report (opinion) of the
  audit company referred to in item 4 of this Decision and the financial statements stated of item 5 of this Decision, without the Notes to the financial statements. The bank subject to consolidated supervision shall publish the Audit Report on consolidated basis, as specified under paragraph 1 of this item, within 15 days upon adoption of the Report by the meeting of shareholders of the parent entity of the banking group.

11. The bank shall submit to the National Bank a copy of the announcement in
    the daily newspaper referred to in item 10 paragraph 1 indent 2 of this Decision within 5 days after the announcement.

IV. TRANSITIONAL AND CLOSING PROVISIONS
12. The provisions of this Decision that apply to banks shall also apply to foreign
bank branches and savings houses.
13. This Decision shall enter into force on the eighth day following that of its
publication in the Official Gazette of the Republic of North Macedonia, and shall apply from 1 July 2022.
14. Once this Decision starts being applied, it shall supersede the Decision on
the scope of audit of the bank's annual financial statements and operations (Official Gazette of the Republic of Macedonia No. 116/14). D. No. 02-15/V-2/2022 31 March 2022 Skopje Anita Angelovska Bezhoska Governor Chairperson of the Council of the National Bank of the Republic of North Macedonia

Annex 1
Questionnaire
Equity, own funds and capital adequacy YES NO Comment 1 1 Has the bank established a process of determining the internal capital for covering risks to which it is or might be exposed in its operations? 2 Does the process of determining the internal capital cover all material risks to which the bank is or may be exposed in its operations? 3 Has the bank established a process of determining the internal capital on individual and consolidated basis (if the bank is a parent entity)? 4 Does the bank conduct stress testing to determine the impact of shocks on the capital adequacy? 5 Does the bank take into consideration the results from stress tests in determining the internal capital for covering individual risks and total internal capital? 6 Has the bank developed a capital plan to achieve and maintain the required level of own funds, i.e. the necessary capital adequacy (if required to develop such a plan under the National Bank regulation on risk management methodology)? 7 Does the bank review the process of establishing internal capital, including all internal acts that document its implementation? 8 Has the bank's internal audit established internal acts for evaluating the process of determining internal capital, the achievement and maintenance of the level of own funds and the required capital adequacy of the bank, as well as the accuracy and reliability of the report on the process of determining internal capital in accordance with the National Bank regulation on risk management methodology? 9 Is the capital adequacy calculated as prescribed by the methodology of the National Bank? 10 Does the bank meet capital buffer requirements? 11 Does the bank calculate the maximum distributable amount of earnings and is the calculation in accordance with the National Bank methodology? 12 Does the bank perform the activities specified in the capital conservation plan (if any)? 13 Does the supervisory board approve the acquisition of capital holdings and the purchase of securities exceeding 5% of the bank's own funds? 14 Does the bank's property in land, buildings, equipment, and capital holdings in non-financial institutions exceed 60% of the bank's own funds? 15 Does the aggregate amount of capital holdings of the bank in non-financial institutions exceed 30% of the bank's own funds?

In the column "Comment", the audit company may provide more detailed explanation of individual questions.

16 Does any individual capital holding of the bank in non￾financial institution exceed 15% of the bank's own funds? 17 Does the bank exercise control in a non-financial institution, excluding ancillary banking service companies? 18 Does the bank hold over 5% of the shares of another bank or non-banking financial institution holding above 5% of the bank's total shares? 19 Has any shareholder with qualified participation in the bank sold a portion of their shares thus reducing the participation below the threshold for which it was granted an approval by the National Bank, without notifying the National Bank thereon? 20 Has the bank notified the National Bank on any change in the equity structure or on a new issue of shares? 21 Is there an agreement pooling the bank shareholders' voting rights from their shares in the bank? 22 Are transactions in own shares executed in accordance with the regulations? 23 Does the bank's internal audit have internal acts in place concerning the bank's own funds and capital adequacy? 24 Is the internal audits frequency in this field in line with the volume of activities and the bank's exposure to risks? 25 Are the recommendations provided by the internal audit observed? 26 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 2 ________________ Signature ______________

2 Please indicate the audit company's officer/officers who completed the questionnaire.

Credit risk YES NO Comment
1 Does the bank have policy and internal acts in place for credit risk management? 2 Are credit risk management policies and internal acts adopted by an appropriate body? 3 Does the credit risk management policy include general rules for the organizational setup of credit risk management; is it based on the risk appetite statement and risk culture; is it consistent with the bank's development plan and business policy ? 4 Do the credit risk management policy and internal acts cover stages of credit risk identification, measurement, control or mitigation, and monitoring? 5 Are the credit risk management policy and internal acts of the bank regularly reviewed? 6 Has the bank established an organizational structure with clearly defined responsibilities and lines of accountability, cooperation and exchange of information in credit risk management? 7 Do the bank's employees involved in the process of approving and monitoring loans, and in credit risk management, understand the credit policy and internal acts and do they follow them? 8 Are the obligations of individuals and organizational units responsible for credit risk management and for back office operations related to lending as well as of persons and organizational units responsible for lending activity and taking credit risk, clearly defined? 9 Has the bank established a system for managing exposure concentration risk, country risk and counterparty risk? 10 Does the bank assess the market value of collateral on credit exposure in accordance with regulation? 11 Is the use of approved loans controlled and monitored in terms of their intended use based on signed contracts? 12 Does the bank have a reporting system in place for reporting on at least:
 structure of total credit exposure,
 total credit exposures to affiliated entities,  non-performing exposures,  migration of credit exposures from one risk category to another within a specified period,  credit exposures approved on the basis of permissible exceptions,  results of stress testing,  restructured credit exposures,  written off credit exposures and credit exposures carried forward to off-balance sheet,  level and trends of expected loan loss i.e. impairment and special reserve,

 collected non-performing, written-off credit exposures and credit exposures carried forward to off-balance sheet,  claims sold? 13 Does the system provide timely and accurate management reporting to the management and supervisory bodies on the bank's exposure to credit risk? 14 Does the bank have an assigned person /organizational unit for managing non-performing exposures? 15 Does the exposure to a entity and entities connected thereto exceed 25% of the bank's own funds? 16 Does the exposure to bank's subsidiary exceed 10% of the bank's own funds? 17 Does the exposure to a shareholder with qualified participation in the bank and the entities connected thereto exceed 10% of the bank's own funds? 18 Does the exposure to a person with special rights and responsibilities and to entities connected thereto exceed 3% of the bank's own funds? 19 Does the total exposure to the persons/entities referred to in questions 16, 17 and 18 exceed 65% of the bank's own funds? 20 Does the bank adequately identify deductible items from exposure when determining exposure limits referred to in questions 16, 17 and 18? 21 Have the credits and other types of exposure to the persons/entities referred to in questions 16, 17 and 18 exceeding Denar 6 million each, been extended on the basis of a decision of the bank's supervisory board? 22 Are the lending terms and all other forms of exposures to the persons/entities referred to in questions 16, 17 and 18 more favorable compared to the terms that apply to other bank's clients, at equal risk level? 23 Does the total amount of large exposures (above 10% of the bank's own funds) exceed eight times of the bank's own funds? 24 Has the bank approved any loan or established another form of exposure which is used to purchase shares in the same bank? 25 Has the bank approved any loan or established another form of exposure by a pledge of shares issued by the same bank? 26 Does the bank, when classifying credit exposure, take into account client’s creditworthiness or project quality, and the changes in client’s creditworthiness or project quality and debt repayment regularity? 27 Has the bank established an appropriate system for determining, tracking, reporting and recording related parties, large exposures and exposure limits, in accordance with the National Bank regulations for the manner of determining related parties and exposure limits? 28 Does the bank, when determining the client's creditworthiness, take into account any effects of those associated with the client?

29 Does the bank assess client’s creditworthiness at the time of approval of credit exposure and upon changes to the agreed conditions (for all clients - individuals and legal entities), and at least once every six months or more often if the criteria on increasing credit risk are met (only for legal entities)? 30 Does the bank document the method of determining the collateral value, i.e. does the bank properly include the collateral value in the calculation of the present value of expected future cash flows? 31 Does the bank document the date of expected foreclosure in the calculation of the present value of expected future cash flows? 32 Has the bank considered in its internal acts, criteria on defining, identifying and monitoring non-performing credit exposures and on taking collection and/or sale activities? 33 Has the bank defined credit risk exposure thresholds, early warning thresholds and internal limits on credit risk exposure, and does it apply and monitor them? 34 Has the bank defined any allowable exceptions and procedure for their approval in its internal acts? 35 Has the bank determined and applied specific criteria for granting loans in foreign currencies and in Denars with FX clause? 36 Has the bank established quantitative limits on the share of credit exposure in foreign currency and in denars with FX clause in the total credit exposure of the bank? 37 Does the bank have quantitative limits for DTI and LTV ratios when approving and monitoring loans in foreign currency and in denars with FX clause? 38 Does the bank keep credit file for each client/project which contains information on the client identity, creditworthiness, project quality, timeliness in loan repayment and collateral quality? 39 Has the bank's internal audit adopted internal acts for auditing credit function and credit risk management? 40 Is the frequency of internal audits of credit risk consistent with the scope of lending and the bank's exposure to this risk, as well as with the established system of risk management? 41 Are the internal audit recommendations observed? 42 Does the bank conduct documented analysis when launching a new product or service to assess their impact on the exposure to credit risk and the process of risk management? 43 Does the bank perform stress testing of credit risk exposure? 44 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 3 ________________ Signature ______________

3 Please indicate the audit company's officer/officers who completed the questionnaire.

Interest rate risk in the banking book YES NO Comment 1 Has the bank established a policy and internal acts for managing interest rate risk in the banking book? 2 Are policies and internal acts for managing interest rate risk in the banking book adopted by an appropriate authority? 3 Does the bank's policy for managing interest rate risk in the banking book include general rules for the organizational setup of managing interest rate risk in the banking book; is it based on the risk appetite statement and risk culture i.e. is it consistent with the bank's development plan and business policy? 4 Are policies and internal acts for managing interest rate risk in the banking book include the stages of risk identification, measurement or assesment, control and monitoring? 5 Are the bank's policy for managing interest rate risk in the banking book and other relevant internal acts regularly reviewed depending on the market conditions and the bank's scope of activities? 6 Do the bank's employees involved in the process of managing interest rate risk in the baking book understand the policy and internal acts for managing this risk and do they follow them? 7 Has the bank defined interest rate exposure thresholds in the banking book, early warning thresholds and internal limits on interest rate risk exposure in the banking book, and does it apply and monitor them? 8 Has the bank defined any allowable exceptions and procedure for their approval in its internal acts? 9 Has the bank been using any financial instruments to hedge any interest rate risk in the banking book (derivatives)? 10 Does the bank enter into new agreements where the interest rate changes with a decision of a bank’s competent body (adjustable interest rate)? 11 Are activities to hedge interest rate risk in the banking book within the organizational structure of the bank segregated from the trading book activities? 12 Does the bank conduct documented analysis when launching a new product or service to assess their impact on the exposure to interest rate risk in the banking book and the process of risk management? 13 Does the bank's internal audit have internal acts in place for auditing the management of interest rate risk in the banking book? 14 Is the frequency of internal audits of the interest rate risk in the banking book consistent with the bank's exposure to this risk and with the established risk management system? 15 Does internal audit also include assessment of assumptions and techniques used by the bank to measure interest rate risk in the banking book? 16 Are the internal audit recommendations observed?

17 Does internal audit cover the measures taken by the bank if the change in the economic value of the banking book as a result of exposure to the interest rate risk is equal to or greater than 20% compared to its own assets? 18 Does the bank have reporting system in place for managing interest rate risk in the banking book which is in line with the scope and complexity of the bank's activities? 19 Does the system provide timely and accurate management reporting on the bank's exposure to interest rate risk in the banking book? 20 Does the bank conduct stress testing of the exposure to interest rate risk in the banking book? 21 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 4 ________________ Signature ______________

4 Please indicate the audit company's officer/officers who completed the questionnaire.

Liquidity risk YES NO Comment
1 Does the bank have policy and internal acts in place for liquidity risk management? 2 Are the policy and internal acts for liquidity risk management adopted by an appropriate authority? 3 Does the bank’s liquidity risk management policy include general rules for the organizational setup of liquidity risk management; is it based on the risk appetite statement and risk culture i.e. is it consistent with the bank's development plan and business policy ? 4 Does the liquidity risk management policy and internal acts in place include the stages of risk identification, measurement, control or mitigation, and monitoring? 5 Are the policy and internal acts for liquidity risk management regularly reviewed? 6 Do the bank's employees involved in liquidity risk management process understand the liquidity risk management policy and internal acts and do they follow it? 7 Is the liquidity coverage ratio calculation in consistence with the National Bank methodology? 8 Has the bank defined a liquidity coverage ratio threshold, early warning threshold and internal limit on liquidity coverage ratio in its internal acts and does it apply and monitor them? 9 Has the bank defined any internal liquidity indicators within its internal acts? 10 Has the bank defined any allowable exceptions and procedure for their approval in its internal acts? 11 Has the bank defined internal liquidity indicators thresholds, early warning thresholds and internal limits on liquidity risk exposure in its internal acts and does it apply and monitor them? 12 Does the bank, for the purposes of liquidity risk management, monitor the liquidity by each relevant currency? 13 Has the bank established an internal liquidity assessment process? 14 Does the internal liquidity assessment process cover all existing and potential material risks to the bank’s liquidity? 15 Does the bank prepare a plan of activities to achieve and/or maintain internal liquidity as required by the current and future liquidity needs and funding sources? 16 Does the bank review its internal liquidity assessment process, including all internal acts that document its implementation? 17 Does the bank have access to open irrevocable credit lines or other liquidity sources which may be used promptly and unconditionally in the case of liquidity shortage? 18 Does the bank monitor the price of funding sources and their maturity and does it use funding sources under conditions less favorable than the market ones? 19 Does the bank monitor the level of core retail deposits?

20 Does the bank monitor the concentration of funding sources by depositor and by type of instruments/products? 21 Does the bank monitor the possibility for renewal of funding sources? 22 Does the bank determine and track available unencumbered funds that can be used as collateral for obtaining additional funding sources? 23 Has the bank defined a method of using funds from the National Bank, including the method of monitoring the values of instruments that the National Bank accepts as collateral for a loan of last resort? 24 Has the bank developed emergency plan for liquidity risk management? 25 Is the emergency plan for liquidity risk management periodically revised following the changes in internal and external operating environment of the bank? 26 Does the bank's internal audit have internal acts in place for auditing liquidity risk management? 27 Is the frequency of internal audits of liquidity risk consistent with the bank's exposure to this risk and the established liquidity management system? 28 Are the internal audit recommendations observed? 29 Does the bank conduct documented analysis when launching a new product or service to assess their impact on the liquidity risk exposure and the process of liquidity risk management? 30 Does the bank have reporting system in place for liquidity risk management that suits the scope and complexity of the bank's activities? 31 Does the system provide timely and accurate management reporting on the bank's exposure to liquidity risk? 32 Has the bank informed the National Bank on time of the reduction of liquidity coverage ratio below minimum level requirement? 33 Does the bank conduct stress testing for liquidity risk exposure? 34 Does the bank consider the stress-testing results when determining internal liquidity? 35 Has the bank established a special body responsible for asset and liabilities management? 36 Can the bank provide information on depositors and their deposits insured in the Deposit Insurance Fund? 37 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 5 ________________ Signature ______________

5 Please indicate the audit company's officer/officers who completed the questionnaire.

Market risk YES NO Comment
1 Does the bank have policy and internal acts in place for market risk management? 2 Are policies and internal acts for market risk management adopted by an appropriate authority? 3 Does the bank’s market risk management policy include general rules for the organizational setup of market risk management; is it based on the risk appetite statement and risk culture i.e. is it consistent with the bank's development plan and business policy ? 4 Do the market risk management policy and internal acts include stages of market risk identification, measurement, control or mitigation, and monitoring? 5 Are the market risk management policy and internal acts regularly reviewed? 6 Do the bank's employees involved in market risk management process understand the market risk management policy and internal acts and do they follow them? 7 Has the bank established in its organizational structure, a clear operational and organizational division between trading activities and back-office activities, including a clear segregation of duties and competences of persons with special rights and responsibilities in charge of trading activities and back office activities? 8 Do only authorized persons have access to the trading system, the records and to important documents? 9 Has the bank defined market risk exposure ratio thresholds, early warning thresholds and internal limits on market risk exposure in its internal acts and does it apply and monitor exposure limits on market risk and is there a system to identify breach of limits? 10 Has the bank defined any allowable exceptions and procedures for their approval within its internal regulations? 11 Does the bank use any financial instruments to hedge market risk exposure (derivatives)? 12 Is there a daily monitoring of trading risks, at least of the data on executed trades, thresholds reached and internal limits and their exceeding, as well as of the results of executed trades? 13 Is the bank’s board of directors informed forthwith of any exceeding the set thresholds and internal limits? 14 Does the bank conduct documented analysis when launching new instruments to assess their impact on the market risk exposure and the process of market risk management? 15 Does the bank's information system provide data and reports on the currency structure of trading items, executed trading transactions over a certain period, as well as reports by type of transaction, organizational unit and type of financial instrument?

16 Does the bank's information system provide data and reports on the significant (large) transactions with deviation from market conditions, on the compliance with the set thresholds and internal limits, and on the compliance of any exceptions with the bank's procedures? 17 Does the bank's information system provide an overview of current and cumulative trading results, at least on a monthly and annual basis? 18 Does the bank's internal audit have internal acts in place to audit bank's market risk management? 19 Is the frequency of internal audits of market risk consistent with the level of the bank's exposure to this risk and the market risk management system? 20 Are the internal audit recommendations observed? 21 Does the bank perform stress-testing on the trading portfolio and all transactions that represent exposure to market risk, and does the bank periodically check and test the systems for measuring market risk? 22 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 6 ________________ Signature ______________

6 Please indicate the audit company's officer/officers who completed the questionnaire.

Operational risk YES NO Comment
1 Does the bank have policy and internal acts in place for operational risk management? 2 Are policies and internal acts for operational risk management adopted by an appropriate authority? 3 Does the bank’s operational risk management policy include general rules for the organizational setup of operational risk management; is it based on the risk appetite statement and risk culture i.e. is it consistent with the bank's development plan and business policy? 4 Do the bank's policy and internal acts for operational risk management include stages of risk identification, assessment, control or mitigation, and monitoring? 5 Does the operational risk management policy contain definition of all types of operational risks the bank is exposed to or may be exposed to? 6 Are the bank's operational risk management policy and internal acts regularly reviewed? 7 Do the bank's employees involved in the operational risk management system understand the operational risk management policy and internal acts and do they observe them? 8 Has the bank defined operational risk exposure ratio thresholds, early warning thresholds and internal limits on operational risk exposure in its internal acts and does it apply and monitor them? 9 Has the bank defined any allowable exceptions and procedures for their approval within its internal acts? 10 Has the bank established a system for defining, monitoring and recording the number, size and other relevant data for the significant flawed events and/or significant losses incurred from operational risk? 11 Does the bank take into account internal and external factors that may have a negative impact on its risk profile when identifying operational risk? 12 What instruments does the bank use in identifying and assessing operational risk (e.g. internal audit reports, database, self-assessment, risk indicators, etc.)? 13 Does the bank have in place a database of all internal losses from risk events in accordance with the National Bank regulation on risk management methodology? 14 Does the bank have an information system for operational risk management, which provides data and reports at least on: type of loss from operational risk, main reasons behind the loss, loss amount and measures taken, as well as reports on exposure to operational risk by business line, organizational part, group of transactions, risk event, etc.? 15 Has the bank adopted any internal physical security acts for the purposes of operational risk management? 16 Has the bank established ML/TF risk management policy or program?

17 Are the ML/TF activities separated from the non-ML/TF activities of the bank? 18 Has the bank have in place control of the compliance with ML/TF risk management regulations? 19 Has the bank established the manner of legal risk identification, assessment, control or mitigation, and monitoring in its operational risk management policy and/or internal acts? 20 Has the bank identified sources of legal risk? 21 Does the bank take into account the conduct risk as part of the legal risk management? How does the bank manage conduct risk? 22 Does the bank hold legal risk data (fines, costs of damages, costs of lost court proceedings, etc.) within the operational risk database? 23 Has the bank established a process of regular informing of authorities? What data are regularly reported to the authorities (for example: about sources of legal risk, court proceedings, legal risk mitigation measures and actions) and which authorities are notified? 24 Does the bank conduct documented analysis when launching new product/activity/system to assess their impact on the exposure to operational risk and the risk management process? 25 Does the operational risk management system encompass the bank’s outsourcing companies? 26 Does the bank's internal audit have internal acts in place for auditing operational risk management? 27 Is the frequency of internal audits concerning the operational risk in accordance with the level of banks' exposure to this risk and the established risk management system? 28 Are the internal audit recommendations observed? 29 Is there a clear division of responsibilities and assignment of persons with special rights and responsibilities and/or employees of the bank who will be responsible for taking actions in emergencies or seriously disturbed working conditions in accordance with the business continuity plan and contingency plan? 30 Are the business continuity plan and the contingency plan consistent with the National Bank risk management methodology regulation? 31 Has the bank facilitated testing of the business continuity plan and the contingency plan? 32 Are the bank’s employees familiar with the business continuity plan and the contingency plan? 33 Has the bank facilitated a periodical revision of the business continuity plan and the contingency plan? 34 Does the the business continuity plan include procedures for transferring business processes to remote location?

35 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 7 ________________ Signature ______________

7 Please indicate the audit company's officer/officers who completed the questionnaire.

IT risk YES NO Comment
1 Has the bank established information security and IT risk management policy and internal acts? 2 Has the bank adopted an IT and digital risk management strategy? 3 Are the strategic/operational IT plans observed? 4 Is there an organizational structure in the IT management and segregation of duty among system administrators? 5 Is there a system through which the ISSO will inform the bodies and/or persons with special rights and responsibilities in the bank about IT risk management? 6 Does the bank have an IT risk identification process in place? 7 Are the action plans deriving from risk analyses and cyber attack protection strategy implemented? 8 Are there administrative, technical and physical controls/measures in place to reduce high IT risks identified by the bank? 9 Does the bank have security incident management process in place? 10 Has the bank established a process of testing the established security controls defined in the IT security policy? 11 Has the bank performed any independent testing of its systems’ resilience to cyber attacks? 12 Is there regular IT systems monitoring and reporting to the bank's bodies? 13 Does the bank have a configuration management process in place? 14 Is there a backup strategy in the bank? 15 Does the backup strategy cover critical systems? 16 Is there off-line backup in the bank? 17 Is the integrity of data backups regularly tested, in accordance with the predefined timetable? 18 Does the percentage of system security updates exceed the requirement for:
 Workstations (Windows > 85%; Adobe > 85%)  Servers (Windows >75%) 19 Is there a process in place for project management of changes to IT systems? 20 Has the bank established a process of providing an IT audit log? 21 Are there any IT components (workstations, servers, network devices, databases) with expired tech-support? 22 Is the Management Board informed about the IT components with expired tech-support and are there action plans to upgrade or replace them? 23 Has the bank established mechanisms for enhanced authentication of end users in the electronic and mobile banking system? 24 Has the bank established mechanisms for monitoring client’s activities and received payment transactions, aimed to

prevent, detect and additionally verify potential contemporary channel systems fraud? 25 Has the bank established systems that recognize presence of malicious software in the remotely established channel (session) and known fraud scenarios? 26 Has the bank established systems that prevent advanced persistent threats (APT)? 27 Are employees trained in information security at least once a year? 28 Does data quality management incorporates appropriate IT controls, such as: automated input controls, extract, transform and load controls (so-called ETL), data warehouse controls (so-called DWH)? 29 Is it possible to directly change data in the reports after they are generated? 30 If yes, are there controls incorporated in the process of changing data in the reports? 31 Related to the previous question, are changes made to the data logged in the reports? 32 Does the internal audit of the bank audit the general IT controls in place? 33 Are the internal audit recommendations observed? 34 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 8 ________________ Signature ______________

8 Please indicate the audit company's officer/officers who completed the questionnaire.

Internal audit YES NO Comment
1 Has the bank's supervisory board established an internal audit department? 2 Is the internal audit an independent organizational unit that operates separately from the other organizational units in the bank? 3 Does the bank's supervisory board define the organizational structure, rights, responsibilities and relations with other organizational parts in the bank, and the responsibility and the requirements for assigning a manager of the internal audit department? 4 Does the internal audit have policies and procedures in place for conducting audit approved by the bank's supervisory board? 5 Does the internal audit perform regular audits and are they in accordance with the annual plan of activities of the departments, which has been approved by the supervisory board? 6 Has the bank's board of directors ensured smooth functioning of the internal audit department, i.e. has it provided an access of the internal audit department to the documentation and to the bank's employees, in order to perform its activities smoothly? 7 Does the internal audit of the bank audit the established controls of the accuracy and quality of data in the financial statements and reports to the National Bank? 8 Does the bank's internal audit include:

• assessment of the internal control systems adequacy and
  efficiency,
• assessment of the implementation of risk management
  policies,
• assessment of the reporting system design,
• assessment of the accuracy and reliability of the commercial
  books and financial statements,
• examination of the accuracy, reliability and timeliness in the
  report, as specified by the regulations,
• monitoring of the compliance with the regulations, the Code
  of Conduct, policies and procedures,
• assessment of the anti-money laundering systems,
• assessment of services provided to the bank by the ancillary
  banking service companies?
  9 Is at least one employee in the internal audit department a certified auditor? 10 Does the internal auditor also perform other tasks? 11 Does the internal audit examine the implementation of findings and recommendations? 12 Does the internal audit also include the bank's business units (branches, windows, etc.)? 13 Does the internal audit cover credit intermediaries of banks?

14 Does the internal audit conduct auditing of ancillary banking service companies and the agreements concluded between the bank and such companies? 15 Does the internal audit prepare internal audit reports at least in the scope and by the dynamics specified by the Banking Law and bylaws adopted pursuant to this law? 16 Does the internal audit submit the semiannual and annual report on operations to the bank's supervisory board, board of directors and audit committee? 17 Does the internal audit immediately report to the bank's supervisory board and board of directors, if, during the audit, it identifies non-adherence to the risk management standards which is likely to result in deterioration of the bank's liquidity or solvency? 18 Does the internal audit immediately report to the bank's supervisory board if, during the audit, it identifies that the bank's board of directors fails to adhere to the regulations, general acts and internal procedures of the bank? 19 Does the bank's board of directors undertake actions for overcoming the deficiencies in the internal control system identified during the internal audit? 20 Does the audit committee evaluate the internal audit efficiency? 21 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 9 ________________ Signature ______________

9 Please indicate the audit company's officer/officers who completed the questionnaire.

Corporate Governance YES NO Comment
1 Has the bank established a risk appetite statement, business policy and development plan as well as annual budget? 2 Are the bank's bodies established as defined by the regulations? 3 Are the criteria for persons with special rights and responsibilities fulfilled? 4 Does the board of directors assess the efficiency of persons with special rights and responsibilities in the bank? 5 Does the supervisory board make at least an annual self￾assessment of the individual and joint performance and does it report to the bank's General Meeting of Shareholders thereon? Does the assessment cover criteria defined in the National Bank’s good corporate governance rules regulation? 6 Does the supervisory board evaluate the suitability of management board members, in accordance with the National Bank’s good corporate governance rules regulation? 7 Does the board of directors regularly inform the supervisory board of all activities and changes to the activities that are relevant for the supervisory board responsibilities? 8 Has the bank defined criteria on identifying other persons with special rights and responsibilities (with the exeption of members of the supervisory board, risk management committee, auditing committee and board of directors)? 9 Does the bank have a remuneration policy in place with clear and transparent rules and criteria for calculating total remuneration? Are the fixed and variable remuneration paid in accordance with the criteria defined in the National Bank’s good corporate governance rules regulation? 10 Does the bank have a policy in place for the method of selection, monitoring of operations and dismissal of members of the supervisory board, risk management committee, auditing committee and board of directors that meets the criteria specified in the National Bank regulation on good corporate governance rules? 11 Does the compliance function performs only compliance￾related activities of the bank? 12 Does the bank's compliance officer submit a monthly report to the bank's board of directors and a semi-annual report to the bank's supervisory board? 13 Does the bank’s organizational setup ensure independent compliance function? 14 Do the compliance officers have unrestricted access to the supervisory board members? 15 Is the bank’s supervisory board informed of any dismissal of a risk management officer and/or compliance officer and of the reasons behind the dismissal? 16 Has the bank established Policy on avoiding conflict of interests? 17 Has the bank established a Corporate Governance Code?

18 Does the bank publish corporate governance data and information and ensure transparency? 19 Are there any additional aspects that the auditor believes should be addressed in this questionnaire that are not Completed by 10 ________________ Signature ______________

10 Please indicate the audit company's officer/officers who completed the questionnaire.