Directive on Internal Governance of Credit Institutions (Amendment) of 2026

E.E. Par.III(I) G.G.R. 203/2026
No. 6018, 28.4.2026
Number 203
THE LAWS ON OPERATIONS OF CREDIT INSTITUTIONS OF 1997 TO 2026 ________________ Directive pursuant to Article 41 66(I) of 1997 74(I) of 1999 94(I) of 2000 119(I) of 2003 4(I) of 2004 151(I) of 2004 231(I) of 2004 235(I) of 2004 20(I) of 2005 80(I) of 2008 100(I) of 2009 123(I) of 2009 27(I) of 2011 104(I) of 2011 107(I) of 2012 14(I) of 2013 87(I) of 2013 102(I) of 2013 141(I) of 2013 5(I) of 2015 26(I) of 2015 35(I) of 2015 71(I) of 2015 93(I) of 2015 109(I) of 2015 152(I) of 2015 168(I) of 2015 21(I) of 2016 5(I) of 2017 38(I) of 2017 169(I) of 2017 28(I) of 2018 89(I) of 2018 153(I) of 2018 80(I) of 2019 149(I) of 2019 21(I) of 2020 73(I) of 2020 28(I) of 2021 94(I) of 2021 95(I) of 2021 162(I) of 2021 163(I) of 2021 61(I) of 2022 62(I) of 2022 162(I) of 2022 17(I) of 2023 59(I) of 2024 158(I) of 2024 14(I) of 2025 84(I) of 2026. The Central Bank of Cyprus, exercising the powers conferred upon it by Article 41 of the Laws on Operations of Credit Institutions of 1997 to 2026, issues this Directive.

Summary
Title.
E.E. Par. III(I):
15.10.2021
(G.G.R.
426/2021)

1. This Directive shall be known as the Directive on Internal Governance of Credit Institutions (Amendment) of 2026 and shall be read together with the Directives on Internal Governance of Credit Institutions of 2021 to 2025 (hereinafter referred to as the "Basic Directive"). The Basic Directive together with this Directive shall be referred to together as the Directives on Internal Governance of Credit Institutions of 2021 to 2026.

1364

E.E. Par. III(I):
7.7.2023
(G.G.R.
213/2023)
E.E. Par. III(I):
29.12.2023
(G.G.R.
428/2023)
E.E. Par. III(I):
29.11.2024
(G.G.R.
395/2024)
E.E. Par. III(I):
7.4.2025
(G.G.R.
103/2025).

Amendment of paragraph
4 of the
Basic
Directive.
2. Subparagraph 1 of paragraph 4 of the Basic Directive is amended by adding, in the appropriate alphabetical order, the following new terms and their definitions:
"country exposure" means the totality of the credit institution's assets, on and off balance sheet, linked to a foreign country. It includes, among others, exposures to counterparties established in that country, exposures whose performance depends essentially, from the credit institution's own assessment, on the economic or other conditions prevailing in that country, as well as exposures from which the ultimate risk arises from that country. The country exposure covers, at a minimum, credit exposures (including loans, facilities and securities), interbank positions, derivatives and exposures to counterparties (including potential future exposure), guarantees, credit letters and other contingent liabilities, trade finance exposures, cross-border intra-group exposures as well as exposures arising from securities financing transactions (securities financing transactions), including repurchase/reverse repurchase agreements (repo/reverse repo), where the issuer of the provided collateral is established in a foreign country; "transmission risk" means the risk of loss, liquidity and/or funding that arises when adverse developments in one country are transmitted and lead to a deterioration of the economic conditions of another country in the same geographical area or with similar economic characteristics, in which the credit institution maintains exposures; "convertibility risk" means the risk of loss, liquidity and/or funding that arises when the counterparty is unable to convert the local currency into the currency of the obligation or to continue the uninterrupted provision of liquidity or funding to the credit institution, due to actions or restrictions imposed by public authorities, including restrictions on access to foreign exchange; "transfer risk" means the risk of loss, liquidity and/or funding that arises when the counterparty fails to pay in the currency of the obligation or to transfer funds in the currency of the obligation or to continue the uninterrupted provision of liquidity or funding to the credit institution, due to restrictions or controls imposed by public authorities or due to foreign exchange shortages; "country risk" means the risk of exposure to losses and/or the risk of liquidity and/or funding that arises for a credit institution due to adverse economic, political, social, legal or exchange rate developments in a specific country in which the credit institution maintains exposures; "sovereign risk" means the risk of loss, liquidity and/or funding that arises when a government and/or organization or other public sector entity whose obligations are fully and explicitly covered by the government of the relevant country, lacks the ability and/or willingness to repay the direct or indirect (guaranteed) obligations thereof; "foreign currency funding exposure" means the totality of the liabilities and funding sources of a credit institution that derive directly or indirectly from a foreign country. It includes, at a minimum,
deposits received from non-residents of Cyprus, funding through markets drawn from non-domestic counterparties, including debt issuances funded by non-domestic counterparties, funding provided by non-domestic public sector entities, funding and liquidity flows linked to derivative transactions with non-domestic counterparties, as well as cross-border intra-group funding;

Amendment of paragraph
20 of the
Basic
Directive.
3. Paragraph 20 of the Basic Directive is amended as follows:
(a) by adding to subparagraph (1) point (c) thereof, immediately after the phrase "(including legal risk and ICT risk)" (fourth line), the phrase ", country risk"; (b) by adding, immediately after subparagraph (7) thereof, the following new subparagraph (8):
"(8) The risk committee monitors and evaluates country risk by preparing periodic reports to the governing body and submitting recommendations for the adoption of measures to mitigate country risk. Any significant changes in the conditions of a country in which the credit institution maintains material exposures through country exposure or funding exposure are reported immediately to the governing body."

Addition of paragraph
51B to the
Basic
Directive.
4. The Basic Directive is amended by adding, immediately after paragraph 51A, the following new paragraph 51B:
"Country Risk.
51B. (1) The credit institution must ensure that adequate policies, procedures and mechanisms are applied for the effective management of country risk, including sovereign risk, transfer risk, convertibility risk and transmission risk, which provide, at a minimum, for the following:
(a) the identification, assessment, measurement and monitoring of country risk, including the identification and documentation of key country risk drivers (country risk drivers), such as macroeconomic developments, political stability, geopolitical factors, legal/regulatory changes, capital flow restrictions, liquidity conditions and access to foreign exchange, (b) the development and/or application of appropriate assessment methodologies, rating and documentation of country risk taking, which include both tools for detecting potential future risks taking into account expected developments and possible future risks, as well as tools for analyzing historical risk profiles. These methodologies must allow for the aggregate calculation and consistent classification of the credit institution's relevant exposures and funding exposures and facilitate the early identification of risk concentrations, (c) the determination, application and documented review of maximum exposure limits per country and per economic activity sector (e.g. transport and storage, construction, real estate management) regarding country exposures, in accordance with the credit institution's risk appetite and risk absorbing capacity, as well as the determination of an appropriate limit-setting approach, including any sub-limits where deemed necessary (e.g. per counterparty category, products), (d) the continuous and uninterrupted monitoring of developments that may affect country risk and the credit institution's exposure profile, utilizing appropriate early warning indicators (early warning indicators). These indicators are determined on the basis of policy and reviewed periodically, and may include, among others, changes in credit ratings, exchange rate volatility, foreign exchange reserve developments, changes in funding costs/government yields, capital control measures, capital market developments, as well as macroeconomic, geopolitical and regulatory developments, (e) the conduct of scenario analyses and/or stress tests, as part of the overall country risk assessment, with the aim of assessing possible impacts and supporting the decision-making process and limit setting, (f) the determination and application of clear escalation procedures in cases of increased risk and/or breach/exceedance of established limits, including predetermined risk mitigation actions, approval procedures for any deviations, as well as early notification of the relevant governing bodies/committees, (g) the establishment and regular updating of reduction, disengagement or exit strategies for countries where there is a material deterioration in risk and/or where the credit institution has material exposures or funding exposures. These strategies are documented, operationally feasible, and consistent with the credit institution's risk profile, risk appetite and risk absorbing capacity (risk absorbing capacity), (h) the creation and maintenance of a watchlist of countries subject to enhanced monitoring and
more frequent reporting. The credit institution must define clear and documented criteria for inclusion and exclusion from this list (entry/exit criteria), which may be linked, among others, to early warning indicators and/or significant differentiation in the internal country risk rating and/or macroeconomic conditions and/or events that increase transfer or convertibility risk, and (i) the determination of minimum management information system capabilities, to ensure the timely and effective measurement, monitoring and reporting of country risk. These systems must allow, at a minimum, the analysis and aggregation of relevant data as follows:
(i) per country,
(ii) per counterparty sector (e.g. sovereign, financial, corporate), (iii) per currency, (iv) per maturity/duration (maturity), (v) per product/type of exposure and funding channel, (vi) per risk level/country rating, and facilitate the monitoring of concentrations, trends and limit breaches where applicable, (j) ensuring that it has adequate and appropriate resources, specialized personnel, expertise and appropriate infrastructure for the continuous and systematic monitoring and assessment of the economic, political, institutional, legal and operational conditions in the countries in which it maintains or may create country exposures. This monitoring covers, among others, developments in the macroeconomic environment, changes in the regulatory and legal framework, the functioning and effectiveness of institutions and the judicial system, possible restrictions on cross-border capital transfers or the imposition of charges, as well as other factors that may affect the creditworthiness of counterparties and/or the effective management and recovery of claims. The credit institution also ensures that it has the necessary expertise, procedures and mechanisms to evaluate ex ante and effectively manage the legal and practical aspects related to the holding and liquidation of collateral in foreign jurisdictions, taking into account specifics such as local practices, the functioning of execution mechanisms and the effectiveness of the legal and institutional framework. For this purpose, the credit institution ensures that it has adequate and reliable information regarding the specifics of each jurisdiction, as well as, where necessary, access to appropriate local or external expertise, to support the proper assessment, monitoring and management of relevant exposures. The resources, tools and procedures used are reviewed at regular intervals to remain adequate and appropriate in relation to the credit institution's risk appetite and risk absorbing capacity (risk absorbing capacity), as well as the scope and geographical diversification of the credit institution's activities."

Entry into force.
5. This Directive enters into force on the date of its publication in the Official Gazette of the Republic.

1367