D3/2021 Reporting Requirements in Terms of Regulation 46

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D3/2021 To: All banks, branches of foreign institutions, controlling companies, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act 94 of 1990 Reporting requirements in terms of regulation 46 of the Regulations relating to Banks Executive summary Regulation 46 of the Regulations relating to Banks (Regulations) imposes certain reporting duties on the auditors of banks, controlling companies and branches of foreign institutions (hereinafter collectively referred to as ‘banks’). The purpose of this Directive is to specify detailed references to the regulatory returns that have to be audited, reviewed or concluded upon under a limited assurance framework in part fulfilment of the auditors’ respective reporting requirements in relation to regulation 46 of the Regulations.

1. Introduction 1.1 Regulation 46(1) of the Regulations requires the auditor of a bank to report annually, within 120 days of the financial year end, on the bank’s financial position and the results of its operations, as reflected in the regulatory returns specified in regulation 46(6) of the Regulations. 1.2 In addition to reporting on the quantitative aspects, the auditor is also required to report on qualitative aspects of the bank and its operations, including, but not limited to the bank’s system of internal controls. 1.3 Regulation 46(6) of the Regulations further requires that the auditor’s reports contemplated in the same regulation be rendered in accordance with the wording and practices agreed from time to time between the Prudential Authority (PA), the South African Institute of Chartered Accountants and the Independent Regulatory Board for Auditors (IRBA). 1.4 The Committee for Auditing Standards of the IRBA is mandated with the review and approval of the illustrative regulatory reports referred to in regulation 46(6) of the Regulations, in line with required due process. The latest approved versions of these illustrative regulatory reports are published on the website of the IRBA1 for use by auditors in fulfilment of the reporting requirements stipulated in this regulation.

1 https://www.irba.co.za/industry-specific-guides-and-regulatory-reports-pages/reports-to-the-prudential￾authority-and-the-exchange-control-department

2 1.5 In respect of regulatory reports pertaining to South African operations, the illustrative regulatory reports referenced above comprise Parts A to I, with Parts A to E addressing the reports required in terms of regulation 46(6) of the Regulations and structured in accordance with the type of audit, review or limited assurance engagement conducted, including the associated levels of assurance. These are:  Part A – Audit report on the year-end BA returns  Part B – Review report on the year-end BA returns  Part C – Limited assurance report on risk returns at year-end  Part D – Limited assurance report on risk returns at year-end derived from internal models  Part E – Limited assurance report on BA 325 daily market risk returns 1.6 In respect of regulatory reports pertaining to foreign operations, the illustrative regulatory reports referenced above comprise Parts A to H, with Parts A to D addressing the reports required in terms of regulation 46(6) of the Regulations and structured in accordance with the type of audit, review or limited assurance engagement conducted, including the associated levels of assurance. These are:  Part A – Audit report on the year-end BA 610 return  Part B – Review report on the year-end BA 610 return  Part C – Limited assurance report on risk lines of the BA 610 return at year￾end  Part D – Limited assurance report on risk lines of the BA 610 return at year￾end derived from internal models 1.7 To date, the aforementioned parts of the illustrative regulatory reports contained the detailed breakdown of the sections of the various regulatory returns listed in regulation 46(6) of the Regulations that were audited, reviewed or concluded upon under a limited assurance framework as part of the engagement. However, in light of the ongoing regulatory changes to align the Regulations with Basel III post-crisis reforms as well as changes required as part of ongoing regulatory reviews, the detailed references to the regulatory returns from Parts A to E and Parts A to D of the illustrative regulatory reports referred to in paragraphs 1.5 and 1.6 above have been removed in order to limit the frequency of changes to these reports. 1.8 This Directive and/or subsequent directives that replace this Directive will specify the detailed scope of audit, review or limited assurance engagement to be conducted by the auditors of banks, in line with the respective requirements specified in regulation 46(6) of the Regulations, and Parts A to E and Parts A to D respectively of subsequent illustrative regulatory reports will be updated to make reference to the prevailing Directive. 2. Directive 2.1 Auditors of banks are hereby directed to perform an audit, review or limited assurance engagement on the respective regulatory returns specified in regulation 46(6) of the Regulations, in accordance with the detailed audit matrix provided in Annexure 1 for reports submitted to the PA in relation to engagements for financial years ended on or after 28 February 2021, for the purposes of reporting in terms of Parts A to E or Parts A to D of the illustrative regulatory reports in relation to South African and foreign operations respectively.

3 2.2 The reports submitted to the PA, in relation to the above, shall be rendered in accordance with the illustrative regulatory reports published by the IRBA from time to time. 2.3 Parts A to E and Parts A to D of the respective reports submitted to the PA shall make reference to this Directive insofar as the detail of audit, review or limited assurance work performed is concerned. 3. Acknowledgement of receipt 3.1 Kindly ensure that a copy of this Directive is made available to your institution’s external auditors. The attached acknowledgement of receipt duly completed and signed by both the chief executive officer of the institution and the said auditors should be returned to the PA at the earliest convenience of the aforementioned signatories. Kuben Naidoo Deputy Governor and CEO: Prudential Authority Date: Encl. 1 The previous directive issued was Directive 2/2021 dated 11 March 2021. 12 March 2021

Page 1 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Annexure 1 South African operations Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 100 (all levels) Lines 1‒88 Lines 89‒127 BA 110 (all levels) Lines 1‒8 Lines 9‒22 BA 120 (all levels) Lines 1‒89 (excluding col 1‒3), Lines 92‒106, Lines 122‒123, Lines 126‒130 Lines 90‒91 Lines 107‒121, 124‒125 (standardised approach for credit risk, market risk, equity risk and standardised/basic indicator approach for operational risk where all entities are on these approaches) Lines 107‒121, 124‒125 (Where one or more of the following apply: internal ratings-based approach for credit risk or equity risk, or internal models approach for market risk or advanced measurement approach for operational risk for any entity)

BA 130 Whole return BA 200 ‒ Bank Line 1, 7‒9, 39, 70‒79 (standardised approaches) Line 107, 113‒115, 162‒ 171 and 211(advanced approaches) Lines 2‒6, 11‒34, 47‒69, 80‒106 (standardised approaches) Lines 276‒292 (internal ratings-based approaches) Lines 108‒112, 117‒161, 172‒206, 219‒275 and 293‒331 (internal ratings￾based approaches)

BA 200 ‒ Cons and/or Group Line 1, 7‒9, 39‒40, 70‒ 79 (standardised approaches) Line 107, 113‒115, 162‒ 171, 211 and 212 (advanced approaches) Lines 2‒6, 11‒34, 47‒69, 80‒85, 87‒102 (standardised approach), 277‒292 (internal ratings￾based approaches) Lines 108‒112, 117‒161, 172‒200, 219‒275 and 321‒324 (internal ratings￾based approaches)

Page 2 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 210 ‒ Bank Lines 1‒228 and 453‒ 471(excluding columns 6‒8) (standardised approach) and lines 229‒ 284, 453‒471 (excluding columns 6‒8) (internal ratings-based approaches) Lines 285‒452, 472‒616 (internal ratings-based approaches)

BA 210 ‒ Cons and/or Group Lines 22‒42, 118‒214 and 453‒471 (excluding columns 6‒8) (standardised approach) and lines 257‒284 and 453‒471 (excluding columns 6‒8) (internal ratings-based approaches) Lines 341‒437, 472‒616 (internal ratings-based approaches)

BA 220 Whole return BA 300 Lines 1‒17 Lines 68‒87 Lines 98‒283 (other non￾modelled) Lines 18‒67, 125, 129‒ 134, 170, 188, 190‒191 (derived from models) 196‒208, 216, 263, 267, 281‒283

BA 310 Lines 1‒9 (Column 1) Lines 1‒9 (Column 2), 10‒31

BA 320 Lines 1‒ 24 and 35‒99 (standardised approach ‒ Simplified, Delta Plus and Scenario Matrix approaches to options) Lines 25‒34 and 100‒ 110 (internal models approach)

Page 3 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 325 – Year-end Lines 7‒10 (credit risk ‒ standardised approach); lines 1‒6 and 18‒23 (market risk ‒ standardised approach); lines 11‒17 (liquidity risk ‒ other non-modelled approach); lines 36‒77 and lines 78‒81 Lines 7‒10 (credit risk internal ratings-based approaches); lines 1‒6, lines 16‒17 (liquidity risk – derived from models); lines 24‒35 (market risk internal models approach)

BA 325 – Other than year-end Lines 7‒10 (credit risk ‒ standardised approach), lines 7‒10 (credit risk – internal ratings-based approaches); lines 1‒6, 18‒23) (market risk ‒ standardised approach); lines 1‒6, 24‒35 (market risk ‒ internal models approaches); lines 11‒17 (liquidity risk – not modelled); lines 16‒17 (liquidity risk – derived from models); lines 36‒ 77 (foreign currency exposure) and lines 78‒ 81 (interbank information) BA 330 Lines 1‒22 Lines 23‒36 (net interest income and economic value of equity)

BA 340 Lines 1‒2 and 37‒46 (standardised approach) and lines (3‒5, 37‒39 and 40‒46 (internal ratings-based approaches)) Lines 6‒36 (internal ratings-based approaches)

BA 350 Whole return

Page 4 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 400 Lines 1‒10 Lines 11‒25, 27‒28 (basic indicator and standardised approaches) Lines 26‒39 (advanced measurement approach)

BA 410 ‒ All levels Whole return BA 500 Lines 1,2 and 4‒100 (standardised approach); lines 1, 3, 4‒37, 109‒126 and 127‒186 (ratings based approach); lines 1, 3, 4‒37 and 109‒126 (supervisory formula and internal assessment approaches); lines 4‒37 and 206‒217 (other unrated exposures not subject to ratings based, supervisory formula or internal assessment approaches); lines 4‒37, 218‒225 and 227‒228 (internal ratings-based approaches ‒ investors’ interest in respect of schemes with early amortisation features); and lines 4‒37 and 227‒ 228 (internal ratings￾based approaches ‒ non￾credit enhancing interest￾only strips (IOs) and principal-only strips (POs)) Lines 101‒108 (internal ratings-based approaches – ratings based, internal assessment and supervisory formula approaches), lines 127‒ 186 (internal assessment approach); lines 187‒205 (supervisory formula approach) and line 226 (internal ratings-based approaches ‒ investors’ interest in respect of schemes with early amortisation features)

Page 5 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 600 ‒ All levels Lines: 1‒39, 40‒46 (excluding column 6 to 8), 47‒58 (standardised approach for credit risk, market risk, equity risk and standardised/basic indicator approach for operational risk where all entities are on these approaches), 40‒46 (excluding column 6 to 8), 47‒58 (where one or more of the following apply: internal ratings￾based approach for credit risk or equity risk, or internal models approach for market risk or advanced measurement approach for operational risk for any entity), and lines 59‒63 (liquidity risk ‒ other non-modelled approach) Lines 1‒39 (internal ratings-based approach for credit risk or equity risk, or internal models approach for market risk or advanced measurement approach for operational risk for any entity), lines 59‒63 (liquidity risk – derived from models)

Page 6 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Return (Bank, unless otherwise stated) Part A returns Part B returns Part C returns Part D returns Part E returns BA 700 ‒ All levels Lines 27‒39 (excluding columns 2 and 3), Lines 43‒47 (excluding columns 2 and 3), Lines 49‒52 (excluding columns 2 and 3), Lines 55, 57‒59 (excluding columns 2 and 3), Lines 63 (excluding columns 2 and 3), Lines 65‒72 (excluding columns 2 and 3), Lines 79‒82 (excluding columns 2 and 3), Line 84 (limit is not triggered) (excluding columns 2 and 3), Line 197 Lines 90‒96 (excluding column 2), Lines 99‒127, Lines 131‒138, Lines 140‒195, Line 196, Lines 198‒202, Line 203 and 205 [No or simplified PVA], Line 204, Lines 206‒210 Lines: 1‒26 (standardised approach); 40‒42, 54 and 56 (excluding columns 2 and 3) (standardised approaches); 73‒78 (excluding columns 2 and 3) (standardised approaches); 84 (excluding columns 2 and 3) (limit is triggered); 86‒ 88 (excluding columns 2 and 3) (standardised approaches); Lines 89 (excluding columns 2 and 3) (standardised approaches); 97 (standardised approaches); 211‒226, 236‒269, 270‒271 (other non‒modelled approach) Lines 1‒26, 40‒42 (excluding columns 2 and 3), 48 (excluding columns 2 and 3), 53 (excluding columns 2 and 3), 54 and 56 (excluding columns 2 and 3) 60‒62 (excluding columns 2 and 3), 64 (excluding columns 2 and 3), 73‒78 (excluding columns 2 and 3), 83 (excluding columns 2 and 3), 85‒89 (excluding columns 2 and 3), 97, 128‒130, 139, 227‒235, 270‒271 (where one or more of the following apply: internal ratings￾based approach for credit risk or equity risk, or internal models approach for market risk or advanced measurement approach for operational risk for any entity or other information derived from models), Line 203 and 205 [Core PVA]

Page 7 of 7 H:\Sec3\Circulars 2021\Banks\Directives 2021\General\Annexure 1 - D3 of 2021.docx/djvr Foreign operations BA 610 Lines Part A lines Part B lines Part C lines Part D lines BA 610 Balance sheet (lines 1‒67), off balance sheet (lines 86‒93), income statement (lines 97‒154 [except columns 1‒3]) and capital adequacy (lines 177‒ 179) Balance sheet (lines 68‒85), off balance sheet (lines 94‒96), capital adequacy (lines 180‒181 [No or simplified PVA]), liquidity risk (lines 232‒236 and 248) and operational risk (lines 310‒319) Capital adequacy (lines 155‒ 163, 164 – 171 and 172‒176), credit risk (lines 182‒211, 231 [standardised approach]), liquidity risk (lines 249 – 265 [not based on models]), market risk (lines 266‒272 [columns 1‒3] [standardised approach], interest rate risk in the banking book (lines 273‒276), equity risk in the banking book (lines 277‒278 [standardised approach], 289‒ 291 [investment in funds]), equity risk in the banking book (lines 279‒281 [IRB approaches]), operational risk (lines 292‒306, 308‒309 [basic indicator and standardised approaches]) Capital adequacy (lines 172‒ 176, lines 180‒181) and credit risk (lines 198‒231) [internal ratings-based approach and/or core PVA]), liquidity risk (lines 237‒247 and 249‒265 [based on models]), Market Risk (lines 266‒272 [columns 4‒8] [internal models approaches]), equity risk in the banking book (lines 282‒ 288 [IRB approach]), operational risk (lines 307‒309 [advanced measurement approach])