Directive on Internal Governance of Credit Institutions (Amending) (No.2) of 2026

E.E. Part III(I) K.D.P. 253/2026 No. 6027, 2.6.2026 Number 253 THE LAWS ON OPERATIONS OF CREDIT INSTITUTIONS OF 1997 TO 2026

---

Directive under Article 41 66(I) of 1997 74(I) of 1999 94(I) of 2000 119(I) of 2003 4(I) of 2004 151(I) of 2004 231(I) of 2004 235(I) of 2004 20(I) of 2005 80(I) of 2008 100(I) of 2009 123(I) of 2009 27(I) of 2011 104(I) of 2011 107(I) of 2012 14(I) of 2013 87(I) of 2013 102(I) of 2013 141(I) of 2013 5(I) of 2015 26(I) of 2015 35(I) of 2015 71(I) of 2015 93(I) of 2015 109(I) of 2015 152(I) of 2015 168(I) of 2015 21(I) of 2016 5(I) of 2017 38(I) of 2017 169(I) of 2017 28(I) of 2018 89(I) of 2018 153(I) of 2018 80(I) of 2019 149(I) of 2019 21(I) of 2020 73(I) of 2020 28(I) of 2021 94(I) of 2021 95(I) of 2021 162(I) of 2021 163(I) of 2021 61(I) of 2022 62(I) of 2022 162(I) of 2022 17(I) of 2023 59(I) of 2024 158(I) of 2024 14(I) of 2025 84(I) of 2026. The Central Bank of Cyprus, exercising the powers conferred upon it under Article 41 of the Laws on Operations of Credit Institutions of 1997 to 2026, issues this Directive.

Summary Title. E.E. Part III(I): 15.10.2021 (K.D.P. 426/2021)

1. This Directive shall be cited as the Directive on Internal Governance of Credit Institutions (Amending) (No. 2) of 2026 and shall be read together with the Directives on Internal Governance of Credit Institutions of 2021 to 2026 (hereinafter referred to as the "Basic Directive"). The Basic Directive together with this Directive shall be referred to together as the Directives on Internal Governance of Credit Institutions of 2021 to (No. 2) of 2026.

Amendment of paragraph 79 of the basic Directive. 2. Paragraph 79 of the Basic Directive is amended by replacing point (e) of sub-paragraph 2 thereof with the following new point (e): "(e) the assessment at least every three years of the adequacy and completeness of the policy on outsourcing activities to third parties and the taking of corrective monitoring measures on an annual basis; furthermore, the internal audit department conducts assessments of outsourcing activities to third parties, at a frequency determined based on the results of the annual risk assessment of the internal audit department, as provided for in sub-paragraph (1) of this paragraph, and at least every two years. These assessments are carried out at an appropriate scale, as a means of assessing compliance with the policy on outsourcing activities to third parties, giving priority to the outsourcing of significant activities to third parties".

Entry into force. 3. This Directive shall enter into force on the date of its publication in the Official Gazette of the Republic. 1582