Exchange Companies Rating Methodology

VIS Credit Rating Company Limited vis.com.pk 1 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 EXCHANGE COMPANIES RATING METHODOLOGY VIS Credit Rating Company Limited

VIS Credit Rating Company Limited vis.com.pk 2 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 Table of Contents SCOPE OF CRITERIA..........................................................................................................................................................................3 SUMMARY OF CRITERIA CHANGES ..........................................................................................................................................3 AN OVERVIEW OF RATINGS FRAMEWORK ..........................................................................................................................3 RATING METHODOLOGY...............................................................................................................................................................4 A. BUSINESS RISK ASSESSMENT..............................................................................................................................................4 B. FINANCIAL RISK ASSESSMENT...........................................................................................................................................6 RATING SUPPORT FACTORS.........................................................................................................................................................7 THE RATING SCALE ...........................................................................................................................................................................8

VIS Credit Rating Company Limited vis.com.pk 3 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 SCOPE OF CRITERIA The updated Exchange Companies Rating Methodology provides a structured framework for assessing the financial and business risk profiles of exchange companies in Pakistan as defined under the State Bank of Pakistan (SBP) Regulatory Framework for Exchange Companies effective January 2025. SUMMARY OF CRITERIA CHANGES The Currency Exchange Companies Rating Methodology (October 2023) has been revised to align with the new Regulatory Framework for Exchange Companies effective January 2025. Key updates reflect the strengthened regulatory environment, including higher capitalization requirements, regulatory reserves, exposure and spread limits, and enhanced governance and compliance standards introduced by SBP. In addition, the methodology expands upon on operational risk factors such as compliance, internal controls, IT infrastructure, settlement efficiency, and resilience under stress scenarios. These changes ensure that the rating methodology remains consistent with the evolving regulatory landscape while providing a more comprehensive evaluation of exchange companies. AN OVERVIEW OF RATINGS FRAMEWORK VIS rating framework has two broad components: (A) Business Risk and (B) Financial Risk, with several sub-factors. Each area is assessed during the ratings process and the individual assessments are combined to arrive at the final rating. Weaknesses in one area may be offset by strengths in another or vice versa. While some factors such as financial ratios have clearly articulated benchmarks for each rating band, some areas require subjective assessment; this makes rating as much an art as a science. The Business Risk assessment itself is performed at two levels; first at the industry level and then at the company specific level. The industry risk assessment focuses on the operating environment, degree of cyclicality and the strength of competitive forces along with the extent of capital intensity, vulnerability to technological change and level of regulatory interference in the industry. At the company specific level, business risk analysis includes management quality assessment in terms of professional expertise in currency risk modelling, organizational structure with well-defined authorities and responsibilities, and operational risk factors focusing on strong internal control environment. The objective of this analysis is to ascertain the franchise value of the Exchange Company and the adequacy of operational systems, including KYC and AML controls, together with a review of quality of management and organizational structure. Financial Risk analysis includes an appraisal of the historic and projected financials, risk entailed by the capital structure, level of profitability and, adequacy of cash flows to meet operational requirements and debt servicing obligations. The client and currency exposure limits definition and management is very important from the rating perspective. Finally, ratings take into account the external support available to the entity and may be enhanced based on the nature of support from sponsors / shareholders, associated companies etc. and the relative credit standing of the supporting entity.

VIS Credit Rating Company Limited vis.com.pk 4 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 RATING METHODOLOGY A. BUSINESS RISK ASSESSMENT Effective January 1, 2025, SBP introduced a new Regulatory Framework for Exchange Companies to strengthen governance, compliance, and resilience in the sector. Key features include raising the minimum paid-up capital to PKR 1 billion (with phased compliance till 2027) and requiring a 15% regulatory reserve with SBP, tighter restrictions on fund withdrawals and borrowings, and a streamlined licensing process. The framework mandates robust governance, internal controls, and IT security (including local data centers and VPN use), alongside strict adherence to AML/CFT/CPF standards and consolidated reporting requirements. Overall, the framework marks a shift towards increased supervision, enhanced operational transparency, reinforcing the sector’s ability to manage risks and maintain market confidence. A. (i) Industry Risk: Industry risk in the currency exchange sector is closely tied to the external dynamics of the economy and the flow of foreign currencies into the country. Exchange Companies (ECs) depend heavily on trade activity, services exports, and most significantly, remittances, which remain the primary source of foreign exchange in Pakistan. This dependence makes the sector particularly sensitive to fluctuations in global economic conditions, oil price cycles, and labor market policies in host countries, especially in the Middle East where a majority of Pakistan’s overseas workforce is employed. A slowdown in remittance flows or adverse developments in key corridors can directly curtail the business volumes of ECs. Macroeconomic and political factors further shape industry prospects. Political instability, external account pressures, sharp currency depreciation, or restrictions on convertibility can materially affect operations. Periods of foreign currency shortages or high volatility often magnify liquidity and settlement challenges for ECs. Regulatory oversight by SBP is another defining feature of industry risk. SBP’s licensing requirements, inspections, and enforcement of AML/CFT/CPF regulations are central to sector stability. Non-compliance can attract penalties, reputational damage, or even suspension of licenses, underscoring the importance of robust governance. Business Risk Industry Risk Management & Organization Profile Operational Risk Financial Risk Profitibilty Liquidity Capitilization Standalone Credit Profile External Support (if available) Issuer Credit Rating

VIS Credit Rating Company Limited vis.com.pk 5 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 In addition, systemic risks such as interbank market disruptions, cross-border transfer restrictions, or liquidity tightening expose ECs to shocks beyond their direct control. The industry also faces structural vulnerability from its concentration in a few remittance corridors, notably the Middle East. This geographic dependence heightens exposure to policy or economic changes in host countries, making inflows and revenue streams inherently fragile. A. (ii) Management & Organization Profile: The evaluation of company-specific risk focuses on management competence, governance, and organizational strength. Leadership quality is assessed through management’s track record in foreign exchange operations, regulatory compliance, and ability to adapt to market and policy shifts. Strong governance frameworks, including independent compliance, risk management, and audit functions, along with clear organizational structures, enhance transparency and mitigate operational risks. Technology readiness is another critical factor, with emphasis on IT resilience, cybersecurity, disaster recovery planning, and capacity to support digital channels and branchless operations. Institutions with advanced digital capabilities are better positioned to manage risks and capture growth opportunities. Alignment with Environmental, Social, and Governance (ESG) principles, including responsible business practices, customer transparency, and financial inclusion, further strengthens long-term sustainability and stakeholder confidence. A. (iii) Operational Risk: Operational risk is a central consideration for exchange companies, given the high volume and transactional nature of their business. Compliance risk is particularly critical, as companies must adhere to the State Bank of Pakistan’s Exchange Company Regulations, as well as robust AML/CFT/CPF frameworks, FATF requirements, and global sanctions screening standards. Any weakness in compliance exposes companies to regulatory penalties, operational disruptions, and reputational damage. The strength of internal controls also plays a decisive role. Well-structured internal audit systems, standardized documentation processes, and proactive fraud prevention measures safeguard the integrity of operations and protect against both financial and reputational losses. Companies with weak control frameworks are more vulnerable to errors, irregularities, and compliance breaches. Market positioning further influences operational resilience. The breadth and quality of counterparty agreements for inward and outward remittances, combined with transaction speed and service quality, determine an institution’s ability to compete effectively. Firms that maintain diversified, reliable correspondent relationships and deliver efficient services are better equipped to sustain volumes and customer loyalty. Reputation and franchise value are equally important, as customer trust is a key asset in a sector subject to regulatory scrutiny. The ability to recover from penalties or adverse events without long-term damage to credibility is a marker of institutional strength. Additionally, concentration risk, arising from dependence on a limited set of counterparties, remittance sources, or currencies, can heighten vulnerability to external shocks. Institutions that diversify across corridors, partners, and products are less exposed to sudden disruptions and have greater operational stability.

VIS Credit Rating Company Limited vis.com.pk 6 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 B. FINANCIAL RISK ASSESSMENT The financial risk assessment under the revised regulatory environment is shaped by both performance benchmarks and the strengthened governance measures introduced by the SBP. VIS continues to evaluate financial ratios not only in absolute terms but also by analyzing trends over time and comparing them with peer companies. These ratios are further contextualized against business risk, as entities with stable and recurring cash flows may sustain higher financial leverage relative to those facing weaker or volatile business prospects. With the new regulatory framework enhanced requirements, trading volumes in inward and outward remittances remain a central factor, both in terms of value and scale. The framework emphasizes the timely settlement of inflows and outflows, particularly the mandatory surrender of inward home remittances in the interbank FX market, which underscores the importance of operational readiness and liquidity planning. Exposure limits have been reinforced, requiring exchange companies to cap net overbought or oversold positions at no more than 50% of their capital base at the close of each business day, in line with practices prescribed for banks. Similarly, spread management remains tightly governed, with the framework mandating that spreads on major currencies—including USD, GBP, EUR, SAR, and AED— must not exceed 1% of the buying rate, while spreads on other currencies must remain competitive. Public display of exchange rates at outlets has also been formalized to ensure transparency and consumer confidence. The introduction of higher capitalization requirements (PKR 1 billion by 2027) and a mandatory 15% regulatory reserve further enhances the sector’s financial resilience, improving companies’ ability to absorb mark-to-market losses from exchange rate volatility. In assessing market position, transaction volumes remain a key indicator of franchise strength, reflecting customer base size and competitive standing in the FX market. Monitoring changes in average transaction values also provides insights into evolving customer preferences and market trends. Currency market risk continues to be intrinsic to the sector, and counterparty exposures remain relevant, particularly in cases of interbank dealings or correspondent arrangements. However, under the new framework, exchange companies are required to adopt stronger risk management protocols, including risk limit setting, stress testing, and enhanced internal controls, which reduce vulnerability to sudden market shocks. Compliance with these regulatory safeguards is now a significant factor in ratings, as they directly impact financial stability, operational credibility, and long-term sustainability. B. (i) Profitability Profitability in exchange companies is largely driven by the ability to effectively manage spreads and generate sufficient transaction volumes. Spread control is critical, as firms must strike a balance between maintaining competitive rates to attract customers while ensuring profitability within SBP approved ranges. Given the inherently thin margins in the sector, transaction volumes play a pivotal role in sustaining earnings—higher volumes directly translate into greater revenue generation. At the same time, cost efficiency is a determining factor, with careful management of operating expenses, particularly those related to IT infrastructure, regulatory compliance, and staffing, being essential for preserving margins. Profitability is also sensitive to market volatility, as sharp fluctuations in foreign exchange (FX) rates can impact spreads and transaction flows; therefore, strong forecasting and risk management capabilities are vital to mitigate earnings volatility and ensure stable performance.

VIS Credit Rating Company Limited vis.com.pk 7 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 B. (ii) Liquidity Management Liquidity management is vital for exchange companies, ensuring timely settlement of transactions and compliance with SBP regulations, including daily position limits that cap exposures at 50% of the capital base. Efficient settlement processes are critical to maintaining confidence, while access to funding sources such as credit lines, interbank arrangements, and supplementary borrowings provides flexibility during shortfalls. Market liquidity also plays a key role, as major currencies allow smooth execution of large trades, whereas less-traded currencies pose higher risks of price impact. To remain resilient, firms must maintain strong monitoring, forecasting, and contingency planning to withstand sudden remittance declines or FX market shocks.. Access to a variety of financial instruments and counterparties can impact liquidity management. Supplementary local borrowings may be availed to manage their liquidity needs efficiently. B. (iii) Capitalization Capital adequacy, measured by the net worth relative to the business scale and regulatory requirements, serves as the foundation of financial stability, ensuring that companies can continue operations even under adverse conditions. The level of leverage is equally important, as excessive dependence on external borrowings may amplify risk during liquidity pressures or market downturns, while a balanced capital structure supports long-term sustainability. Capitalization also determines a company’s capacity to absorb foreign exchange risk, particularly mark-to-market losses that may arise from sharp exchange rate fluctuations. To measure and monitor such vulnerabilities, firms rely on risk ratios such as (i) Value at Risk (VaR): This estimates the potential loss in value of a currencies portfolio over a specified period for a given confidence interval. (ii) Currency Exposure Ratio: This ratio compares the net exposure in a foreign currency to the company's total assets. A high ratio indicates a high level of risk related to currency fluctuations. (iii) Currency Sensitivity Gap: This compares the difference between foreign currency assets and liabilities. A significant gap might expose the company to currency translation risks. A well-balanced capitalization profile helps manage financial risk. RATING SUPPORT FACTORS Entity ratings may be enhanced on the basis of the extent of support from sponsors / shareholders, associated companies, etc. VIS takes into account how important the company is to the group, the relative financial health of the group and any explicit or implicit support to the company being rated. VIS seeks to analyze the particular instances in which assistance was required by the company being rated and the degree of support provided by the sponsors in the past. Evaluation of the financial strength of the group then becomes important to give any benefit in credit ratings including its franchise value, access to funds and diversification element. In the event that a company / obligation is supported by two entities carrying independent credit risks, then the support provided is generally superior as compared to the situation in which only the stronger entity was supporting the company being rated. This concept arises from the viewpoint that the probability of both the supporting entities defaulting at the same time is lower than the probability of either one defaulting. Limited benefit of joint support is given to associated / group companies or companies in the same sector to ensure independent risk drivers. Debt instruments may be notched from entity ratings on considerations of asset protection and ranking. For details on notching, please see ‘Instrument Rating’ by VIS.

VIS Credit Rating Company Limited vis.com.pk 8 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 THE RATING SCALE Exchange Companies are rated on the Issuer/Issue Rating Scale which may be accessed at (https://docs.vis.com.pk/docs/VISRatingScales.pdf)

VIS Credit Rating Company Limited vis.com.pk 9 VIS Credit Rating Company Limited Exchange Companies AUGUST 2025 Islamic International Rating Agency – Bahrain – iira.com Credit Rating Information & Services Ltd. – Bangladesh – crislbd.com Japan Credit Rating Agency, Ltd. - Japan China Chengxin International Credit Rating Company Limited - China 128/C, 25th Lane off Khayaban-e-Ittehad, Phase VII, DHA, Karachi Tel: (92-21) 35311861-64 431, Block-Q, Commercial Area, Phase-II, D.H.A. Lahore - Cantt. Tel: (92-42) 35723411-13 www.vis.com.pk info@vis.com.pk Information herein was obtained from sources believed to be accurate and reliable; however, VIS does not guarantee the accuracy, adequacy or completeness of any information and is not responsible for any errors or omissions or for the results obtained from the use of such information. Rating is an opinion on credit quality only and is not a recommendation to buy or sell any securities. Copyright VIS Credit Rating Company Limited. All rights reserved. Contents may be used by news media with credit to VIS. DISCLAIMER VIS Credit Rating Company Ltd.