Region

Jurisdiction

Regulator

2021-01-01

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro

The Council of the Central Bank of Montenegro issued this Decision to prescribe minimum risk management standards for the Development Bank of Montenegro. It mandates the establishment of a comprehensive risk management system, including defined strategies, policies, and a risk control function independent from business lines. The regulation further requires the Bank to implement specific procedures for identifying, measuring, and reporting on various risks, including stress testing and the management of new products.

Montenegro

Central Bank of Montenegro

[unofficial translation] Pursuant to Article 44 paragraph 2 item 3 of the Central Bank of Montenegro Law (OGM 40/10, 06/13, 70/17, 125/23), and Article 26 of the of the Law on the Development Bank of Montenegro (OGM 99/24), the Council of the Central Bank of Montenegro, at its meeting held on 25 July 2025, passed the following DECISION ON MINIMUM STANDARDS FOR RISK MANAGEMENT IN THE DEVELOPMENT BANK OF MONTENEGRO I BASIC PROVISIONS Subject matter Article 1 (1) This Decision shall prescribe the minimum standards for risk management the Development Bank of Montenegro (hereinafter: the Development Bank) is or might be exposed to in its operations. Meaning of terms Article 2 Terms used in this Decision shall have the following meaning:

risk profile means the measurement, or the assessment of all risks to which the Development Bank is or might be exposed in its operations;
risk culture means norms, attitudes and behaviours related to risk awareness, risk assumption and risk management, and the controls that shape the decisions on risks;
risk controlling means the overall strategic objectives, methods, criteria and procedures to assume, avoid, reduce or transfer the identified risk;
stress testing means an assessment of the impact of particular events and processes, including microeconomic and macroeconomic scenarios, on the overall capital position of the Development Bank or funding sources and liquidity by means of a projection of capital sources and capital requirements of the Development Bank or the impact of shocks on the Development Bank's overall liquidity position, including the determination of capital requirements;
reputational risk means a risk of loss of trust in the integrity of the Development Bank caused by adverse public opinion on the Development Bank's business practices, regardless of whether there are any grounds for such a public opinion or not;
country risk means the risk that: − the central government, central bank and/or entities treated as the central

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 2 government will not be able to settle their liabilities to local creditors and/or to foreign creditors; and − the counterparty having its head office or habitual residence outside Montenegro will not be able to settle its liabilities due to economic and political factors specific for the country in which a counterparty has its head office or habitual residence. 7) model risk means the risk of loss the Development Bank may incur, as a consequence of decisions that could be principally based on the output of internal models, due to errors in the development, implementation or use of such models; 8) strategic risk means the risk of loss caused by adverse business decisions, lack of responsiveness to changes in the economic environment, and the like; 9) information system (IS) means a comprehensive set of technological infrastructure (hardware and software assets), organisation, people and procedures for generating, collection, processing, storage, transmission, representation, use, modification and other procedures for data processing; 10) information system resources mean software, hardware and information assets, people and processes; 11) software assets (IS software components) mean all types of application and system software, databases, software development tools, utility programmes and other software; 12) hardware assets (IS hardware components) mean computers and computer equipment, communication equipment, data storage media and other technical equipment supporting the information system operations; 13) information assets mean data in databases, data files, program code, configuration of hardware assets, technical and user documentation, reports, strategies, policies, procedures, other internal acts, and the like; 14) information technology (IT) means a combination of hardware and software assets that enables automated generation, collection, processing, storage, transmission, presentation and/or use of information; 15) IT system means information technology governed as a part of the mechanisms or interconnected network that provides support to the Development Bank’s operations; 16) IT service means any service the IT system provides to internal or external information system users; 17) IT project means any project or its part in which the IT systems or services are changed, replaced, put out of use or implemented. IT project also includes those projects that are an integral part of wider IT project programmes or transformation of operations related project programmes; 18) information system users mean all persons authorised to develop, maintain and/or use the information system (Development Bank employees, service provider employees accessing the information system of the Development Bank, clients accessing the Development Bank’s information system through electronic interactive communication channels, etc.); 19) information system risk means the risk of negative effects on the financial result and capital of the Development Bank, achievement of its business objectives, as well as operation in accordance with regulations, due to inadequate

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 3 information system management or other system weaknesses which negatively affect the system functionality or security; 20) incident means one or more related unplanned events that jeopardise or will likely jeopardise the Development Bank’s information system security or functionality; 21) information security means a state where only authorised users (confidentiality) have access to accurate and complete information (integrity) when they need it (availability); 22) information confidentiality means that the information is not disclosed or available to unauthorised persons; 23) information integrity means that information i.e. data has not been subject to unauthorised or unforeseen alterations; 24) information availability means that an authorised person may access to information and use it in a timely manner; 25) information system reliability means that the information system is functioning consistently and as expected and that it produces the expected, accurate results; 26) gap risk means the risk resulting from the maturity structure of interest rate sensitive instruments that arises from differences in the timing of their rate changes, covering changes to the maturity structure of interest rates occurring consistently across the yield curve (parallel risk) or differentially by period (nonparallel risk); 27) basis risk means the risk arising from the impact of relative changes in interest rates on interest rate sensitive instruments that have similar tenors but are priced using different interest rate indices, and it arises from the imperfect correlation in the adjustment of the rates earned and paid on different interest rate sensitive instruments with otherwise similar rate change characteristics; 28) option risk means the risk arising from options, where the Development Bank or its customer can alter the level and timing of their cash flows, namely the risk arising from interest rate sensitive instruments where the holder will almost certainly exercise the option if it is in their financial interest to do so, and the risk arising from flexibility embedded implicitly or within the terms of interest rate sensitive instruments, such that changes in interest rates may affect a change in the behaviour of the client. 29) scenario analysis means an assessment of the impact of a concurrent change in several risk factors on the financial position of the Development Bank under clearly defined stress conditions; 30) sensitivity analysis means an assessment of the impact of a specific risk factor on the financial position of the Development Bank, whereat the cause of stress is not identified; 31) liquidity buffer means the amount of liquid assets that the Development Bank shall hold in accordance with Articles 125 to 133 of this Decision; 32) reporting currency means the currency used for the purposes of reporting in accordance with this Decision, expressed in EUR; 33) asset coverage requirement means the ratio of assets to liabilities as determined for credit enhancement purposes in relation to covered bonds;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 4 34) public sector entity shall have the meaning specified under the Decision on Capital Adequacy of the Development Bank of Montenegro (hereinafter: the Decision on Capital Adequacy of the Development Bank); 35) micro, small and medium legal person (SME) means a micro, small and medium-sized legal person as defined in the law governing accounting; 36) net liquidity outflow means the amount resulting from deducting liquidity inflows from liquidity outflows, in accordance with Articles 135 to 147 of this Decision; 37) level 1 assets mean assets of extremely high liquidity and credit quality in accordance with Article 131 of this Decision; 38) level 2 assets mean assets of high liquidity and credit quality in accordance with Article 132 of this Decision; 39) retail deposit means a liability to a natural person or to an SME, where the SME would qualify for the class of exposures to the portfolio of small loans features (retail exposures) under the Decision on Capital Adequacy of the Development Bank, where the aggregate deposits by such SME do not exceed EUR 300,000; 40) financial customer means a customer, including a financial customer belonging to a non-financial corporate group, that provides financial services set out in the law governing the operations of credit institutions as its main activity, or is one of the following: − a credit institution; − an investment firm; − a securitisation special purpose entity (SSPE); − a collective investment undertaking (CIU); − a non-open ended investment scheme; − an insurance undertaking; − a reinsurance undertaking; − a financial holding company or mixed-financial holding company; − financial institution; − institution for occupational retirement provision; 41) stress means a sudden or severe deterioration in the solvency or liquidity position of the Development Bank due to changes in market conditions or idiosyncratic factors as a result of which there is a significant risk that the Development Bank becomes unable to meet its commitments as they fall due within the next 30 calendar days; 42) unencumbered asset means assets which are not subject to any legal, contractual, regulatory or other restrictions preventing the Development Bank from liquidating, selling, transferring, assigning or, generally, disposing of those assets via an outright sale or repurchase agreement; 43) margin loans mean collateralised loans extended to customers for the purpose of taking leveraged trading positions; 44) derivative contracts mean the contracts concerning interest rate, currencies and gold, as well as contracts of similar nature concerning other underlying items or indices and which, as a minimum, include instruments such as: options, futures, swaps, forward rate agreements and any other derivatives relating to securities, commodities, financial indices or financial measures which may be settled physically or in cash, and financial contracts for differences;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 5 45) convertible currencies mean the currencies of countries members of G10 (Belgium, France, Italy, Japan, the Netherlands, Canada, Germany, the USA, Sweden, Switzerland), the EEA member states (including Iceland, Liechtenstein, and Norway in addition the EU Member States), Australia, and New Zealand; 46) personal investment company means an undertaking or a trust, the owner or beneficial owner of which is either a natural person or a group of closely connected natural persons, which was set up with the sole purpose of managing the assets of the owners and which does not carry out any other commercial, industrial or professional activity, and which may carry out activities such as segregating the owners' assets from corporate assets, facilitating the transmission of assets within a family or preventing a split of the assets after the death of a member of the family, provided these activities are connected to the main purpose of managing the owners' assets; 47) central government means the state administration bodies, state agencies and other entities having powers relating to the entire territory of the country, and which are classified as the central government in accordance with the European System of Accounts (ESA 2010); 48) committed credit or liquidity facility means a credit or liquidity facility that is irrevocable or conditionally revocable; 49) factor means any number between 0 and 1 which, multiplied by a certain amount, gives weighted amount or value referred to in Article 151paragraph (1) of this Decision; 50) funding liquidity risk means the risk that the Development Bank will not be able to meet successfully both expected and unexpected current and future cash flow and collateral needs without affecting its regular daily operations or its financial performance; 51) market illiquidity risk means the risk that the Development Bank will not be able to simply offset or eliminate a position at the market price because of market disruption or inadequate market depth. 52) senior management means persons who exercise executive functions within the Development Bank, and who are responsible for the day-to-day management of the Development Bank, and are accountable for that to the Supervisory Board and the Management Board; 53) qualifying central counterparty means a central counterparty that has been either authorised by the competent authority in Montenegro or European Union or established in third country and recognised by ESMA. II RISK MANAGEMENT RULES Risk management system Article 3 (1) Risk management system, within the meaning of this Decision, means the overall organisational structure, rules, processes, procedures, systems and resources for identifying, measuring, assessing, control, monitoring and reporting on risk exposure or overall risk management, and it shall imply the establishment of an adequate corporate governance, risk culture and setting up strategy, policy and other internal acts for

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 6 managing risks. (2) For the purpose of establishing risk management system, the Development Bank shall:

identify employees to be involved in the risk management system;
establish and properly document risk management process that includes the identification and alignment of risk profile with risk appetite;
establish, monitor and maintain internal exposure limits in line with the risk appetite or proportionate to the financial strength, strategic objectives and level of capital of the Development Bank;
identify, on an ongoing basis, risks to which it is or might be exposed to in its operations, and analyse causes to those risk exposures;
regularly measure or assess and control the risks to which it is exposed in its operations;
clearly determine the criteria and procedures for treating or the method for managing risks – assumption, mitigation or transfer of risk to the counterparty, taking into account the existing and desirable risk profile and risk appetite, as well as to adequately document the manner and the reasons for the selected treatment or the risk management method;
run periodical stress testing;
establish the system of regular monitoring and reporting to the Supervisory Board and the Management Board of the Development Bank on exposures to risks and on the stress testing results. (3) The Development Bank shall adequately monitor risks which were transferred to a third party, in particular, concentration risk that may arise on this basis. (4) For the purposes of paragraph (2) item 4) of this Article, the Development Bank shall ensure that the transactions with connected persons are monitored to properly identify and assess the underlying risks. (5) For the purposes of paragraph (2) items 5) and 6) of this Article, the Development Bank shall also take into account the effects of potential impact of significant macroeconomic trends and data on the exposure to risks and individual portfolios. (6) Reporting on risks referred to in paragraph (2) item 8) of this Article shall in particular include information on exposure to specific risks and key risk indicators, including information on risk profile and its changes, data on significant losses, information on measures and activities intended to be taken or that have been taken to treat risks, information on excess of defined internal exposure limits and other exceptions from the activities in line with internal acts, including the exemptions from identified risk appetite and information on positive and negative changes in business indicators that refer or may refer to the change in risk exposure. (7) The Development Bank shall ensure the application of sound risk management system through a risk control function which is responsible for further identifying, monitoring, analysing, measuring, managing and reporting risks, thus forming the second

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 7 line of defence, independent from the business lines of the Development Bank it controls, and which, as the first line of defence, take risks and are responsible for their operational management directly and on a daily basis, and which shall have appropriate processes and controls in place that aim to ensure that the risks assumed are identified, analysed, measured, monitored, managed and reported. Risk management strategy Article 4 (1) Risk management strategy shall be one or several internal acts that include objectives and fundamental principles of risk assumption and management as well as risk appetite, which should be adequately expressed through internal exposure limits. (2) When determining the risk appetite, the Development Bank shall take into account, quantitative information or model results or assessment of risk exposure, as well as adequate qualitative information, such as expert judgement and critical analysis. (3) The Development Bank shall regularly align its risk management strategy with the general strategy, taking into account developments in market in which the Development Bank operates and changes within the Development Bank (e.g., changes in the assets and earnings structure, the increase in business complexity, risk profile changes, introduction of new products and business lines, etc.), as well as the operating objectives of the Development Bank, in accordance with Article 2 of the Law on the Development Bank of Montenegro (hereinafter: the Law). Risk management policies Article 5 (1) The risk management policies shall constitute one or several internal acts which shall in particular include the following:

a determination of the risk appetite as regards specific risks;
clearly-defined lines of powers and responsibilities to manage risks within the Development Bank;
a methodology for the identification and measurement or assessment of the risks to which the Development Bank is or might be exposed in its operations, including a stress testing methodology;
internal limits and controls, and other risk controlling and monitoring procedures;
procedures and measures to be taken in the event of non-compliance with the adopted policies and procedures, including potential future or actual excess of internal limits, and
procedures and measures for crisis situations. (2) For the purposes of paragraph (1) item 5) of this Article, measures to be taken should at least include the following:
identifying reasons for the occurrence of deviation from adopted policies and procedures, i.e., excess of internal limits;
assessing the level of potential or actual excess of internal limit;
escalation to adequate levels;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 8 4) monitoring of the outcome resulting from the excess of limits; 5) keeping records on deviations from policies and procedures and internal limits exceeding. (3) The policies referred to in paragraph (1) of this Article shall be clearly defined and documented and accessible to all employees of the Development Bank involved in the risk assumption and management process. (4) The Development Bank shall review and, if necessary, update the policies referred to in paragraph (1) of this Article at least on an annual basis and at each significant change in risk exposure, and it shall ensure that they are applied at the level of the whole Development Bank. New products and significant changes Article 6 (1) The Development Bank shall, within its risk management framework, by performing risk control function in accordance with the Law, also cover risks arising from the introduction of new products or services, significant changes in the existing products and services, including significant changes in processes (e.g., new outsourcing) and systems (e.g., changes in information system) connected with those products and services, extraordinary transactions that may occur as a result of the aforesaid, as well as the entrance to new markets and trading in new instruments. (2) Significant changes or extraordinary transactions referred to in paragraph (1) of this Article shall in particular refer to the following:

establishment of new subsidiary undertakings or special purpose entities;
new products;
changes in the risk management system and procedures, and
changes in the organisational structure of the Development Bank. (3) The Development Bank shall prescribe in its internal acts the criteria and procedures relating to the introduction of new products or services referred to in paragraph (1) of this Article and within them in particular:
define what it considers to be a new product or service and their significant change;
establish the processes and procedures for the introduction of new products or services;
define the powers and responsibilities for the approval and verification of new products. (4) Prior to introducing new products or services, the Development Bank shall carry out an analysis of the risk arising therefrom, and in particular:
describe the new product;
analyse the impact of the new product on the Development Bank’s existing and future risk exposure, its capital adequacy and profitability;
ensure the required technical, organisational and human resources;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 9 4) provide an objective assessment of all the risks arising from new activities, using different scenarios; 5) assess whether the introduction of a new product or service leads to potential weaknesses in risk management and internal controls; 6) assess the ability of the Development Bank to efficiently manage new risks; 7) define the procedures to be used to manage the risks related to new products, and 8) comply with the accounting, tax and legal requirements, including those of the Central Bank of Montenegro (hereinafter: the Central Bank). Stress testing Article 7 (1) The Development Bank shall carry out, within its risk management, stress testing at the level of significant risk to which it is exposed, at portfolio level and at the level of the whole Development Bank. (2) The Development Bank shall in particular include the following in its policies and procedures governing stress testing:

types of stress testing and their objectives;
frequency of stress testing exercises, and at least on quarterly basis;
transparent and consistent lines of responsibilities and activities;
when carrying out stress testing on a consolidated basis, a list of entities included in stress testing, as well as the scope of stress testing to be carried out at the level of individual entities;
data infrastructure to be used in stress testing;
a description of stress testing methodology, including the description of internal models if used;
assumptions to be taken into consideration in stress testing, as well as measures to be implemented based on stress test results, and
the method of reporting to the senior management and management bodies on the stress test results. (3) The risk control function shall regularly review stress testing results, periodically review the adequacy of defined assumptions and scenarios and, if needed, carry out such stress testing independently from other organisational parts carrying out stress testing, and it shall report the Management Board of the Development Bank on the results obtained. (4) The Development Bank shall perform stress testing using the sensitivity analysis, scenario analysis as well as reverse stress testing, taking into consideration the economic cycle stage of the economy, and it shall ensure that this testing is not based solely on historical experiences but hypothetical scenarios and external sources of data needs to be included, and stress testing should include various intensities of effects and at least one scenario must include significant economic recession. (5) The Development Bank shall ensure that the stress testing is supported by

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 10 appropriate data infrastructure that is based on an efficient risk aggregation and risk reporting. (6) The Development Bank shall take into account stress testing results while:

reviewing strategic planning;
reviewing the risk appetite;
reconsidering the funding policy;
reviewing internal limits;
use of risk mitigation techniques;
reviewing capital and liquidity adequacy, and
reviewing or developing activities related to contingency planning. (7) The Development Bank shall assess the appropriateness of stress testing regularly, and at least on an annual basis, as well as at each significant change in risk exposure and it shall cover the following:
frequency of stress testing exercises and its compliance with objectives;
the need for development work;
the adequacy of informing relevant employees, bodies and committees in the Development Bank;
the quality of data and other information used, and
the appropriateness of documentation of stress testing results. (8) The Development Bank shall document in an appropriate manner the stress testing process, and it shall regularly update such documentation. (9) The Development Bank shall ensure that the stress testing process is included in the internal audit work programme. Senior management tasks in risk management Article 8 Within the internal controls system set up by the Development Bank in accordance with the Law, the Development Bank should identify the management that shall, within the risk management, do the following:
implement risk assumption and risk management strategies and policies;
implement and maintain the risk management process;
implement procedures and provide instructions and guidelines for carrying out the Development Bank's business activities resulting in risk exposures;
maintain the effectiveness of internal controls embedded in the risk management system, and
implement adequate procedures to assess the effects of the introduction of new products and their significant changes on the Development Bank's risk exposure.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 11 III MANAGEMENT OF CREDIT AND RELATED RISKS 3.1. Credit risk and counterparty risk Credit risk related organisational requirements Article 9 (1) The Development Bank shall ensure a clear operational and organisational separation of transaction contracting operations from risk control operations and backoffice operations. (2) The decision-making procedure regarding the origination of credit exposures shall include:

the establishment of criteria, policies and procedures for granting new exposures and restructuring the existing ones;
the establishment of rules of origination at the level of individual debtors and collateral providers and at the level of the group of persons connected with the debtor and the collateral provider, depending on the exposure amount and risk;
identifying competences and responsibilities of the Development Bank’s competent bodies for granting exposures, depending on the exposure amount and risk;
the engagement of risk control function in the process of deciding on granting material exposures through the provision of independent information, analyses and assessments of risk exposures, or advice regarding proposals for risk taking made by business units and reporting to the Management Board, Supervisory Board or relevant working body of the Supervisory Board as to whether these decisions are consistent with the Development Bank’s risk appetite and risk management strategy, whereby business units, Management Board and Supervisory Board of the Development Bank or the relevant working body of the Supervisory Board are solely responsible for the origination process;
the possibility that the credit exposures that are not material may be granted by a person responsible for contracting transactions, in which case the Development Bank shall establish the criteria for those exposures and the rules of origination, including their classification based on similar features, and the rules governing their monitoring on an aggregate basis. (3) The Development Bank shall establish decision-making rules for granting credit exposures which apply when a person responsible for the risk control function or another person authorised to make an independent credit risk assessment has expressed a negative opinion on such decision. (4) The Development Bank shall ensure that the activities of contracting transactions are not performed within the same organisational unit that performs activities relating to the valuation of assets, classification of assets and calculation of loan loss provisions. (5) The Development Bank shall ensure that the decision-making process referred to in

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 12 paragraph (2) item 1) of this Article also includes exposures granted under special conditions in accordance with the Law. Credit process Article 10 (1) A credit process shall in particular include the following:

a credit exposure origination process;
a credit risk exposure monitoring process;
a credit risk exposure analysis;
an early warning system;
the management of non-performing loans;
the management of restructured loans;
the process of classifying and valuing on-balance and off-balance sheet items in the manner specified in a regulation of the Central Bank governing the criteria and the manner of classification of assets and calculation of provisions for potential loan losses of the Development Bank; and
the keeping of records on credit exposures. Credit exposure origination process Article 11 (1) Before granting a credit exposure, during the contractual relationship on the basis of which a credit exposure has occurred and during each significant subsequent increase in the value of the credit exposure, the Development Bank shall assess the debtor’s creditworthiness and regularity in settling their liabilities to the Development Bank and other creditors. (2) Before granting a credit exposure, the Development Bank shall, in addition to the creditworthiness of a debtor, assess quality, marketability, availability, value and legal validity of collateral, and where the collateral value to a great extent depends on the creditworthiness of a third-party collateral provider, it shall assess the creditworthiness of such collateral provider. (3) When defining the criteria for determining the debtor's creditworthiness, the Development Bank shall take into account the requirements established in the regulation governing the criteria and the manner of classification of assets and calculation of provisions for potential loan losses of the Development Bank. (4) When analysing credit exposure, the Development Bank shall primarily take into account the creditworthiness of the debtor and, as a rule, treat the collateral received for individual exposure as the secondary source of collection. (5) The Development Bank shall establish a policy on eligible collateral and the methodology for assessing collateral value, taking into account the minimum requirements set out in the regulation of the Central Bank governing the classification of assets and calculation of provisions for potential loan losses of the Development Bank.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 13 (6) The Development Bank shall keep separate records of placements granted under special conditions in accordance with the Law, and regularly report to the management bodies thereof. Credit risk exposure monitoring process Article 12 (1) The credit risk exposure monitoring process shall include an assessment of the creditworthiness of the debtor, the group of persons connected with the debtor, and the collateral quality during the contractual relationship on the basis of which the credit exposure has occurred. (2) During the contractual relationship on the basis of which the credit exposure has occurred, the Development Bank shall monitor the operation of the debtor, as well as the quality, marketability, availability, value and legal validity of collateral. (3) The Development Bank shall monitor debtor's compliance with contractual commitments and, in the case of granting purpose-specific-loans, monitor whether the funds placed have been used exclusively for these purposes. (4) The Development Bank shall ensure that monitoring of individual exposures is established in the manner as to enable a timely implementation of adequate measures to reduce credit risk if the creditworthiness of the debtor or collateral provider deteriorates. (5) The Development Bank shall adopt procedures prescribing the collection and monitoring of all relevant information which might point to an increase in the risk of the credit exposures and collateral, for the purpose of risk reassessment and reporting to the persons included in the credit risk management process. Credit risk exposure analysis Article 13 (1) The Development Bank shall establish a system for an ongoing analysis of the structure and quality of the overall portfolio of credit risk exposures, which shall include an analysis of concentration risk inherent in the portfolio, an assessment of future trends of the structure and quality of entire credit risk exposure portfolio, and recognise new risks that may arise from the exposure portfolio, as well as increase in the level of risk due to changes in the operating circumstances and conditions. (2) The Development Bank shall take into account the analysis referred to in paragraph (1) of this Article, when defining the strategies and policies for assuming or managing credit risk. (3) The Development Bank shall monitor and analyse entire portfolio of credit risk exposures in such a manner as to provide for timely implementation of adequate measures to reduce credit risk.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 14 Early warning system Article 14 (1) The Development Bank shall carry out the following:

establish an early warning system providing for a timely identification of exposures carrying an increased credit risk, and
keep records on exposures carrying an increased credit risk. (2) The early warning system referred to in paragraph (1) item 1) of this Article should be based on either internal or external ratings or indicators, and it should enable recognition of exposures carrying an increased credit risk at early stages of credit quality deterioration on individual basis, as well as at the level of exposures carrying common characteristics of credit risk. Management of non-performing loans Article 15 (1) The Development Bank shall establish an adequate framework for managing nonperforming loans that shall in particular include the following:
the method for identifying, measuring, monitoring and overseeing nonperforming loans, as well as measures for avoiding the occurrence of nonperforming loans in the Development Bank's assets;
time-bound and value-set objectives for treating non-performing loans and exposures in the enforced collection process;
the objectives of the Development Bank related to non-performing loans in the short-term, medium-term and long-term;
the implementation of operational plan for treating non-performing loans, and
full integration of the strategy for treating non-performing loans into managerial processes of the Development Bank, including regular monitoring and adequate oversight of these activities. (2) The Development Bank shall analyse the impact of the non-performing loans on own funds, profitability, liquidity and other performance indicators of the Development Bank. (3) When establishing objectives referred to in paragraph (1) item 3) of this Article, the Development Bank shall take into account different methods of managing non-performing loans, such as:
monitoring and restructuring of non-performing loans;
active reduction of non-performing loan;
change of exposure type or settlement of credit exposure by acquiring the property of the debtor, and
various legal options such as opening of bankruptcy proceedings or out of court settlement. (4) The Development Bank shall establish in its internal acts the following:
policies, methods and frequency of valuation of collateral in the form of immovable and movable property for non-performing loans, oversight and control of such valuation, as well as the criteria for collateral valuers, and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 15 2) the criteria, processes and decision-making levels for full or partial accounting write-off of receivables from debtors arising from non-performing loans and decision-making levels for taking legal actions required to call and realise the collateral. Management of restructured loans Article 16 (1) In its internal act for managing restructured loans, the Development Bank shall in particular cover the following:

procedures for approving forbearance measures, the manner of making decisions on forbearance measures, including persons and functions included in that procedure, taking into account the measures that would enable viable collection of loans and avoid enforced collection cases;
a description of available forbearance measures, depending on the reasons why loans have been identified as non-performing loans, and
information requirements for assessing the viability of forbearance measures, monitoring procedures and oversight of the forbearance measures. (2) Before reaching a decision of loan restructuring, the Development Bank shall assess the economic justification of loan restructuring to a single debtor or a group of debtors having similar economic features, and in case of economic justification, it shall establish appropriate restructuring plan and monitor its implementation and effects. (3) When determining economic justification referred to in paragraph (2) of this Article, the Development Bank shall obtain:
a detailed analysis of the reasons that led to difficulties in the operation of the debtor, or, if applicable, group of debtors;
a plan for the operational, financial and ownership restructuring of the debtor, if applicable, and
cash flow projection for the period established in the restructuring plan. (4) On the basis of the information referred to in paragraph (3) of this Article, the Development Bank shall make:
an assessment of the feasibility of a plan for the operational, financial and ownership restructuring of the debtor, if applicable;
an analysis of possible methods of credit exposure restructuring and the rationale for the chosen method, and
a new loan repayment plan, which shall be the basis for monitoring the implementation of the credit exposure restructuring plan. (5) Before approving the forbearance measure, the Development Bank shall assess the creditworthiness of the debtor or, if applicable, group of debtors. (6) Following the approval of the forbearance measure, the Development Bank shall monitor the implementation of the restructuring plan and of cash flows of the debtor or, if applicable, group of debtors having similar economic features, on an ongoing basis and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 16 at a minimum on a quarterly basis. Content and keeping of credit exposure records Article 17 (1) For the purpose of credit risk management, the Development Bank shall keep a credit exposure records, or a credit file of a debtor that shall in particular contain the following:

basic data on the debtor (for natural person – name, last name and address, for legal person – name and head office, number of employees, ownership structure, data on members of the management bodies) and connectedness of the debtor with other persons if the debtor is a part of the group of connected persons;
loan agreement and/or agreement on other credit exposures;
data on main debtors and creditors of each debtor to which the exposure of the Development Bank is significant on an individual basis;
financial statements of the debtor for the previous three years, if applicable;
analysis and assessment of the financial position of the debtor, including debtor's internal rating;
for individually significant exposures, where the evidence on the reduction of financial assets of the debtor exists, the analysis and assessment of future cash flows of the debtor against their liabilities;
the proposal for granting credit exposure, opinion of a professional service and the decision of the Development Bank’s body responsible for granting thereof;
analytical record card of balance sheet and off-balance sheet items concerning individual debtor of the Development Bank;
documents on collateral;
documents on the enforced collection proceedings undertaken, including records of lawsuits that the Development Bank has initiated to collect its claims against that debtor;
records of lawsuits pending against the Development Bank with regard to that credit exposure;
any documents related to the treatment of the restructured credit exposures, and
other documents related to information on financial position of the debtor. (2) The Development Bank shall establish the procedure for keeping credit files and identify responsible persons that will ensure the completeness and integrity of the documentation. (3) The Development Bank shall, in addition to the requirement to keep documents governed by other regulations, keep the documents referred to in paragraph (1) of this Article as well as other documents and records that make the content of the credit file, during the business relationship or until the finalisation of lawsuits in the cases where they were initiated on this. Sale of receivables Article 18 (1) Where the Development Bank sold credit or other receivables in the amount that exceeds the materiality threshold, it shall notify the Central Bank of the sale, and it shall

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 17 in particular submit the following together with the notification:

agreement on the sale of receivables;
information on reasons for the sale of receivables;
data on the quality of the receivables in the moment of their sale;
data on the quality of collateral underlying those receivables, if any;
information on creditworthiness of the debtor to which the Development Bank has had the receivable sold;
information on the pricing method for the receivable sold, and
assessment of effects of the sale on the Development Bank’s financial position and performance indicators. (2) The materiality threshold referred to in paragraph (1) of this Article shall be the following amount, whichever is lower:
EUR 500,000, or
10% of Tier 1 capital of the Development Bank. Treatment of personal data Article 19 The Development Bank shall treat in accordance with the law governing personal data protection the data collected, processed, kept, submitted and used during the assessment of creditworthiness of the debtor and monitoring of the regularity in the payment of its obligations. 3.2. Risks related to credit risk Concentration risk Article 20 (1) The Development Bank shall, in its concentration risk management policy referred to in in accordance with Article 17 paragraph (2) of the Law, establish in particular the concentration related to the following:
individual persons and groups of connected persons;
groups of exposures connected by common risk factors, such as the same economic sector, the same activity, geographic region, the same business and type of goods, or the application of the same risk mitigation techniques that increase the exposure towards collateral providers; and
overall credit portfolio. (2) The Development Bank shall adopt adequate methodologies to monitor and mitigate concentration risk, which shall in particular include the following:
an active management of credit exposures portfolio diversification;
a determination of concentration limits, and
credit risk transfer or reduction.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 18 Country risk Article 21 For the purposes of country risk management, the Development Bank shall establish:

policies and procedures for country risk management, and
assessment of feasibility of contracts which have provided a basis for individual exposures to a debtor form another country and of the possibility of liquidating the collateral under the laws of the country in question in a specific period. Interest rate - induced credit risk and currency - induced credit risk Article 22 (1) In its credit risk management, the Development Bank shall cover an additional exposure to the risk of loss which arises from exposures:
indexed to variable interest rate (hereinafter: interest rate-induced credit risk), and
denominated in foreign currency or indexed to foreign currency (hereinafter: currency-induced credit risk). (2) The Development Bank shall, within the process of granting credit exposures denominated in the currency other than the EUR or indexed to the currency other than the EUR and/or credit exposures with variable interest rate, define the criteria for assessing the creditworthiness of debtors which shall in particular include the assessment of significant increase in debt repayment amount in the case of significant negative oscillations of underlying variable indicators. (3) The Development Bank shall take into account results of the assessment referred to in paragraph (2) of this Article in the process of establishing creditworthiness of the debtor. (4) Where the Development Bank uses hedging instruments against the risk referred to in paragraph (1) of this Article, it shall establish the methods for hedging of credit exposures in its internal methodologies. (5) The Development Bank shall ensure that the credit risk management referred to in paragraph (1) of this Article provides in particular the following:
identification of debtors that expose it to such risks;
calculation of impairment and provisions for exposures subject to risks referred to in paragraph (1) of this Article, in the case of foreign exchange rate or interest rates changes, and
connection of credit exposures and reference hedging instruments used by the Development Bank, if applicable. (6) The Development Bank shall carry out stress testing for risks referred to in paragraph (1) of this Article and take into account the connection between the foreign exchange rate and/or interest rate developments and the increase in the repayment of credit exposures measured by the ratio of total payments per credit exposures and income or profit of the debtor.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 19 IV RESIDUAL RISK MANAGEMENT Residual risk management Article 23 (1) Residual risk shall be a risk of loss for the Development Bank occurring if the results of application of the recognised credit risk mitigation techniques used by the Development Bank are less effective than expected. (2) The Development Bank shall adopt and implement adequate policies and procedures for residual risk management. (3) Policies and procedures for managing residual risk may be a part of the Development Bank's credit risk management policy. V MANAGEMENT OF THE INTEREST RATE RISK IN THE BANKING BOOK Management of the interest rate risk in the banking book Article 24 (1) The Development Bank shall establish and implement a comprehensive, reliable and efficient system for managing risks arising from potential changes in interest rates that affect the Development Bank’s activities from the non-trading book (hereinafter: the IRRBB), and that affect both the economic value of equity and the net interest income (earnings perspective). (2) When calculating the impact of interest rate movements from the earnings perspective, the Development Bank shall, in addition to the effects on interest income and expenses, also consider the effects of the market value changes of instruments either shown in other comprehensive income (profit and loss statement) or directly in equity, and take into account the increase or reduction in earnings and capital over shortterm and medium-term horizons resulting from interest rate movements. (3) The change in net interest income should be the difference between the expected net interest income under a shock or stress scenario from a going-concern perspective and the expected net interest income under a base scenario. (4) The change in the market value of instruments (fair value) should be the difference between the expected market value under a shock or stress scenario from a goingconcern perspective and the expected market value under a base scenario at the end of the assessed horizon. (5) The Development Bank should consider all interest rate sensitive instruments in the banking book in the context of the assessment and management of exposures to IRRBB, including assets, liabilities, interest rate derivatives, non-interest rate derivatives referencing an interest rate and other off-balance sheet items (such as loan

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 20 commitments). (6) When identifying interest rate sensitive instruments, the Development Bank should consider non-performing exposures (net of provisions) as interest rate sensitive instruments reflecting expected cash flows and their maturity. Overall strategy for managing the IRRBB Article 25 (1) The IRRBB strategy of the Development Bank, including the risk appetite for IRRBB and IRRBB mitigation, shall be a part of the overall strategy, in particular the strategic objectives and risk objectives. (2) The overall IRRBB strategy of the Development Bank shall also include the decision about the extent to which its business model relies on generating net interest income by ‘riding the yield curve’ – i.e., funding assets with a comparatively long repricing period with liabilities with a comparatively short repricing period, and where the business model relies heavily on this source of net interest income, the management body of the Development Bank should explain its IRRBB strategy and how it plans to survive periods of flat or inverse yield curves. (3) When using models of customer behaviour as an input for the measurement of its IRRBB, the Development Bank should provide evidence demonstrating that it understands the consequences of modelling of its customer base behaviour. (4) When making decisions on hedging activities, the Development Bank shall take into account the effects of accounting policies, but the accounting treatment may not drive their risk management approach. Risk appetite for IRRBB Article 26 (1) The Development Bank shall define risk appetite for IRRBB as an acceptable impact of fluctuating interest rates on both, the earnings and the economic value of equity. (2) Where the Development Bank has significant exposures to the three main sub-types of IRRBB i.e., gap risk, basis risk or option risk, it shall define its risk appetite in relation to each of these material sub-types of IRRBB, and establish limits for each risk sub-type. (3) The Development Bank shall, within the defined risk appetite, establish powers and responsibilities for managing IRRBB, as well as instruments, the hedging method and the risk assumption level for IRRBB. (4) When defining its risk appetite, the Development Bank shall take account of the effects of earnings risk that may arise as a consequence of accounting treatment of transactions in the non-trading book. (5) The impact of earning risk referred to in paragraph (4) of this Article shall not be

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 21 limited only to interest income and expenses, but it should take into account separately the effects of changes in interest rates on the market value of instruments that are reflected either through profit or loss statement or directly in equity, depending on accounting treatment. (6) The Development Bank shall take into account the impact on earnings related to embedded optionalities in fair value instruments under ongoing interest rate shocks and stress scenarios, and the potential impact on profit and loss statements of hedging interest rate derivatives if their effectiveness was hampered by interest rate changes. Limits Article 27 (1) The Development Bank shall implement limits that target maintaining IRRBB exposures consistent with its risk appetite and with its overall approach for measuring IRRBB, in particular the following:

limit policy that is appropriate to the nature, size, complexity and capital adequacy of the Development Bank and its ability to measure and manage its risks;
limits that clearly articulate that the acceptable amount of IRRBB should be applied on a consolidated basis and, as appropriate, at the level of individual affiliates;
senior management reporting systems and, if needed, reporting to the Management Board, in the case of exceeding limits, on positions that are or might be exceeded;
reporting of risk measures to the Management Board at least on quarterly basis. (2) The Development Bank shall establish and monitor risk hedging and controlling market price risks of instruments that are accounted for at market value. (3) Depending on its business model, the Development Bank may also identify sub-limits for individual business units, portfolios, instrument types, specific instruments or material sub-types of IRRBB risk such as gap risk, basis risk and option risk. (4) Limits may be associated with specific scenarios of changes in interest rates and maturity structures, such as their increase or decrease or a change in shape of the yield curve (5) The interest rate movements used in developing the limits should appropriately represent sufficiently adverse shock and stress situations, taking into account historical interest rate volatility and the time required by the management body to mitigate those risk exposures. IRRBB management policies and procedures Article 28 (1) The system for identifying and managing the IRRBB should ensure that:
the procedures for updating scenarios for the measurement and assessment of

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 22 IRRBB are set up; 2) the measurement approach and the corresponding assumptions for measuring and assessing IRRBB are appropriate and proportional; 3) the assumptions of the models used are regularly reviewed and, if necessary, amended; 4) the standards for the evaluation of positions and the measuring of performance are defined; 5) appropriate documentation and control over permissible hedging strategies and hedging instruments exist, and 6) the lines of powers and responsibilities for managing IRRBB exposures are defined. (2) The policies should be well reasoned, comprehensive and documented and should address all IRRBB components that are important to the Development Bank, specifically the following:

the application of the boundary between non-trading book and trading book, and internal risk transfers between the non-trading book and the trading book should be properly documented and monitored within the broader monitoring of the IRRBB originated by interest rate derivatives instruments;
the size and the form of the different interest rate shocks to be used for internal IRRBB calculations;
the treatment of ‘pipeline transactions’ (including any related hedging);
the aggregation of multi-currency interest rate exposures;
the measurement and management of basis risk resulting from different interest rate indexes;
the measurement of IRRBB arising from behavioural and automatic options in assets or liabilities, including convexity effects and non-linear payoff profiles. (3) The Development Bank shall revise all IRRBB policies at least once a year and update them, if needed. Internal controls Article 29 (1) The Development Bank shall ensure regular reviews and evaluations of the internal controls system and procedures for managing IRRBB risks by persons or organisational units that are independent from the operations that are being reviewed. (2) Internal audit shall establish regular review of the procedures for identifying, measuring, monitoring and controlling the IRRBB. Information system and applications for managing IRRBB Article 30 (1) For the purposes of IRRBB management, the Development Bank shall establish timely and reliable information systems and applications for:
carrying out, processing and recording of business events;
identifying, measuring and aggregating exposures to IRRBB, and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 23 3) generating the reports. (2) The systems referred to in paragraph (1) of this Article should enable:

full and clear recording of all transactions, taking into account their IRRBB characteristics;
possibility of accommodating a reasonable range of shock and stress scenarios, as well as any additional scenarios;
measurement, assessment and monitoring of the impact of individual transactions to the overall exposure;
computation of economic value measures;
computation of earnings-based measures for IRRBB, as well as other measures of IRRBB based on the interest rate shock and stress scenarios, and
gathering of detailed information on repricing date of a given transaction, interest rate type or index, any options (including early repayment or redemption) and the fees relating to the exercise of these options. (3) The Development Bank shall establish adequate organisational controls of information systems to prevent the loss of data used by the IRRBB applications, and to control changes to the coding used in those applications, so as to ensure, in particular:
the reliability of data and parameters used as input, as well as the integrity of processing systems for IRRBB models;
that the likelihood of errors occurring in the information system is minimised; and
that adequate measures are taken if market disruptions or slumps occur. (4) The Development Bank shall implement appropriate processes that ensure that the data entered into the information system is correct, and establish appropriate mechanisms to verify the accuracy of the aggregation process and the reliability of model results. (5) The Development Bank shall identify potential reasons for discrepancies and irregularities that may arise at the time of data processing, and shall have procedures in place to handle those discrepancies and irregularities, including procedures for the mutual reconciliation of positions to enable these discrepancies and irregularities to be eliminated. Internal reporting Article 31 (1) The Development Bank shall ensure that the internal risk reporting systems provide timely, accurate and comprehensive information about their exposures to IRRBB. (2) Internal reports shall be submitted to the Management Board and senior management at least on quarterly basis. (3) The reports referred to in paragraph (2) of this Article shall include in particular:
summaries of the aggregate IRRBB exposures, including information on exposures to gap, basis and option risks, including explanations of all significant

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 24 positions in assets, liabilities, cash flows, and strategies that are driving the level and direction of IRRBB; 2) compliance with policies and limits, and 3) summaries of the reviews of IRRBB policies, procedures and adequacy of the measurement systems, including in particular any findings of internal and external auditors. IRRBB measurement Article 32 (1) For measuring and monitoring IRRBB, the Development Bank shall use at least one earnings-based measure and at least one economic value measurement method that, in combination, capture all components of IRRBB. (2) For the purposes of identification, assessment, management and mitigation of IRRBB, the Development Bank shall include at least the following non-trading book positions in financial assets, liabilities and off-balance sheet items at least for each currency where they have a position that is material:

interest rate derivatives;
non-interest rate derivatives for which the cash flows are determined in total or in part, by referencing an interest rate;
interest rate-sensitive assets, other than the assets referred to in items 1) to 2) of this paragraph which are not deducted from Common Equity Tier 1 capital;
interest rate-sensitive liabilities other than the liabilities referred to in items 1) to
of this paragraph and other than Common Equity Tier 1 and other perpetual instruments without any call dates, including non-remunerated deposits, and
interest rate-sensitive off-balance sheet items other than those referred to in items 1) to 2) of this paragraph. (3) Material position referred to in paragraph (2) of this Article means a position whose accounting value of assets or liabilities denominated in a currency, amounts to at least 5% of the total non-trading book financial assets or liabilities, or to less than 5% where the sum of financial assets or liabilities included in the calculation is lower than 90% of the total non-trading book financial assets (excluding tangible assets) or liabilities. (4) The net interest income shall be calculated at a minimum on a time horizon of one year. (5) The time remaining up to the end of a net interest income horizon shall be the net interest rate horizon minus the relevant repricing mid points of the buckets referred to in Table 1 Article 33 of this Decision. (6) The Development Bank shall classify shock scenarios into one of the following types:
parallel shocks, specifically: − a shock of increased interest rates in parallel across all maturities; − a shock of decreased interest rates in parallel across all maturities;
a shock involving rotations to the maturity structure, specifically:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 25 − with a decrease in the interest rate on long-term maturities and an increase in the interest rate on short-term maturities, leading to a flattening of the interest rate curve; − with an increase in the interest rate on long-term maturities and decrease in the interest rate on short-term maturities, leading to a steepening of the interest rate curve; 3) uneven shocks, specifically: − a shock of increased interest rates that is greater at short-term maturities; − a shock of decreased interest rates that is greater at short-term maturities. (7) For the purposes of Article 34 paragraphs (6) and (7) and Article 36 of this Decision: − the shock referred to in paragraph (6) item 1) indent 1, item 2) indent 1 and item 3) indent 1 of this Article shall be the shock prescribing an increase in short-term interest rates; − the shock referred to in paragraph (6) item 1) indent 2, item 2) indent 2 and item 3) indent 2 of this Article shall be the shock prescribing a decrease in short-term interest rates. (8) For the purposes of Article 35 paragraph (3) of this Decision: − the shock referred to in paragraph (6) item 1) indent 1, item 2) indent 1 and item 3) indent 1 of this Article shall be the shock prescribing an increase in interest rates; − the shock referred to in paragraph (6) item 1) indent 2, item 2) indent 2 and item 3) indent 2 of this Article shall be the shock prescribing a decrease in interest rates. General requirements for allocating cash flows under standardised approach for the calculation of economic value of equity Article 33 (1) The Development Bank shall slot by repricing date, currency and type of shock scenario the notional cash flows of its positions into the repricing time buckets laid down in Table 1 of this Article, as follows:

for fixed instruments by repricing date, following any deduction applied in accordance with paragraph (2) of this Article, to the relevant time bucket referred to in Table 1 of this paragraph;
for floating rate instruments by repricing date into the relevant repricing time buckets, as follows: −cash flows deriving from interest payments other than payments of the spread component up to the next repricing date, as per the contractual agreement. −the remaining principal amount, as per the contractual agreement. −spread components up to the final contractual maturity irrespective of any repricing of the non-amortised principal, except where they are excluded according to paragraph (2) of this Article.
for non-maturity deposits in accordance with Article 34 of this Decision;
for fixed rate loans subject to the risk of early repayment in accordance with Article 35 of this Decision;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 26 5) for term deposits subject to early redemption in accordance with Article 36 of this Decision; 6) for derivatives not subject to optionality in accordance with Article 37 of this Decision; 7) for other instruments in accordance with Article 38 of this Decision. Table 1: Time buckets Time buckets (mo.=month; yr.=year) Midpoint of time bucket (tk) (in years) Length of time bucket (in years) Overnight (O/N) 0.0028 0

O/N ≤ 1 mo. 0.0417 1/12 1 mo. ≤ 3 mo. 0.1667 2/12 3 mo. ≤ 6 mo. 0.375 3/12 6 mo. ≤ 9 mo. 0.625 3/12 9 mo. ≤ 12 mo. 0.875 3/12 12 mo. ≤ 18 mo. 1.25 6/12 18 mo. ≤ 2 yr. 1.75 6/12 2 yr. ≤ 3 yr. 2.5 1 3 yr. ≤ 4 yr. 3.5 1 4 yr. ≤ 5 yr. 4.5 1 5 yr. ≤ 6 yr. 5.5 1 6 yr. ≤ 7 yr. 6.5 1 7 yr. ≤ 8 yr. 7.5 1 8 yr. ≤ 9 yr. 8.5 1 9 yr. ≤ 10 yr. 9.5 5 10 yr. ≤ 15 yr. 12.5 5 15 yr. ≤ 20 yr. 17.5 5 20 yr. 25 10 (2) Where the Development Bank excludes commercial margins and other spread components from the calculation of cash flows, it shall do the following:

use a transparent methodology for identifying the risk-free rate at origination of each instrument;
use a methodology that is applied consistently across business units;
ensure that the exclusion of commercial margins and other spread components from the cash flows is consistent with how the Development Bank manages and hedges IRRBB;
notify the Central Bank of their exclusion. (3) The Development Bank shall not take into account, for the purposes of the slotting referred to in paragraph (1) of this Article, the impact on notional repricing cash flow deriving from an embedded optionality of an automatic interest rate option, but the notional repricing cash flows shall be slotted as if the embedded optionality does not

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 27 exist. (4) The Development Bank shall take into account, for the purposes of slotting referred to in paragraph (1) of this Article the notional repricing cash flow deriving from an embedded optionality of a behavioural interest rate option. Non-maturity deposits Article 34 (1) The Development Bank shall classify non-maturity deposits according to the counterparty as follows:

retail non-maturity deposits, and
wholesale non-maturity deposits, which are further classified into wholesale deposits of financial customers and wholesale non-financial deposits. (2) The Development Bank shall distinguish the stable from the non-stable part of the retail deposits and the wholesale non-financial deposits referred to in paragraph (1) of this Article, using the observed changes of the volume of the deposits due to upward and downward movements of the risk-free interest rate for a period of at least the preceding ten years. (3) The Development Bank shall further distinguish the stable part of the non-maturity deposits referred to in paragraph (1) of this Article into a core and a non-core component. (4) To determine the amount of the non-core component of the stable deposits, the Development Bank may multiply the amount of all stable deposits by the pass-through rate. (5) When assessing the pass-through rate, the Development Bank shall consider the following elements also having regard to positions having similar features:
the current level of interest rates, the spread between the Development Bank’s offer rate and market rate, competition from other firms, the Development Bank’s geographical location and demographic and other relevant characteristics of its customer base.
the unlikely repricing of the core component even under significant changes in the interest rate environment. (6) In scenarios prescribing an increase in short-term interest rates as referred to in Article 32 paragraphs (6) and (7) of this Decision, the core component calculated in accordance with paragraphs (4) and (5) of this Article shall be multiplied by 0.8 and the non-core component shall increase accordingly. (7) In scenarios prescribing a downward movement of short-term interest rates, the core component calculated in accordance with paragraphs (3) and (5) of this Article shall be multiplied by 1.2 and the non-core component shall decrease accordingly. (8) The Development Bank shall apply the following caps on the proportion of the core

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 28 component of the non-maturity deposits when implementing paragraphs (3) to (7) of this Article:

70%, for retail non-maturity deposits referred to in paragraph (1) item 1) of this Article;
50%, for non-financial wholesale non-maturity deposits referred to in paragraph (1) item 2) of this Article. (9) The Development Bank shall treat all financial non-maturity wholesale deposits, as referred to in paragraph (1) item 1) of this Article, as non-core non-maturity deposits. (10) The Development Bank shall allocate the non-core component of the non-maturity deposits into the (overnight) repricing time bucket (1) referred to in Table 1 of Article 33 of this Decision. (11) The Development Bank shall identify non-maturity deposits as non-core deposits if the total amount of non-maturity deposits is smaller than 2% of the positions referred to in Article 32 paragraph (2) of this Decision that are accounted for as a liability in accordance with the applicable accounting framework. Fixed rate loans subject to the risk of early repayment Article 35 (1) The Development Bank shall treat fixed rate loans to retail customers as subject to the risk of early repayment, where the borrower has the ability to repay a part or all of the outstanding principal before the contractually agreed repayment date or the contractual maturity date of the principal, without bearing the economic costs for such repayment, and where a borrower is bearing the economic cost only above a certain early repayment threshold, the Development Bank should treat the loan as a fixed rate loan subject to the risk of early repayment. (2) The Development Bank shall determine and apply, in a way consistent over time and appropriate for the estimation of an average early repayment rate, an estimation of the baseline annual conditional early repayment rate per currency for the positions referred to in paragraphs (1) and (7) of this Article, wherein that rate shall be distinct for each portfolio of homogeneous positions and shall be determined under the prevailing maturity structure of interest rates based on all available internal observations, and it may be set at 0, where the total amount of the fixed rate loans referred to in paragraphs (1) and (7) of this Article is less than 5% of the positions referred to in Article 32 paragraph (2) of this Decision that are accounted for as an asset in accordance with the applicable accounting framework. (3) The Development Bank shall adjust the conditional early repayment rate calculated in accordance with paragraph (2) of this Article to the shock scenarios, wherein, in scenarios prescribing an increase in interest rates as referred to in Article 32 paragraph (8) of this Decision, the conditional early repayment rate shall be multiplied by 0.8, while in scenarios prescribing a decrease in interest rates as referred to in Article 32 paragraphs (6) and (8) of this Decision, the conditional early repayment rate shall be multiplied by

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 29 1.2. (4) For each repricing time bucket referred to in Table 1 of Article 33 of this Decision, the Development Bank shall estimate the expected amount of prepaid loans per time bucket by multiplying the amount referred to in item 1) of this paragraph with the appropriate rate referred to in item 2) of this paragraph:

the outstanding amount of the fixed rate loan referred to in paragraph (1) of this Article of a certain homogeneous product type denominated in a certain currency, wherein the amount matured or prepaid at a time earlier than the lower limit of the time bucket shall not be regarded as outstanding amount;
the time-weighted conditional early repayment rate is defined as the conditional early repayment rate in accordance with paragraph (2) of this Article, multiplied by the length of the applicable time bucket specified in Table 1 of Article 33 of this Decision and adjusted in accordance with paragraph (3) of this Article. (5) The Development Bank shall allocate the early repaid amount of the fixed rate loans referred to in paragraph (1) of this Article, including penalty fees on the early repaid amount that retail customers pay in the applicable scenario, into the appropriate time buckets referred to in Table 1 of Article 33 of this Decision, wherein any part of their repricing cash flows that is not expected to be early repaid shall be allocated into the repricing time buckets referred to Table 1 of Article 33 of this Decision on the basis of the contractual repayment schedule for the duration of their contractual maturity. (6) The Development Bank shall not treat fixed rate loans to wholesale customers, where the borrower has the ability to early repay a part or all of the outstanding principal before the contractually agreed repayment date or the contractual maturity date of the principal in accordance with the provisions of this Article, but in accordance with Article 33 paragraph (1) item 1) and Article 39 of this Decision. (7) Where the Development Bank is exposed to assets in the form of securities with underlying instruments in the form of loans referred to in paragraph (1) of this Article, and the issuer of those assets has no obligation to replace the loans in the case of their early repayment, a look-through approach shall be applied and the positions in those assets shall be evaluated in accordance with paragraph (1) of this Article, irrespective of whether the counterparty of the Development Bank is a retail or a wholesale customer. Term deposits subject to the risk of early redemption Article 36 (1) The Development Bank shall consider fixed interest rate term deposits as term deposits with the risk of early redemption, where they are retail deposits and the depositor holds the option to redeem any outstanding amount before the contractual maturity date of the deposit. (2) Term deposits referred to in paragraph (1) of this Article, the early redemption (withdrawal) of which would result in a penalty that the customer would pay to the Development Bank compensating for both, the loss of interest between the date of the

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 30 deposit’s redemption and the date of its contractual maturity and for the economic cost of redeeming the deposit, may be treated in accordance with Article 33 paragraph (1) item

of this Decision. (3) The Development Bank shall not apply the provisions of this Article to wholesale fixed rate term deposits, but Article 33 paragraph (1) item 1) of this Decision, and where the wholesale depositor holds the option to redeem any outstanding amount before the contractual maturity date of the deposit, and the conditions referred to in paragraph (2) of this Article are not met, the option shall be treated as an embedded automatic option in accordance with Article 39 of this Decision. (4) The Development Bank shall determine, in a way that is consistently applied over time and which is suitable for the estimation of an average early redemption rate, an estimation of the baseline cumulative term deposit redemption rate, which the Development Bank shall determine distinctively for each portfolio of homogeneous products denominated in a currency, under the prevailing maturity structure of interest rates, based on all available internal observations, and the rate may also be set at 0, where the total of term deposits referred to paragraph (1) of this Article is smaller than 5% of the positions referred to in Article 32 paragraph (2) of this Decision that are accounted for as a liability in accordance with the accounting framework. (5) The Development Bank shall adjust the term deposit redemption rates determined in paragraph (4) of this Article to the shock scenarios, wherein:
in scenarios prescribing a decrease of the short-term interest rates as referred to in Article 32 paragraphs (6) and (8) of this Decision, the redemption rate shall be multiplied by 0.8, and
in scenarios prescribing an increase of the short-term interest rates as referred to in Article 32 paragraphs (6) and (8) of this Decision, the redemption rate shall be multiplied by 1.2. (6) The Development Bank shall calculate the expected amount of early redeemed term deposits, per time buckets referred to in Table 1 of Article 33 of this Decision, by multiplying the amount of term deposits referred to in item 1) of this paragraph by the appropriate rate referred to in item 2) of this paragraph:
the amount of term deposits referred to in paragraph (1) of this Article of a certain homogeneous product type denominated in a certain currency;
the appropriate cumulative term deposit redemption rate adjusted in accordance with paragraph (5) of this Article. (7) The Development Bank shall obtain the total amount of the early redeemed term deposits by the aggregation of the early redemption amounts per time buckets set out in accordance with paragraph (6) of this Article, for all time buckets and sets of homogeneous product types, wherein the obtained expected early redeemed amounts shall be allocated in the time bucket (1) (overnight deposits), while the parts of the cash flows of the term deposits referred to in paragraph (1) of this Article not expected to be redeemed early shall be allocated in accordance with their contractual maturity into the time buckets referred to in Table 1 of Article 33 of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 31 Derivatives not subject to optionality Article 37 (1) The Development Bank shall separate derivative instruments not subject to optionality into a paying and a receiving leg. (2) The receiving leg of a derivative instrument shall be treated as an incoming cash flow, while the paying leg of a derivative instrument shall be treated as an outgoing cash flow. (3) Cross-currency interest rate swaps involving swapping principal or interest in different currencies shall be treated separately for each leg in each currency. (4) The Development Bank shall treat the interest income and expenses of derivative instruments used for hedging separately from the income and expenses deriving from the hedged position. Other instruments Article 38 (1) The Development Bank whose non-performing exposure ratio equals or exceeds 2% shall allocate the cash flow of non-performing exposures net of value adjustments, reflecting their expected cash flows and their timing, into the repricing time buckets referred to in Table 1 of Article 33 of this Decision in a way that it is consistently applied over time. (2) For the purposes of paragraph (1) of this Article, non-performing exposures shall be determined for debt securities, loans and advances classified as non-performing in accordance with the regulation governing the classification of assets and calculation of provisions for potential loan losses of the Development Bank, wherein the non-performing exposures ratio shall be calculated as the amount of non-performing exposures divided by the amount of total gross debt securities, loans and advances. (3) Where the sum of notional amounts of fixed rate loan commitments to retail counterparties exceeds 2% of the positions referred to in Article 32 paragraph (2) of this Decision that are accounted for as an asset in accordance with the accounting framework, the Development Bank shall estimate, taking into account the value of the contract for the counterparty in the baseline and shock scenarios and based on historical internal observations of drawings on fixed rate loan commitments per the type of the counterparty under similar conditions, amounts to be drawn and undrawn in both scenarios, and it shall allocate the estimated drawn amounts in accordance with the estimated time of the drawing, into the repricing time buckets referred to in Table 1 of Article 33 of this Decision. Economic value of equity add-on for automatic interest rate options Article 39 (1) The Development Bank shall calculate the economic value of equity add-on for the explicit and embedded automatic sold and bought interest rate options of their positions referred to in Article 33 paragraph (3) of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 32 (2) In the case of bought automatic interest rate options, the Development Bank shall determine the change in value of the option between the applicable interest rate shock scenario and the baseline scenario combined with a relative increase in the implicit interest rate volatility of 25%. (3) In the case of sold automatic interest rate options, the Development Bank shall calculate the value change for the applied interest rate shock scenario compared to the baseline scenario, wherein the value change shall be the difference between:

an estimate of the value of the option for the option holder, given: − a risk-free yield curve in the applicable currency under the applied interest rate shock scenario; and − a relative increase in the implicit interest rate volatility of 25%.
the value of the sold option for the option holder, on the basis of the non-shock yield curve and implicit interest rate volatility in the applicable currency at the valuation date. (4) The Development Bank shall calculate the total measure for automatic interest rate option risk as a result of an interest rate shock scenario in a currency as the difference between the values calculated in accordance with paragraphs (2) and (3) of this Article. (5) For the valuation required under paragraphs (2) and (3) of this Article, the Development Bank shall apply its relevant internal valuation methods. Economic value of equity and delta economic value of equity calculation Article 40 (1) The Development Bank shall calculate the economic value of equity for the baseline and the shock scenario in each currency in accordance with paragraphs (2) to (4) of this Article, and it shall calculate the change in the economic value of equity in accordance with paragraphs (5) and (6) of this Article. (2) The Development Bank shall allocate the notional cash flows into the time buckets in accordance with Articles 33 to 38 of this Decision, with the following further specifications:
all positive and negative notional cash flows within a time bucket shall be netted, forming a net long or net short position for each repricing time bucket;
incoming cash flows shall have a positive sign, and outgoing cash flows shall have a negative sign. (3) Net notional repricing cash flows shall be discounted towards a present value by using a discount factor 𝐷𝐷𝐷𝐷𝐷𝐷,𝑐𝑐 (𝑡𝑡𝑡𝑡) shall be calculated from the spot zero interest rate 𝑅𝑅 ,𝑐𝑐 (𝑡𝑡𝑡𝑡) at the bucket mid-point for the respective scenario and currency 𝑐𝑐 multiplied by the bucket mid-point 𝑡𝑡𝑡𝑡 as: 𝐷𝐷𝐷𝐷𝑖𝑖,𝑐𝑐(𝑡𝑡𝑘𝑘) = exp�−𝑅𝑅𝑖𝑖,𝑐𝑐(𝑡𝑡𝑘𝑘) ∗ 𝑡𝑡𝑘𝑘� (4) The Development Bank shall sum up the discounted net repricing cash flows across all repricing time buckets, to determine the economic value of equity for the baseline and the shock scenario, for each currency.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 33 (5) The change in the economic value of equity shall be calculated by subtracting the economic value of equity in the baseline scenario from the economic value of equity in the shock scenario, and by adding the change of the value of the explicit and embedded automatic interest rate option calculated in accordance with Article 39 of this Decision. (6) When calculating the aggregate change for each shock scenario, the Development Bank shall add together any negative and positive changes occurring in each currency, wherein in this calculation, currencies other than the reporting currency shall be converted to the reporting currency at the Central Bank spot FX rate on the reference date. (7) Positive changes referred to in paragraph (6) of this Article shall be weighted by a factor of 50%, or by a factor of 80% in the case of Exchange Rate Mechanism II - ERM II currencies with a formally agreed fluctuation band narrower than the standard band of +/- 15%. (8) Weighted gains shall be recognized up to the greater of the following values:

the absolute value of negative changes in EUR or ERM II currencies; or
the result of applying a factor of 50% to the positive changes of ERM II currencies or EUR. Special requirements under standardised approach for allocating repricing cash flows for the calculation of net interest income Article 41 For the allocation of repricing cash flows for the calculation of the net interest income, the Development Bank shall apply provisions of Articles 33 to 38 of this Decision, with the following derogations:
by way of derogation from Article 33 paragraph (2) of this Decision, the Development Bank shall include in interest payments the commercial margins and other spread components;
in addition to the allocation of the notional cash flows referred to in Article 33 paragraph (1), and Articles 35, 36, and 38 of this Decision into the appropriate time buckets in accordance with the provisions of those Articles, the Development Bank shall allocate those cash flows into the reference term time buckets referred to in Table 2 of this Article, wherein notional repricing cash flows that are interest payments shall take into account the reference term of the instrument that generated them;
in addition to the allocation of the notional cash flows into time buckets referred to in Article 33 paragraph (1) item 2) and Article 34 of this Decision, the Development Bank shall allocate those cash flows into the first reference term time bucket referred to in Table 2 of this Article (time bucket exceeding the overnight up to and including 12 months, with the midpoint of 12 months);
fixed legs of derivative instruments referred to in Article 37 of this Decision shall be treated under item 2) of this paragraph, while floating legs of derivative instruments shall be treated under item 3) of this paragraph.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 34 Table 2: Repricing time buckets for allocating expected cash flows Number Time buckets (mo.=month; yr.=year) Midpoint of time bucket (in years) REFj

O/N ≤ 12 mo. 1 12 mo. ≤ 1.5 yr. 1.25 1.5 yr. ≤ 2 yr. 1.75 2 yr. ≤ 3 yr. 2.5 3 yr. ≤ 4 yr. 3.5 4 yr. ≤ 5 yr. 4.5 5 yr. ≤ 6 yr. 5.5 6 yr. ≤ 7 yr. 6.5 7 yr. ≤ 8 yr. 7.5 8 yr. ≤ 9 yr. 8.5 9 yr. ≤ 10 yr. 9.5 10 yr. ≤ 15 yr. 12.5 15 yr. ≤ 20 yr. 17.5 20 yr. 25 Net interest income add-on for automatic interest rate options up to the net interest income horizon Article 42 The Development Bank shall apply Article 39 of this Decision to calculate the net interest income add-on for explicit and embedded automatic interest rate options up to the net interest income horizon, with the following derogations:

automatic options that can only be exercised beyond the net interest income horizon shall be excluded from the calculation;
the relative increase in implicit volatility shall be disregarded for the purposes of this calculation;
the value referred to in Article 39 paragraphs (2) and (3) of this Decision shall be calculated on the basis of pay-outs expected in the baseline and shock scenarios;
by way of derogation from Article 39 paragraphs (2) and (3) of this Decision, the instruments vis-a-vis retail and non-retail counterparties, whose optionality/nonlinearity is automatically activated, shall be assumed to be rolled over with comparable characteristics up to the end of the net interest income horizon referred to in item 1) of this paragraph. Market value changes for automatic interest rate options held at fair value and maturing beyond the net interest income horizon Article 43 To calculate the market value changes for automatic interest rate options held at fair value and maturing beyond the net interest income horizon, the Development Bank shall apply Article 39 of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 35 Projected yield of risk-free component for the calculation of net interest income Article 44 (1) For the purposes of calculating the contribution to net interest income of the projected risk-free yield on the reinvestment or refinancing of repricing cash flows, the Development Bank shall, for each currency and scenario, determine a table of forward rates representative of the risk-free component of interest rates that is expected to be applied to risk-free loans starting at the repricing mid points of buckets referred to in Table 3 of this paragraph, and with maturities corresponding to the reference term bucket mid points referred to in Table 2 of Article 41 of this Decision. Table 3: Time buckets referred to in Table 1 of Article 33 of this Decision that shall be repriced in the case of different net interest income horizons Time buckets (mo.=month; yr.=year) net interest income horizon

O/N 12 mo. 1 O/N 1.5 yr. 1.5 O/N ≤ 2 yr. 2 O/N ≤ 3 yr. 3 O/N ≤ 4 yr. 4 O/N ≤ 5 yr. 5 O/N ≤ 6 yr. 6 O/N ≤ 7 yr. 7 O/N ≤ 8 yr. 8 O/N ≤ 9 yr. 9 O/N ≤ 10 yr. 10 O/N ≤ 15 yr. 15 O/N ≤ 20 yr. 20 20 yr. 25 (2) The Development Bank shall determine the forward rates referred to in paragraph (1) of this Article in accordance with the following formula: 𝐹𝐹 𝑖𝑖,𝑐𝑐�𝑡𝑡𝑘𝑘, 𝑡𝑡𝑘𝑘 + 𝑅𝑅𝑅𝑅 𝑗𝑗� = − In�𝐷𝐷𝐷𝐷𝑖𝑖,𝑐𝑐�𝑡𝑡𝑘𝑘+𝑅𝑅𝑅𝑅 𝑗𝑗�/𝐷𝐷𝐷𝐷𝑖𝑖,𝑐𝑐(𝑡𝑡𝑘𝑘)� 𝑅𝑅𝑅𝑅 𝑗𝑗 , where: 𝑡𝑡 is the midpoint of repricing bucket k; 𝑅𝑅𝑅𝑅 𝑗𝑗 is the midpoint of reference term bucket j; 𝐹𝐹 ,𝑐𝑐(𝑡𝑡 ,𝑡𝑡 + 𝑅𝑅𝑅𝑅 𝑗𝑗 ) is the forward rate for the respective scenario and for currency 𝑐𝑐 for a risk-free loan starting at the midpoint of repricing bucket and maturing at the midpoint of reference term bucket j;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 36 𝐷𝐷𝐷𝐷 ,𝑐𝑐 (𝑡𝑡 ) is the discounting factor for the respective scenario and for currency 𝑐𝑐 and time 𝑡𝑡 as referred to Article 40 paragraph (3) of this Decision. (3) The Development Bank shall determine the applicable risk-free interest rate, for each combination of a repricing bucket midpoint with a reference term bucket midpoint, by multiplying the forward rates referred to in paragraph (1) of this Article with the remaining time up to the end of the time horizon of the net interest income calculation set out in Article 32 paragraph (5) of this Decision. (4) The remaining time up to the end of a net interest income horizon shall be the net interest income horizon minus the relevant repricing mid points of the buckets referred to in Table 1 of Article 33 of this Decision. (5) The Development Bank shall calculate the contribution to the net interest income of the projected risk-free interest rate on the reinvestment or refinancing of repricing cash flows by multiplying the notional repricing cash flows referred to in Article 33 paragraph (1) item 1), and Articles 34 to 38 of this Decision, allocated in accordance with Article 41 paragraph (1) items 2) and 3) of this Decision, with the contribution of the corresponding applicable risk-free interest rate calculated in accordance with paragraph (3) of this Article. Projected yield of commercial margin component for the calculation of net interest income Article 45 (1) The Development Bank shall calculate the contribution to the net interest income of the projected commercial margin on the reinvestment or refinancing of repricing cash flows of the instruments referred to in Article 33 paragraph (1) item 1), and Articles 34 to 36 of this Decision by allocating these cash flows at the reset of commercial margins, and by estimating the applicable commercial margin rate and the remaining time up to the end of the net interest income horizon. (2) The allocation of cash flows referred to in paragraph (1) of this Article shall be performed in the repricing time buckets referred to in Table 3 of Article 44 of this Decision in accordance with Article 33 paragraph (1) item 1), and Articles 34 to 36 of this Decision. (3) By way of derogation from Article 33 paragraph (1) item 2) of this Decision, in the case of floating rate instruments, the part of repricing cash flows constituting a principal amount shall be allocated in accordance with its final contractual maturity date. (4) To calculate the contribution of the projected commercial margin on the reinvestment of repricing cash flows to the net interest income, the Development Bank shall allocate the evaluated positions into the following product types (further divided by geographical location), and currency denomination:

the product types of financial assets shall be: − debt securities;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 37 − loans and advances – non-financial corporates; − loans and advances - households –mortgages; − loans and advances - households – credit (non-mortgage); − loans and advances – other counterparties; − other products in the non-trading book; 2) the product types of financial liabilities shall be: − deposits – non-financial corporates; − deposits – households; − deposits – other counterparties; − debt securities; − other liabilities in the non-trading book. (5) To determine the commercial margin rate referred to in paragraph (1) of this Article, the Development Bank shall apply the following:

in the case of instruments traded in deep and active liquid markets where the value of the instrument can be determined on the basis of widely disseminated and easily available market prices, the commercial margin rate shall be determined on the basis of the market price and the interest payments of the instrument with a deduction of the risk-free rate;
in the case of other instruments, the commercial margin rate shall be determined by the weighted average of commercial margins received or paid in transactions during the last 360 days, having regard to the product type, geographical location and currency denomination referred to in paragraph (4) of this Article. In the absence of such transactions, the commercial margin rate shall be determined on the basis of assumptions relying on margins received or paid in comparable portfolios. (6) The commercial margin rate determined in accordance with paragraph (5) of this Article in the baseline scenario shall also apply in a shock scenario. (7) To take into account the remaining time in the net interest income horizon, the Development Bank shall determine the percentage of commercial margin yield by multiplying the commercial margin calculated in accordance with paragraph (5) of this Article by the remaining time up to the end of the net interest income horizon, whereby the remaining time up to the end of a net interest income horizon shall be the net interest income horizon minus the relevant repricing mid points of the repricing buckets referred to in Table 1 of Article 33 of this Decision. (8) The Development Bank shall determine the contribution to the net interest income of the projected commercial margin on the reinvestment or refinancing of repricing cash flows by multiplying the cash flows calculated in accordance with paragraph (2) of this Article by the applicable commercial margin yield referred to in paragraph (7) of this Article.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 38 Interest payments or part of interest payments that occur up to and including their reset date Article 46 (1) To determine the contribution to the net interest income of interest payments occurring up to the repricing date including that date, the Development Bank shall additionally allocate exclusively these interest payments of the instruments referred to in Article 33 paragraph (1) item 1), and Articles 34 to 38 of this Decision into the repricing time buckets referred to in Table 3 of Article 44 of this Decision, provided that these interest payments meet the following conditions:

the size of the interest payment is known and fixed, with no possibility for the payment to change due to a movement in interest rates;
the interest payment is expected to be paid within the net interest income horizon referred to in Article 32 paragraph (4) of this Decision. (2) For instruments referred to in Article 33 paragraph (1) item 2) of this Decision, where the interest payment occurs after the interest repricing date, the Development Bank shall apply paragraph (1) of this Article only to the part of the interest payment that represents the commercial margin. Market value changes for instruments held at fair value maturing beyond the net interest income horizon Article 47 (1) To calculate the market value changes beyond the net interest income horizon for instruments held at fair value, the Development Bank shall perform the allocation in accordance with Article 40 paragraph (2) of this Decision, taking into account Article 41 paragraph (1) item 1) of this Decision, and with the following derogations: (1) the cash flows related to instruments not held at fair value shall be excluded; (2) the cash flows repricing in the net interest income time horizon shall be excluded by being set to zero in the repricing time buckets referred to in Table 3 of Article 44 of this Decision. (2) To calculate the market value changes for instruments held at fair value that are maturing beyond the net interest income horizon, the Development Bank shall apply Article 40 paragraphs (3) to (5) of this Decision to the allocation performed in accordance with paragraph (1) of this Article. Net interest income add-on for basis risk Article 48 (1) Where the sum of floating rate instruments, other than those in the category “overnight”, exceeds 5% of the positions referred to in Article 32 paragraph (2) of this Decision that are accounted for as assets in accordance with the applicable accounting framework, the notional repricing cash flows of floating rate instruments shall be allocated, in addition to their allocation in accordance with Article 33 paragraph (1) item 2) of this Decision, for each currency by their repricing date, to the repricing time buckets referred to in Table 3 of Article 44 of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 39 (2) The notional repricing cash flows referred to in paragraph (1) of this Article shall, for the purpose of their allocation, be broken down into the following reference terms, which the floating rate instrument refers to:

overnight;
1 month;
3 months;
6 months;
12 months. (3) In the absence of a reference term, the notional repricing cash flows shall be assigned to the following categories:
“policy rate” in case the floating rate instrument refers to a central bank policy rate;
“other” in case of a floating rate instrument link to any other benchmark. (4) Incoming notional repricing cash flows shall be allocated with a positive sign and outgoing notional repricing cash flows shall be allocated with a negative sign. (5) For the purposes of paragraph 1 of this Article, the Development Bank shall exclude embedded interest rate options and shall treat those options in accordance with paragraph (10) of this Article. (6) The Development Bank shall estimate tightening shocks and widening shocks, in a way that is consistently applied over time, for each reference term category referred to in paragraphs (2) to (4) of this Article for a given currency on the basis of historic observations of movements in the interest rates of the instruments in each category. (7) The tightening shocks and widening shocks shall be determined by comparing interest rates with the overnight reference term referred to in paragraph (2) item 1) of this Article, to the other reference terms as set out in paragraph (2) items 2) to 5) and paragraphs (3) and (4) of this Article. (8) The Development Bank shall apply to the notional repricing cash flows for each currency the shocks referred to in paragraph (7) of this Article multiplied by the remaining time up to the end of a net interest income horizon. (9) The remaining time up to the end of a net interest income horizon referred to in paragraph (8) of this Article shall be the net interest income horizon minus the relevant repricing mid points of the buckets referred to in Table 1 of Article 33 of this Decision. (10) The Development Bank shall aggregate in one amount separately for the tightening and for the widening scenario the results of the calculations referred to in paragraph (8) of this Article. (11) The Development Bank shall calculate both in the tightening and in the widening scenario the pay-outs from automatic interest rate options that are explicit or embedded

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 40 in floating rate instruments, and shall compare these pay-outs to the pay-outs calculated under the baseline scenario; the resulting difference in the pay-outs shall be added to the result calculated in accordance with paragraph (10) of this Article for the tightening scenario and the widening scenario separately, with a positive sign for incoming pay-outs and a negative sign for outgoing pay-outs, whereby in this calculation pay-outs shall not be discounted and no assumptions shall be made regarding changes in volatility. (12) The net interest income add-on for basis risk shall be the lower result calculated in accordance with this Article in the tightening and the widening scenario. Net interest income and delta net interest income calculation Article 49 (1) To calculate the net interest income, thereby excluding explicit and embedded automatic interest rate options up to the net interest income horizon, the Development Bank shall take the sum of:

the projected risk-free yields calculated in accordance with Article 44 of this Decision;
the projected yield from commercial margins calculated in accordance with Article 45 of this Decision, and
the sum of interest payments up to their reset date including that date, calculated in accordance with Article 46 of this Decision, reduced by any material interest accrued at t=0. (2) In the calculation referred to in paragraph (1) of this Article, the Development Bank shall treat incoming cash flows with a positive sign and outgoing cash flows with a negative sign. (3) To obtain the impact of a shock scenario on net interest income, the Development Bank shall take the sum of:
the difference between: − the calculation referred to in paragraph (1) of this Article relating to a shock scenario; − the calculation referred to in paragraph (1) of this Article relating to the baseline scenario;
the net interest income add-on for automatic options within the net interest income horizon calculated in accordance with Article 42 of this Decision;
the net interest income add-on for basis risk calculated in accordance with Article 48 of this Decision. (4) The Development Bank shall perform the calculation referred to in paragraph (3) items 1) and 2) of this Article using the same shock scenario, while it shall perform the calculation referred to in paragraph (3) item 3) of this Article using the tightening or widening scenario referred to in Article 48 paragraph (11) of this Decision that has the largest negative impact on the net interest income. (5) When calculating the aggregate change for each shock scenario, the Development

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 41 Bank shall add together any negative and positive changes occurring in each currency, wherein currencies other than the reporting currency shall be converted to the reporting currency at the Central Bank spot FX rate on the reference date. (6) Positive changes referred to in paragraph (5) of this Article shall be weighted by a factor of 50% or by a factor of 80% in the case of Exchange Rate Mechanism II- ERM II currencies with a formally agreed fluctuation band narrower than the standard band of +/- 15% to offset losses in EUR. (7) Weighted gains shall be recognised up to the greater of the following values:

the absolute value of negative changes in EUR or ERM II currencies; or
the result of applying a factor of 50% to the positive changes of ERM II currencies or EUR. IRRBB stress testing Article 50 (1) The Development Bank shall perform the IRRBB stress testing at least annually and more frequently in times of increased interest rate volatility/instability and increased IRRBB levels. (2) The Development Bank shall perform reverse stress testing in order to:
identify interest rate scenarios that could severely threaten capital and earnings; and
reveal vulnerabilities arising from its hedging strategies and the potential behavioural reactions of its customers. (3) In testing vulnerabilities under stressed conditions, the Development Bank shall use larger and more extreme shifts in yield curve and changes in interest rates than those used for the purpose of ongoing management, including in particular the following:
substantial changes in the relationships between key market rates (basis risk);
sudden and substantial shifts in the yield curve (both parallel and non-parallel);
breakdowns of key assumptions about the behaviour of asset and liability items;
changes in key interest rate correlation assumptions;
significant changes to current market and macro conditions and to the competitive and economic environment, and their possible development; and
specific scenarios that relate to the individual business model and profile of the Development Bank. (4) The Development Bank shall feed the results of stress scenarios into the decisionmaking at the appropriate management level, which includes strategic or business decisions, the allocation of internal capital, and risk management decisions, and also when establishing and reviewing the policies and limits for the IRRBB. Measurement assumptions Article 51 (1) When measuring IRRBB, the Development Bank shall fully document key

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 42 behavioural and modelling assumptions, which should be aligned with business strategies and it shall review those assumptions at least annually. (2) The Development Bank shall, in relation to both economic value and earnings-based measures of IRRBB, take into account assumptions made for the purpose of risk quantification in relation to at least the following areas:

the exercise of interest rate options (automatic or behavioural) by both the Development Bank and its customer under specific interest shock and stress scenarios;
the treatment of exposure balances and interest flows arising from non-maturity cash flows;
the treatment of fixed term deposits with regard to risk of early redemption;
the treatment of fixed rate loans and fixed rate loan commitments;
the treatment of equity in internal economic value measures;
the implications of accounting practices for the measurement of IRRBB, and in particular hedge-accounting effectiveness. (3) The Development Bank shall review significant measurement assumptions at least annually, and more frequently during rapidly changing market conditions. VI MARKET RISK MANAGEMENT Organisational requirements for market risk Article 52 The Development Bank shall ensure that the front-office function is clearly separated, operationally and organisationally, from the risk control function and the treasury backoffice function. Transaction contracting Article 53 (1) The Development Bank shall ensure that the contracting parties reach an agreement on all the essential elements of a transaction prior to its conclusion. (2) The Development Bank shall ensure that transactions are arranged in line with market conditions. (3) By way of derogation from paragraph (2) of this Article, the Development Bank may contract transactions which are not in line with market conditions if:
a transaction has been contracted based on a clearly defined and justified client request, with the agreed deviation from market conditions clearly specified in the documentation accompanying the transaction, and
each transaction which has not been contracted in line with market conditions must be accompanied by a clearly specified description of the deviation from market conditions and the reasons for such deviation.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 43 (4) The Development Bank shall report to the Management Board and senior management on all significant transactions which have not been contracted in line with market conditions. (5) The Development Bank shall ensure that trading is conducted only in its business premises. (6) Where transactions are contracted by telephone, the Development Bank shall ensure that all telephone conversations of the employees authorised to contract transactions are recorded, in accordance with the law. (7) The Development Bank shall ensure that each contractual transaction is accompanied by written documentation containing all essential elements of the contractual transaction and other relevant information, and the certificate of the contractual transaction and the accompanying documentation should be forwarded to the treasury back-office function in the shortest possible period. (8) The transactions concluded after the working hours of the persons responsible for the treasury back-office function must be separately labelled and included in the daily trading position. (9) The Development Bank shall ensure that the employee authorised to contract transactions enters transaction data into the information system using their own identification label, and the time of data entry and employee identification label must be automatically generated. Transaction recording and control Article 54 (1) The Development Bank shall ensure that each contractual transaction is adequately recorded and immediately included into internal reports on contractual transactions. (2) The Development Bank shall verify whether the certificates for contractual transactions received from the counterparty are timely and complete, and it shall immediately notify the counterparty on untimely or incomplete contractual transaction certificates. (3) The Development Bank shall establish the regular control of the transaction contracting process, including the control of:

the completeness of documentation on a contractual transaction and its timely forwarding to the treasury back-office function;
the consistency of contractual transaction data with contractual transaction certificates, electronic trading systems certificates and other sources;
whether contractual transactions are in line with market conditions;
the deviations from internal trading rules, and
the consistency of the front office function transaction records with those of other

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 44 independent organisational units. Market risk exposure analysis Article 55 (1) When analysing its market risk exposure, the Development Bank shall take into account in particular the following:

all Development Bank’s activities sensitive to changes in market factors, also taking into account trading book and non-trading book positions;
the development and liquidity of relevant financial markets and market price volatility or instability of financial instruments;
actual and projected mismatches and open positions arising from the Development Bank’s activities;
risk concentration in the trading book;
correlations between market prices of various financial instruments;
correlations with other risks to which the Development Bank is exposed, e.g., credit risk and liquidity risk;
complexity of financial instruments, (e.g., OTC derivatives or instruments valued using mark-to-model techniques);
embedded options, and
profit and capital simulations under various scenarios, including the maximum loss quantification under extreme market conditions. (2) When analysing its foreign exchange risk exposure, the Development Bank shall, in addition to the elements referred to in paragraph (1) of this Article, in particular take into account the following:
the impact of adverse exchange rate fluctuations on the value of the open foreign exchange position; and
changes in carrying values of the Development Bank's foreign currency positions arising from the change in the exchange rate of a non-EUR currency. (3) The Development Bank shall regularly assess the effects of profit and capital simulations in relation to its actual performance, and the simulations shall relate to the following:
interest and interest-sensitive income and expense as well as the economic value of on-balance and off-balance sheet items under various interest rate scenarios;
foreign exchange and foreign exchange-sensitive income and expense as well as the economic value of on-balance and off-balance sheet items under various exchange rate scenarios, and
other market factors and market-sensitive income and expense as well as the economic value of on-balance and off-balance sheet items under various market scenarios. Market risk monitoring Article 56 (1) The monitoring of risks arising from trading activities shall comprise daily monitoring of data on:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 45

trading positions and their price volatility;
utilisation and excesses of the limits, and
trading results. (2) When determining limits for restricting losses, the Development Bank shall take into account the capital and income levels and the limit structure should be based on an assessment of the level of risk and the maximum permitted losses. (3) The Development Bank shall ensure that the limits referred to in paragraph (2) of this Article are adjusted on a regular basis in accordance with stress testing results, and those limits must include each contractual transaction. (4) The Development Bank shall establish an authorisation system for the transactions exceeding the established limits and a system of explaining the reasons for exceeding the established limits. (5) The Development Bank shall establish a system for reporting to its senior management and, if it deems necessary, to its Management Board, on all excesses of the established limits, and in the case of the excess of limits, those should be recognised immediately and included in the daily report on limits. (6) The system for monitoring the utilisation and excesses of the limits must comprise the control of contractual transactions' alignment with the established limits, control of the authorisation system for transactions exceeding the established limits, and control of the system for explaining the reasons for exceeding the established limits. (7) The reports providing a basis for the Development Bank's monitoring of data on contractual transactions and limits are also to include a breakdown of open positions by transaction type, risk type, organisational unit or portfolio, as well as a breakdown of the established limits and their utilisation levels. (8) The Development Bank shall monitor the excesses of the limits referred to in paragraph (6) of this Article on a daily basis, during and at the end of the working hours, and the reports providing a basis for the Development Bank's monitoring of data on trading results are to include current and cumulative results on a monthly and annual basis broken down by areas of trading. VII OPERATIONAL RISK MANAGEMENT 7.1. Operational risk Operational risk management Article 57 (1) The Development Bank shall, within its operational risk management, in particular include the following:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 46

the existing or potential risk of loss for the Development Bank occurring due to inappropriate provision of financial services including the cases of intent or negligence (hereinafter: risk of unconscientious business);
information system risk;
model risk;
business changes, including new products, activities, processes, and systems;
risk arising from project management;
legal risk;
external events,
operational risk arising from outsourcing, and
significant inherent risks in the existing products, activities, processes, and systems. (2) For the purposes of identifying and measuring or assessing operational risk, the Development Bank shall take into account the following:
all relevant internal and external factors,
events that have resulted in losses, and
risk to which the Development Bank is exposed that may be considered operational risk but which has not resulted in losses. (3) The Development Bank shall measure or assess the identified operational risk, taking into account the probability and frequency of its materialisation, and its potential impact on the Development Bank. Identifying and analysing significant losses Article 58 (1) For the purposes of operational risk management, the Development Bank shall:
determine the principles of identifying and classifying operational risk events or operational risk sources;
identify significant operational risk for the Development Bank and the significant loss arising from operational risk. (2) The Development Bank shall immediately carry out a detailed analysis of significant losses for which it has identified that are connected with operational risk. (3) The Development Bank shall immediately implement adequate measures for losses referred to in paragraph (2) of this Article for the purpose of their reduction and/or containment. Monitoring and reporting on operational risk exposures Article 59 The Development Bank shall, in particular, include the following in the regular monitoring and reporting on operational risk exposures:
the type of loss or risk;
the causes and sources of the events or risks;
the scope, or the significance of the events or risks, and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 47 4) the measures which are to be or have been implemented to reduce and limit the consequences of the events or to control risk. 7.2. Information system risk Organisational requirements for information system risk Article 60 (1) The Development Bank shall, in accordance with the Law, ensure adequate and transparent organisational structure with clearly defined powers and responsibilities, including the management bodies and their working bodies, in the manner that ensures efficient and safe information system management (IT operations, IT development, information security, etc.), information system risks (hereinafter: the IS risks) and business continuity in order to avoid conflict of interest, ensure efficient communication and cooperation with regard to the performance of these activities and establish clear and well-documented decision-making process. (2) The Development Bank shall ensure that the appropriate number of persons with the necessary professional qualifications and competencies is continuously available to perform the activities referred to in paragraph (1) of this Article and to implement the information system development strategy referred to in Article 62 of this Decision. (3) The Development Bank shall prescribe the content, frequency and method of reporting to the competent bodies of the Development Bank on significant facts related to the performance of activities referred to in paragraph (1) of this Article. (4) Organisational parts of the Development Bank that perform operational activities and activities in which the IS risks arise, and in particular the organisational part or parts in charge of performing IT operations, shall be responsible for establishing appropriate processes and controls which reduce these risks to an acceptable level in accordance with the adopted IS risk appetite, and they shall ensure that services and systems they deliver and activities they perform are in compliance with internal and external requirements. (5) The Development Bank shall designate the organisational part and/or persons directly responsible for coordinating, monitoring and overseeing the application of IS risk management rules, i.e., ensure that these risks are being identified, measured, assessed, controlled, monitored and reported. (6) The Development Bank shall ensure the independence and objectivity of the organisational part and/or persons referred to in paragraph (5) of this Article, i.e., that such organisational part and/or persons do not perform operational activities in which risk arises (which are monitored and overseen), and in particular those activities performed by the organisational part of the Development Bank in charge of IT operations.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 48 (7) The organisational part and/or the persons referred to in paragraph (5) of this Article shall report in a timely manner to the competent bodies of the Development Bank on regular and extraordinary activities related to IS risk management. Use of third-party providers Article 61 (1) The Development Bank shall ensure adequate management of IS risks which arise or might arise from the business relationship with third party providing a service or an ISrelated product to the Development Bank, regardless of whether such business relationship represents an outsourcing arrangement, wherein this business relationship also implies the implementation of risk mitigation measures laid down in this Decision. (2) The Development Bank shall, before entering into the business relationship referred to in paragraph (1) of this Article, conclude a contract with the third party, taking into account that the content and the scope of contractual provisions are defined in accordance with the complexity and the volume of activities outsourced and with the IS risk appetite of the Development Bank. (3) The contract referred to in paragraph (2) of this Article shall in particular contain the provisions with regard to the following:

information security measures, such as cyber security requirements, the Development Bank’s data encryption and data life cycle, network security, data location centres, any requirements regarding continuity of service provision, overseeing of system security and the like;
the manner and frequency of operational and security incident handling, including escalation and reporting procedures. (4) The Development Bank shall monitor the quality and security of performance of operations subject to the contract referred to in paragraph (2) of this Article and the fulfilment of the contracted level of service. Information system development strategy Article 62 (1) The Development Bank shall adopt the strategy of development of information system for a period that is not shorter than three years, and this strategy shall be aligned with the general strategy, and it should at least:
through a review of the current and desired state, describe the way in which the information system should be developed, including the changes related to IT systems, IT architecture, organisational and operational structure and the use of third-party services;
define clear objectives regarding information security, with an emphasis on IT systems, IT services, employees and processes;
describe the manner in which the Development Bank will be committed to the management of the information system in order to preserve business continuity.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 49 (2) The Development Bank shall elaborate in more detail the strategy referred to in paragraph (1) of this Article by adopting annual operational action plans that contain measures for the realisation of the objectives defined in the information system development strategy. (3) Annual operational action plans referred to in paragraph (2) of this Article should as a minimum contain a description of activities and projects, contractors, responsible persons, budget and deadlines for executing planned activities. (4) The Development Bank shall ensure that the allocated financial assets are appropriate to implement the information system development strategy referred to in paragraph (1) of this Article. (5) The Development Bank shall establish a process of continuous measurement and oversight of the efficiency of the implementation of the information system development strategy referred to in paragraph (1) of this Article. Internal acts for IS risk management Article 63 (1) The Development Bank shall, in its internal acts, define the rules for managing IS risks, which should define at least the following:

IS risk appetite, in accordance with the Development Bank's risk appetite;
methods and indicators (threats, vulnerability, probability, impact, etc.) for identifying and measuring i.e., assessing IS risks to which the Development Bank is exposed;
procedures for defining measures to control risks, including introduction of new and/or modification of the existing controls with a view to mitigating risks;
procedures for monitoring the implementation of measures referred to in item 3) of this paragraph and their efficiency, as well as the number of identified operational and security incidents and actions taken to correct the measures;
the obligation to identify and measure i.e., assess risks of the relevant part of the information system resulting from any major changes in information system, service and/or management of information system, prior to passing a decision on realisation of such changes;
the obligation to identify and measure i.e., assess risks of the relevant part of the information system after any significant operational or security incident;
timeframe for carrying out regular, comprehensive IS risk identification and assessment, and at least once a year;
the manner and frequency of preparing and delivering reports to the competent bodies of the Development Bank on any significant facts regarding activities on IS risk management and the Development Bank's exposure to these risks;
powers and responsibilities for IS risk management for all levels of work and decision-making processes in order to avoid conflict of interest.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 50 Mapping of business functions, processes, IT services and systems Article 64 (1) The Development Bank shall identify and regularly update mapping of its business functions and processes executed within those functions, which:

describes interdependencies of various functions and processes;
contains an overview of information assets used or created by a function and/or a process;
describes information inflow and outflow among various functions and processes. (2) The Development Bank shall also identify and regularly update mapping of connectivity between the business functions and processes referred to in paragraph (1) of this Article, and the IT systems, IT services, employees and external service providers supporting and/or enabling the functioning of these functions and processes. Identifying the importance of information system resources Article 65 (1) The Development Bank shall classify and document business functions, processes, information assets, IT systems, IT services, employees and external service providers referred to in Article 64 of this Decision in terms of their importance i.e., criticality. (2) When identifying the importance i.e., the criticality of resources referred to in paragraph (1) of this Article, the Development Bank shall at least consider their availability, confidentiality and integrity requirements. (3) The Development Bank shall also clearly define assignments and responsibilities for resources referred to in paragraph (1) of this Article and for identifying their classification. (4) The importance of resources referred to in paragraph (1) of this Article shall be considered and reviewed when performing the IS risk assessment. Defining corrective measures Article 66 (1) Based on risk assessment results, the Development Bank shall, in accordance with its IS risk appetite, determine which measures are required to reduce the IS risks to an acceptable level, and whether changes in the existing business processes, control measures, IT systems and/or IT services are required. (2) The Development Bank shall estimate the time required to carry out changes referred to in paragraph (1) of this Article and, in accordance with its IS risk appetite, , if needed, define interim risk mitigation measures that will apply until the projected changes are carried out. Ensuring data quality Article 67 (1) The Development Bank shall ensure that its information system provides timely, reliable and complete data that are significant for making business decisions, efficient

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 51 performance of business activities and risk management, i.e., for the safe and sound operations of the Development Bank. (2) The Development Bank shall, in accordance with the nature, size and complexity of its operations, based on risk assessment, automate the processing of data referred to in paragraph (1) of this Article using information technology, where possible and reasonable, wherein manual processing of such data must be justified, documented and limited to an acceptable level. (3) Information system software components used for processing of data referred to in paragraph (1) of this Article should have adequate controls for validating data at the input, during the processing, as well as at the output, with a view to preventing inaccuracies and inconsistencies in such data. (4) The Development Bank shall determine whether inadequate information technology is the cause of possible deviations and irregularities that may occur during the processing of data referred to in paragraph (1) of this Article, and establish procedures to address these deviations and irregularities and eliminate the reasons that led to their occurrence. (5) Data processing, within the meaning of this Article, shall be the entire chain of data collection, recording and processing up to their selection, sorting and filtering based on specific criteria, and presentation in the reports. Information system audit Article 68 (1) The Development Bank shall ensure the audit of the information system, information system management and IS risks management by an independent auditor with the knowledge and experience in the area of IS risks, at least on an annual level. (2) The subject of the audit referred to in paragraph (1) of this Article should be proportionate to the IS risks the Development Bank is exposed to. (3) The Development Bank shall adopt and on an annual level update the plan of the audit referred to in paragraph (1) of this Article. (4) The Development Bank shall establish the process for the implementation of measures and removal of irregularities identified in the audit referred to in paragraph (1) of this Article, as well as the monitoring of such implementation. Information security policy Article 69 (1) The Development Bank shall adopt and implement the information security policy as a key document defining the general principles and rules to protect confidentiality, integrity and availability of data and information of the Development Bank and its clients, and which in particular identifies the following:

objective and scope of the policy;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 52 2) principles for information security management; 3) description of main roles, general and special responsibilities with regard to information security management. (2) The Development Bank shall in its information security policy referred to in paragraph (1) of this Article define the responsibilities of all employees, contractors and service providers regarding data protection, as well as measures that may be taken against them in the case of the information system security disruption. (3) The Development Bank shall introduce persons referred to in paragraph (2) of this Article with the information security policy. (4) The Development Bank shall ensure, in its information security policy, the confidentiality, integrity and availability of logical and physical information system resources, in accordance with their criticality, as well as sensitive data regardless of whether they are at rest, in transit or in use. (5) The Development Bank shall continuously align its information security policy with the changes in the information system and its environment, in cases when the information system security is disrupted, and based on the risk assessment results. (6) Based on the information security policy, the Development Bank shall, in its internal acts, prescribe and implement detailed rules pertaining to all aspects of the information security that refer to:

organisation and governance in accordance with Articles 60 and 68 of this Decision and regulations governing internal audit in the Development Bank;
logical security;
physical security;
IT operations security;
information security monitoring;
information security review, assessment and testing;
information security training and awareness. Logical security Article 70 (1) The Development Bank shall, in its internal acts, define and implement rules for logical access control management (identity and access management) that ensure at least the following:
access to information system is performed on a need-to-know basis, including remote access;
information system users are granted minimum access rights based on a defined business requirement; thus, these rights represent a minimum requirement for an uninterrupted performance of duties;
assigned access rights enable adequate segregation of duties, i.e., the users are not assigned the combination of access rights that enables them to circumvent controls;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 53 4) where possible, the information system users are assigned personalised user accounts that can be easy identified, where one account is used by only one user, so that the activities carried out in the information system might be clearly connected with the user and the responsibility might be clearly identified; 5) the use of privileged access is strictly controlled by limiting and closely monitoring activities of an account with elevated system access entitlements (such as system administrator accounts), and privileged remote access is approved only on a need-to-know basis using a reliable solution for strong authentication (such as two-factor authentication); 6) user activities, and in particular all privileged user activities are recorded in system and operational logs, and they are developed, monitored and stored in accordance with the identified criticality of information system resources referred to in Article 65 of this Decision for the purpose of timely detecting unauthorised access and activities in the information system, reconstructing events, and identifying responsibilities; 7) access rights are granted, withdrawn or modified in a timely manner, in accordance with the predefined approval workflow, which includes persons that are identified as persons responsible for the resources to be accessed in accordance with Article 65 paragraph (3) of this Decision; 8) in the case of termination of employment, access rights shall be promptly withdrawn; 9) access rights shall be reviewed at least once a year to ensure that users do not possess privileges greater than needed, and that such privileges are withdrawn when no longer necessary; 10) authentication methods are enforced that are sufficiently robust to adequately and efficiently ensure that access control policies and procedures are complied with; 11) authentication method complexity is commensurate with the criticality of the IT systems, services and information being accessed including, at a minimum, the use of complex passwords or stronger authentication methods, in accordance with risk assessment; 12) access rights used by IT systems and applications to electronically access data and IT systems shall be limited to to a minimum required to provide relevant IT service. (2) Remote access, within the meaning of this Article, shall be the access that enables the use of access rights to information system resources from a remote location by using telecommunication infrastructure which is not fully controlled or supervised by the Development Bank. (3) Privileged access, within the meaning of this Article, shall be the access to information system resources which enables users to have substantially more rights and to override logical controls (e.g., administrator of network equipment, database, system software, application software, etc.). (4) Authentication, within the meaning of this Article, shall be the process of verification of the identity of the user, system or process by a system.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 54 (5) The Development Bank shall document in more detail the type, content, storing period, security method, frequency of analysis and the method of supervision of operational and system logs being developed in accordance with paragraph (1) of this Article. Physical security Article 71 (1) The Development Bank shall, in its internal acts, define and implement the physical security controls with the aim to protect its premises, data centres and sensitive areas from unauthorised access and from environmental hazards (static electricity, high temperature, fire, flood, etc.). (2) Physical access to IT systems must be monitored and permitted to only appropriately trained authorised persons, in accordance with their tasks and responsibilities, and it must be regularly reviewed to ensure, without delay, that unnecessary access rights are promptly revoked when not required. (3) Adequate physical measures to protect from environmental hazards must be established in a way that is commensurate with the importance of the buildings and premises and the criticality of the operations or IT systems located in these buildings. (4) The Development Bank shall review periodically the correctness of physical measures implemented in accordance with this Article. IT operations security Article 72 (1) The Development Bank shall, in its internal acts, define and apply rules to prevent the occurrence of security issues in IT systems and IT services, and minimise their potential adverse impacts on IT service delivery, and these rules shall, at a minimum, include the following:

identification of and evaluation of technical vulnerabilities, which should be remediated by ensuring that software components (including firmware and software provided by Development Bank to its internal and external users) are up to date, by deploying critical security patches or by implementing compensating controls;
implementation of secure configuration baselines of all network components;
implementation of network segmentation, data loss prevention systems and the encryption of network traffic in accordance with the data classification;
implementation of protection of endpoints including servers, workstations and mobile devices;
the evaluation whether endpoints meet the defined security before granting access to the corporate network;
implementation of mechanisms for verifying the integrity of software, firmware and data;
encryption of data at rest and in transit in accordance with the data classification.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 55 (2) The Development Bank shall, on an ongoing basis, determine whether changes in the existing operational environment influence the existing security measures, require their adjustment or the introduction of additional measures to mitigate related risks. (3) Changes referred to in paragraph (2) of this Article must be carried out in accordance with the formally defined change management process in accordance with Article 84 of this Decision. Information security monitoring Article 73 (1) The Development Bank shall, in its internal acts, define and implement rules for monitoring information security and detecting unusual events that may impact Development Bank's information security, and respond to these events appropriately. (2) As a part of continuous information security monitoring, the Development Bank shall implement efficient measures for detecting physical and logical intrusions as well as breaches of confidentiality, integrity and availability of information. (3) The process of continuous information security monitoring includes:

relevant internal and external factors, including business and IT functions;
transactions to detect misuse of access by employees, third parties or other entities;
potential internal and external threats. (4) The Development Bank shall establish and continuously implement controls for detecting events such as undesirable information leakages, presence of malicious software and use of software containing publicly known technical vulnerabilities. (5) An organisational part and/or persons responsible for monitoring the Development Bank's information security shall continuously monitor the security and operational threats that could materially affect the ability of the Development Bank to provide services, and monitor technological and security developments to ensure that they are aware of potential risks. (6) An organisational part and/or persons responsible for monitoring the Development Bank's information security shall, in a timely manner, report to competent bodies of the Development Bank on regular and extraordinary activities with regard to monitoring information security and in particular of detected events that have affected or may affect the Development Bank's information security. Information security testing Article 74 (1) The Development Bank shall, in its internal acts, define and implement rules for information security testing that validates the robustness and effectiveness of its information security measures.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 56 (2) The Development Bank shall, in its information security testing rules referred to in paragraph (1) of this Article, ensure that the tests:

are carried out by persons not involved in the development of the information security measures and having sufficient knowledge, skills and experience with regard to testing of those measures;
include, in accordance with the risk assessment, threat-led penetration testing and scanning of IT systems to detect vulnerabilities. (3) The Development Bank shall periodically repeat tests of information security measures, at least on an annual basis for all critical IT systems, or at least once in three years for non-critical IT systems. (4) The Development Bank shall perform extraordinary tests of information security measures when:
infrastructure and significant processes and software change;
the changes occur due to significant operational or security incidents;
new or significant changes of the existing critical applications are introduced that are available on Internet. (5) The Development Bank shall, in accordance with the results of the testing referred to in this Article, adjust information security measures, and in the case of critical IT systems, it shall do it without delay. Information security training and awareness Article 75 (1) The Development Bank shall pass, implement and regularly review the information security awareness programme in accordance with current trends. (2) The Development Bank shall provide that, in accordance with the programme referred to in paragraph (1) of this Article, all employees and other natural persons engaged in the Development Bank are periodically, and at least annually, trained to perform their duties and responsibilities in accordance with information security policy and rules, with a view to reducing human errors, thefts, frauds, misuses or losses, and to address Development Bank’s information security-related risks. IT operations' internal acts and documents Article 76 (1) The Development Bank shall manage its IT operations based on formally defined processes that are described in clear, complete and detailed procedures. (2) The Development Bank shall maintain and regularly update the list of software and hardware components of information system that contains basic information on their configuration and enables prompt identification of components, their locations, security classification and ownership.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 57 (3) The Development Bank shall regularly maintain documentation which describes interdependencies and links between different software and hardware components of the information system, to enable proper configuration and change management and prompt response to security and operational incidents including cyber-attacks. (4) The Development Bank shall regularly maintain records on all external connection points through which third persons may have unauthorised access to the internal part of information system of the Development Bank, and on all devices which have access to the Internet. Hardware and software asset management Article 77 (1) The Development Bank shall manage hardware and software assets during their life, form their purchase or development, to their withdrawal from use, to ensure that they constantly meet business and risk management requirements. (2) The Development Bank shall, in managing hardware and software assets referred to in paragraph (1) of this Article, ensure appropriate maintenance of those assets in accordance with the manufacturer's recommendations, and reduce risks arising from the use of outdated assets or assets that no longer have manufacturer's support. (3) The Development Bank shall establish and develop IT systems and services in the manner that is compliant with the business impact analysis results referred to in Article 86 of this Decision, which shall ensure duplication of specific critical components in order to prevent interruptions caused by events affecting those components. System and operational logs Article 78 (1) The Development Bank shall develop, monitor and ensure keeping of system and operational logs from critical IT systems in order to detect, analyse and correct errors. (2) The Development Bank shall document in more detail the type, content, storing period, security method, frequency of analysis and the method of supervision of operational and system logs being developed in accordance with paragraph (1) of this Article. Performance and capacity planning and monitoring Article 79 The Development Bank shall establish a process for planning and monitoring the performance and capacities of IT systems to prevent, detect and respond to important performance issues of these systems and their capacity shortages in a timely manner. Data backup Article 80 (1) The Development Bank shall establish the process for managing data backups which includes the processes of developing, storing and testing data backups, and restoration from backups to ensure availability of data if needed.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 58 (2) The process referred to in paragraph (1) of this Article must be established in accordance with the requirements regarding recovery or restoration, with the established criticality of business processes, IT systems and services, and with the implemented risk assessment. (3) Data backups must be regularly updated, secured and appropriately stored on one or more safe locations, of which at least one must be sufficiently remote from the primary site so they are not exposed to the same risks. (4) The Development Bank shall identify in its internal act the type, volume, the manner and frequency of the development, testing and storing of data in a remote location, storing period for backups and the manner of keeping records thereof. Incident and problem management Article 81 (1) The Development Bank shall establish an incident and problem management process to minimise the impact of adverse events and enable prompt and efficient response in the case of disruption of security and functionality of information system. (2) The Development Bank shall determine criteria and thresholds for classifying events as operational or security incidents as set out in this Decision, as well as early warning indicators that will enable early detection of these incidents. (3) The incident and problem management process should establish:

the procedures to identify, track, log, categorise and classify incidents based on priorities in accordance with adverse impact they have or might have on operations;
the roles and responsibilities for different incident scenarios and categories of incidents;
procedures for prompt response to incidents aimed at mitigating adverse impacts of incidents and ensuring that the service becomes operational and secure;
procedures for identifying, analysing and removing root causes behind one or more incidents, in order to prevent their recurrence;
efficient internal communication plans, including communication with regard to incident notification and escalation to a higher level of management, and securityrelated customer complaints, to ensure that:

all incidents with potentially high adverse impact on critical IT systems and services are reported to the relevant organisational units’ senior management and IS/IT senior management in a timely manner;
in the event of significant incidents, the Supervisory Board and Management Board are informed on an ad hoc basis, at least of the impact, response and additional activities to be taken as a result of the incidents;

efficient external communication procedures for critical business functions and processes set out within the meaning of Article 65 of this Decision, in order to ensure:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 59

collaboration with relevant stakeholders to effectively respond to and recover from the incident;
provision of timely information to clients and other parties in accordance with regulations. IT project management Article 82 (1) The Development Bank shall establish the IT project governance process that adequately supports the implementation of information system development strategy referred to in Article 62 of this Decision. (2) The Development Bank shall establish and implement an IT project management policy which shall include at least:

project objectives;
roles and responsibilities;
a project risk assessment;
a project plan, timeframe and steps;
key milestones;
change management requirements. (3) Roles and responsibilities referred to in paragraph (2) item 2) of this Article should be defined so that information security requirements are analysed and approved by a function that is independent from the IT system development function. (4) The Development Bank shall, in its internal acts related to IS risk management referred to in Article 63 of this Decision, appropriately include risks related to IT projects. (5) The Development Bank shall manage risks arising from the IT project portfolio in an adequate manner (programme management), taking into account, in particular, risks that may arise from interdependencies of different projects and dependencies of different projects from the same resources and/or expertise. (6) The Development Bank shall ensure that all business areas and functions affected by the IT project are represented in the project team and that the project team has the knowledge required to ensure a secure and successful project implementation. (7) The Development Bank shall establish reporting to competent bodies of the Development Bank of regular and ad hoc activities regarding IT project management, on individual or aggregate basis, depending on the importance and size of IT project and, in particular, of launching of a project, its implementation status and associated risks. IT system acquisition and development Article 83 (1) The Development Bank shall, in its internal acts using risk-based approach, define and implement rules governing the IT system acquisition, development and maintenance, which shall, at least, ensure that:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 60

before any acquisition or development of IT systems, the functional and nonfunctional requirements, including information security requirements, are clearly defined and approved by competent persons;
measures are in place to mitigate the risk of unintentional alteration or intentional manipulation of the IT systems during their development and implementation in the production environment;
acquired and developed IT systems are tested and approved by applying adequate methodology prior to their first use in production. (2) In its methodology for testing and approving IT systems, the Development Bank shall ensure that:
criticality of business processes and other relevant information system resources has been taken into consideration during the testing process;
the testing confirms the reliability of new IT system, or that such system functions as intended;
the testing is performed in the testing environment that adequately reflects the production environment;
the implementation of information security measures is tested to identify potential security weaknesses, violations and incidents. (3) The Development Bank shall separate in an adequate manner development, testing and production environments to ensure segregation of duties, adequate development and testing. (4) The Development Bank shall restrict the use of production data in development, testing and other non-production environments and ensure the integrity and confidentiality of those data on all systems. (5) Access right to production data shall be assigned only to authorised users, regardless of the environment of such data. (6) The Development Bank shall implement measures to protect the integrity of the source codes of IT systems that are developed in-house. (7) The Development Bank shall have in place a process to document the development, implementation, operation and/or configuration of IT systems to reduce the risk of dependency on the subject matter experts. (8) The documentation referred to in paragraph (7) of this Article should be comprehensive, accurate and regularly updated and, where applicable, contain at least user documentation, technical system documentation and operating procedures. (9) In accordance with risk assessment, the provisions of this Article shall also apply to software solutions managed or developed by internal end users outside IT organisational unit of the Development Bank, such as end user computing applications.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 61 (10) The Development Bank shall maintain records of these applications that meet the characteristics listed in paragraph (9) of this Article, if they support critical business functions and processes set out within the meaning of Article 65 of this Decision. Change management Article 84 (1) The Development Bank shall establish an IT hardware and software components' change management process to ensure that all changes to information systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner, and restoration plans are established in order to avoid that changes lead to unexpected and unwanted behaviour of this system, i.e., disrupt its security or functionality. (2) The Development Bank shall ensure that changes of hardware and software components, which, in order to overcome emergency situations, must be introduced as soon as possible, are implemented following procedures that provide adequate safeguards. 7.3. Business continuity Business continuity management Article 85 The Development Bank shall establish business continuity management process to ensure the business continuity and limit losses in the event of severe business disruption or discontinuation. Business impact analysis Article 86 (1) As a part of business continuity management process referred to in Article 85 of this Decision, the Development Bank shall periodically analyse its exposure to severe business disruptions and discontinuations and assess their potential impacts, qualitatively and quantitatively, using available internal and external data and scenario analysis. (2) The Development Bank shall, during business impact analysis referred to in paragraph (1) of this Article, consider identified classification and interdependency of business functions, processes, information assets, IT systems, IT services, employees and external service providers referred to in Articles 64 and 65 of this Decision. (3) Based on business impact analysis referred to in paragraph (1) of this Article, the Development Bank shall formally identify:

key/critical business activities, processes, IT systems and services, including outsourced activities;
levels of services the Development Bank is required to maintain or restore in a timely manner;
recovery time objective (RTO), which indicate the maximum acceptable time within which the business process and IT systems and its supporting services must be restored after an incident;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 62 4) recovery point objective (RPO), which indicate the maximum time period during which it is acceptable for data to be lost before an incident. Business continuity plan Article 87 (1) Management board of the Development Bank shall define a business continuity plan (BCP), which shall be adopted in accordance with the Law, based on the business impact analysis referred to in Article 86 of this Decision. (2) When defining the plan referred to in paragraph (1) of this Article, the Development Bank shall coordinate such activities with all relevant internal and external stakeholders and consider dependences from third parties and services they provide. (3) When defining the business continuity plan referred to in paragraph (1) of this Article, the Development Bank shall consider risks that might have an adverse impact on its objectives with regard to the protection, and if needed, restoration of availability, integrity and confidentiality of its business functions, supporting processes, IT systems, IT services and information assets. (4) The business continuity plan referred to in paragraph (1) of this Article must be designed to enable the Development Bank to react appropriately to potential failure scenarios and to recover the operations of its critical business activities after disruptions within a recovery time objective (RTO) and a recovery point objective (RPO). (5) The business continuity plan referred to in paragraph (1) of this Article must contain a list of priorities to be used in case of recovery of several business activities. (6) The Development Bank shall, in the business continuity plan referred to in paragraph (1) of this Article, consider a series of different scenarios, including extreme but plausible scenarios, to which it might be exposed, including a cyber-attack scenario, and it should describe how the continuity of IT systems and services, as well as the Development Bank’s information security, are ensured. Information system disaster recovery plan Article 88 (1) The Management Board of the Development Bank shall, considering short-term and long-term recovery objectives, define and adopt information system disaster recovery plan(s) (DRP) based on business impact analysis referred to in Article 86 of this Decision and scenarios referred to in Article 87 paragraph (6) of this Decision. (2) Information system disaster recovery plan referred to in paragraph (1) of this Decision shall in particular include:

conditions to be met to implement the plan;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 63 2) a detailed description of procedures that ensure recovery and availability of at least key/critical IT systems and services in accordance with defined requirements; 3) a list of priorities to be met if the recovery of more IT systems and/or services is needed; 4) data on teams to be responsible for recovery of individual IT systems or services and team members, including their clearly defined duties and responsibilities; 5) data on the information system recovery location; 6) data on key service providers set out within the meaning of Article 86 paragraph (3) item 1) of this Decision. Testing, updating and availability of plans Article 89 (1) The Development Bank shall regularly test the plans referred to in Articles 87 and 88 of this Decision and compile reports thereof, wherein the appropriateness of plans for key/critical business activities, processes, IT systems and services shall be verified at least annually based on severe but plausible scenarios. (2) The Development Bank shall, during the testing referred to in paragraph (1) of this Article, establish whether it can successfully transfer to alternative method of performing critical business activities from the disaster recovery environment, maintain such mode for a sufficiently representative period of time and restore normal functioning afterwards. (3) The Development Bank shall regularly revise and update plans referred to in Articles 87 and 88 of this Decision in accordance with lessons learned from previous incidents, testing results, new identified risks and threats, changed objectives and recovery priorities, business changes, including changes in products, activities, processes and systems, changes in environment and business strategy. (4) For the purpose of effective implementation of plans referred to in Articles 87 and 88 of this Decision, the Development Bank shall ensure that all employees are aware of their roles and responsibilities in case of contingencies and that these plans are readily available to them in contingencies. Contingency reporting and communication Article 90 (1) The Development Bank shall ensure reporting to the Management Board on activities regarding all relevant facts arising from business continuity management and, in particular, on testing of plans referred to in Articles 87 and 88 of this Decision, analysis of deficiencies identified during the testing process and significant changes in business continuity management. (2) In the event of a disruption of business or another emergency, the Development Bank shall have measures in place so that all relevant internal and external stakeholders are informed thereof and it shall maintain communication with them.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 64 (3) In the case the circumstances requiring implementation of plans referred to in Articles 87 and 88 of this Decision occur, the Development Bank shall notify the Central Bank, without delay, of significant facts and circumstances thereof. 7.4. Outsourcing-related risks management Outsourcing service provider Article 91 An outsourcing service provider (hereinafter: the service provider) may be:

a credit institution with a head office in Montenegro;
a legal or a natural person, which is, according to the regulations of the country in which such person is established or in which such person has habitual residence or temporary residence, authorised to perform processes, services or activities which are subject to outsourcing (hereinafter: outsourced functions). Entrusting of services not considered to be outsourcing Article 92 (1) The Development Bank shall establish whether the entrusting by the Development Bank of the performance of services to a service provider is considered to be outsourcing. (2) Within the meaning of paragraph (1) of this Article, the following shall not be considered as outsourcing:
services that are legally required to be performed by a service provider (e.g., external audit);
market information services and services of interbank communication and trading services (e.g., services provided by Bloomberg, Moody’s, Standard & Poor’s, Fitch, Reuters);
global electronic payment networks (e.g., Visa, MasterCard);
services of a clearing house and a central counterparty;
global financial messaging infrastructures that are subject to oversight by relevant authorities (e.g., SWIFT);
correspondent banking services;
non-financial services that would otherwise not be undertaken by the Development Bank (e.g. advertising services, obtaining legal opinions, and representation before the court and administrative bodies, architect services, cleaning, gardening and maintenance of business premises, servicing of company cars, catering services, vending machine services, transportation services, delivery services, services of sending, receiving, transmitting and/or storing electronic documents or electronic invoices, acquisition of goods (e.g. plastic cards, card readers, office supplies and furniture) and utility services (e.g. electricity, water, gas, telecommunication services)).

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 65 Critical and important functions Article 93 (1) Within the meaning of this Decision, critical and important functions shall mean activities for which it is assessed that:

defects or failures in their performance would materially impair the ability of the Development Bank to meet obligations laid down in the Law and other regulations and/or the continuity of its regular operations;
they have significant impact on efficient risk management, including risks associated with outsourcing. (2) Critical and important functions shall also be the functions performed by the control functions of the Development Bank. (3) A service provider may hire other person to perform a part of the outsourced critical and important functions, subject to the prior authorisation of the Development Bank. Maintaining control over outsourced functions Article 94 (1) For the purpose of preventing adverse impact of outsourcing on its operations, the Development Bank shall, upon outsourcing, maintain an adequate level of control over outsourced functions, or a possibility to pass and implement outsourcing-related decisions. (2) The Development Bank shall ensure that its responsibility to third parties, and the responsibility of responsible persons in the Development Bank, may not be transferred to the service provider through outsourcing. Activities that cannot be outsourced Article 95 The following activities may not be outsourced:
the Development Bank activities referred to in Article 9 of the Law and the Decision on the Establishment of the Development Bank of Montenegro A.D. Podgorica (OGM 122/24);
activities performed by the members of the Management Board;
implementation of measures and activities taken to prevent and detect money laundering and terrorist financing the outsourcing of which is prohibited by other regulation. Outsourcing of activities that enable the performance of critical and important functions Article 96 The Development Bank may outsource activities that enable it to perform activities referred to in Article 9 of the Law or that support the performance of such activities, provided that there are no impediments to such outsourcing referred to in Article 24 paragraph (3) of the Law.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 66 Assessments before adopting a decision on outsourcing Article 97 (1) Before reaching a decision on the selection or change of service provider and before giving consent to hire a person referred to in Article 93 paragraph (3) of this Decision, the Development Bank shall:

carry out a detailed analysis of prospective service provider relating to its ability to provide services, its financial situation and business reputation;
establish, in the case where the prospective service provider has a head office or performs outsourcing functions outside Montenegro, whether the regulations of a country or countries in which the service provider performs its activities enable the Central Bank undisturbed supervision of service provider in accordance with the Law;
assess potential difficulties and time needed to select other service provider or to independently perform activities in case of termination of outsourcing, and determine the feasibility (easy, moderate, difficult or impossible);
assess the impact of outsourcing on:

business continuity and the reputation of the Development Bank;
costs, financial result, liquidity, capital and solvency of the Development Bank;
the quality of services provided by the Development Bank to its clients;
risk profile of the Development Bank;
reporting. (2) In addition to assessments referred to in paragraph (1) of this Article, when selecting service provider for critical and important functions, the Development Bank shall determine whether the prospective service provider has an appropriate business continuity plan and assess whether the service provider is able to meet the requirements to perform a critical and important function as defined in the business continuity plan of the Development Bank. Risk management Article 98 (1) The Development Bank shall ensure that the performance of outsourcing enables it to continuously monitor the outsourced functions and manage risks associated with outsourcing. (2) The Development Bank’s internal control system shall cover outsourced functions. (3) For all outsourced functions, including functions that are not considered to be subject to outsourcing within the meaning of this Decision, but are associated with outsourcing, the Development Bank shall identify, assess, monitor and control risks associated with outsourcing to which it is or might be exposed.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 67 Identifying and assessing outsourcing-related risks Article 99 (1) The Development Bank shall, when identifying and assessing outsourcing-related risks, take into account expected benefits and costs of the proposed outsourcing, including comparative analysis of risks that may be reduced in outsourcing or may be managed better compared to risks that may arise due to the planned outsourcing. (2) For the purpose of identifying and assessing risks referred to in paragraph (1) of this Article, the Development Bank shall in particular take into consideration the following:

concentration risk, including risk arising from:

entrusting the outsourced function to a dominant service provider that is not easily substitutable;
multiple outsourcing arrangements with the same service provider or service providers closely connected with that service provider;

the aggregated risks resulting from outsourcing several functions of the Development Bank;
the measures implemented by the Development Bank and by the service provider to reduce outsourcing-related risks. Data and system protection Article 100 (1) For the purpose of ensuring data protection in accordance with the law and separate regulations, and when carrying out risk assessment prior to outsourcing and during continuous control of the performance of the service provider in the process of the performance of outsourced functions, the Development Bank shall:
identify and classify all relevant functions and associated confidential data and systems, as well as measures prescribed to protect those data;
carry out a detailed analysis of functions to be outsourced or already outsourced and data and systems associated with outsourcing and take into account potential risks, in particular operational risk, including legal risk, ICT-related risk, compliance and reputational risks, and potential control limits for performing outsourced activities laid down in the regulations of the country or countries from which the outsourced function is performed or in which data is kept;
define the required level of protection of data confidentiality, integrity and availability, the continuity of outsourced functions and possibility of creating trails of using data and systems;
analyse, where applicable, the ability of the service provider to apply measures of protection during their processing, transfer and standstill, such as cryptograph techniques in combination with using adequate architecture for managing cryptographic keys. (2) The Development Bank shall ensure that the service provider, where relevant, observes appropriate IT security standards.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 68 Regular risk assessment and oversight of outsourced functions Article 101 (1) The Development Bank shall regularly carry out risk assessment in accordance with the provisions of this Decision, and ensure periodic reporting to the Supervisory Board and Management Board on identified risks associated with outsourced functions. (2) The Development Bank shall ensure that the outsourced functions, at least critical and important functions, are performed on an ongoing basis in line with the defined performance quality standards. (3) For the purpose of ensuring performance and quality of outsourced functions in accordance with paragraph (2) of this Article, the Development Bank shall:

ensure the submission of the appropriate reports by the service providers;
assess the activity of the service provider based on key performance indicators, oversight results, reports of the service providers on the achieved level of service provided and independent reviews;
analyse and assess other relevant information submitted by the service provider, including reports on measures implemented to ensure the business continuity of the service provider and their testing results. Outsourcing management policy Article 102
The Development Bank shall identify in its outsourcing management policy the following:
the process of the adoption of decision on outsourcing;
planning of outsourcing, specifically:

the definition of business requirements in respect of outsourcing;
the identification of critical and important functions;
the identification and assessment of risks resulting from outsourcing and management of those risks;
detailed analysis of potential service providers;
identification, assessment, mitigation or prevention of actual and potential conflicts of interest and their management;
business continuity related to the outsourced activities, and
approval of new outsourcing;

the method of implementation, monitoring and managing outsourcing that in particular, pertains to the following:

ongoing oversight or assessment of service providers’ performance;
activities in the case of changes of arranged outsourcing or service providers;
independent audit, or review of compliance with legal and regulatory requirements, and
terms and conditions for renewing outsourcing arrangements;

documentation and the manner of keeping records of outsourced functions, and
the action plan referred to in Article 107 of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 69 Individual outsourced functions Article 103 (1) For the activities which are subject to outsourcing, the Development Bank shall clearly define in its internal acts the following:

powers and responsibilities of organisational units or persons responsible for monitoring and managing outsourcing which have adequate professional knowledge and experience to perform such activities;
performance and quality standards for carrying out outsourced functions;
the method for monitoring performance and quality of carrying out outsourced functions;
the method of notifying the Management Board of the Development Bank of all important events related to the outsourcing;
activities carried out by the Development Bank in case of early termination of outsourcing agreement and/or inability to meet the obligations thereof. (2) Acts referred to in paragraph (1) of this Article shall be taken into consideration when granting authorisations and decisions referred to in Article 93 paragraph (3) and Article 97 of this Decision. Internal audit of outsourcing Article 104 (1) The Development Bank shall, in line with the risk assessment, cover by the internal audit the outsourcing management process, including outsourced functions. (2) Internal audit referred to in paragraph (1) of this Article shall at least include the review of:
adequacy of compliance with policies and internal acts related to the outsourcing;
adequacy, quality and effectiveness of the assessment of criticality and importance outsourced functions;
adequacy, quality and effectiveness of assessment of outsourcing-related risks and their ongoing compliance with the risk management strategy;
whether there is adequate engagement of the Supervisory Board and the Management Board, and
whether adequate oversight of outsourced functions and adequate management of outsourcing are in place. Outsourcing agreement Article 105 (1) Outsourcing shall be carried out on the basis of an agreement concluded between the Development Bank and the service provider entrusted to perform outsourced functions. (2) The agreement referred to in paragraph (1) of this Article must be appropriate to the risks associated with the outsourcing, and to the scope and complexity of the outsourced functions.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 70 (3) The agreement referred to in paragraph (1) of this Article shall in particular contain the following:

the subject of outsourcing with a detailed description of the outsourced functions;
place, time and the method of meeting the contractual obligations;
time period of the agreement and financial liabilities of counterparties;
qualitative and, if applicable, quantitative indicators based on which the requirements of the Development Bank are defined for the service levels and the quality of performance for the outsourced function;
the manner of monitoring the performance of the function which are the subject of the agreement and the fulfilment of the agreed level of quality of the performance of outsourced functions;
reports and information that the service provider is to deliver to the Development Bank, and the frequency of their delivery;
the obligation of keeping confidential data in accordance with the law and separate regulations;
the obligation of the service provider to request consent from the Development Bank in the case of hiring other person for critical and important functions;
the obligation of the service provider to notify the Development Bank in a timely manner of all circumstances that have, or might have, a significant impact on meeting the contractual obligations;
provision on whether the service provider should take a professional indemnity insurance policy and, if applicable, the level of insurance cover requested;
the obligation of the service provider to provide the outsourced functions in accordance with Montenegrin regulations;
the obligation of the service provider and person referred to in Article 93 paragraph (3) of this Decision to enable the Central Bank undisturbed supervision of their operations in the part referring to the performance of outsourced functions, including on-site examination at the location of the service provision or with the service provider, and to ensure timely and unlimited submission of outsourcing-related documentation and data;
conditions for the termination of the agreement;
provisions that ensure that the data owned by the Development Bank can be accessed in the case of bankruptcy, resolution or discontinuation of business operations of the service provider;
the rights and obligations of contracting parties in case of early termination of agreement for the purpose of ensuring business continuity;
the jurisdiction for the settlement of disputes;
the method of dispute settlement. Notification to the Central Bank Article 106 (1) The Development Bank shall, no later than 30 days following the conclusion of an outsourcing arrangement, notify the Central Bank of the outsourcing of critical and important functions carried out, or on the change of the service provider that was entrusted with the performance of these functions.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 71 (2) The notification referred to in paragraph (1) of this Article shall contain a detailed description of functions to be outsourced and the reasons for outsourcing or for the change of a service provider, supported by the following:

a decision of the competent body of the Development Bank on the selection of the service provider for the outsourced function or on the change of the service provider;
the results of the assessment of outsourced critical and important functions in accordance with Article 93 of this Decision;
the assessments and analyses referred to in Article 97 of this Decision;
acts referred to in Articles 102 and 103 of this Decision;
documentation on technical equipment and organisational structure of the service provider that enable a secure and high-quality performance of outsourced functions, including the method of confidential data protection;
evidence of prior experience of the service provider for performing functions which are subject to outsourcing;
a list of persons connected with service provider and the description of their connectedness;
a statement of the Development Bank that the outsourcing will not lead to conflict of interest;
the outsourcing agreement referred to in Article 105 of this Decision;
other information and circumstances which the Development Bank finds important with regard to the outsourcing carried out. Action plan in case of termination of the outsourcing arrangement Article 107 For the purpose of ensuring a continuous performance of the functions which are subject to outsourcing, without adverse impact on the compliance with regulatory requirements and the quality of provision of services to clients, the Development Bank shall establish an action plan for all outsourced critical and important functions, in particular in the case of:
the termination of outsourcing agreement;
the termination of operation of the service provider;
the deterioration of the quality of the outsourced function and actual or potential business disruptions caused by the inappropriate or failed provision of services associated with the outsourced function;
occurrence of material risks to the adequate and continuous functioning of the outsourced function. Registry of outsourcing arrangements Article 108 (1) The registry of outsourcing arrangements kept by the Development Bank in accordance with the Law shall contain the following information:
the name of the service provider and the reference number of the outsourcing agreement;
the subject of outsourcing and a description of outsourced functions;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 72 3) a note on whether the outsourcing involves critical and significant functions, with a brief summary of the reasons why the outsourcing in question is considered critical or significant, where applicable; 4) the country from which the outsourcing service is being provided; 5) location where outsourced data are placed, including the information on whether or not (yes/no) the data also contain personal data that are protected in accordance with the law; 6) the number, name, the start date, and the duration of the outsourcing agreement; 7) the date of the most recent assessment of outsourcing-related risks; 8) the list of persons referred to in Article 93 paragraph (3) of this Decision, in the case of their engagement; 9) the result of the assessment referred to in Article 101 paragraph 3) item 3) of this Decision; 10) the name of the organisational unit or persons responsible for monitoring and managing outsourcing. 11) type of outsourcing reflecting the nature of the outsourced function (for example: IT outsourcing, control function, etc.); 12) in the case of outsourcing to a cloud environment, the type of service provided in the cloud and the implementation model (for example: public/ private/ hybrid/ shared); 13) date of the most recent assessment of the criticality and importance of the outsourced function. (2) In addition to the information referred to in paragraph (1) of this Article, the registry of outsourcing of critical and important functions shall also contain the following:

data on whether the service provider or the person referred to in Article 93 paragraph (3) of this Decision is owned by the Development Bank;
results of the assessment referred to in paragraph (1) item 7) of this Article;
data on the person or body of the Development Bank competent for authorising the outsourcing arrangements;
data on the contractual jurisdiction for settlement of disputes arising from outsourcing agreements;
the date of the most recent and next scheduled audit, where applicable;
where applicable, the names of persons referred to in Article 93 paragraph (3) of this Decision to which parts of critical and important functions are sub-outsourced, the name/s of country or countries where such persons are registered, or from which the service will be provided, and in which the data will be stored;
identification of alternative service providers for an outsourced critical and important function;
the results of the assessment referred to in Article 97 paragraph 1) item 3) of this Decision;
data on whether the outsourced critical and important function supports business operations that are time-critical; 10)the estimated annual costs for performing outsourced critical and important function.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 73 Updating of existing outsourcing agreements Article 109 (1) The Development Bank shall review the outsourcing agreements that have been entered into with the service providers to perform critical and important functions before the entry into force of this Decision, and if needed, align them with the provisions of this Decision no later than 12 months following the day of its entry into force. (2) Upon the expiry of the time limit referred to in paragraph (1) pf this Article, the Development Bank shall deliver to the Central Bank a notification containing information on the procedure and information referred to in Article 108 of this Decision. VIII LIQUIDITY RISK MANAGEMENT 8.1 Minimum standards for liquidity risk management Liquidity risk management Article 110 (1) Within the implementation of the strategies, policies, processes, and systems for the identification, measurement and monitoring of liquidity risk, in addition to activities set out in Article 21 paragraph (4) of the Law, the Development Bank shall:

perform stress testing and establish procedures for the actions of the Development Bank's Management Board and senior management in cases of certain unfavourable stress test results;
have in place the Development Bank funding plan/strategy;
establish assumptions on the behaviour of assets, liabilities and the off-balance sheet, as well as assumptions on other relevant circumstances, in such way that these assumptions correspond with the Development Bank’s activities and market conditions;
ensure diversification in the structure of and the access to the sources of funding;
set up an adequate information system. (2) Acts adopted by the Development Bank in accordance with the Law and this Decision for the purpose of liquidity risk management shall be deemed adequate where they:
are proportionate to the complexity, risk profile, scope of operations of the Development Bank and the established risk tolerance;
provide liquidity risk management over an appropriate time horizon, including daily;
ensure the maintenance of adequate levels of liquidity buffers;
are tailored to business lines, currencies;
and
include adequate allocation mechanism.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 74 Risk tolerance Article 111 Risk tolerance shall be established as a level of liquidity risk the Development Bank is willing to take, taking into account its business model, total risk tolerance, role in the financial system, financial condition, and the funding capacity allowing it to manage its liquidity under both normal and stressed conditions. Liquidity risk management strategy and policies Article 112 (1) Liquidity risk management strategy shall, in particular, cover the objectives and basic principles for taking and managing liquidity risk. (2) Development Bank’s policies and other acts relating to liquidity risk management shall, in particular, include the following:

a detailed description of the liquidity risk management process with clearly defined competences and responsibilities of all participants (organisational units and established bodies within the Development Bank) in relation to taking and managing liquidity risk;
a clearly defined system of reporting on the Development Bank’s exposure to liquidity risk, and, in particular, timely reporting to the management bodies on the Development Bank’s liquidity position and other aspects relevant for appropriate liquidity risk management;
established internal liquidity risk exposure limits that must adequately reflect the Development Bank’s business orientation, i.e., the complexity of the activities it performs, specified periodicity of monitoring compliance with the established limits and reporting to management bodies, as well as procedures defining the activities to be taken in the event of limit breaches;
establishment and maintenance of adequate level of liquidity buffer, in accordance with the analysis of maturity match between the assets and liabilities, and off-balance sheet positions for previously established time horizons;
assumptions about the trends of assets, liabilities and off-balance sheet positions, as well as assumptions about other relevant circumstances in accordance with the Development Bank’s activities, and assumptions about inflows and outflows;
assets and liabilities’ structure, including off-balance sheet liabilities and the assumptions regarding the asset liquidity and marketability;
measurement and monitoring of net cash flows, including daily liquidity management;
management of pledged (encumbered) and unencumbered assets, in accordance with Article 21 of the Law;
procedures for adequate oversight of pledged assets;
procedures for non-EUR currency operations;
defined level of interaction between the liquidity risk and other risks to which the Development Bank is exposed (credit risk, market risk, interest rate risk, operational risk, legal risk, reputational risk and the like), which affect the Development Bank’s liquidity position;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 75 12) Development Bank’s obligation to review, on a regular basis, the interactions between the liquidity financing risk and market liquidity risk; 13) diversification and stability of the sources of funding, i.e., the Development Bank’s access to markets so that it reflects the Development Bank’s presence in its chosen funding markets, and the assessment of the Development Bank’s capacity to quickly raise funds from its sources under both normal and stressed conditions; 14) defined system for assessing all current and future inflows and outflows, including the estimation of funds required for off-balance sheet items; 15) detailed description of internal control process, which defines appropriate control activities for monitoring the efficiency and effectiveness of the liquidity risk management system, i.e., the assessment of adequacy and reliability of financial information of the Development Bank; 16) stress testing and the analysis of different stress scenarios; 17) contingency plan, and 18) liquidity recovery plans. (3) If the Development Bank operates in non-EUR, it currencies shall analyse the liquidity in those currencies, including the analysis of convertibility of foreign currencies. (4) Where there are constraints with regard to the transfer of liquidity surplus across jurisdictions, the Development Bank shall specify any such constraints in the policy referred to in paragraph (2) of this Article, and take them into account when managing liquidity risk. Management Board’s responsibility with respect to liquidity risk Article 113 With respect to liquidity risk, the Management Board of the Development Bank shall:

ensure the implementation of acts adopted for the purpose of liquidity risk management;
ensure that the Development Bank’s day-to-day obligations are met under both normal and stressed conditions, thus maintaining the appropriate liquidity buffer;
ensure necessary quality and timeliness of liquidity risk reports;
ensure the efficiency of internal controls embedded into the liquidity risk management system, and
adopt contingency and liquidity recovery plans. The senior management’s responsibility with respect to liquidity risk Article 114 With respect to liquidity risk, the senior management shall:
ensure the functioning of the liquidity risk management system and its efficiency in EUR and in other currencies;
set limits for liquidity risk management, and regularly revise them in accordance with the established liquidity risk tolerance;
ensure an appropriate reporting system in case of breaches of limits, and the procedures for breaches of limits;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 76 4) develop contingency and liquidity recovery plans, review these plans at least annually, and propose adjustments of internal acts to those plans. Risk monitoring and reporting Article 115 The Development Bank shall include in its system for liquidity risk reporting to the management bodies, in particular, the monitoring of liquidity position in EUR and other currencies, liquidity indicators in relation to liquidity risk limits, stress testing results, and the other relevant data. Measuring and monitoring cash flows Article 116 (1) The Development Bank shall establish a system for forecasting all current and future inflows and outflows, including the forecasting of funds for off-balance sheet positions. (2) The Development Bank should manage liquidity risk with respect to future cash flows of assets and liabilities for:

sources of contingent liquidity demand and related triggers associated with balance sheet positions (in the case of liquid funds shortfall), and
currencies in which the Development Bank has exposures. (3) The Development Bank shall ensure that its liquidity risk management over various time horizons, considers changes in liquidity needs and funding capacity on a daily basis, and short-term, medium-term and longer-term liquidity needs and funding capacity, as well as potential vulnerabilities to events, activities and strategies in order to ensure that an adequate liquidity buffer level is maintained. (4) Liquidity buffer referred to in paragraph (3) of this Article shall comprise sufficient liquid assets, specifically highly liquid, unencumbered liquid assets, readily available at any moment to be used, without any legal or operational impediment, under various stress conditions (of different intensity and duration), including the loss or impairment of both unsecured and otherwise secured funding sources. (5) The Development Bank shall regularly check the accuracy of input data used for calculating its liquidity position. Funding sources Article 117 The Development Bank shall secure access to alternative sources of funding and in its liquidity risk policy include in particular:
potential sources of funding and its projection, taking into account the long-term maturity gap, the business model, strategy, and liquidity risk tolerance;
the manner of active management of funding sources in the market;
the manner of establishing and maintaining cooperation with depositors and creditors, and monitoring frequency of use of available funding sources;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 77 4) an assessment of access to financial markets and an assessment of available funds under normal circumstances and in stress situations; 5) an assessment of stability of funding sources and the risks affecting their stability; 6) monitoring of the concentration of the funding sources and limiting it, taking into account the assessment of specific instruments’ liquidity, geographical locations, and providers of funding sources, and 7) identification and the manner of use of the alternative funding sources (new issues of short- and long-term debt instruments, asset securitisation, the sale or repo of unencumbered, highly liquid assets, and the like). Stress testing Article 118 (1) The Development Bank shall define, in its liquidity risk management policy or another act relating to liquidity risk stress testing, the procedures for the implementation and analysis of stress scenarios referred to in Article 21 paragraph (4) of the Law, as well as the frequency of their implementation, and, at least on a quarterly basis it shall:

establish the obligation to carry out stress testing for shorter and longer periods of stress conditions;
establish the obligation to carry out liquidity testing depending on the stress conditions and intensity;
enable the relevant management body and the senior management of the Development Bank to analyse the stress testing results;
establish procedures for actions to be taken in cases of unfavourable stress testing results; (2) The Development Bank shall take into account, periodically review and revise as appropriate, the assumptions underlying the stress testing, and in particular the assumptions relating to the following:
a sudden withdrawal of retail deposits;
sources of funding with the early withdrawal option;
reduction of funding sources by major depositors;
additional contingent off-balance sheet exposures;
funding tenor;
the effects of any deterioration of the Development Bank’s credit rating;
convertibility of foreign currencies and their availability in the foreign exchange markets; and
an estimate of future balance sheet growth of the Development Bank. (3) When carrying out stress testing, the Development Bank shall calculate the impact on liquidity for all positions with the possibility of margin calls. (4) Stress testing results represent a basis for taking remedial measures or actions for mitigating the Development Bank’s exposure to liquidity risk, for providing liquidity buffers and for adjusting the Development Bank’s liquidity profile to the established risk tolerance.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 78 Contingency Plan Article 119 (1) Pursuant to Article 21 paragraph (4) item 7) of the Law, the Development Bank shall adopt a contingency plan, which shall contain in particular the following:

early warning indicators that signal the occurrence of a crisis and employees responsible for monitoring and reporting on those indicators (e.g., exceeding of internal limits, decline in deposits, decline in security prices, increased funding costs, changes in the Development Bank’s credit rating, difficulties in raising funds in money markets, deterioration of asset quality or profitability);
situations in which the plan is implemented;
clear segregation of duties, powers, and responsibilities in the Development Bank for the implementation of the plan, with contact information for team members responsible for action in the event of the implementation of the plan;
procedures enabling timely and relevant information to be delivered to the Management Board and senior management for the purpose of deciding on acting under contingency;
procedures and the manner of obtaining lacking funds and a timeframe within which specific activities should be taken (e.g., sale of assets, establishment of new funding lines) under normal and stress circumstances;
types, amount, and reliability of all funding sources with specified sequence of use under different stress circumstances;
ranking of funding sources in terms of availability, or establishing a schedule for the use of these sources in accordance with the identified situation, defining backup facilities, which could be used in regular business, and secured facilities, which would be used when back-up facilities are not available or sufficient to cover lacking funds under contingency;
potential encumbrance on assets arising from various stress situations (e.g., Development Bank’s credit quality downgrade, impairment of pledged assets or increased margin calls). (2) The Development Bank shall, at least annually, revise the plan referred to in paragraph (1) of this Article and change it, as appropriate, on the basis of the stress testing results. (3) The plan referred to in paragraph (1) of this Article may be an integral part of the liquidity risk management policy or a part of the liquidity recovery plan of the Development Bank. Information system Article 120 The Development Bank’s information system shall provide data necessary for timely and continuous management of liquidity risk, and in particular for:
measuring and monitoring Development Bank’s liquidity on a day-to-day basis and in other set periods;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 79 2) measuring and monitoring liquidity for each foreign currency that has a material impact on the overall liquidity of the Development Bank; 3) monitoring compliance with established limits for liquidity risk management; 4) establishing liquidity indicators; 5) analysing the trends and assessing the stability of deposits and other sources of financing; 6) carrying out liquidity stress testing of the Development Bank; 7) compiling reports and information for the purposes of the Development Bank’s management bodies and other persons involved in the liquidity risk management process. 8.2 Quantitative requirements for liquidity risk management 8.2.1. Liquidity indicators Daily and ten-day liquidity indicators Article 121 (1) The Development Bank shall express minimum daily and ten-day liquidity by its liquidity indicator. (2) Liquidity indicator referred to in paragraph (1) of this Article shall be the ratio between the sum of liquid assets and the sum of matured liabilities referred to in Article 122 of this Decision. (3) The Development Ban shall define the liquidity indicator calculation frequency, which shall be at least once a month. Liquid assets and matured liabilities Article 122 (1) Liquid assets, within the meaning of this Decision, shall be the following:

cash;
funds with the Central Bank;
funds at the accounts with domestic credit institutions (demand deposits);
funds at the accounts at foreign credit institutions (demand deposits); (2) Matured liabilities, within the meaning of this Decision, shall be the following:
loan payables;
interest and fee payables;
matured liabilities on time deposits;
20% of demand deposits;
10% of liabilities on approved, irrevocable committed undrawn credit facilities;
other matured liabilities.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 80 Minimum liquidity indicator Article 123 The Development Bank shall establish the minimum liquidity indicator that may not be less than 1. 8.2.2. Elements for calculating liquidity coverage ratio 8.2.2.1. Liquidity buffer Composition of the liquidity buffer Article 124 In order to be eligible to form part of the Development Bank's liquidity buffer, the liquid assets shall comply with the following requirements:

the general requirements laid down in Article 125 of this Decision,
the operational requirements laid down in Article 126 of this Decision,
the criteria for classification of assets as a level 1 or level 2 assets in accordance with Articles 130 to 133 of this Decision. General requirements for liquid assets Article 125 (1) The liquid assets of the Development Bank meet the general requirements where:
the assets are a property, right, entitlement or interest which is held by the Development Bank or which is a part of a liquidity pool referred to in paragraph (2) item 1) of this Article and which is free from any encumbrance.
the assets have not been issued by the Development Bank;
the assets have not been issued by any of the following:

a credit institution, unless the issuer is a public sector entity referred to in Article 130 paragraph (1) item 3), Article 131 paragraph (1) of this Decision
an investment firm,
an insurance undertaking;
a reinsurance undertaking,
a financial holding company,
a mixed financial holding company,
other entity that performs one or more financial services.

the value of the assets may be determined on the basis of widely disseminated and easily available market prices, and, in the absence of such prices, on the basis of an easy-to-calculate formula that uses publicly available inputs and is not significantly dependent upon strong assumptions;
the assets are listed on a recognised exchange in Montenegro or in a third country, and tradable via active outright sale or via simple repurchase transaction on generally accepted repurchase markets.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 81 (2) Within the meaning of paragraph (1) item 1) of this Article, unencumbered assets shall comprise the following:

assets included in a liquidity pool and available for immediate use as collateral to obtain additional funding under committed but not yet funded credit facilities or, if the liquidity pool is managed by a central bank, uncommitted but not yet funded credit facilities available to the Development Bank. The Development Bank shall assume that assets in the liquidity pool are encumbered in order of increasing liquidity on the basis of the liquidity classification set out in Articles 130 to 133 of this Decision, starting with assets ineligible for the liquidity buffer;
assets that the Development Bank has received as collateral for credit risk mitigation purposes in reverse repo or securities financing transactions and that the Development Bank may dispose of;
assets attached as non-mandatory overcollateralisation to a covered bond issuance. (3) The requirements referred to in paragraph (1) item 5) of this Article shall be assessed separately for each market, and assets admitted to trading in an organised venue which is not a recognised exchange, either in a Montenegro or in a third country, shall be deemed liquid only where the trading venue provides for an active and sizable market for outright sales of assets. (4) To assess whether the trading venue provides for an active and sizable market referred to in paragraph (3) of this Article, the following shall, in particular, be taken into account:
historical evidence of market breadth and depth as proven by low bid-ask spreads, high trading volume and a large and diverse number of market participants;
the presence of a robust market infrastructure. (5) The requirements laid down in paragraph (1) items 3) and 4) of this Article shall not apply to:
cash referred to in Article 130 paragraph (1) item 1) of this Decision;
the exposures to central governments referred to in Article 131 paragraph (1) item
of this Decision;
the exposures to central banks referred to in Article 130 paragraph (1) items 2) and 4) and Article 131 of this Decision. Operational requirements for liquid assets Article 126 (1) The Development Bank shall have policies and limits in place to ensure that the holdings of liquid assets comprising their liquidity buffer remain appropriately diversified at all times, and for those purposes, it shall take into account the extent of diversification among various categories of liquid assets and within the same category of liquid assets referred to Articles 130 to 133 of this Decision, and any other relevant diversification factors, such as types of issuers, counterparties, or the geographical locations of those issuers and counterparties.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 82 (2) The Development Bank shall have direct access to its holdings of liquid assets and be able to monetise them at any time during the 30 calendar day stress period via outright sale or repurchase agreement on generally accepted repurchase markets where:

a liquid asset shall be deemed readily accessible, where there are no legal or other impediments to the Development Bank's ability to monetise such an asset in a timely fashion;
assets used to provide credit enhancement in structured transactions or to cover operational costs of the Development Bank shall not be deemed readily accessible to the Development Bank;
assets held in a non-convertible currency shall be deemed readily accessible only insofar as the Development Bank uses those assets to cover outflows of liquid assets in that currency; (3) The Development Bank shall ensure that its liquid assets are under the control of a specific liquidity management function, which shall be demonstrated by:
placing the liquid assets in a separate par off the liquidity pool under the direct management of the liquidity management function and with the sole intent of using them as a source of contingent funds, including during stress periods;
putting in place internal systems and controls to give the liquidity management function effective operational control to monetise the holdings of liquid assets at any point in the 30 calendar day stress period and to access the contingent funds without directly conflicting with any existing business or risk management strategies, provided that an asset shall not be included in the liquidity buffer where its monetisation without replacement throughout the 30 calendar day stress period would remove a hedge that would create an open risk position in excess of the internal limits of the Development Bank; (4) The Development Bank shall regularly, and at least once a year, test the marketabilityy of the sufficiently representative sample of their holdings of liquid assets by means of outright sale or simple repurchase agreement on a generally accepted repurchase market. (5) The Development Bank shall develop a strategy for disposing of samples of liquid assets which are adequate to:
test the access to the market for those assets and their usability;
check that the processes for the timely marketability of assets are effective;
minimise the risk of sending a negative signal to the market as a result of marketing of assets during stress periods. (6) The requirement laid down in paragraphs (4) and (5) of this Article shall not apply to level 1 assets referred to in Article 130 of this Decision; (7) For liquid assets held in the liquidity buffer of the cover pool, the requirements set out in paragraphs (4) and (5) of this Article shall be deemed fulfilled if the Development Bank regularly, and at least once a year, markets liquid assets that represent a sufficiently

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 83 representative sample of the liquid assets contained in the liquidity buffer of the cover pool, although such assets do not necessarily have to be part of that buffer. (8) The requirement set out in paragraph (2) of this Article shall not prevent the Development Bank from hedging the market risk associated with its liquid assets, where:

The Development Bank puts in place appropriate internal arrangements in accordance with paragraphs (2) and (3) of this Article to ensure that those assets continue to be readily available and under the control of the liquidity management function, and
the net liquid assets outflows and inflows that would result from an early closeout of the hedge are taken into account in the valuation of the relevant asset in accordance with Article 129 of this Decision. (9) The Development Bank shall ensure that the currency denomination of its liquid assets is consistent with the distribution by currency of its net outflows of liquid assets. (10) Restriction referred to in paragraph (9) of this Article shall be applied only for the reporting currency or a currency subject to additional reporting requirement in accordance with Article 179 paragraph (2) of this Decision. (11) In determining the level of any restriction on currency mismatch that may be applied in accordance with paragraphs (9) and (10) of this Article, the following shall be taken into account:
whether the Development Bank has the ability to:

use the liquid assets to generate liquidity in the currency and jurisdiction in which the net outflows of liquid assets arise;
swap currencies and raise funds in foreign currency markets during stressed conditions consistent with the 30 calendar day stress period;
transfer a liquidity surplus from one currency to another and across jurisdictions and legal entities within its group during stressed conditions consistent with the 30 calendar day stress period;

the impact of sudden, or adverse exchange rate movements on existing mismatched positions and on the effectiveness of any foreign exchange hedges in place. Stress scenarios for the purpose of liquidity coverage ratio Article 127 The Development Bank may be considered as being subject to stress in the case of:
the run-off of a significant proportion of its retail deposits;
a partial or total loss of unsecured wholesale funding capacity, including wholesale deposits and other sources of contingent funding such as received committed or uncommitted liquidity or credit facilities;
a partial or total loss of secured, short-term funding;
additional outflows of liquid assets arising as a result of a credit rating downgrade of up to three notches;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 84 5) increased market volatility affecting the value of collateral or its quality or creating additional collateral needs; 6) unscheduled draws on liquidity and credit facilities; 7) potential obligation to buy-back debt or to honour non-contractual obligations. Calculating and monitoring liquidity coverage ratio Article 128 (1) The Development Bank shall calculate and monitor the liquidity coverage ratio in the reporting currency for all items, regardless of the currency in which they are denominated, and separately calculate and monitor the liquidity coverage ratio for:

items subject to additional reporting requirements in a currency other than the reporting currency, in accordance with Article 179 paragraph (2) of this Decision, whereby the Development Bank shall separately calculate and monitor its liquidity coverage ratio in that other currency;
items denominated in the reporting currency when the total amount of liabilities denominated in a currency other than the reporting currency equals or exceeds 5% of the Development Bank’s total liabilities, excluding own funds and offbalance sheet items, whereby the Development Bank shall separately calculate and monitor its liquidity coverage ratio in the reporting currency. (2) The Development Bank shall not double-count liquid assets, inflows, or outflows. Valuation of liquid assets Article 129 (1) For the purposes of calculating its liquidity coverage ratio, the Development Bank shall use the market value of its liquid assets. (2) The market value of liquid assets referred to in paragraph (1) of this Article shall be reduced in accordance with Article 126 paragraph (8) item 2) of this Decision and the haircuts set out in Articles 131 to 132 of this Decision, where appropriate. 8.2.2.2. Liquid assets Level 1 assets Article 130 (1) Level 1 assets shall include the following:
cash;
exposures to central banks:
assets representing claims on or guaranteed by the:

Government of Montenegro;
central government of a third country, provided that it is assigned a credit assessment of at least credit quality step 1 by a nominated external credit assessment institution in accordance with the Decision on Capital Adequacy of the Development Bank;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 85 4) assets representing claims on or guaranteed by the multilateral development banks and international organisations that are assigned risk weight of 0% in accordance with the Decision on Capital Adequacy of the Development bank. (2) The aggregate amount of assets referred to in paragraph (1) item 4) of this Article denominated in a given currency that the Development Bank may recognise as level 1 assets shall not exceed the amount of the Development Bank's stressed net outflows of liquid assets incurred in that same currency. (3) Where a part or all of the assets referred to in paragraph (1) item 4) of this Article are denominated in a currency which is not the domestic currency of the third country, the Development Bank may only recognise those assets as level 1 assets up to an amount equal to the Development Bank's amount of stressed net outflows of liquid assets incurred in that foreign currency that corresponds to the Development Bank's operations in the jurisdiction of a country where the liquidity risk is being taken. (4) No haircut shall be required on the market value of the level 1 assets referred to in paragraph (1) of this of this Article. Level 2 assets Article 131 (1) Level 2 assets shall include assets representing claims on or guaranteed by the central government or the central bank of a third country, or by a local self-government unit or public sector entity in a third country, provided that they are assigned a 20% risk weight in accordance with the Decision on Capital Adequacy of the Development Bank; (2) The market value of the level 2 assets shall be subject to a haircut of at least 15%. Composition of the liquidity buffer by asset classes Article 132 (1) The Development Bank shall comply at all times with the following requirements on the composition of their liquidity buffer:

a minimum of 85% of the liquidity buffer is to be composed of level 1 assets;
a minimum of 15% of the liquidity buffer is to be composed of level 2 assets; (2) The requirements set out in paragraph (1) of this Article shall be applied after adjusting the level of liquid assets after considering secured funding, secured lending or collateral swap transactions using liquid assets for at least a part of the transaction, where these transactions mature within 30 calendar days, after deducting any applicable haircuts and provided that the Development Bank complies with the operational requirements laid down in Article 127 of this Decision. (3) The Development Bank shall calculate the liquidity buffer as the sum of the amounts referred to in items 1) and 2) of this paragraph, reduced by the amount referred to in item
or item 4) of this paragraph, whichever is lower:
the level 1 asset amount;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 86 2) the level 2 asset amount; 3) the sum of amounts referred to in items 1) and 2) of this paragraph; 4) excess liquid assets amount calculated in accordance with paragraphs (4) and (5) of this Article. (4) Excess liquid assets amount shall be comprised of the following components:

the level 1 liquid assets that would be held by the Development Bank upon the unwind of any secured funding, secured lending or collateral swap transaction that matures within 30 calendar days from the calculation date and where the Development Bank and the counterparty exchange liquid assets on at least one leg of the transaction.
the adjusted level 2 asset amount, which shall be equal to the value post-haircuts of all level 2 assets that would be held by the Development Bank upon the unwind of any secured funding, secured lending or collateral swap transaction that matures within 30 calendar days from the calculation date and where the Development Bank and the counterparty exchange liquid assets on at least one leg of the transaction.
The surplus of liquid assets shall be calculated as the sum of the amounts referred to in items 1) and 2) of this paragraph, reduced by the amount referred to in item 3) or item
of this paragraph, whichever is lower:
the level 1 asset amount;
the adjusted level 2 asset amount;
the sum of amounts referred to in terms 1) and 2) of this paragraph;
the amount referred to in item 1) of this paragraph multiplied by 100/85. (6) The Central Bank may, on a case-by-case basis, exempt the Development Bank from the application of paragraphs (2) and (3) of this Article in full or in part with respect to one or more secured funding, secured lending or collateral swap transactions using liquid assets on at least one leg of the transaction and maturing within 30 calendar days, provided that the following conditions are met:
the counterparty to the transaction or transactions is the Central Bank;
exceptional circumstances occur which pose a systemic risk affecting the banking sector in Montenegro; Implications of a breach of requirements and criteria Article 133 Where a liquid asset ceases to comply with the requirements laid down in Article 125 and Article 126 paragraph (2) of this Decision or any applicable eligibility criteria laid down in this Articles 130 to 32 of this Decision, the Development Bank shall cease to recognise it as a liquid asset no later than 30 calendar days from the day when the breach of requirements or criteria occurred. 8.2.2.3. Outflows and inflows of liquid assets

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 87 Net outflows of liquid assets Article 134 (1) The net outflows of liquid assets, within the meaning of this Decision, shall be the sum of outflows of liquid assets referred to paragraph (2) item 1) of this Article reduced by the sum of inflows of liquid assets in paragraph (2) item 2) of this Article, but shall not be less than zero. (2) The net outflows of liquid assets shall be calculated based on:

the sum of outflows of liquid assets determined in accordance with Articles 135 to 144 of this Decision, and
the sum of inflows of liquid assets determined in accordance with Articles 145 and 146 of this Decision, calculated as follows:

the inflows exempted from the cap as referred to in Article 146 paragraph (2) of this Decision;
inflows, other than those referred to in Article 146 paragraph (2) of this Decision, or 75% of the outflows referred to in item 1) of this paragraph reduced by the exempt inflows referred to in Article 146 paragraph (2) of this Decision, whichever is lower, but not less than zero; (3) Inflows of liquid assets and outflows of liquid assets shall be assessed over a 30 calendar day stress period, under the assumption of a combined idiosyncratic and market-wide stress scenarios as referred to in Article 127 of this Decision. (4) The calculation of net outflows of liquid assets shall be performed in accordance with the following formula: NLO = TO – MIN(FEI, TO) – MIN(IC, 0,75*MAX(TO – FEI, 0)), where NLO = net liquidity outflow, TO = total outflows, TI = total inflows, FEI = fully exempted inflows, IC = inflows subject to cap of 75% of outflows. a) Liquidity outflows Calculating liquidity outflows Article 135 (1) Liquidity outflows shall be calculated by multiplying the outstanding balances of various categories or types of liabilities and off-balance sheet commitments by the rates at which they are expected to run off or be drawn down in accordance with this Article and Articles 136 to 144 of this Decision. (2) Liquidity outflows referred to in paragraph (1) of this Article multiplied by the applicable outflow rate shall include:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 88

the current outstanding amount for stable and other retail deposits in accordance with Articles 137 and 138 of this Decision;
the current outstanding amounts of other liabilities that become due, can be called for pay-out by the issuer or by the provider of the funding sources or entail an expectation by the provider of the funding that the Development Bank would repay the liability during the next 30 calendar days, as determined in accordance with Articles 140, and 144 of this Decision;
the additional outflows determined in accordance with Article 141 of this Decision;
the maximum amount that can be drawn down during the next 30 calendar days from undrawn committed credit and liquidity facilities, as determined in accordance with Article 143 of this Decision;
the additional outflows identified in the assessment in accordance with Article 136 of this Decision. (3) The liquidity outflows calculated in accordance with paragraph (1) of this Article shall be subject to any netting of interdependent inflows that is authorised under Article 139 of this Decision. Additional liquidity outflows for other products and services Article 136 (1) The Development Bank shall regularly assess the likelihood and potential volume of liquidity outflows during 30 calendar days for products or services which it offers or sponsors, and which are not referred to in Articles 140 to 144 of this Decision, or in relation to products that the potential purchasers would consider to be associated with the Development Bank.

(2) Products and services referred to in paragraph (1) of this Article shall include in particular:

other off-balance-sheet liabilities and contingent funding obligations, including committed funding facilities;
undrawn loans and advances to wholesale counterparties;
mortgage secured loans that have been agreed but not yet drawn down;
planned outflows related to the renewal of existing retail or wholesale loans or the extension of new retail or wholesale loans;
derivative payables, other than the contracts listed in Article 2 item (46) of this Decision, and credit derivatives;
trade finance off-balance-sheet related products. (3) The outflows referred to in paragraph (1) of this Article shall be assessed under the assumption of a combined idiosyncratic and market-wide stress scenarios as referred to in Article 127 of this Decision. (4) For the assessment referred to in paragraph (3) of this Article, the Development Bank shall particularly take into account material reputational damage that could result from not providing liquidity support to products or services referred to in paragraph (2) of this Article.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 89 (5) The Development Bank shall, at least once a year and before the expiry of the third quarter of the current year, report to the Central Bank those products and services for which the likelihood and potential volume of the liquidity outflows referred to in paragraph (1) of this Article are material. (6) The Central Bank shall determine the outflow rate referred to in paragraph (1) of this Article if it assesses that the Development Bank failed to conduct adequate assessments of the likelihood and volume of outflows referred to in paragraph (1) of this Article. (7) The Development Bank shall apply an outflow rate of 5% for trade finance off-balance sheet related products. (8) Within the meaning of paragraph (7) of this Article, trade finance shall mean financing, including guarantees connected to the exchange of goods and services through financial products of defined short-term maturity, generally of less than one year, without automatic rollover, and such financing is uncommitted and requires the submission of supporting transactional documentation for each drawdown request, and the repayment of trade finance exposures is usually independent of the debtor, the funds instead coming from cash received from importers or resulting from proceeds of the sales of the underlying goods. Outflows from stable retail deposits Article 137 (1) Unless the criteria for a higher outflow rate under Article 138 paragraphs (2) to (5) or paragraph (9) of this Decision are fulfilled, the amount of retail deposits covered by a deposit guarantee scheme in accordance the Government regulation, or an equivalent deposit guarantee scheme in a third country, shall be considered as stable and multiplied by 5% where the deposit is a part of an established relationship making withdrawal highly unlikely. (2) A deposit shall be considered to be part of an established relationship where the depositor has:

an active contractual relationship with the Development Bank of at least 12 months’ duration;
a borrowing relationship with the Development Bank for residential loans or other long-term loans; or
at least one other active contractual relationship for a product other than a loan with the Development Bank. Outflows from other retail deposits Article 138 (1) The Development Bank shall multiply by 10% other retail deposits, including the part of retail deposits not covered by Article 137 of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 90 (2) Notwithstanding paragraph (1) of this Article, other retail deposits shall be subject to higher outflow rates, as determined by the Development Bank, in accordance with paragraph (3) of this Article, where:

the total deposit balance, including all the clients’ deposit accounts at the Development Bank, exceeds EUR 200 000;
the deposit is placed in an internet access-only account;
the deposit is subject to an interest rate that fulfils any of the following conditions:

the interest rate significantly exceeds the average rate for similar products for retail clients;
its return is derived from the return on a market index or set of indices;
its return is derived from any market variable other than a floating interest rate;

the deposit was originally placed as fixed-term with an expiry date maturing within the 30 calendar day period or the deposit presents a fixed notice period shorter than 30 calendar days, in accordance with contractual arrangements, other than the deposits referred to in paragraphs (6) to (8) of this Article;
the depositor is resident in a third country or the deposit is denominated in a currency other than the EUR. (3) The Development Bank shall apply a higher outflow rate determined as follows:
where a retail deposit fulfils the criterion referred to in paragraph (2) item 1 of this Article or two of the criteria referred to in items 2) to 5) of the same paragraph, an outflow rate of 15% shall be applied;
where a retail deposit fulfils the criterion referred to in paragraph (2) item 1) and at least another criterion referred to in items 2) to 5) of this Article, or three or more criteria referred to in paragraph (2) of this Article, an outflow rate of 20% shall be applied. (4) On a case-by-case basis, the Central Bank may require the application of a higher outflow rate, where justified by the specific circumstances of the Development Bank. (5) The Development Bank shall apply the outflow rate referred to in paragraph (3) item
of this Article to retail deposits, where the assessment of fulfilment of conditions referred to in paragraph (2) of this Article has not been carried out or is not completed. (6) The Development Bank may exclude from the calculation of outflows specific clearly defined categories of retail deposits, as long as in each and every instance it applies the following provisions for the whole category of those deposits, unless an exception can be justified on the basis of circumstances of hardship for the depositor:
within 30 calendar days, the depositor is not allowed to withdraw the deposit; or
for early withdrawals within 30 calendar days, the depositor shall loose the interest between the date of withdrawal and the contractual maturity date and must pay a pecuniary penalty that should not exceed the interest due for the time that elapsed between the date of deposit and the date of withdrawal. (7) The portion of the deposit referred to in paragraph (6) of this Article, which can be withdrawn without incurring a penalty, shall be treated as a demand deposit, and the remaining balance shall be treated as a term deposit.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 91 (8) An outflow rate of 100% shall be applied to the cancelled deposits with a residual maturity of less than 30 calendar days and where pay-out has been agreed to the Development Bank. (9) By way of derogation from paragraphs (1) to (8) of this Article and Article 137 of this Decision, the Development Bank shall multiply retail deposits taken in third countries by a higher percentage outflow rate, if such higher percentage is provided for by the regulations establishing liquidity requirements in that third country. Outflows with interdependent inflows Article 139 Subject to prior authorisation of the Central Bank, the Development Bank may calculate the liquidity outflow net of an interdependent inflow provided that:

the interdependent inflow is directly linked to the outflow and is not considered in the calculation of liquidity inflows referred to in Articles 145 and 146 of this Decision;
the interdependent inflow is required pursuant to a legal, regulatory or contractual commitment; and
the interdependent inflow meets one of the following conditions:

it arises compulsorily before the outflow;
it is received within ten days and is guaranteed by the Government of Montenegro. Outflows from other liabilities Article 140 (1) The Development Bank shall multiply by 40% liabilities resulting from deposits by clients that are non-financial customers, sovereigns, central banks, multilateral development banks, public sector entities, credit unions authorised by a competent authority of the third country, or by personal investment companies. (2) By way of derogation, where the liabilities referred to in paragraph (1) of this Article are covered by a deposit guarantee scheme in accordance with deposit protection system of the Development Bank as governed by the Government regulation, they shall be multiplied by 20%. (3) The Development Bank shall multiply liabilities resulting from its own operating expenses by 0%. (4) The Development Bank shall multiply liabilities maturing within 30 calendar days and resulting from securities financing transactions or capital market-driven transactions by the following weights:

0% where they are collateralised by assets that, but for being used as collateral for those transactions, would qualify as liquid assets of any of the categories of level 1 asset referred to in Article 130 of this Decision;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 92 2) 15% where they are collateralised by assets that, but for being used as collateral for those transactions, would qualify as liquid assets of any of the categories of level 2 asset referred to in Article 131 of this Decision; 3) 100% where they are collateralised by assets that do not fall within any of items

and 2) of this paragraph. (5) Collateral swaps, and other transactions with a similar form that mature within the next 30 calendar days shall lead to an outflow, where, in accordance with Articles 134 to 144 of this Decision, the asset borrowed is subject to a lower weight than the asset lent, and in that case the outflow shall be calculated by multiplying the market value of the asset borrowed by the difference between the outflow rate applicable to the asset lent and the outflow rate applicable to the asset borrowed determined in accordance with paragraph (4) of this Article. (6) For the purposes of calculation referred to in paragraph (5) of this Article, a 100% haircut shall be applied to assets that do not qualify as liquid assets. (7) An outflow rate of 100% shall be applied to all notes, bonds and debt securities issued by the Development Bank. (8) Assets borrowed on an unsecured basis and maturing within the next 30 calendar days shall be assumed to run off in full, leading to a 100% outflow of liquid assets, unless the Development Bank owns the assets borrowed and the assets borrowed do not form part of the liquidity buffer. Additional outflows Article 141 (1) Collateral other than cash and assets referred to in Article 130 of this Decision which is posted by the Development Bank for contracts listed in Article 2 item (46) of this Decision and credit derivatives, shall be subject to an additional outflow of 20%. (2) The Development Bank shall calculate an additional outflow for all contracts, which lead to additional liquidity outflows or collateral needs within 30 calendar days and following a material deterioration of the Development Bank's credit quality, and it shall notify the Central Bank of that outflow no later than at the submission of the report referred to in Article 179 paragraph (1) of this Decision. (3) Where the Central Bank considers the outflow for contracts referred to in paragraph (2) of this Article to be material in relation to the potential liquidity outflows of the Development Bank, it shall require the Development Bank to calculate an additional outflow for those contracts corresponding to the additional collateral needs or cash outflows resulting from a material deterioration in the Development Bank's credit quality corresponding to a downgrade in its external credit assessment of at least three notches.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 93 (4) The Development Bank shall apply a 100% outflow rate to additional collateral or cash outflows referred to in paragraph (3) of this Article. (5) The Development Bank shall regularly review the relationship between the material deterioration in the credit quality and the contracts referred to in paragraph (2) of this Article, and notify the results of its review to the Central Bank. (6) The Development Bank shall add additional outflows corresponding to collateral needs in the case of a material impact of an adverse market scenario on the derivatives transactions, and this calculation shall be made in the manner provided for in Article 142 of this Decision. (7) Where the Development Bank has a short position that is covered by an unsecured security borrowing, it shall add an additional outflow corresponding to 100% of the market value of the securities or other assets sold short, unless the terms upon which it has borrowed them require their return only after 30 calendar days, and where the short position is covered by a collateralised securities financing transaction, the Development Bank shall assume the short position will be maintained throughout the 30 calendar day period and will have a 0% outflow. (8) The Development Bank shall add an additional outflow corresponding to 100% of:

the excess collateral it holds that can be contractually called at any times by the counterparty;
collateral that is due to be posted to a counterparty within 30 calendar days;
collateral that corresponds to assets that would qualify as liquid assets for the purposes of Articles 124 to 132 of this Decision that can be substituted for assets corresponding to assets that would not qualify as liquid assets without the consent of the Development Bank. (9) Deposits received as collateral shall not be considered liabilities for the purposes of Article 137, 138, 140 or 144 of this Decision and shall be subject to the provisions of paragraphs (1) to (8) of this Article. (10) The amount of cash received exceeding the amount of cash received as collateral shall be treated as deposits in accordance with Article 137, 138, 140 or 144 of this Decision. (11) The Development Bank shall assume a 100% outflow for loss of funding:
on asset-backed securities, covered bonds and other structured financing instruments maturing within 30 calendar days, when these instruments are issued by the Development Bank;
on asset-backed commercial papers, units, securities investment vehicles and other such financing facilities, and this 100% outflow rate shall apply to the maturing amount, to the amount of assets that could potentially be returned, or the liquidity required.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 94 (12) For that portion of financing programs under paragraph (11) of this Article, the Development Bank that is a provider of associated liquidity facilities does not need to double count the maturing financing instrument and the liquidity facility for consolidated programmes. Calculation of additional outflows Article 142 (1) For the purposes of calculation of outflows referred to in Article 141 paragraph (6) of this Decision, the Development Bank's derivatives transactions shall be considered material where the total of notional amounts of such transactions have exceeded 10% of the net liquidity outflows at any time in the previous two years. (2) For the purposes of item 1) of this Article, the net liquidity outflows shall be calculated without the additional outflow component referred to in Article 141 paragraphs (3) and (4) of this Decision. (3) The additional outflow corresponding to collateral needs resulting from the impact of an adverse market scenario on the Development Bank's derivatives transactions considered as material within the meaning of paragraph (1) of this Article, shall be the largest absolute net 30-day collateral flow realised during the 24 months preceding the date of calculation of the liquidity coverage requirement. (4) The Development Bank may only treat inflows and outflows of transactions on a net basis where they are executed under the same standardised netting agreement, wherein the absolute net collateral flow shall be based on both realised outflows and inflows, and the netting shall be calculated at the Development Bank's portfolio level. Outflows from credit and liquidity facilities Article 143 (1) Within the meaning of this Article, a liquidity facility shall mean any committed, undrawn back-up facility that would be utilised to refinance the debt obligations of a customer in situations where such a customer is unable to rollover that debt in financial markets. (2) The amount of liquidity facility referred to in paragraph (1) of this Article shall be calculated as the amount of the debt issued by the customer currently outstanding and maturing within 30 calendar days that is backstopped by the facility, provided that:

the portion of the liquidity facility that is backing a debt that does not mature within 30 calendar days shall be excluded from the liquidity facility.
any additional capacity of the liquidity facility shall be treated as a committed credit facility with the associated outflow rate as specified in paragraph (3) of this Article.
general working capital facilities for corporate entities shall be classified as credit facilities.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 95 (3) Outflows for committed credit and liquidity facilities shall be calculated by multiplying the amount of those facilities by the corresponding outflow rates set out in paragraphs (5), (6), and (7) of this Article, and determined as a percentage of the maximum amount that can be drawn down within 30 calendar days, net of any liquidity requirement that would be applicable under Article 136 of this Decision for the trade finance off-balance sheet items, and net of any collateral made available to the Development Bank and valued in accordance with Article 129 of this Decision, provided that the collateral fulfils all of the following conditions:

it may be reused or hypothecated by the Development Bank;
it is held in the form of liquid assets, but is not recognised as part of the liquidity buffer; and
it does not consist of assets issued by the counterparty of the facility or one of its affiliated entities. (4) If the necessary information is available to the Development Bank, the maximum amount that can be drawn down for credit and liquidity facilities shall be determined taking into account the counterparty's own obligations or the pre-defined contractual drawdown schedule coming due over 30 calendar days. (5) The maximum amount that the clients of the Development Bank can draw down from undrawn committed credit and liquidity facilities within the next 30 calendar days shall be multiplied by 5%, if those clients belong to the retail deposit exposure class. (6) The maximum amount that the clients can draw down from undrawn committed credit facilities within 30 calendar days shall be multiplied by 10% where they:
cannot be assigned to the category of clients considered to be retail deposits;
have been offered to non-financial customers, including non-financial corporates, sovereigns, central banks, multilateral development banks and public sector entities;
have not been provided for the purpose of replacing funding of the client in situations where the client is unable to meet the funding requirements in the financial markets. (7) The maximum amount that can be drawn down from undrawn committed liquidity facilities within 30 calendar days shall be multiplied by 30%, where those facilities meet the conditions referred to in paragraph (6) items 1) and 2) of this Article, and by 40% where they are provided to personal investment companies. (8) Committed amount of a liquidity facility that has been provided to an SSPE for the purpose of purchasing assets, other than securities, from non-financial customers shall be multiplied by 10%, to the extent that it exceeds the amount of assets currently purchased from clients and where the maximum amount that can be drawn down is contractually limited to the amount of assets currently purchased. (9) The maximum amount that can be drawn down from other undrawn committed credit and liquidity facilities within 30 calendar days shall be multiplied by the corresponding outflow rate as follows:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 96

40% for credit and liquidity facilities extended to credit institutions and to other regulated financial institutions;
100% for liquidity facilities that the Development Bank has granted to SSPEs, other than those referred to in paragraph (8) of this Article, and for arrangements under which the Development Bank is required to buy or swap assets from an SSPE;
100% for credit and liquidity facilities to financial customers not referred to in items
and 2) of this paragraph and paragraphs (1) to (8) of this Article. (10) By way of derogation from paragraphs (1) to (9) of this Article, in the case where the funding for promotional loans is provided by the Government of Montenegro, the Development Bank may apply the treatments set out in paragraphs (5) and (6) of this Article to credit and liquidity facilities that are extended to promotional lenders for the sole purpose of directly or indirectly funding promotional loans, provided that those loans meet the requirements for the outflow rates referred to in paragraphs (5) and (6) of this Article. (11) By way of derogation from Article 145 paragraph (3) item 7) of this Decision, where promotional loans referred to in paragraph (10) of this Article are extended as pass through loans via a credit institution acting as an intermediary, the Development Bank may apply symmetric inflows and outflows, which shall be calculated by applying to the undrawn committed credit or liquidity facility received and extended the rate referred to in paragraphs (5) and (6) of this Article and observing the conditions and requirements otherwise imposed in relation to that rate. (12) The promotional loans referred to in paragraph (10) of this Article may be available only to persons who are non-financial customers on a non-competitive, not for profit basis in order to promote the policy of the Government Montenegro, and it shall only be possible to draw on such credit and liquidity facilities following the reasonably expected demand for a promotional loan and up to the amount of such demand, provided there is a subsequent reporting on the use of the funds distributed. Outflows from other liabilities Article 144 (1) Where the total of all contractual commitments to extend funding to non-financial customers within 30 calendar days, other than commitments referred to in Articles 137 to 143 of this Decision, exceeds the amount of inflows from those non-financial customers calculated in accordance with Article 145 paragraph (3) item 1) of this Decision, the excess shall be subject to a 100% outflow rate. (3) Non-financial customers referred to in paragraph (2) of this Article and Article 146 paragraph (3) item 1) of this Decision shall include, but not be limited to, natural persons, SMEs, business undertakings, sovereigns, multilateral development banks and public sector entities, (4) Non-financial customers referred to in paragraph (3) of this Article shall exclude financial customers and central banks.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 97 b) Liquidity inflows Inflows Article 145 (1) Liquidity inflows shall be assessed over a period of 30 calendar days, and they shall comprise only contractual inflows from exposures that are not past due and for which the Development Bank has no reason to expect non-performance within 30 calendar days. (2) The Development Bank shall apply a 100% inflow rate to inflows referred to in paragraph (1) of this Article, including in particular the monies due from:

central banks and financial customers with a residual maturity of no more than 30 calendar days;
trade finance transactions with a residual maturity of no more than 30 calendar days;
securities maturing within 30 calendar days;
positions in major indexes of equity securities, provided there is no double counting with liquid assets, and that they include monies contractually due within 30 calendar days, such as cash dividends from those major indexes and cash due from those equity securities sold but not yet realized/settled, if they are not recognised as liquid assets in accordance with Articles 124 to 132 of this Decision. (3) By way of derogation from paragraph (2) of this Article:
monies due from non-financial customers with a residual maturity of no more than 30 calendar days, with the exception of monies due from trade finance transactions or maturing securities, shall be reduced for the purposes of principal payment by 50 % of their value, however, if the Development Bank acts as intermediary and if it received a commitment from a multilateral development bank or a public sector entity to disburse a promotional loan to a final recipient may take into account an inflow up to the amount of the outflow that they apply to the corresponding commitment to extend those promotional loans;
monies due from securities financing transactions and capital market-driven transactions with a remaining maturity of no more than 30 calendar days shall be multiplied by:

0%, where they are collateralised by assets of any of the categories of level 1 asset;
15%, where they are collateralised by liquid assets of any of the categories of level 1 asset;
100%, where they are collateralised by assets not included in indents 1 and 2 of this item,

to monies due from contractual margin loans maturing in the next 30 calendar days made against non-liquid assets collateral shall receive a 50% inflow rate, provided that the Development Bank is not using the collateral it originally received against the loans to cover any short positions;
collateral swaps, and other transactions with a similar form that mature within 30 calendar days shall lead to an inflow, where the asset lent is subject, in

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 98 accordance with Articles 134 to 144 of this Decision, to a lower haircut than the asset borrowed, and that inflow shall be calculated by multiplying the market value of the asset lent by the difference between the inflow rate applicable to the asset borrowed and the inflow rate applicable to the asset lent in accordance with the rates specified in item 2) of this paragraph, whereby a 100% haircut shall apply to assets that do not qualify as liquid assets; 5) where the collateral obtained through reverse repos, securities borrowings, collateral swaps, or other transactions with a similar form, maturing within 30 calendar days is used to cover short positions that can be extended beyond 30 calendar days, the Development Bank shall assume that such transactions will be rolled-over and will not give rise to any cash inflows reflecting the need to continue to cover the short position or to repurchase the relevant securities, and the short positions shall include both, instances where in a matched book the Development Bank sold short a security outright as part of a trading or hedging strategy and instances where in a matched book the Development Bank has borrowed a security for a given period and lent the security out for a longer period; 6) undrawn credit or liquidity facilities, and other commitments referred to in Article 143 paragraph (9) of this Decision, shall not be recognised as an inflow; 7) monies due from securities issued by the Development Bank itself or by a SSPE with which the Development Bank has close links shall be taken into account on a net basis with an inflow rate applied on the basis of the inflow rate applicable to the underlying assets in accordance with this Article; 8) loans with an undefined contractual end date shall be taken into account with a 20% inflow rate, provided that the contract allows the Development bank to withdraw or to request payment within 30 calendar days. (4) Provisions of paragraph (3) item 1) of this Article shall not apply to monies due from securities financing transactions and capital market-driven transactions that are collateralised by liquid assets in accordance with Articles 124 to 132 of this Decision in the manner specified in paragraph (3) item 2) of this Article. (5) In the case referred to in paragraph (3) item 2) of this Article, no inflow shall be recognised where the collateral is used by the Development Bank to cover a short position in accordance with Article 140 paragraph (9) of this Decision; (6) Inflows from the release of balances held in segregated accounts in accordance with regulatory requirements for the protection of customer trading assets shall be taken into account in full, provided that those segregated balances are maintained in liquid assets as defined in Articles 125 to 133 of this Decision. (7) Outflows and inflows expected over 30 calendar days from the contracts listed in Article 2 item 46 of this Decision and from credit derivatives shall be multiplied by a 100% inflow rate in the event of a net inflow. (8) The Development Bank shall not take into account any inflows:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 99

from any of the liquid assets referred to in Articles 124 to 132 of this Decision other than payments due on the assets that are not reflected in the market value of the asset.
from any new obligations entered into. Cap on inflows Article 146 (1) The Development Bank shall limit the recognition of liquidity inflows to 75% of total liquidity outflows in accordance with Articles 134 to 144 of this Decision. (2) By way of derogation from paragraph (1) of this Article, subject to the prior authorisation of the Central Bank, the Development Bank may fully or partially exempt from the cap the following liquidity inflows:
where the provider is a parent institution or a subsidiary undertaking of the Development Bank or another subsidiary of the same parent institution;
referred to in Article 139 of this Decision, including inflows from loans related to mortgage lending, or promotional loans referred to in Article 143 paragraph (10) of this Decision or from a multilateral development bank or a public sector entity that the Development Bank has passed-through. (3) The Development Bank shall determine the amount of the net liquidity inflows referred to in paragraph (1) of this Article applying the formula laid down in Article 134 paragraph (4) of this Decision. 8.3 Net stable funding ratio 8.3.1 Determining stable funding Determining stable funding Article 147 The Development Bank shall determine items requiring stable funding of the Development Bank. 8.3.2 Net stable funding ratio Application on a consolidated basis Article 148 Where the net stable funding ratio applies on a consolidated basis, the following provisions shall apply:
the assets and off-balance-sheet items of a subsidiary undertaking of the Development Bank with a head office in a third country which are subject to required stable funding factors under the net stable funding requirement set out in the national law of that third country that are higher than those specified in Articles 159 to 168 of this Decision, shall be subject to consolidation in accordance with the higher factors specified in the national law of that third country;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 100 2) the liabilities and own funds of a subsidiary undertaking of the Development Bank with a head office in a third country which are subject to available stable funding factors under the net stable funding requirement set out in the national law of that third country that are lower than those specified in Articles 152 to 158 of this Decision, shall be subject to consolidation in accordance with the lower factors specified in the national law of that third country; 3) third-country assets which meet the requirements laid down in Articles 124 to 132 of this Decision and which are held by a subsidiary undertaking of the Development Bank with a head office in a third country shall not be recognised as liquid assets for consolidation purposes where they do not qualify as liquid assets under the national law of that third country which sets out the liquidity coverage requirement. Net stable funding ratio Article 149 (1) The Development Bank shall, for the purpose of adequate meeting of long-term liabilities referred to in Article 22 paragraph (9) of the Law, maintain a net stable funding ratio of at least 100%, calculated in the reporting currency for all its transactions, irrespective of their actual currency denomination. (2) The ratio referred to in paragraph (1) of this Article shall be equal to the ratio of the Development Bank's available stable funding as referred to in Articles 152 to 158 of this Decision to the Development Bank's required stable funding as referred to in Articles 159 to 168 of this Decision, and shall be expressed as a percentage in accordance with the following formula: Available stable funding Required stable funding =Net stable funding ratio (%) (3) Where, at any time, the net stable funding ratio of the Development Bank has fallen below 100%, or can be reasonably expected to fall below 100 %, the Development Bank shall immediately notify the Central Bank thereof, explaining the reasons that led to the failure to meet the prescribed requirement and an action plan with a deadline for eliminating the non-compliance. (4) The Development Bank shall calculate and monitor its net stable funding ratio in the reporting currency for all its transactions, irrespective of their actual currency denomination, and separately for its transactions denominated in each of the currencies that is subject to separate reporting in accordance with Article 179 paragraph (2) of this Decision. (5) The Development Bank shall ensure that the distribution of its funding profile by currency denomination is consistent with the distribution of its assets by currency.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 101 8.3.3. General rules for the calculation of the net stable funding ratio Calculation of the net stable funding ratio Article 150 (1) For the purpose of calculating its net stable funding ratio, the Development Bank shall take into account assets, liabilities and off-balance-sheet items on a gross basis and shall apply the appropriate stable funding factors set out in Articles 152 to 168 of this Decision to the accounting value of its assets, liabilities and off-balance-sheet items. (2) For the purposes of paragraph (1) of this Article, gross basis means that the accounting rules for determining the value of assets, liabilities and off-balance sheet items are applied, so that these positions are taken in the net accounting amount shown in the balance sheet, without applying additional prudential netting. (3) The Development Bank shall not double count required stable funding and available stable funding. (4) Where an item can be allocated to more than one required stable funding category, the Development Bank shall allocate that item to the required stable funding category that produces the greatest contractual required stable funding for that item. (5) The Development Bank shall calculate the amount of required stable funding for derivative contracts in accordance with Articles 152 to 168 of this Decision. (6) Cash received as collateral to mitigate the exposure of a derivative position shall be treated as such and shall not be treated as deposits to which provisions of Articles 152 to 158 of this Decision apply. Interdependent assets and liabilities Article 151 (1) Subject to prior authorisation of the Central Bank, the Development Bank may treat an asset and a liability as interdependent, provided that all the following conditions are met:

the Development Bank acts solely as a pass-through unit to channel the funding from the liability into the corresponding interdependent asset;
the individual interdependent assets and liabilities are clearly identifiable and have the same principal amount;
the asset and interdependent liability have substantially matched maturities, with a maximum delay of 20 days between the maturity of the asset and the maturity of the liability;
the interdependent liability has been requested pursuant to a legal, regulatory or contractual commitment and is not used to fund other assets;
the principal payment flows from the asset are not used for other purposes than repaying the interdependent liability;
the counterparties for each pair of interdependent assets and liabilities are not the same.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 102 (2) Assets and liabilities shall be considered to meet the conditions set out in paragraph (1) of this Article and shall be deemed interdependent where they are directly linked to the promotional loans and credit and liquidity facilities that fulfil the criteria set out in the Articles 124 to 146 of this Decision for the Development Bank acting as simple intermediary that does not incur any funding risk. 8.3.4 Available stable funding Calculation of the amount of available stable funding Article 152 (1) The amount of available stable funding shall be calculated by multiplying the accounting value of various categories or types of liabilities and own funds by the available stable funding factors to be applied in accordance with Articles 154 to 158 of this Decision. (2) The total amount of available stable funding shall be the sum of the weighted amounts of liabilities and own funds. (3) Bonds and other debt securities that are issued by the Development Bank, sold exclusively in the retail market, and held in a retail account, may be treated as belonging to the appropriate retail deposit category, in which case those instruments cannot be bought and held by persons other than retail customers. Residual maturity of a liability or of own funds Article 153 (1) The Development Bank shall take into account the residual contractual maturity of its liabilities and own funds to determine the available stable funding factors to be applied in accordance with Articles 154 to 158 of this Decision. (2) In determining the residual maturity of a liability or of own funds referred to in paragraph (1) of this Article, the Development Bank shall take into account the existing options, and it shall do so on the assumption that the counterparty will redeem call options at the earliest possible date, whereas for options exercisable at the discretion of the Development Bank, the Development Bank and the Central Bank shall take into account reputational factors that may limit Development Bank's ability not to exercise the option, in particular market expectations that the Development Bank should redeem certain liabilities before their maturity. (3) The Development Bank shall treat deposits with fixed notice periods in accordance with their notice period, and shall treat term deposits in accordance with their residual maturity. (4) By way of derogation from paragraph (2) of this Article, the Development Bank shall not take into account options for early withdrawals where, in accordance with Article 138 paragraphs (6) to (8) of this Decision, the depositor has to pay a material penalty for early

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 103 withdrawals which occur in less than one year, to determine the residual maturity of term retail deposits. (5) In order to determine the available stable funding factors to be applied in accordance with Articles 154 to 158 of this Decision, the Development Bank shall treat any portion of liabilities having a residual maturity of one year or more that matures in less than six months and any portion of such liabilities that matures between six months and less than one year as having a residual maturity of less than six months and between six months and less than one year, respectively. 0% available stable funding factor Article 154 (1) All liabilities without a stated maturity, including short positions and open maturity positions, shall be subject to a 0% available stable funding factor, with the exception of the following:

deferred tax liabilities, which shall be treated in accordance with the nearest possible date on which such liabilities could be realised;
minority interests, which shall be treated in accordance with the term of the instrument. (2) Deferred tax liabilities and minority interests as referred to in paragraph (1) shall be subject to one of the following factors:
0%, where the effective residual maturity is less than six months;
50%, where the effective residual maturity is six months but less than one year;
100%, where the effective residual maturity is one year or more. (3) The following liabilities and capital items or instruments shall be subject to a 0% available stable funding factor:
trade date payables arising from purchases of financial instruments, of foreign currencies and of commodities, that are expected to settle within the standard settlement cycle or period that is customary for the relevant exchange or type of transactions, or that have failed to settle but are nonetheless expected to settle;
liabilities that are categorised as being interdependent with assets in accordance with Article 152 of this Decision;
liabilities with a residual maturity of less than six months provided by: − the Central Bank, the European Central Bank or the central bank of an EU Member State; − the central bank of a third country; − financial customers;
any other liabilities and capital items or instruments not referred to in Articles 155 to 158 of this Decision. 50% available stable funding factor Article 155 The following liabilities and capital items or instruments shall be subject to a 50% available stable funding factor:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 104

liabilities with a residual maturity of less than one year provided by: − the Government of Montenegro, the central government of an EU Member State or of a third country; − regional or local self-government in Montenegro, in an EU Member State or in a third country; − public sector entities in Montenegro, in an EU Member State or in a third country; − multilateral development banks and international organisations that are assigned 0% risk weight in accordance with the Decision on Capital Adequacy of the Development Bank; − non-financial corporate customers;
liabilities with a residual contractual maturity of a minimum of six months but less than one year that are provided by: − the Central Bank, the European Central Bank or the central bank of an EU Member State; − the central bank of a third country; − financial customers;
any other liabilities and capital items or instruments with a residual maturity of a minimum of six months but less than one year not referred to in Articles 156, 157 and 158 of this Decision. 90% available stable funding factor Article 156 Demand retail deposits, retail deposits with a fixed notice period of less than one year and term retail deposits having a residual maturity of less than one year that fulfil the relevant criteria for other retail deposits set out in Article 138 of this Decision shall be subject to a 90% available stable funding factor. 95% available stable funding factor Article 157 Demand retail deposits, retail deposits with a fixed notice period of less than one year and term retail deposits having a residual maturity of less than one year that fulfil the relevant criteria for stable retail deposits set out in Article 137 of this Decision shall be subject to a 95% available stable funding factor. 100% available stable funding factor Article 158
The following liabilities and capital items and instruments shall be subject to a 100% available stable funding factor:
the Common Equity Tier 1 items of the Development Bank before the deduction of the items referred to in the Decision on Capital Adequacy of the Development Bank;
the Additional Tier 1 items of the Development Bank before the deduction of the items referred to in Decision on Capital Adequacy of the Development Bank, excluding any instruments with explicit or embedded options that, if exercised, would reduce the effective residual maturity to less than one year;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 105 3) the Tier 2 items of the Development Bank before the deductions referred to in the Decision on Capital Adequacy of the Development Bank, having a residual maturity of one year or more, excluding any instruments with explicit or embedded options that, if exercised, would reduce the effective residual maturity to less than one year; 4) any other capital instruments of the Development Bank with a residual maturity of one year or more, excluding any instruments with explicit or embedded options that, if exercised, would reduce the effective residual maturity to less than one year; 5) any other secured and unsecured loans and liabilities with a residual maturity of one year or more, including term deposits, unless otherwise specified in Articles 154 to 157 of this Decision. 8.3.5 Required stable funding Calculation of the amount of required stable funding Article 159 (1) The amount of required stable funding shall be calculated by multiplying the accounting value of various categories or types of assets and off-balance-sheet items by the required stable funding factors to be applied in accordance with Articles 161 to 168 of this Decision. (2) The total amount of required stable funding shall be the sum of the weighted amounts of assets and off-balance-sheet items. (3) Assets which the Development Bank has borrowed, including in securities financing transactions, shall be excluded from the calculation of the amount of required stable funding where those assets are accounted for on the balance sheet of the Development Bank and the Development Bank does not have right of ownership over the asset. (4) Assets that the Development Bank has borrowed, including in securities financing transactions, shall be subject to the required stable funding factors referred to in paragraph (1) of this Article, where those assets are not accounted for on the balance sheet of the Development Bank, but the Development Bank does have right of ownership over the assets. (5) Assets that the Development Bank has lent, including in securities financing transactions over which the Development Bank retains beneficial ownership, shall be considered as encumbered assets and shall be subject to the required stable funding factors to be applied in accordance with Articles 161 to 168 of this Decision, even where the assets do not remain on the balance sheet of the Development Bank, otherwise, such assets shall be excluded from the calculation of the amount of required stable funding. (6) Assets that are encumbered for a residual maturity of six months or longer shall be assigned the higher of the following factors:

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 106

required stable funding factor that would be applied in accordance with Articles 161 to 168 of this Decision to those assets if they were held unencumbered, or
the required stable funding factor that is otherwise applicable to those encumbered assets. (7) The factors referred to in paragraph (6) of this Article shall apply where the residual maturity of the encumbered assets is shorter than the residual maturity of the transaction that is the source of encumbrance. (8) Assets that have less than six months remaining in the encumbrance period shall be subject to the required stable funding factor to be applied in accordance with Articles 161 to 168 of this Decision to the same assets if they were held unencumbered. (9) Where the Development Bank reuses or repledges an asset that was borrowed, including in securities financing transactions, and that asset is accounted for off-balancesheet, the transaction in relation to which that asset has been borrowed shall be treated as encumbered, provided that the transaction cannot mature without the Development Bank returning the asset borrowed. (10) The following assets shall be considered to be unencumbered:
assets included in a pool which are available for immediate use as collateral to obtain additional funding under committed or, where the pool is operated by the Central Bank, uncommitted but not yet funded, credit lines that are available to the Development Bank, whereat the Development Bank shall assume that assets in the pool are encumbered in order of increasing liquidity on the basis of the liquidity classification pursuant to the provisions of this Decision, starting with assets ineligible for the liquidity buffer;
assets that the Development Bank has received as collateral for credit risk mitigation purposes in secured lending, secured funding or collateral exchange transactions and that the Development Bank may dispose of;
assets attached as non-mandatory overcollateralisation to a covered bond issuance. (11) In the case of non-standard, temporary operations conducted, in accordance with the law, by the Central Bank, the European Central Bank, or the central bank of an EU Member State or of a third country in order to fulfil its mandate in a period of market-wide financial stress or in exceptional macroeconomic circumstances, the following assets shall receive a reduced required stable funding factor:
by way of derogation from Article 166 item 4) and Article 168 paragraph (1) item
of this Decision, assets encumbered for the purposes of the operations referred to in this paragraph;
by way of derogation from Article 166 item 2) indents 1 and 2 and Article 167 item
of this Decision, monies due that result from the operations referred to in this paragraph. (12) The Central Bank shall determine, in agreement with the central bank that is the counterparty to the transaction, the required stable funding factor to be applied to the

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 107 assets referred to in paragraph (11) of this Article, whereat that factor may not be lower than the required stable funding factor that would apply in accordance with Articles 161 to 168 of this Decision to those assets if they were held unencumbered. (13) When applying a reduced required stable funding factor in accordance with paragraph (12) of this Article, the Central Bank shall closely monitor the impact of that reduced factor on the Development Bank's stable funding positions and shall take appropriate supervisory measures where necessary. (14) In order to avoid double counting, the Development Bank shall exclude assets that are associated with collateral that is recognised as variation margin posted, or recognised as initial margin posted, or recognised as a contribution to the default fund of a central counterparty from other parts of calculation of the amount of required stable funding determined in accordance with this Decision. (15) The Development Bank shall include non-EUR currencies and commodities for which a purchase order has been executed in the calculation of the amount of required stable funding financial instruments, and it shall exclude financial instruments, foreign currencies and commodities for which a sale order has been executed from the calculation of the amount of required stable funding, provided that those transactions are not reflected as derivatives or secured funding transactions on the Development Bank's balance sheet and that those transactions are to be reflected on the Development Bank's balance sheet when settled. Residual maturity of an asset Article 160 (1) The Development Bank shall take into account the residual contractual maturity of its assets and off- balance-sheet transactions when determining the required stable funding factors to be applied to its assets and off-balance-sheet items in accordance with Articles 161 to 168 of this Decision. (2) The Development Bank shall treat assets relating to collateral related to OTC derivatives contracts the segregated exchange of which has been defined in risk management procedures, in accordance with the underlying exposure of those assets, whereat the Development Bank shall subject those assets to a higher required stable funding factor, depending on the term of encumbrance to be determined by the Central Bank, whereby the Central Bank shall consider whether the Development Bank is able to freely dispose of or exchange such assets and shall consider the term of the liabilities to the Development Bank's customers to whom that collateral segregation requirement relates. (3) When calculating the residual maturity of an asset, the Development Bank shall take options into account, based on the assumption that the issuer or counterparty will exercise any option to extend the maturity of an asset, and for options that are exercisable at the discretion of the Development Bank, the Development Bank and the Central Bank shall take into account reputational factors that may limit the Development Bank's ability not to

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 108 exercise the option, in particular markets' and clients' expectations that the Development Bank should extend the maturity of certain assets at their maturity date. (4) For amortising loans with a residual contractual maturity of one year or more, any portion that matures in less than six months and any portion that matures between six months and less than one year shall be treated as having a residual maturity of less than six months and between six months and less than one year, respectively. 0% required stable funding factor Article 161 (1) The following assets shall be subject to a 0% required stable funding factor:

unencumbered assets that are eligible as level 1 high-quality liquid assets;
all reserves held by the Development Bank in the Central Bank, the ECB or in the central bank of an EU Member State or the central bank of a third country, including reserve requirement and excess reserves;
all claims on the Central Bank, the ECB, the central bank of an EU Member State or the central bank of a third country that have a residual maturity of less than six months;
trade date receivables arising from sales of financial instruments, non-EUR currencies or commodities that are expected to settle within the standard settlement cycle or period that is customary for the relevant exchange or type of transaction, or that have failed to settle but are nonetheless expected to settle;
assets that are categorised as being interdependent with liabilities in accordance with Article 151 of this Decision;
monies due from securities financing transactions with financial customers, where those transactions have a residual maturity of less than six months, where those monies due are collateralised by assets that qualify as level 1 assets, excluding extremely high-quality covered bonds, and where the Development Bank would be legally entitled and operationally able to reuse those assets for the duration of the transaction. (2) For subsidiary undertakings with a head office in a third country, where the required central bank reserves are subject to a higher required stable funding factor under the net stable funding requirement set out in the national law of that third country, that higher required stable funding factor shall be taken into account for consolidation purposes. 5% required stable funding factor Article 162 The following assets and off-balance-sheet items shall be subject to a 5% required stable funding factor:
monies due from securities financing transactions with financial customers, where those transactions have a residual maturity of less than six months, other than those referred to in Article 161 paragraph (1) item 6) of this Decision;
the undrawn portion of committed credit and liquidity facilities pursuant to this Decision;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 109 3) trade finance off-balance-sheet related products with a residual maturity of less than six months. 7.5% required stable funding factor Article 163 Trade finance off-balance-sheet related products with a residual maturity of at least six months but less than one year shall be subject to a 7.5% required stable funding factor. 10% required stable funding factor Article 164

The following assets and off-balance-sheet items shall be subject to a 10% required stable funding factor:
monies due from transactions with financial customers that have a residual maturity of less than six months other than those referred to in Article 161 paragraph (1) item 6) and Article 162 paragraph (1) item 2) of this Decision;
trade finance on-balance-sheet related products with a residual maturity of less than six months;
trade finance on-balance-sheet related products, with a residual maturity of one year or more; 15% required stable funding factor Article 165 (1) Unencumbered assets that are eligible as level 2A assets pursuant to this Decision shall be subject to a 15% required stable funding factor, regardless of whether they comply with the operational requirements and with the requirements on the composition of the liquidity buffer. 50% required stable funding factor Article 167 The following assets shall be subject to a 50% required stable funding factor:
monies due from transactions with a residual maturity of less than one year with: − the Government of Montenegro, government of an EU Member State or of a third country; − regional or local self-governments in Montenegro, in an EU Member State or in a third country; − public sector entities in Montenegro, in an EU Member State or in a third country; − multilateral development banks and international organisations which are assigned 0% risk weight in accordance with the Decision on Capital Adequacy of the Development Bank;
non-financial corporates, retail customers and SMEs;monies due from transactions with a residual maturity of at least six months but less than one year with: − the Central Bank, the European Central Bank or the central bank of an EU Member State;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 110 − the central bank of a third country; − financial customers; 3) trade finance on-balance-sheet related products with a residual maturity of at least six months but less than one year; 4) assets encumbered for a residual maturity of at least six months but less than one year, except where those assets would be assigned a higher required stable funding factor in accordance with Articles 167 and168 of this Decision if they were held unencumbered, in which case the higher required stable funding factor that would apply to those assets if they were held unencumbered shall apply; 5) any other assets with a residual maturity of less than one year, unless otherwise specified in Articles 161 to 165 of this Decision. 85% required stable funding factor Article 167

The following assets and off-balance-sheet items shall be subject to an 85% required stable funding factor:
any assets and off-balance-sheet items, including cash, posted as initial margin for derivative contracts, unless those assets would be assigned a higher required stable funding factor in accordance with Article 169 of this Decision if held unencumbered, in which case the higher required stable funding factor that would apply to those assets if they were held unencumbered shall apply;
any assets and off-balance-sheet items, including cash, posted as contribution to the default fund of a central counterparty, unless those would be assigned a higher required stable funding factor in accordance with Article 168 of this Decision if held unencumbered, in which case the higher required stable funding factor to be applied to the unencumbered asset shall apply;
unencumbered loans with a residual maturity of one year or more, excluding loans to financial customers and loans referred to in Articles 161 to 166 of this Decision, which are not past due for more than 90 days and which are assigned a risk weight of more than 20% in accordance with the Decision on Capital Adequacy of the Development Bank;
trade finance on-balance-sheet related products, with a residual maturity of one year or more;
unencumbered securities with a residual maturity of one year or more that are not in default and that are not eligible as liquid assets pursuant to the provisions of this Decision;
physically traded commodities, including gold but excluding commodity derivatives; 100% required stable funding factor Article 168 (1) The following assets shall be subject to a 100% required stable funding factor:
any assets encumbered for a residual maturity of one year or more;
any assets other than those referred to in Articles 161 to 167 of this Decision, including loans to financial customers having a residual contractual maturity of one year or more, non-performing exposures, items deducted from own funds,

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 111 fixed assets, non-exchange-traded equities, retained participation, insurance assets, defaulted securities. IX MANAGEMENT OF THE RISK OF EXCESSIVE LEVERAGE Leverage ratio Article 169 (1) In accordance with Article 23 paragraph (2) of the Law, the leverage shall be, with respect to the own funds of the Development Bank, the relative size of assets, off-balance sheet obligations and contingent obligations of the Development Bank to pay or to deliver or to provide collateral, including obligations from received sources of funding, commitments, derivatives or repurchase agreements. (2) With a view to managing the risk of excessive leverage, the Development Bank shall prescribe in its acts minimum leverage ratio calculated in accordance with the methodology referred to in paragraphs (3) to (6) of this Article. (3) Leverage ratio shall be calculated as the ratio between the Tier 1 capital of the Development Bank and total exposure measure of the Development Bank, expressed in percentages. (4) The total exposure measure of the Development Bank, for the purpose of paragraph (3) of this Article, shall be the sum of the following items:

asset items calculated in line with Article 171 paragraph (1) of this Decision, excluding: − derivative contracts referred to in Article 2 item 46) of this Decision; − credit derivatives; and − positions referred to in Article 176 of this Decision;
derivative contracts referred to in Article 2 item 46) of this Decision and credit derivatives, including contracts and credit derivatives recorded off-balance, calculated in line with Article 172 of this Decision;
add-ons for counterparty credit risk based on securities financing transactions, including those that are recorded in off-balance sheet, calculated in accordance with Article 176 of this Decision;
off-balance sheet items, calculated in line with Article 177 of this Decision, excluding: − derivative contracts referred to in Article 2 item 46) of this Decision; − credit derivatives; − securities financing transactions (SFT); and − positions referred to in Article 178 of this Decision;
regular-way purchases and sales awaiting settlement, calculated in line with Article 178 of this Decision. (5) The Development Bank shall treat long settlement transactions in accordance with paragraph (4) items 1) to 4) of this Article, as applicable.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 112 (6) For the purposes of paragraph (4) item 5) of this Article and Article 178 of this Decision, the regular-way purchase or sale means a purchase or a sale of a security under contracts for which the terms require delivery of the security within the period established generally by law or convention in the marketplace concerned. (7) Unless otherwise expressly provided for in this part of the Decision, the Development Bank shall calculate the total exposure measure in accordance with the following principles:

physical or financial collateral, guarantees and other sureties or credit risk mitigation purchased shall not be used to reduce the total exposure measure; and
assets shall not be netted with liabilities. Exposures excluded from the total exposure Article 170 (1) By way of derogation from Article 169 paragraphs (4) and (5) of this Decision, the Development Bank may exclude any of the following exposures from its total exposure measure:
the exposure measures deducted from Common Equity Tier 1 items;
the amount of assets deducted from Tier 1 capital;
exposures that are assigned a risk weight of 0 % in accordance with the Decision on Capital Adequacy of the Development Bank;
the exposures arising from assets that constitute claims on the Government of Montenegro, local self-governments or public sector entities in relation to public sector investments and promotional loans;
the guaranteed parts of exposures arising from export credits that meet both of the following conditions: − the guarantee is provided by an eligible provider of unfunded credit protection, including by export credit agencies or by central governments; and − a 0 % risk weight applies to the guaranteed part of the exposure in accordance with the Decision on Capital Adequacy of the Development Bank;
fiduciary assets which meet all the following conditions: − they are recognised on the Development Bank's balance sheet according to applicable regulation; − they meet the criteria for derecognition set out in IFRS 9, as applied in accordance with regulations; − they meet the criteria for non-consolidation set out in IFRS 10, where applicable;
exposures that meet all the following conditions: − they are exposures to a public sector entity; − they arise from deposits that the Development Bank is legally obliged to transfer to the public sector entity referred to in item 1) of this paragraph for the purpose of funding general interest investments;
the excess collateral deposited at tri-party agents that has not been lent out;
the variation margin which the Development Bank has paid in cash to its counterparty, where such amount, under the applicable accounting framework is

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 113 recognised as a receivable asset, provided that the conditions set out in Article 172 paragraph (4) items 1) to 5) of this Decision are met; 10) exposure to the Central Bank in the form of assets which represents coins and banknotes in EUR currency and claims on the Central Bank, including reserves held at the Central Bank, after the exemption fulfilled the conditions set out in paragraphs (3) and (4) of this Article. (2) For the purposes of paragraph (1) item 4) of this Article, the promotional loan means a loan granted by the Development Bank or an entity set up by the Government of Montenegro or a local self-government, directly or through the Development Bank on a non-competitive, not-for-profit basis, in order to promote the public policy objectives of the Government of Montenegro or a local self-government. (3) The Development Bank may exclude the exposures listed in paragraph (1) item 10) of this Article where the following conditions are met:

the Central Bank has determined and publicly declared that exceptional circumstances exist that warrant the exclusion in order to facilitate the implementation of monetary policies; and
the exemption is granted for a limited period of time not exceeding one year. (4) The exposures to be excluded under paragraph (1) item 10) of this Article shall meet the following conditions:
they are denominated in the same currency as the deposits deposited with the Development Bank; and
their average maturity does not significantly exceed the average maturity of the deposits deposited with the Development Bank. Calculation of the exposure value of assets Article 171 (1) The Development Bank shall calculate the exposure value of assets, excluding derivative contracts referred to in Article 2 item 46) of this Decision, credit derivatives, and positions referred to in Article 176 of this Decision in accordance with the following principles:
the exposure value of assets means an exposure value in accordance with the Decision on Capital Adequacy of the Development Bank;
securities financing transactions shall not be netted. (2) By way of derogation from paragraph (1) item 2) of this Article, the Development Bank may calculate the exposure value of cash receivables and cash payables under securities financing transactions with the same counterparty on a net basis only if the following conditions have been met:
the transactions have the same explicit final settlement date;
the right of the Development Bank to set off the amount owed to the counterparty with the amount owed by the counterparty is legally enforceable in the normal course of business; and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 114 3) the counterparties intend to settle on a net basis or to settle simultaneously, or the transactions are subject to a settlement mechanism that results in the functional equivalent of net settlement. (3) For the purposes of paragraph (2) item 3) of this Article, the Development Bank may consider that a settlement mechanism results in the functional equivalent of net settlement only where, on the settlement date, the net result of the cash flows of the transactions under that mechanism is equal to the single net amount under net settlement and the following conditions are met:

the transactions are settled through the same settlement system or settlement systems using a common settlement infrastructure; and
the settlement arrangements are supported by cash or intraday credit facilities intended to ensure that the settlement of the transactions will occur by the end of the business day;
any issues arising from the securities legs of the securities financing transactions do not interfere with the completion of the net settlement of the cash receivables and payables. (4) The condition set out in paragraph (3) item 3) of this Article shall be met only where the failure of any securities financing transaction in the settlement mechanism may delay settlement of only the matching cash leg or may create an obligation to the settlement mechanism, supported by an associated credit facility. (5) Where there is a failure of the securities leg of a securities financing transaction in the settlement mechanism at the end of the window for settlement in the settlement mechanism, the Development Bank shall split out this transaction and its matching cash leg from the netting set and treat them on a gross basis. Calculation of the exposure value of derivatives Article 172 (1) the Development Bank shall calculate the exposure value of derivative contracts listed in Article 2 item 46) of this Decision, and of credit derivatives, on- and off-balance-sheet, as follows: 𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸 𝑣𝑣𝑣𝑣𝑣𝑣 = 𝛼𝛼 · (𝑅𝑅𝑅𝑅 + 𝑃𝑃 ) where: 𝑅𝑅𝑅𝑅 = the replacement cost as calculated in accordance with Article 173 of this Decision; and 𝑃𝑃 = the potential future exposure as calculated in accordance with Article 175 of this Decision; 𝛼𝛼 = 1.4. (2) The Development Bank shall include in the total exposure measure sold options even where their exposure value can be set to zero.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 115 (3) Where the provision of collateral related to derivative contracts reduces the amount of assets under the accounting framework, the Development Bank shall reverse that reduction. (4) For the purposes of paragraphs (1) and (2) of this Article, the Development Bank calculating the replacement cost of derivative contracts in accordance with Article 173 of this Decision may recognise only the collateral received in cash from its counterparties as the variable (variation) margin referred to in Article 173 of this Decision, where the accounting framework has not already recognised the variation margin as a reduction of the exposure value and where the following conditions are met:

for trades not cleared through a qualifying central counterparty, the cash received by the recipient counterparty is not segregated from the assets of the Development Bank;
the variation margin is calculated and exchanged at least daily based on a markto-market valuation of derivatives positions;
the variation margin received is in a currency specified in the derivative contract, governing master netting agreement, credit support annex to the qualifying master netting agreement or as defined by any netting agreement with a qualifying central counterparty;
the variation margin received is the full amount that would be necessary to extinguish the mark-to-market exposure of the derivative contract subject to the threshold and minimum transfer amounts that are applicable to the counterparty; and
the derivative contract and the variation margin between the Development Bank and the counterparty to that contract are covered by a single netting agreement that the Development Bank may treat as risk-mitigating. (5) Where the Development Bank provides cash collateral to a counterparty and that collateral meets the conditions set out in paragraph (4) items 1) to 5) of this Article, the Development Bank shall consider that collateral as the variation margin posted with the counterparty and shall include it in the calculation of the replacement cost. (6) For the purposes of paragraph (4) item 2) of this Article, the Development Bank shall be considered to have met the condition set out therein where the variation margin is exchanged on the morning of the trading day following the trading day on which the derivative contract was stipulated, provided that the exchange is based on the value of the contract at the end of the trading day on which the contract was stipulated. (7) For the purposes of paragraph (4) item 4) of this Article, where a margin dispute arises, the Development Bank may recognise the amount of non-disputed collateral that has been exchanged.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 116 Replacement cost Article 173 (1) The Development Bank shall calculate the replacement cost (RC) for netting sets that are not subject to a margin agreement, in accordance with the following formula: 𝑅𝑅𝑅𝑅 = 𝑚𝑚 { 𝐶𝐶𝐶𝐶 − 𝑁𝑁𝑁𝑁 𝑁𝑁, 0} (2) The Development Bank shall calculate the replacement cost for a single netting set that is subject to a margin agreement in accordance with the following formula: 𝑅𝑅𝑅𝑅 = 𝑚𝑚 { 𝐶𝐶𝐶𝐶 – – 𝑁𝑁𝑁𝑁 𝑁𝑁, 𝑇𝑇𝑇𝑇 + – 𝑁𝑁𝑁𝑁 𝑁𝑁, 0} where: 𝑅𝑅𝑅𝑅 = the replacement cost; = the volatility-adjusted value of the net variation margin received or posted, as applicable, to the netting set on a regular basis to mitigate changes in the netting set's CMV; 𝑇𝑇𝑇𝑇 = the margin threshold applicable to the netting set under the margin agreement below which the Development Bank cannot call for collateral; and = the minimum transfer amount applicable to the netting set under the margin agreement. (3) The Development Bank shall calculate the replacement cost for multiple netting sets that are subject to the same margin agreement in accordance with the following formula: 𝑅𝑅𝑅𝑅 = 𝑚𝑚 ��max{ 𝐶𝐶𝐶𝐶𝑖𝑖 , 0} − 𝑚𝑚 { 𝑀𝑀𝑀𝑀 + 𝑁𝑁𝑁𝑁 𝑁𝑁𝑀𝑀𝑀𝑀, 0}, 0 𝑖𝑖 � + 𝑚𝑚 ��𝑚𝑚 𝑚𝑚{ 𝐶𝐶𝐶𝐶𝑖𝑖, 0} − 𝑚𝑚 𝑚𝑚{ 𝑀𝑀𝑀𝑀 + 𝑁𝑁𝑁𝑁 𝑁𝑁𝑀𝑀𝑀𝑀, 0}, 0 𝑖𝑖 � where: 𝑅𝑅𝑅𝑅 = the replacement cost; = the index that denotes the netting sets that are subject to the single margin agreement 𝐶𝐶 𝑖𝑖 = the CMV of netting set i; 𝑀𝑀𝑀𝑀 = the sum of the volatility-adjusted value of collateral received or posted, as applicable, to multiple netting sets on a regular basis to mitigate changes in their CMV; and 𝑁𝑁𝑁𝑁 𝑀𝑀𝑀𝑀 = the sum of the volatility-adjusted value of collateral received or posted, as applicable, to multiple netting sets other than VMMA.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 117 (4) For the purposes of the paragraph (3) of this Article, NICAMA may be calculated at trade level, at netting set level or at the level of all the netting sets to which the margin agreement applies depending on the level at which the margin agreement applies. (5) The Development Bank shall calculate the collateral amounts of VM, VMMA, NICA and NICAMA, by applying the following requirements:

where all the transactions included in a netting set belong to the trading book, only collateral that is eligible under the Decision on Capital Adequacy of the Development Bank shall be recognised;
where a netting set contains at least one transaction that belongs to the nontrading book, only collateral that is eligible under the Decision on Capital Adequacy of the Development Bank shall be recognised;
collateral received from a counterparty shall be recognised with a positive sign and collateral posted to a counterparty shall be recognised with a negative sign;
the volatility-adjusted value of any type of collateral received or posted;
the same collateral item shall not be included in both VM and NICA at the same time;
the same collateral item shall not be included in both VMMA and NICAMA at the same time;
any collateral posted to the counterparty that is segregated from the assets of that counterparty and, as a result of that segregation, is bankruptcy remote in the event of the default or insolvency of that counterparty shall not be recognised in the calculation of NICA and NICAMA. (6) For netting sets that are not referred to in paragraphs (1) to (4) of this Article, the Development Bank shall calculate the replacement cost in accordance with the following formula: 𝑅𝑅𝑅𝑅 = 𝑚𝑚 { 𝐶𝐶𝐶𝐶, 0} where: RC = the replacement cost; and CMV = the current market value. (7) By way of derogation from paragraph (6) of this Article, for netting sets of transactions that are traded on a recognised exchange, and that are centrally cleared by a qualifying central counterparty, or for which collateral is exchanged bilaterally with the counterparty, the Development Bank shall calculate the replacement cost in accordance with the following formula: 𝑅𝑅 = 𝑇𝑇𝑇𝑇 + where: RC = the replacement cost;

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 118 TH = the margin threshold applicable to the netting set under the margin agreement below which the Development Bank cannot call for collateral; and MTA = the minimum transfer amount applicable to the netting set under the margin agreement. (8) By way of derogation from paragraph (7) of this Article, for multiple netting sets that are subject to a margin agreement, the Development Bank shall calculate the replacement cost as the sum of the replacement cost of each individual netting set, calculated in accordance with paragraph (6) of this Article as if they were not margined; and the value of multiplier in the formula that is used to calculate the potential future exposure shall be set to 1, as follows: 𝑃𝑃 = � 𝐴𝐴𝐴𝐴𝐴𝐴 (𝑎𝑎) 𝑎𝑎 Where: PFE = the potential future exposure; and AddOn(a) = the add-on for risk category “a”, as specified in Article 174 of this Decision; Add-on for risk category “a” Article 174 (1) The Development Bank shall calculate the credit risk category add-on as follows: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶 = �| 𝐴𝐴𝐴𝐴𝐴𝐴 ( 𝐸𝐸𝑘𝑘)| 𝑘𝑘 where: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶 = the credit risk category add-on for hedging set j; and AddOn(Entityk) = the add-on for the credit entity k. (2) The Development Bank shall calculate the equity risk category add-on for hedging set j as follows: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐸𝐸𝐸𝐸 𝐸𝐸 = �| 𝐴𝐴𝐴𝐴𝐴𝐴 ( 𝐸𝐸𝑘𝑘)| 𝑘𝑘 where: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐸𝐸𝐸𝐸 𝐸𝐸 = the equity risk category add-on for hedging set j; and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 119 AddOn(Entityk) = the add-on for the credit reference entity k. (3) The Development Bank shall calculate the commodity risk category add-on for hedging set j as follows: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐶𝐶𝐶𝐶𝐶𝐶 = �� 𝐴𝐴𝐴𝐴𝐴𝐴 (𝑇𝑇 𝐾𝐾 𝑗𝑗 )� 𝑘𝑘 where: 𝐴𝐴𝐴𝐴𝐴𝐴 𝑗𝑗 𝐶𝐶𝐶𝐶𝐶𝐶 = the commodity risk category add-on for hedging set j; and 𝐴𝐴𝐴𝐴𝐴𝐴 (𝑇𝑇 𝑘𝑘 𝑗𝑗 ) = the add-on for the commodity reference type k. Potential future exposure Article 175 (1) The Development Bank shall calculate the potential future exposure of a netting set as follows: 𝑃𝑃 = 𝑚𝑚 ∙ � 𝐴𝐴𝐴𝐴𝐴𝐴 (𝑎𝑎) 𝑎𝑎 where: 𝑃𝑃 = the potential future exposure; = the index that denotes the risk categories included in the calculation of the potential future exposure of the netting set; 𝐴𝐴𝐴𝐴 (𝑎𝑎) = the add-on for risk category “a” calculated in accordance with Article 174 of this Decision, as applicable; and 𝑚𝑚 = the multiplication factor calculated in accordance with the formula referred to in paragraph (3) of this Article. (2) For the purpose of calculation referred to in paragraph (1) Article, the Development Bank shall include the add-on of a given risk category in the calculation of the potential future exposure of a netting set where at least one transaction of the netting set has been mapped to that risk category. (3) The potential future exposure of multiple netting sets that are subject to one margin agreement, as referred in Article 173 paragraph (3) of this Decision, shall be calculated as the sum of the potential future exposures of all the individual netting sets as if they were not subject to any form of a margin agreement.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 120 (4) For the purposes of paragraph (1) of this Article, the multiplier shall be calculated as follows: 𝑚𝑚 = � 1 𝑖𝑖 𝑧𝑧 ≥ 0 min �1, + (1 − ) ∙ � 𝑧𝑧 �� 𝑖𝑖 𝑧𝑧 < 0 where: = 5%; = 2 ∙ (1 − ) ∙ � 𝐴𝐴𝐴𝐴𝐴𝐴 (𝑎𝑎) 𝑎𝑎 𝑧𝑧 = � CMV − NICA for netting sets referred to in Article 173 paragraph (1)of this Decision CMV − VM − NICA for netting sets referred to in Article 173 paragraph (2)of this Decision CMVi − NICAi for netting sets referred to in Article 173 paragraph (3)of this Decision 𝑁𝑁𝑁𝑁 𝑖𝑖 = the net independent collateral amount calculated only for transactions that are included in netting set “i”. NICAi shall be calculated at trade level or at netting set level depending on the margin agreement. Counterparty credit risk add-on for securities financing transactions Article 176 (1) In addition to the calculation of the exposure value of securities financing transactions (SFT), including those that are off-balance-sheet in accordance with Article 171 paragraph (1) of this Article, the Development Bank shall include in the total exposure measure an add-on for counterparty credit risk calculated in accordance with paragraphs (2) or (3) of this Article, as applicable. (2) The Development Bank shall calculate the add-on for transactions with a counterparty that are not subject to a master netting agreement on a transaction-by-transaction basis in accordance with the following formula: 𝑖𝑖 ∗ = 𝑚𝑚 {0, 𝑖𝑖 − 𝑖𝑖} where: 𝑖𝑖 ∗ = the add-on; = the index that denotes the transaction; 𝑖𝑖 = the fair value of securities or cash lent to the counterparty under transaction ; and 𝑖𝑖 = the fair value of securities or cash received from the counterparty under transaction .

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 121 (3) The Development Bank may set 𝑖𝑖 ∗ equal to zero where 𝑖𝑖 is the cash lent to a counterparty and the associated cash receivable is not eligible for the netting treatment set out in Article 171 paragraph (2) of this Decision. (4) The Development Bank shall calculate the add-on for transactions with a counterparty that are subject to a master netting agreement on an agreement-by-agreement basis in accordance with the following formula: 𝑖𝑖 ∗ = 𝑚𝑚 �0,� 𝑖𝑖 𝑖𝑖 − � 𝑖𝑖 𝑖𝑖 � where 𝑖𝑖 ∗ = the add-on; = the index that denotes the netting agreement; 𝑖𝑖 = the fair value of securities or cash lent to the counterparty for the transactions that are subject to master netting agreement ; and 𝑖𝑖 = the fair value of securities or cash received from the counterparty that is subject to master netting agreement . (5) For the purposes of paragraphs (3) and (4) of this Article, the term counterparty includes also tri-party agents that receive collateral in deposit and manage the collateral in the case of tri-party transactions. (6) Where sale accounting is achieved for a repurchase transaction under the accounting framework, the Development Bank shall reverse all sales-related accounting entries. (7) Where the Development Bank acts as an agent between two parties in a securities financing transaction, including an off-balance-sheet transaction, the following provisions shall apply to the calculation of the Development Bank's total exposure measure:

where the Development Bank provides an indemnity or guarantee to one of the parties in the securities financing transaction and the indemnity or guarantee is limited to any difference between the value of the security or cash the party has lent and the value of collateral the borrower has provided, the Development Bank shall only include the add-on calculated in accordance with paragraph (2) or (3) of this Article, as applicable, in the total exposure measure;
where the Development Bank does not provide an indemnity or guarantee to any of the involved parties, the transaction shall not be included in the total exposure measure;
where the Development Bank is economically exposed to the underlying security or the cash in the transaction to an amount greater than the exposure covered by the add-on, it shall include in the total exposure measure also the full amount of the security or the cash to which it is exposed;
where the Development Bank acting as agent provides an indemnity or guarantee to both parties involved in a securities financing transaction, the Development

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 122 Bank shall calculate its total exposure measure in accordance with items 1), 2) and 3) of this paragraph separately for each party involved in the transaction. Calculation of the exposure value of off-balance-sheet items Article 177 (1) The Development Bank shall calculate the exposure value of off-balance-sheet items, excluding derivative contracts, credit derivatives and securities financing transactions. (2) By way of derogation from paragraph (1) of this Article, the Development Bank may reduce the credit exposure equivalent amount of an off-balance-sheet item by the corresponding amount of specific credit risk adjustments, whereat the calculation shall be subject to a floor of zero. (3) By way of derogation from paragraph (1) of this Article, the Development Bank shall apply a conversion factor of 10% to low-risk off-balance-sheet items which is assigned 0% factor in accordance with the Decision on Capital Adequacy of the Development Bank. Calculation of the exposure value of regular-way purchases and sales awaiting settlement Article 178 (1) The Development Bank shall treat cash related to regular-way sales and securities related to regular-way purchases which remain on the balance sheet until the settlement date as assets in accordance with Article 169 paragraph (4) item 1) of this Decision. (2) Where the Development Bank, in accordance with the applicable accounting framework, applies trade date accounting to regular-way purchases and sales which are awaiting settlement, it shall reverse out any offsetting between cash receivables for regular-way sales awaiting settlement and cash payables for regular-way purchase awaiting settlement allowed under that framework, and after the Development Bank has reversed out the accounting offsetting, it may offset between those cash receivables and cash payables where both the related regular-way sales and purchases are settled on a delivery-versus-payment basis. (3) Where the Development Bank, in accordance with the applicable accounting framework, applies settlement date accounting to regular-way purchases and sales which are awaiting settlement, it shall include in the total exposure measure the full nominal value of commitments to pay related to regular-way purchases. (4) The Development Bank may offset the full nominal value of the commitments to pay related to regular-way purchases by the full nominal value of cash receivables related to regular-way sales awaiting settlement only where both of the following conditions are met:

both the regular-way purchases and sales are settled on a delivery-versuspayment basis; and

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 123 2) the financial assets bought and sold that are associated with cash payables and receivables are fair valued through profit and loss and included in the Development Bank's trading book. X REPORTING AND NOTIFICATION Reporting to the Central Bank Article 179 (1) Reporting to the Central Bank on daily and ten-day liquidity indicators, liquidity coverage ratio and stable funding shall be done in the manner and within the deadlines set out in a separate Central Bank decision governing the reporting to the Central Bank by the Development Bank. (2) The Development Bank shall, as at the date set out in the decision referred to in paragraph (1) of this Article, submit additional reports on the liquidity coverage requirement and the stable funding ratio where items are denominated in a currency other than the reporting currency and the Development Bank has aggregate liabilities denominated in such a currency which amount to or exceed 5% of the Development Bank's or the single liquidity sub-group's total liabilities, excluding own funds and offbalance-sheet items, reporting shall be done in the currency of denomination. (3) Where items are denominated in the reporting currency, and the total liabilities in currencies other than the reporting currency amount to or exceed 5% of the Development Bank's or the single liquidity sub-group's total liabilities, excluding own funds and offbalance-sheet items, the Development Bank shall not submit additional reports in other currencies. (4) In the event of shortfall in liquidity, the Development Bank shall immediately notify the Central Bank of the amount of lacking liquid assets, reasons for liquidity shortfall and planned activities to overcome illiquidity. Public disclosure Article 180 The Development Bank shall establish mechanisms that ensure an adequate level of public disclosure of information on the organisation and financial position of the Development Bank, in particular in situations where negative information about the Development Bank appears in public. XI TRANSITIONAL AND FINAL PROVISIONS Notification on outsourcing arrangements Article 181 (1) The Development Bank shall, no later than six months following the day of entry into force of this Decision, notify the Central Bank on the outsourcing of critical or important functions carried out before the entry into force of this Decision.

[unofficial translation]

Decision on Minimum Standards for Risk Management in the Development Bank of Montenegro (OGM 94/25) 124 (2) The notification referred to in paragraph (1) of this Article shall contain data from the registry referred to in Article 108 of this Decision. Deferred application Article 182 Provisions of Articles 30 to 51 and Article 57 paragraph (1) items 3), 4) and 5) of this Decision shall apply as of 1 January 2027. Repealed regulation Article 183 As of the commencement date of application of this Decision, the Decision on Minimum Standards for Risk Management in the Investment and Development Fund of Montenegro (OGM 79/18) shall be repealed. Entry into force Article 184 This Decision shall enter into force on the eighth day following that of its publication in the “Official Gazette of Montenegro”. THE COUNCIL OF THE CENTRAL BANK OF MONTENEGRO CHAIRPERSON Decision number: 0101-5891-6/2025 G O V E R N O R, Podgorica, 25 July 2025 Irena Radović m.p.