Self-Assessment Report on the ZETSS/RTGS System's Observance of the Bank for International Settlements Principles for Financial Market Infrastructures (December 2021)

FINANCIAL MARKETS NATIONAL PAYMENT SYSTEMS SELF ASSESSMENT REPORT ON THE ZETSS/RTGS SYSTEM’S OBSERVANCE OF THE BANK FOR INTERNATIONAL SETTLEMENT (BIS) PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES (PFMIS) DECEMBER 2021

Page 2 of 104 Table of Contents EXECUTIVE SUMMARY.....................................................................3

1. INTRODUCTION .............................................................................4
2. OVERVIEW OF THE PAYMENT LANDSCAPE........................5
3. OBJECTIVE OF THE ASSESSMENT: .........................................7
4. SUMMARY OF PRINCIPLES ASSESSMENT ............................7
5. SUMMARY ASSESSMENT CHALLENGES AND ACHIEVEMENTS ..................................................................................8
6. RATING GUIDELINES AND RELATED ASSESSMENTS:....13
7. DETAILED ASSESSMENT...........................................................19
8. CONCLUSION ..............................................................................103 Table of Tables Table 1:Summary of Principles Assessed .............................................7 Table 2: Ratings Summary on Observance Status ..............................8 Table 3: Summary of Highlights and Challenges Per Principle.........8 Table 4:Prioritized list of recommendations......................................12 Table 5 : Rating Guideline....................................................................14 Table 6:Summary of Principles Ratings and Comments..................14 Table 7: Principles Key Considerations Questions, comments and Assessments............................................................................................19 Table of Figures Figure 1: RTGS Annual Transactions 2009-2020................................6 Figure 2: RTGS Annual Digital Transactions Proportions 2009-2020 ...................................................................................................................6

Page 3 of 104 Reserve Bank of Zimbabwe (RBZ) hereby publishes its self-assessment for 2020 settlement system against the Principles for Financial Market Infrastructures (PFMIs) formulated by CPMI/IOSCO and published in April 2012. The self-assessment was performed by the Operations Unit. An internal self-assessment against the principles has been performed previously, but this is the first self-assessment to be published. The principles are designed to broadly apply to all systemically important financial infrastructures. Ten of the 24 principles are not applicable to RTGS (nos. 4-7, 10, 11, 12, 14, 16 and 24), while the remaining 14 are considered relevant of which, thirteen principles were observed and one was broadly observed. RBZ’s conclusion is that there are principles that need long term solutions, that is gaps in the current legal framework, technological integration, stress testing and capacitating resources. The principle on access criteria and operating rules will be publicly shared on an ongoing basis. It is important that all broadly observed should be monitored as the economy is under constant evolution. Fourteen principles were said to be applicable and observed. Overall, the assessment demonstrates that the ZETSS FMI operates in line with best international standards as required by the 24 Principles. EXECUTIVE SUMMARY

Page 4 of 104

1. INTRODUCTION The self-assessment for the Zimbabwe Electronic Transfer Settlement System (ZETSS) known as Real Time Gross Settlement System (RTGS) was done by the Reserve Bank of Zimbabwe Financial Markets, National Payment Systems, Operations Unit and reviewed by the Oversight function of the Bank ZETSS operations are primarily governed by the Reserve Bank Act and the National Payment Systems (NPS) Act and other guidelines issued by the Bank. The system is owned and operated by the Central Bank and administered by Financial Markets Division, National Payment Systems Department- Settlement and Operations Section. The Oversight Section of the NPS Department oversees the operations of the FMI as guided by international best practices in particular the 24 Principles for Financial Market Infrastructures (PFMIs). Supporting statutes to the operations of The RTGS include among others the Exchange Control, Banking and Anti Money Laundering and Counter Financing of Terrorism (AML/CFT) Laws. This is the first publication of the ZETSS self￾assessment against the Bank for International Settlements’ (BIS) Principles for Financial Market Infrastructures(PFMIs) as at the end of
2. It is also the second self-assessment the Bank has completed for ZETSS. ZETSS facilitates safe, secure and real-time transmission of high value funds between accounts in different financial institutions. It was implemented in November 2002 and has undergone several upgrades to meet the ever changing payments systems requirements. The ZETSS participation is open to Banks, Building Societies, Post Office Savings Bank, the Development Bank and Microfinance Banks. Currently there are twenty-two (25) registered ZETSS participants. The settlement of domestic high value transactions and retail transaction batches is in central bank money. Each settlement participant has an account with the RBZ from which interbank settlement obligations are

Page 5 of 104 settled. Participants must provide enough funds to ensure that the settlement system functions smoothly. Settlement in ZETSS is considered final and irrevocable and is based on a pre-funded (credit push) principle. The system has improved efficiency in payment systems by mitigating settlement risk and eradicating time lag for settling high value and time critical payments. They include; clearing house positions, interbank transfers, government securities and money market transactions. Turnaround time for a transaction is instantaneous. 2. OVERVIEW OF THE PAYMENT LANDSCAPE ZETSS is the settlement system established and operated by the Reserve Bank of Zimbabwe (RBZ) for real time gross settlement of large value and time critical transactions. In addition, it has the capacity to settle batched retail transactions using the multi-lateral netting systems. Its primary objective is to provide a settlement mechanism in which both processing and final settlement of participant payment instructions in real time. The transactions are checked for funds availability and settled on a gross basis. The system is credit push based to manage credit and systemic risks. The Real Time Gross Settlement System (RTGS) as the most critical systemically important payment system for large value, time critical payments between system participants, settled transactions valued at ZWL1.6 Trillion constituting 62% of the local digital transactions in the year 2020. This was an increase 592% from prior year transactions. In terms of volumes ZETSS system handled 10.7 million transactions constituting 0.56% of the local digital transactions in the economy or an increase of 31% from prior year transactions. The growing RTGS annual transactional values and volumes are shown in the figure 1 below.

Page 6 of 104 Figure 1: RTGS Annual Transactions 2009-2020 The Large Value Payment, Clearing and Settlement Systems (Real Time Gross Settlement System (RTGS) maintained a high level of availability of 99% during the year 2020 with few network connectivity challenges experienced. 1.1. Over the years since 2009 the proportion of ZETSS transactions to overall local digital transactions have been declining. It was only during the year 2020 that the proportions of volumes and values slightly increased as shown in Figure 2 below: 1.2. Figure 2: RTGS Annual Digital Transactions Proportions 2009- 2020

2 4 6 8 10 12 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 Volumes in Millions Values Trillions Values Volume 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 0% 20% 40% 60% 80% 100% 120% 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 RTGS DIG LOCAL PROP VAL LHS RTGS DIG LOCAL PROP VOL RHS

Page 7 of 104 1.3. Other payment systems in the country include the mobile internet Cheque and cards on ATMs and Cards. In 2020 the Mobile money transaction volumes constituted 87% of the volumes and 14% of the transaction values. 1.4. 1.5. The ZETSS system settles transactions from the Centralized Securities Depositories in addition to those from other payment systems in in the country. 3. OBJECTIVE OF THE ASSESSMENT: To increase the transparency over the RBZ’s management of the RTGS, increase visibility over the governance, operations and risk management framework amongst a broad audience. The audience include payment system operators settling in RTGS, other market participants, authorities and the general public. This will also give a better understanding of the activities of the Central Bank with regards to the provision of the RTGS. The assessment measured compliance and facilitate the implementation and ongoing observance of the 24 PFMIs 4. SUMMARY OF PRINCIPLES ASSESSMENT Fourteen of the 24 principles are applicable to RTGS system while the remaining ten were considered relevant with the reasons shown in table 1 below. Table 1:Summary of Principles Assessed Principles assessed are 1-3,8,9,13, 15,17-23 (14 principles) Principles not assessed Reason 4 -6 Margin Applicable to CSDs 7, Not applicable to RTGS

Page 8 of 104 10 , 11, 12, 14, 16 Physical Securities CSD & Custody and Investment Applicable to CSDs 24- Tiered Participation Applicable to TRs The ratings range from observed being aligned to the principles to not observed being non-compliant to the BIS Principles for Financial Market Infrastructures (PFMIs). From the fourteen principles assessed thirteen were observed and one was broadly observed as shown in table 2 below. Table 2: Ratings Summary on Observance Status Assessment category Principle Observed 1-3,8-9,13,15,18-23 Broadly observed 17 Partly observed Not observed Not applicable 4-7,10 , 11, 12, 14, 16 and 24 5. SUMMARY ASSESSMENT CHALLENGES AND ACHIEVEMENTS Overall, the assessment demonstrated that the ZETSS system operates in line with best international standards as required by the 24 Principles as shown by the summary of the major highlights and few challenges noted in Table 3 below. Table 3: Summary of Highlights and Challenges Per Principle Highlights of the FMI’s key practices and achievements List identified issues of concern; Principle Clear legal basis, rules and regulations, enforceable contracts in place Review of the current legal framework which is in process.

1. Legal Basis

Page 9 of 104 Highlights of the FMI’s key practices and achievements List identified issues of concern; Principle The Operations and Oversight functions are two separate Units within NPS. Non apparent 2. Governance Arrangements Risk assessment conducted when there is a major change to the operations of the system such as system upgrades. No credit facilities are in place for participants. 3. Comprehensive Risk Management Framework Only participants with available balances on their settlement accounts are able to push transactions Not applicable 4. Credit Risk Zimswitch and Cheque payment streams which settle through RTGS have collateral mechanisms in place. Not applicable 5. Collateral Not applicable Not applicable 6.Margin Not applicable Not applicable 7. Liquidity risk Settlement is real time and settled transactions are final and irrevocable Settlement risk￾Currently, participants only access the system in real time, there is no facility for queueing 8. Settlement finality Settlement currently in ZWL and USD whilst other retail payment systems are settling using Central Bank's money in line with best practice Non apparent 9. Money settlements Not applicable Not applicable 10: Physical deliveries

Page 10 of 104 Highlights of the FMI’s key practices and achievements List identified issues of concern; Principle Not applicable Not applicable 11: Central securities depositories Not applicable Not applicable 12: Exchange￾of-value settlement systems Entry and exit criteria clearly documented for potential and existing participants There is a procedure and the Act has clauses on exit and entry requirements 13. Participant￾default rules and procedures Payments service providers such as Zimswitch and CDC provide collateral to mitigate against non-settlement of batches. Other retail payments system settle through RTGS There is a risk management framework which is reviewed periodically against risk within operations 15. General business risk Not applicable Not applicable 16: Custody and investment risks Costs related to participation on the platform are available, service level agreements in place including documented processes and procedures to mitigate operational risk. There are also internal controls that have been implemented which include segregation of duties, organisational structures, reporting, reports reviews, There should be DR tests and Two Factor Authentication. Need for annual Stress Testing and capacitation to do same. 17. Operational risk

Page 11 of 104 Highlights of the FMI’s key practices and achievements List identified issues of concern; Principle chart of authority internal and external audits. The FMI is guided by international standards in terms of communication and procedure standards. Also adheres to SWIFT financial messaging standards, Participants to be certified as SWIFT ready to enable access to system Access criteria is not publicly shared but given to potential applicants 18. Access and participation requirements FMI rules and procedures There should be guidelines in place to ensure that participants understand risks associated with tiered participation arrangements. 19. Tiered participation arrangements Other retail payments system settle through RTGS The RTGS and CSD are interfaced but are on different technological versions 20. FMI Links Costs related to participation on the platform are available, service level agreements in place Service providers failing to adhere due to economic hardships for example shortage of foreign currency 21. Efficiency and effectiveness The FMI is guided by international standards in terms of communication and procedure standards. Also adheres to SWIFT financial messaging standards, Non apparent. 22. Communication procedures and standards

Page 12 of 104 Highlights of the FMI’s key practices and achievements List identified issues of concern; Principle Participants to be certified as SWIFT ready to enable access to system FMI has rules and procedures in place There is need to include operating rules on the website 23. Disclosure of rules, key procedures, and market data The major challenges that require attention include the review of the legal framework, enabling two factor authentication, Disaster Recovery Test, and reciting the DR site away from fuel tanks, Business continuity testing on ZETSS and upgrade of the CSD system as noted in Table 4 below. Table 4:Prioritized list of recommendations Issue of concern or other gap or shortcoming Recommended action and comments Time frame for addressing recommende d action No two factor authentication(TFA); Cybersecurity risk Issue should be addressed as a matter of urgency to manage Cybersecurity risk. There should be Two Factor Authentication on ZETSS High – needs immediate remediation Gaps in the current legal framework The process of reviewing should be expedited Medium – 12 to 18 months No periodic DR tests. There should be annual DR tests Medium – 12 to 18 months The RTGS and CSD are interfaced but are on different technological versions The RTGS and CSD should be interfaced at the same level of technological versions Medium – 12 to 18 months

Page 13 of 104 Access criteria and operating rules are not publicly shared but given to potential applicants There is need to include these documents on the website. Low – can be resolved during normal course of business No Stress Testing and capacitation of staff Need for annual Stress Testing and capacitation of staff Low – can be resolved during normal course of business No guidelines are in place to ensure that participants understand risks associated with tiered participation arrangements. Operational risk There should be guidelines in place to ensure that participants understand risks associated with tiered participation arrangements. Low – can be resolved during normal course of business RTGS is the settlement system for retail payment and securities settlement systems on a deferred net settlement basis for batches from each system once per working day. Settlement risk￾Currently, participants only access the system during working day for settlement once a day. Increase settlement cycles to reduce liquidity requirements. Consider more settlement windows with options for settlement 24/7. Low – can be resolved during normal course of business 6. RATING GUIDELINES AND RELATED ASSESSMENTS: Table 5 explains the rating basis whilst table 6 below provide the summary of the ratings for each principle.

Page 14 of 104 Table 5 : Rating Guideline An aspect is considered OBSERVED (4); if any identified gaps and shortcomings are not issues of concern and are minor, manageable and of a nature that the FMI could consider taking them up in the normal course of its business. It is considered BROADLY OBSERVED (3) if the assessment has identified one or more issues of concern that the FMI should address and follow up on in a defined timeline.. It will be considered PARTLY OBSERVED (2); if the assessment has identified one or more issues of concern that could become serious if not addressed promptly. The FMI should accord a high priority to addressing these issues. . It will be considered NOT OBSERVED (1); if the FMI does not observe the principle. The assessment has identified one or more serious issues of concern that warrant immediate action. Therefore, the FMI should accord the highest priority to addressing these issues. An aspect will be considered NOT APPLICABLE (0); whenever it does not apply given the structural, legal and institutional conditions. Table 6:Summary of Principles Ratings and Comments Principle Comments Rating 1: Legal basis-An FMI should have a well-founded, clear, transparent, and enforceable legal basis for each material aspect of its activities in all relevant jurisdictions. Clear legal basis, rules and regulations, enforceable contracts in place Observed

Page 15 of 104 Principle Comments Rating 2: Governance arrangements An FMI should have governance arrangements that are clear and transparent, promote the safety and efficiency of the FMI, support the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders. The FMI's governance arrangements clearly defines responsibility and accountability levels. The board ensures that the FMI activities are monitored through the risk management measures put in place such annual audits. Observed 3: Risk-management framework: An FMI should have a sound risk￾management framework for comprehensively managing risks. Risk assessment conducted on an ongoing basis and as and when there is a major change to the operations of the system such as system upgrades. There are strong systems and measures in place to mitigate risk. Observed 4: Credit exposure; An FMI should effectively measure, monitor, and manage its credit exposures to participants and those arising from its payment, clearing, and settlement processes. Not Applicable Not Applicable 5 Collateral: An FMI that requires collateral to manage its or its participants’ credit exposure should accept collateral with low credit, liquidity, and market risks. Not Applicable Not Applicable 7: Liquidity risk An FMI should effectively measure, monitor, and manage its liquidity risk. Not Applicable Not Applicable 8: Settlement finality An FMI should provide clear and certain final settlement T+0 or T+1 Settlement is real time and settled transactions are final and irrevocable Observed 9: Money settlements An FMI should conduct its money settlements in central bank money or near central bank money Settlement is in Central Bank money. Observed

Page 16 of 104 Principle Comments Rating 10: Physical deliveries; An FMI should clearly state its obligations with respect to the delivery of physical instruments or commodities and should identify, monitor, and manage the risks associated with such physical deliveries Not applicable Not Applicable 11: Central securities depositories: A CSD should have appropriate rules and procedures to help ensure the integrity of securities issues and minimise and manage the risks associated with the safekeeping and transfer of securities. A CSD should maintain securities in an immobilised or dematerialised form for their transfer by book entry. Not applicable Not Applicable 12: Exchange-of-value settlement systems: If an FMI settles transactions that involve the settlement of two linked obligations (for example, securities or foreign exchange transactions), it should eliminate principal risk by conditioning the final settlement of one obligation upon the final settlement of the other. Not applicable Not Applicable 13 Participant-default rules and procedures; An FMI should have effective and clearly defined rules and procedures to manage a participant default. The RTGS is credit push in place to manage default before it occurs Observed

Page 17 of 104 Principle Comments Rating 15 General business risk: An FMI should identify, monitor, and manage its general business risk and hold sufficiently liquid net assets funded by equity to cover potential general business losses so that it can continue providing services as a going concern. There is a risk management framework which is reviewed periodically against risk within operations Observed 16: Custody and investment risks: An FMI should safeguard its own and its participants’ assets and minimise the risk of loss on and delay in access to these assets. An FMI’s investments should be in instruments with minimal credit, market, and liquidity risks. Not applicable Not Applicable 17: Operational risk; An FMI should identify all plausible sources of operational risk, both internal and external, and minimise their impact through the deployment of appropriate systems, controls, and procedures. Documented processes and procedures to mitigate Operational risk. There are also internal controls that have been implemented which include segregation of duties, organisational structures, reporting, reports reviews, chart of authority internal and external audits. DR tests should be done annually and Two Factor Authentication. Broadly Observed 18 Access and participation requirements: An FMI should have objective, risk-based, and publicly disclosed criteria for participation, which permit fair and open access. Entry and exit criteria clearly documented in the operating rules for potential and existing participants Observed 19: Tiered participation arrangements; An FMI should, to the extent practicable, identify, understand, and manage the material risks to it arising from tiered participation arrangements. There should be guidelines in place to ensure that participants understand risks associated with tiered participation arrangements. Observed

Page 18 of 104 Principle Comments Rating 20: FMI Links; An FMI that establishes a link with one or more FMIs should identify, monitor, and manage link-related risks. The RTGS and CSD are interfaced but are on different technological versions Observed 21 Efficiency and effectiveness: An FMI should be efficient and effective in meeting the requirements of its participants and the markets it serves Objectives and goals are defined in the operating rules. Observed 22: Communication procedures and standards; An FMI should use or accommodate the relevant internationally accepted communication procedures and standards. The FMI is guided by international standards in terms of communication and procedure standards. Also adheres to SWIFT financial messaging standards, Participants to be certified as SWIFT ready to enable access to system. Observed 23: Disclosure of rules, key procedures, and market data; An FMI should have clear and comprehensive rules and procedures and should provide sufficient information to enable participants to have an accurate understanding of the risks they incur by participating in the FMI. All relevant rules and key procedures should be publicly disclosed. The rules and procedures are disclosed to participants and not yet available to the public. Observed Overall Assessment of ZETSS Observed

Page 19 of 104 7. DETAILED ASSESSMENT Table 7 provides the list of detailed questions for each principle and related key consideration as well as comments from self-assessments and related rating for each key consideration and principle. It also provides a summary of issues of concern for each principle, related risk and timelines for resolving the noted issues of concern. The table also explains the rating basis and a summary of challenges for each principle. Table 7: Detailed Principles; Key Considerations, Questions, comments and Assessments Principle Key Consideration Questions Comments RATING Principle 1: Legal basis; An FMI should have a well-founded, clear, transparent, and enforceable legal basis for each aspect of its activities in all relevant jurisdictions. Key consideration 1: The legal basis should provide a high degree of certainty for each material aspect of an FMI’s activities in all relevant jurisdictions. Material aspects and relevant jurisdictions. (a) What are the material aspects of the FMI’s activities that The material aspects of the FMI's activities that require a Observed

Page 20 of 104 Principle Key Consideration Questions Comments RATING require a high degree of legal certainty (for example, rights and interests in financial instruments; settlement finality; netting; interoperability; immobilisation and dematerialisation of securities; arrangements for DvP, PvP or DvD; collateral arrangements (including margin arrangements); and default procedures)? high degree of legal certainty include; availability of settlement finality, netting and collateral arrangements. These are covered in the NPS Act. Legal basis for each material aspect b How does the FMI ensure that its legal basis (that is, the legal framework and the FMI’s rules, procedures and contracts) provides a high degree of legal certainty for each material aspect of the FMI’s activities in all relevant jurisdictions? The Reserve Bank of Zimbabwe (RBZ) as the system operator derives its legal authority from the NPS Act which is used in conjunction with the Banking Act and the RBZ Act. There is need to review the NPS Act in line with developments in digital payments. Observed (c) For an FMI that has a netting arrangement, how does the FMI ensure that its legal basis supports the enforceability of that arrangement? The netting arrangements are provided for in the NPS Act (Chapter 24:23) and the RTGS operating rules and procedures. Observed (d) Where settlement finality occurs in an FMI, how does the FMI ensure that its legal basis supports the finality of transactions, including those of an insolvent participant? Does the legal basis for the external settlement mechanisms the FMI uses, such as funds transfer or The issue of settlement finality is enshrined in the NPS Act , RTGS Operating Rules Observed

Page 21 of 104 Principle Key Consideration Questions Comments RATING securities transfer systems, also support this finality? Key consideration 2: An FMI should have rules, procedures, and contracts that are clear, understandable, and consistent with relevant laws and regulations. Q.1.2.1: How has the FMI demonstrated that its rules, procedures and contracts are clear and understandable? Operating Rules are distributed to all participants and signed for prior to receiving training on how to use the system. The helpdesk is also available for participants to seek clarity when the need arises. Observed Q.1.2.2: How does the FMI ensure that its rules, procedures and contracts are consistent with relevant laws and regulations (for example, through legal opinions or analyses)? Have any inconsistencies been identified and remedied? Are the FMI’s rules, procedures and contracts reviewed or assessed by external authorities or entities? The internal and external auditors together with international organisation’s such as the IMF and World Bank have made assessments to rules, procedures and contracts. Some inconsistencies have been identified and remedial action taken. Observed Q.1.2.3: Do the FMI’s rules, procedures and contracts have to be approved before coming into effect? If so, by whom and how? Draft operating rules, procedures and contracts are forwarded to the Bank's legal department and participants for their comments before approval from senior management. Observed Key consideration 3: An FMI should be able to articulate the legal basis for its activities to relevant authorities, participants, and, where relevant, participants’ customers, in a clear and understandable way.

Page 22 of 104 Principle Key Consideration Questions Comments RATING Q.1.3.1: How does the FMI articulate the legal basis for its activities to relevant authorities, participants and, where relevant, participants’ customers? The FMI uses the user group, website and email to articulate the legal basis for its activities to authorities, participants and participants' customers. Observed Key consideration 4: An FMI should have rules, procedures, and contracts that are enforceable in all relevant jurisdictions. There should be a high degree of certainty that actions taken by the FMI under such rules and procedures will not be voided, reversed, or subject to stays. Q.1.4.1: How does the FMI achieve a high level of confidence that the rules, procedures and contracts related to its operations are enforceable in all relevant jurisdictions identified in key consideration 1 (for example, through legal opinions and analyses)? Signed contracts and signed rules and procedures Observed Degree of certainty for rules and procedures Q.1.4.2: How does the FMI achieve a high degree of certainty that its rules, procedures and contracts will not be voided, reversed or subject to stays? Are there any circumstances in which an FMI’s actions under its rules, procedures or contracts could be voided, reversed or subject to stays? If so, what are those circumstances? Contracts are signed at the highest level of the organisation. Ensure that contracts are read and understood through continuous interaction. Observed

Page 23 of 104 Principle Key Consideration Questions Comments RATING Q.1.4.3: Has a court in any relevant jurisdiction ever held any of the FMI’s relevant activities or arrangements under its rules and procedures to be unenforceable? No such encounter Observed Key consideration 5: An FMI conducting business in multiple jurisdictions should identify and mitigate the risks arising from any potential conflict of laws across jurisdictions. Q.1.5.1: If the FMI is conducting business in multiple jurisdictions, how does the FMI identify and analyse any potential conflict-of-laws issues? When uncertainty exists regarding the enforceability of an FMI’s choice of law in relevant jurisdictions, has the FMI obtained an independent legal analysis of potential conflict-of-laws issues? What potential conflict-of-laws issues has the FMI identified and analysed? How has the FMI addressed any potential conflict￾of-laws issues? Not applicable Not Applicable Overall observance of Principle 1 Clear legal basis, rules and regulations, enforceable contracts in place Observed Principle 2: Governance arrangements An FMI should have governance arrangements that are clear and transparent, promote the safety and efficiency of the FMI, and support the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders.

Page 24 of 104 Principle Key Consideration Questions Comments RATING Key consideration 1: An FMI should have objectives that place a high priority on the safety and efficiency of the FMI and explicitly support financial stability and other relevant public interest considerations. Q.2.1.1: What are the FMI’s objectives, and are they clearly identified? How does the FMI assess its performance in meeting its objectives? Specified in Operating Rules and Objectives. By logging calls and complaints, recording average uptime of the system and turnaround time of resolution of queries Observed Q.2.1.2: How do the FMI’s objectives place a high priority on safety and efficiency? How do the FMI’s objectives explicitly support financial stability and other relevant public interest considerations? Observance of an operating schedule ensures efficiency. The RTGS as a high value payment system promotes efficiency stability and safety objectives. Observed Key consideration 2: An FMI should have documented governance arrangements that provide clear and direct lines of responsibility and accountability. These arrangements should be disclosed to owners, relevant authorities, participants, and, at a more general level, the public. Document specific roles and governance arrangements in place Observed Governance arrangements Q.2.2.1: What are the governance arrangements under which the FMI’s board of directors (or equivalent) and management operate? What are the lines of responsibility and accountability within the FMI? How and where are these arrangements documented? There is Board Oversight and Financial Stability Committees in place. To ensure public objectives are observed and relevant enforcement mechanism in place. Observed

Page 25 of 104 Principle Key Consideration Questions Comments RATING Q.2.2.2: For central bank￾operated systems, how do governance arrangements address any possible or perceived conflicts of interest? To what extent do governance arrangements allow for a separation of the operator and oversight functions? The Operations and Oversight functions are distinctly separated. Observed Q.2.2.3: How does the FMI provide accountability to owners, participants and other relevant stakeholders? Management is provided with relevant reports, Zimswitch and Chengetedzai Depository are provided with confirmations after settlement of their batches. Statistics are also available on the website. Observed Disclosure of governance arrangements Q.2.2.4: How are the governance arrangements disclosed to owners, relevant authorities, participants and, at a more general level, the public? The RBZ board and Management as shown on the website. Observed Key consideration 3: The roles and responsibilities of an FMI’s board of directors (or equivalent) should be clearly specified, and there should be documented procedures for its functioning, including procedures to identify, address, and manage member conflicts of interest. The board should review both its Overall performance and the performance of its individual board members regularly. Roles and responsibilities of the board. Supervision of the Bank as the operator of the RTGS payment system is carried out on a non‐statutory basis, by the Bank’s Financial Market Directorate, to the same standard applied to payment system operators recognised by the Central Bank. The Board supports this through the oversight of all risks that could impact the resilience of the Bank including payment systems.

Page 26 of 104 Principle Key Consideration Questions Comments RATING Q.2.3.1: What are the roles and responsibilities of the FMI’s board of directors (or equivalent), and are they clearly specified? There is a governance structure specific to the Bank’s management and operation of the RTGS system. The Director for Financial Markets has overall responsibility for the RTGS system. Observed Q.2.3.2: What are the board’s procedures for its functioning, including procedures to identify, address and manage member conflicts of interest? How are these procedures documented, and to whom are they disclosed? How frequently are they reviewed? Not applicable Not Applicable Q.2.3.3: Describe the board committees that have been established to facilitate the functioning of the board. What are the roles, responsibilities and composition of such committees? Not applicable Not Applicable Review of performance Q.2.3.4: What are the procedures established to review the performance of the board as a whole and the performance of the individual board members? Not applicable Not Applicable Key consideration 4: The board should contain suitable members with the appropriate skills and incentives to fulfil its multiple roles. This typically requires the inclusion of non-executive board member(s). Q.2.4.1: To what extent does the FMI’s board have the appropriate skills and incentives to fulfil its multiple roles? How Not applicable Not Applicable

Page 27 of 104 Principle Key Consideration Questions Comments RATING does the FMI ensure that this is the case? Q.2.4.2: What incentives does the FMI provide to board members so that it can attract and retain members of the board with appropriate skills? How do these incentives reflect the long￾term achievement of the FMI’s objectives? Not applicable Not Applicable Q.2.4.3: Does the board include non-executive or independent board members? If so, how many? Not applicable Not Applicable Q.2.4.4: If the board includes independent board members, how does the FMI define an independent board member? Does the FMI disclose which board member(s) it regards as independent? Not applicable Not Applicable Key consideration 5: The roles and responsibilities of management should be clearly specified. An FMI’s management should have the appropriate experience, a mix of skills, and the integrity necessary to discharge their responsibilities for the operation and risk management of the FMI. Roles and responsibilities of management Q.2.5.1: What are the roles and responsibilities of management, and are they clearly specified? Availability of management structures and job descriptions. Observed Q.2.5.2: How are the roles and objectives of management set and evaluated? Performance appraisals. Observed Experience, skills and integrity

Page 28 of 104 Principle Key Consideration Questions Comments RATING Q.2.5.3: To what extent does the FMI’s management have the appropriate experience, mix of skills and the integrity necessary for the operation and risk management of the FMI? How does the FMI ensure that this is the case? Background checks by security and a thorough recruiting system by HR, continuous training and development. Observed Q.2.5.4: What is the process to remove management if necessary? The HR policy and Code of Conduct covers the recruitment and processes to remove management where necessary. Observed Key consideration 6: The board should establish a clear, documented risk-management framework that includes the FMI’s risk-tolerance policy, assigns responsibilities and accountability for risk decisions, and addresses decision making in crises and emergencies. Governance arrangements should ensure that the risk-management and internal control functions have sufficient authority, independence, resources, and access to the board. Risk management framework Documented risk management framework for the department available. Q.2.6.1: What is the risk management framework that has been established by the board? How is it documented? Documented at departmental level which then feeds into the organisational risk framework. Observed Q.2.6.2: How does this framework address the FMI’s risk tolerance policy, assign responsibilities and accountability for risk decisions (such as limits on risk exposures), and address decision-making in crises and emergencies? The Operator is accountable for risk decisions and the system’s credit push facility limits exposures among participants. Observed Q.2.6.3: What is the process for determining, endorsing and The framework is drafted at department level and is Observed

Page 29 of 104 Principle Key Consideration Questions Comments RATING reviewing the risk management framework? forwarded to other stakeholders for input. Authority and independence of risk management and audit functions Q.2.6.4: What are the roles, responsibilities, authority, reporting lines and resources of the risk management and audit functions? The Risk management function is within the laid down structure of the department. The Audit function reviews independently the risk management framework. Observed Q.2.6.5: How does the board ensure that there is adequate governance surrounding the adoption and use of risk management models? How are these models and the related methodologies validated? The risk management committee at Board level oversees the overall management model of the organisation thereby ensuring that the FMIs risk management policy is in place. Observed Key consideration 7: The board should ensure that the FMI’s design, rules, Overall strategy, and major decisions reflect appropriately the legitimate interests of its direct and indirect participants and other relevant stakeholders. Major decisions should be clearly disclosed to relevant stakeholders and, where there is a broad market impact, the public. Identification and consideration of stakeholder interests Major changes and decisions are disclosed at the highest level of the organisation organogram. Q.2.7.1: How does the FMI identify and take account of the interests of the FMI’s participants and other relevant stakeholders in its decision￾making in relation to its design, rules, Overall strategy and major decisions? RTGs user groups, help desk and whistle blowing desk all contribute ideas and interest of the public. Observed

Page 30 of 104 Principle Key Consideration Questions Comments RATING Q.2.7.2: How does the board consider the views of direct and indirect participants and other relevant stakeholders on these decisions; for example, are participants included on the risk management committee, on user committees such as a default management group or through a public consultation? How are conflicts of interest between stakeholders and the FMI identified, and how are they addressed? Availability of RTGs user group. Observed Disclosure Q.2.7.3: To what extent does the FMI disclose major decisions made by the board to relevant stakeholders and, where appropriate, the public? Through broadcasts, circulars, letters, emails and its website. Observed Key Conclusions Overall observance of Principle 2 The FMI's governance arrangements clearly defines responsibility and accountability levels. The board ensures that the FMI activities are monitored through the risk management measures such as annual audits Observed Principle 3: Risk-management framework: An FMI should have a sound risk￾management framework for comprehensively managing legal, credit, liquidity, operational, and other risks. Key Considerations for Comprehensive risk management framework

Page 31 of 104 Principle Key Consideration Questions Comments RATING Key consideration 1: An FMI should have risk-management policies, procedures, and systems that enable it to identify, measure, monitor, and manage the range of risks that arise in or are borne by the FMI. Risk-management frameworks should be subject to periodic review. Risks that arise in or are borne by the FMI Q.3.1.1: What types of risk arise in or are borne by the FMI? Systemic, liquidity, credit, operational and settlement risks Observed Risk management policies, procedures and systems Q.3.1.2: What are the FMI’s policies, procedures and controls to help identify, measure, monitor and manage the risks that arise in or are borne by the FMI? Departmental risk framework and rules and procedures. Observed Q.3.1.3: What risk management systems are used by the FMI to help identify, measure, monitor and manage its range of risks? Credit push system within the RTGS and collateral system. Observed Q.3.1.4: How do these systems provide the capacity to aggregate exposures across the FMI and, where appropriate, other relevant parties, such as the FMI’s participants and their customers? Credit push eliminates overdrafts and ensures that a participant is liquid before transacting. Gridlock management to avoid delays in the system. Observed Review of risk management policies, procedures and systems Q.3.1.5: What is the process for developing, approving and maintaining risk management policies, procedures and systems? Review of policies and procedures, participants are consulted and approvals from management. Observed Q.3.1.6: How does the FMI assess the effectiveness of risk Feedback from participants through the help desk and self￾assessments. Observed

Page 32 of 104 Principle Key Consideration Questions Comments RATING management policies, procedures and systems? Q.3.1.7: How frequently are the risk management policies, procedures and systems reviewed and updated by the FMI? How do these reviews take into account fluctuation in risk intensity, changing environments and market practices? The policies are reviewed annually and as and when the need arises. Risk based policy is used to review considering the changing environment. Observed Key consideration 2: An FMI should provide incentives to participants and, where relevant, their customers to manage and contain the risks they pose to the FMI. Q.3.2.1: What information does the FMI provide to its participants and, where relevant, their customers to enable them to manage and contain the risks they pose to the FMI? Information to manage deadlines and cut off times to fund RTGS positions. Operating schedule broadcast. Observed Q.3.2.2: What incentives does the FMI provide for participants and, where relevant, their customers to monitor and manage the risks they pose to the FMI? Encourage participants to push transactions within the first window which is cheaper. Penalties to participants to push transaction in early windows for the benefits of their customers. Observed Q.3.2.3: How does the FMI design its policies and systems so that they are effective in allowing their participants and, where relevant, their customers to manage and contain their risks? Collaboration with all stakeholders Observed

Page 33 of 104 Principle Key Consideration Questions Comments RATING Key consideration 3: An FMI should regularly review the material risks it bears from and poses to other entities (such as other FMIs, settlement banks, liquidity providers, and service providers) as a result of interdependencies and develop appropriate risk￾management tools to address these risks. Material risks Q.3.3.1: How does the FMI identify the material risks that it bears from and poses to other entities as a result of interdependencies? What material risks has the FMI identified? Through ensuring that there is effective interface of systems e.g. DVP, stress testing and process flows Observed Q.3.3.2: How are these risks measured and monitored? How frequently does the FMI review these risks? Using the statistics from the FMI. The statistics show insufficient funds, penalties, position monitor amongst others. Trending the behaviour of participants through profiling as well. Observed Risk management tools Q.3.3.3: What risk management tools are used by the FMI to address the risks arising from interdependencies with other entities? Interfaces with other systems e.g. DVP, Collateral. Observed Q.3.3.4: How does the FMI assess the effectiveness of these risk management tools? How does the FMI review the risk management tools it uses to address these risks? How frequently is this review conducted? Collateral is reviewed monthly, regular monitoring of systems. Observed

Page 34 of 104 Principle Key Consideration Questions Comments RATING Key consideration 4: An FMI should identify scenarios that may potentially prevent it from being able to provide its critical operations and services as a going concern and assess the effectiveness of a full range of options for recovery or orderly wind-down. An FMI should prepare appropriate plans for its recovery or orderly wind-down based on the results of that assessment. Where applicable, an FMI should also provide relevant authorities with the information needed for purposes of resolution planning. Scenarios that may prevent an FMI from providing critical operations and services Political, Economic, Operational, Social and Technological Q.3.4.1: How does the FMI identify scenarios that may potentially prevent the FMI from providing its critical operations and services? What scenarios have been identified as a result of these processes? Crisis simulation, environment scanning, precedence set before. Poor communication and power outages. Observed Q.3.4.2: How do these scenarios take into account both independent and related risks to which the FMI is exposed? By assessing the results of the crisis simulation. Observed Recovery or orderly wind-down plans Q.3.4.3: What plans does the FMI have for its recovery or orderly wind-down? Disaster Recovery and business continuity plans as well as DR Site. Observed Q.3.4.4: How do the FMI’s key recovery or orderly wind-down strategies enable the FMI to continue to provide critical operations and services? By working from a disaster recovery site. Observed Q.3.4.5: How are the plans for the FMI’s recovery and orderly wind-down reviewed and updated? How frequently are the plans reviewed and updated? Annually or when necessary. Observed

Page 35 of 104 Principle Key Consideration Questions Comments RATING Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking No credit facilities are in place for participants for use of lender of last resort given that the system is a credit push system. Increased settlement delays by participants facing liquidity challenges and even failure to settle in other payment systems on RTGS. Low – can be resolved during normal course of business Overall observance of Principle 3 Observed Principle 4: Credit exposure; An FMI should effectively measure, monitor, and manage its credit risk from participants and from its payment, clearing, and settlement processes. An FMI should maintain sufficient financial resources to cover its credit exposure to each participant fully with a high degree of confidence. A CCP should also maintain additional financial resources to cover a wide range of potential stress scenarios that should include, but not be limited to, the default of the [one/ two] participant[s] and [its/their] affiliates that would potentially cause the largest aggregate credit exposure[s] in extreme but plausible market conditions. Key consideration 1: An FMI should establish a robust framework to manage its credit exposures to its participants and the credit risks arising from its payment, clearing, and settlement processes. Credit exposure may arise from current exposures, potential future exposures, or both. Q.4.1.1: What is the FMI’s framework for managing credit exposures, including current and potential future exposures, to its Not applicable Not Applicable

Page 36 of 104 Principle Key Consideration Questions Comments RATING participants and arising from its payment, clearing and settlement processes? Q.4.1.2: How frequently is the framework reviewed to reflect the changing environment, market practices and new products? Not applicable Not Applicable Key consideration 2: An FMI should identify sources of credit risk, routinely measure and monitor credit exposures, and use appropriate risk-management tools to control these risks. Q.4.2.1: How does the FMI identify sources of credit risk? What are the sources of credit risk that the FMI has identified? Not applicable Not Applicable Q.4.2.2: How does the FMI measure and monitor credit exposures? How frequently does and how frequently can the FMI recalculate these exposures? How timely is the information? Not applicable Not Applicable Q.4.2.3: What tools does the FMI use to control identified sources of credit risk (for example, offering an RTGS or DvP settlement mechanism, limiting net debits or intraday credit, establishing concentration limits, or marking positions to market on a daily or intraday basis)? How does the FMI measure the effectiveness of these tools? Not applicable Not Applicable

Page 37 of 104 Principle Key Consideration Questions Comments RATING Key consideration 3: A payment system or SSS should cover its current and, where they exist, potential future exposures to each participant fully with a high degree of confidence using collateral and other equivalent financial resources (see Principle 5 on collateral). In the case of a DNS payment system or DNS SSS in which there is no settlement guarantee but where its participants face credit exposures arising from its payment, clearing, and settlement processes, such an FMI should maintain, at a minimum, sufficient resources to cover the exposures of the two participants and their affiliates that would create the largest aggregate credit exposure in the system. Coverage of exposures to each participant Q.4.3.1: How does the payment system or SSS cover its current and, where they exist, potential future exposures to each participant? What is the composition of the FMI’s financial resources used to cover these exposures? How accessible are these financial resources? Not applicable Not Applicable Q.4.3.2: To what extent do these financial resources cover the payment system’s or SSS’s current and potential future exposures fully with a high degree of confidence? How frequently does the payment system or SSS evaluate the sufficiency of these financial resources? Not applicable Not Applicable For DNS payment systems and DNS SSSs in which there is no settlement guarantee Q.4.3.3: If the payment system or SSS is a DNS system in which there is no settlement guarantee, do its participants face credit exposures arising from the Not applicable Not Applicable

Page 38 of 104 Principle Key Consideration Questions Comments RATING payment, clearing and settlement processes? If there are credit exposures in the system, how does the system monitor and measure these exposures? Q.4.3.4: If the payment system or SSS is a DNS system in which there is no settlement guarantee and has credit exposures among its participants, to what extent does the payment system’s or SSS’s financial resources cover, at a minimum, the default of the two participants and their affiliates that would create the largest aggregate credit exposure in the system? Not applicable Not Applicable Key consideration 7: An FMI should establish explicit rules and procedures that address fully any credit losses it may face as a result of any individual or combined default among its participants with respect to any of their obligations to the FMI. These rules and procedures should address how potentially uncovered credit losses would be allocated, including the repayment of any funds an FMI may borrow from liquidity providers. These rules and procedures should also indicate the FMI’s process to replenish any financial resources that the FMI may employ during a stress event, so that the FMI can continue to operate in a safe and sound manner. Allocation of credit losses Q.4.7.1: How do the FMI’s rules and procedures explicitly address any credit losses it may face as a result of any individual or combined default among its participants with respect to any of their obligations to the FMI? How do the FMI’s rules and procedures address the allocation of uncovered credit losses and in what order, including the Not applicable Not Applicable

Page 39 of 104 Principle Key Consideration Questions Comments RATING repayment of any funds an FMI may borrow from liquidity providers? Replenishment of financial resources Q.4.7.2: What are the FMI’s rules and procedures on the replenishment of the financial resources that are exhausted during a stress event? Not applicable Not Applicable Overall observance of Principle 4 Not Applicable Principle 5 Collateral: An FMI that requires collateral to manage its or its participants’ credit exposure should accept collateral with low credit, liquidity, and market risks. Key consideration 1: An FMI should generally limit the assets it (routinely) accepts as collateral to those with low credit, liquidity, and market risks. Q.5.1.1: How does the FMI determine whether a specific asset can be accepted as collateral, including collateral that will be accepted on an exceptional basis? How does the FMI determine what qualifies as an exceptional basis? How frequently does the FMI adjust these determinations? How frequently does the FMI accept collateral on an exceptional basis, and does it place limits on its acceptance of such collateral? Not applicable Not Applicable Q.5.1.2: How does the FMI monitor the collateral that is posted so that the collateral Not applicable Not Applicable

Page 40 of 104 Principle Key Consideration Questions Comments RATING meets the applicable acceptance criteria? Q.5.1.3: How does the FMI identify and mitigate possible specific wrong-way risk – for example, by limiting the collateral it accepts (including collateral concentration limits)? Not applicable Not Applicable Key consideration 2: An FMI should establish prudent valuation practices and develop haircuts that are regularly tested and take into account stressed market conditions. Valuation practices Q.5.2.1: How frequently does the FMI mark its collateral to market, and does it do so at least daily? Not applicable Not Applicable Q.5.2.2: To what extent is the FMI authorised to exercise discretion in valuing assets when market prices do not represent their true value? Not applicable Not Applicable Haircutting practices Q.5.2.3: How does the FMI determine haircuts? Not applicable Not Applicable Q.5.2.4: How does the FMI test the sufficiency of haircuts and validate its haircut procedures, including with respect to the potential decline in the assets’ value in stressed market conditions involving the liquidation of collateral? How frequently does the FMI complete this test? Not applicable Not Applicable Key consideration 3: In order to reduce the need for procyclical adjustments, an FMI should establish stable and conservative haircuts that are calibrated to include periods of stressed market conditions, to the extent practicable and prudent.

Page 41 of 104 Principle Key Consideration Questions Comments RATING Q.5.3.1: How does the FMI identify and evaluate the potential procyclicality of its haircut calibrations? How does the FMI consider reducing the need for procyclical adjustments – for example, by incorporating periods of stressed market conditions during the calibration of haircuts? Not applicable Not Applicable Key consideration 4: An FMI should avoid concentrated holdings of certain assets where this would significantly impair the ability to liquidate such assets quickly without significant adverse price effects. Q.5.4.1: What are the FMI’s policies for identifying and avoiding concentrated holdings of certain assets in order to limit potential adverse price effects at liquidation? What factors (for example, adverse price effects or market conditions) are considered when determining these policies? Not applicable Not Applicable Q.5.4.2: How does the FMI review and evaluate concentration policies and practices to determine their adequacy? How frequently does the FMI review and evaluate these policies and practices? Not applicable Not Applicable Key consideration 5: An FMI that accepts cross-border collateral should mitigate the risks associated with its use and ensure that the collateral can be used in a timely manner. Q.5.5.1: What are the legal, operational, market and other risks that the FMI faces by Not applicable Not Applicable

Page 42 of 104 Principle Key Consideration Questions Comments RATING accepting cross-border collateral? How does the FMI mitigate these risks? Q.5.5.2: How does the FMI ensure that cross-border collateral can be used in a timely manner? Not applicable Not Applicable Key consideration 6: An FMI should use a collateral management system that is well￾designed and operationally flexible. Collateral management system design Q.5.6.1: What are the primary features of the FMI’s collateral management system? Not applicable Not Applicable Q.5.6.2: How and to what extent does the FMI track the reuse of collateral and its rights to the collateral provided? Not applicable Not Applicable Operational flexibility Q.5.6.3: How and to what extent does the FMI’s collateral management system accommodate changes in the ongoing monitoring and management of collateral? Not applicable Not Applicable Q.5.6.4: To what extent is the collateral management system staffed to ensure smooth operations even during times of market stress? Not applicable Not Applicable Key Conclusions Overall observance of Principle 5 Not applicable Not Applicable

Page 43 of 104 Principle Key Consideration Questions Comments RATING Principle 7: Liquidity risk; An FMI should effectively measure, monitor, and manage its liquidity risk. An FMI should maintain sufficient liquid resources to effect same￾day and, where appropriate, intraday settlement of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of [one/two] participant[s] and [its/their] affiliates that would generate the largest aggregate liquidity need in extreme but plausible market conditions. Key consideration 1: An FMI should have a robust framework to manage its liquidity risks from its participants, settlement banks, Nostro agents, custodian banks, liquidity providers, and other entities. Q.7.1.1: What is the FMI’s framework for managing its liquidity risks, in all relevant currencies, from its participants, settlement banks, nostro agents, custodian banks, liquidity providers and other entities? Not applicable Not Applicable Q.7.1.2: What are the nature and size of the FMI’s liquidity needs, and the associated sources of liquidity risks, that arise in the FMI in all relevant currencies? Not applicable Not applicable Q.7.1.3: How does the FMI take into account the potential aggregate liquidity risk presented by an individual entity and its affiliates that may play multiples roles with respect to the FMI? Not applicable Not applicable Key consideration 2: An FMI should have effective operational and analytical tools to identify, measure, and monitor its settlement and funding flows on an ongoing and timely basis, including its use of intraday liquidity. Q.7.2.1: What operational and analytical tools does the FMI have to identify, measure and monitor settlement and funding flows? Not applicable Not applicable

Page 44 of 104 Principle Key Consideration Questions Comments RATING Q.7.2.2: How does the FMI use those tools to identify, measure and monitor its settlement and funding flows on an ongoing and timely basis, including its use of intraday liquidity? Not applicable Not applicable Key consideration 3: A payment system or SSS, including one employing a DNS mechanism, should maintain sufficient liquid resources in all relevant currencies to effect same-day settlement, and where appropriate intraday or multiday settlement, of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate payment obligation in extreme but plausible market conditions. Q.7.3.1: How does the payment system or SSS determine the amount of liquid resources in all relevant currencies to effect same day settlement and, where appropriate, intraday or multiday settlement of payment obligations? What potential stress scenarios (including, but not limited to, the default of the participant and its affiliates that would generate the largest aggregate payment obligation in extreme but plausible market conditions) does the payment system or SSS use to make this determination? Not applicable Not applicable Q.7.3.2: What is the estimated size of the liquidity shortfall in each currency that the payment system or SSS would need to cover? Not applicable Not applicable

Page 45 of 104 Principle Key Consideration Questions Comments RATING Key consideration 5: For the purpose of meeting its minimum liquid resource requirement, an FMI’s qualifying liquid resources in each currency include cash at the central bank of issue and at creditworthy commercial banks, committed lines of credit, committed foreign exchange swaps, and committed repos, as well as highly marketable collateral held in custody and investments that are readily available and convertible into cash with prearranged and highly reliable funding arrangements, even in extreme but plausible market conditions. If an FMI has access to routine credit at the central bank of issue, the FMI may count such access as part of the minimum requirement to the extent it has collateral that is eligible for pledging to (or for conducting other appropriate forms of transactions with) the relevant central bank. All such resources should be available when needed. Size and composition of qualifying liquid resources Q.7.5.1: What is the size and composition of the FMI’s qualifying liquid resources in each currency that is held by the FMI? In what manner and within what time frame can these liquid resources be made available to the FMI? Not applicable Not applicable Availability and coverage of qualifying liquid resources Not applicable Not applicable Q.7.5.2: What prearranged funding arrangements has the FMI established to convert its readily available collateral and investments into cash? How has the FMI established that these arrangements would be highly reliable in extreme but plausible market conditions? Has the FMI identified any potential barriers to accessing its liquid resources? Not applicable Not applicable

Page 46 of 104 Principle Key Consideration Questions Comments RATING Q.7.5.3: If the FMI has access to routine credit at the central bank of issue, what is the FMI’s relevant borrowing capacity for meeting its minimum liquid resource requirement in that currency? Not applicable Not applicable Q.7.5.4: To what extent does the size and the availability of the FMI’s qualifying liquid resources cover its identified minimum liquidity resource requirement in each currency to effect settlement of payment obligations on time? Not applicable Not applicable Key consideration 6: An FMI may supplement its qualifying liquid resources with other forms of liquid resources. If the FMI does so, then these liquid resources should be in the form of assets that are likely to be saleable or acceptable as collateral for lines of credit, swaps, or repos on an ad hoc basis following a default, even if this cannot be reliably prearranged or guaranteed in extreme market conditions. Even if an FMI does not have access to routine central bank credit, it should still take account of what collateral is typically accepted by the relevant central bank, as such assets may be more likely to be liquid in stressed circumstances. An FMI should not assume the availability of emergency central bank credit as a part of its liquidity plan. Size and composition of supplemental liquid resources Q.7.6.1: What is the size and composition of any supplemental liquid resources available to the FMI? Not applicable Not applicable Availability of supplemental liquid resources Q.7.6.2: How and on what basis has the FMI determined that these assets are likely to be saleable or acceptable as collateral to obtain the relevant Not applicable Not applicable

Page 47 of 104 Principle Key Consideration Questions Comments RATING currency, even if this cannot be reliably prearranged or guaranteed in extreme market conditions? Q.7.6.3: What proportion of these supplemental assets qualifies as potential collateral at the relevant central bank? Not applicable Not applicable Q.7.6.4: In what circumstances would the FMI use its supplemental liquid resources in advance of, or in addition to, using its qualifying liquid resources? Not applicable Not applicable Q.7.6.5: To what extent does the size and availability of the FMI’s supplemental liquid resources, in conjunction with its qualifying liquid resources, cover the relevant liquidity needs identified through the FMI’s stress test programme for determining the adequacy of its liquidity resources (see key consideration 9)? Not applicable Not applicable Key consideration 7: An FMI should obtain a high degree of confidence, through rigorous due diligence, that each provider of its minimum required qualifying liquid resources, whether a participant of the FMI or an external party, has sufficient information to understand and to manage its associated liquidity risks, and that it has the capacity to perform as required under its commitment. Where relevant to assessing a liquidity provider’s performance reliability with respect to a particular currency, a liquidity provider’s potential access to credit from the central bank of issue may be taken into account. An FMI should regularly test its procedures for accessing its liquid resources at a liquidity provider. Use of liquidity providers

Page 48 of 104 Principle Key Consideration Questions Comments RATING Q.7.7.1: Does the FMI use a liquidity provider to meet its minimum required qualifying liquidity resources? Who are the FMI’s liquidity providers? How and on what basis has the FMI determined that each of these liquidity providers has sufficient information to understand and to manage their associated liquidity risk in each relevant currency on an ongoing basis, including in stressed conditions? Not applicable Not applicable Reliability of liquidity providers Q.7.7.2: How has the FMI determined that each of its liquidity providers has the capacity to perform on its commitment in each relevant currency on an ongoing basis? Not applicable Not applicable Q.7.7.3: How does the FMI take into account a liquidity provider’s potential access to credit at the central bank of issue? Not applicable Not applicable Q.7.7.4: How does the FMI regularly test the timeliness and reliability of its procedures for accessing its liquid resources at a liquidity provider? Not applicable Not applicable CPMI-IOSCO – Disclosure framework and assessment methodology – December 2012 39 Not applicable Not applicable

Page 49 of 104 Principle Key Consideration Questions Comments RATING Key consideration 8: An FMI with access to central bank accounts, payment services, or securities services should use these services, where practical, to enhance its management of liquidity risk. Q.7.8.1: To what extent does the FMI currently have, or is the FMI eligible to obtain, access to accounts, payment services and securities services at each relevant central bank that could be used to conduct its payments and settlements and to manage liquidity risks in each relevant currency? Not applicable Not applicable Q.7.8.2: To what extent does the FMI use each of these services at each relevant central bank to conduct its payments and settlements and to manage liquidity risks in each relevant currency? Not applicable Not applicable Q.7.8.3: If the FMI employs services other than those provided by the relevant central banks, to what extent has the FMI analysed the potential to enhance the management of liquidity risk by expanding its use of central bank services? Not applicable Not applicable Q.7.8.4: What, if any, practical or other considerations to expanding its use of relevant central bank services have been identified by the FMI? Not applicable Not applicable

Page 50 of 104 Principle Key Consideration Questions Comments RATING Key consideration 9: An FMI should determine the amount and regularly test the sufficiency of its liquid resources through rigorous stress testing. An FMI should have clear procedures to report the results of its stress tests to appropriate decision makers at the FMI and to use these results to evaluate the adequacy of and adjust its liquidity risk￾management framework. In conducting stress testing, an FMI should consider a wide range of relevant scenarios. Scenarios should include relevant peak historic price volatilities, shifts in other market factors such as price determinants and yield curves, multiple defaults over various time horizons, simultaneous pressures in funding and asset markets, and a spectrum of forward-looking stress scenarios in a variety of extreme but plausible market conditions. Scenarios should also take into account the design and operation of the FMI, include all entities that might pose material liquidity risks to the FMI (such as settlement banks, nostro agents, custodian banks, liquidity providers, and linked FMIs), and where appropriate, cover a multiday period. In all cases, an FMI should document its supporting rationale for, and should have appropriate governance arrangements relating to, the amount and form of total liquid resources it maintains. Stress test programme Q.7.9.1: How does the FMI use stress testing to determine the amount and test the sufficiency of its liquid resources in each currency? How frequently does the FMI stress-test its liquid resources? Not applicable Not applicable Q.7.9.2: What is the process for reporting on an ongoing basis the results of the FMI’s liquidity stress tests to appropriate decision-makers at the FMI, for the purpose of supporting their timely evaluation and adjustment of the size and composition of the FMI’s liquidity resources and liquidity risk management framework? Not applicable Not applicable Stress test scenarios

Page 51 of 104 Principle Key Consideration Questions Comments RATING Q.7.9.3: What scenarios are used in the stress tests, and to what extent do they take into account a combination of peak historic price volatilities, shifts in other market factors such as price determinants and yield curves, multiple defaults over various time horizons, simultaneous pressures in funding and asset markets, and a spectrum of forward-looking stress scenarios in a variety of extreme but plausible market conditions? Not applicable Not applicable Q.7.9.4: To what extent do the scenarios and stress tests take into account the FMI’s particular payment and settlement structure (for example, real-time gross or deferred net; with or without a settlement guarantee; DVP model 1, 2 or 3 for SSSs), and the liquidity risk that is borne directly by the FMI, by its participants, or both? Not applicable Not applicable Q.7.9.5: To what extent do the scenarios and stress tests take into account the nature and size of the liquidity needs, and the associated sources of liquidity risks, that arise in the FMI to settle its payment obligations on time, including the potential that individual entities and their affiliates may play multiples roles with respect to the FMI? Not applicable Not applicable Review and validation

Page 52 of 104 Principle Key Consideration Questions Comments RATING Q.7.9.6: How frequently does the FMI assess the effectiveness and appropriateness of stress test assumptions and parameters? How does the FMI’s stress test programme take into account various conditions, such as a sudden and significant increase in position and price volatility, position concentration, change in market liquidity, and model risk including shift of parameters? Not applicable Not applicable Q.7.9.7: How does the FMI validate its risk management model? How frequently does it perform this validation? Not applicable Not applicable Q.7.9.8: Where and to what extent does the FMI document its supporting rationale for, and its governance arrangements relating to, the amount and form of its total liquid resources? Not applicable Not applicable Key consideration 10: An FMI should establish explicit rules and procedures that enable the FMI to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations on time following any individual or combined default among its participants. These rules and procedures should address unforeseen and potentially uncovered liquidity shortfalls and should aim to avoid unwinding, revoking, or delaying the same-day settlement of payment obligations. These rules and procedures should also indicate the FMI’s process to replenish any liquidity resources it may employ during a stress event, so that it can continue to operate in a safe and sound manner. Same day settlement Q.7.10.1: How do the FMI’s rules and procedures enable it to settle payment obligations on time following any individual or combined default among its participants? Not applicable Not applicable

Page 53 of 104 Principle Key Consideration Questions Comments RATING Q.7.10.2: How do the FMI’s rules and procedures address unforeseen and potentially uncovered liquidity shortfalls and avoid unwinding, revoking or delaying the same day settlement of payment obligations? Not applicable Not applicable Replenishment of liquidity resources Q.7.10.3: How do the FMI’s rules and procedures allow for the replenishment of any liquidity resources employed during a stress event? Not applicable Not applicable Overall observance of Principle 7 Not applicable Not applicable Principle 8: Settlement finality; An FMI should provide clear and certain final settlement, at a minimum, by the end of the value date. Where necessary or preferable, an FMI should provide final settlement intraday or in real time. Key Considerations for Settlement Finality Management Key consideration 1: An FMI’s rules and procedures should clearly define the point at which settlement is final. Point of settlement finality Q.8.1.1: At what point is the settlement of a payment, transfer instruction or other obligation final, meaning irrevocable and unconditional? Is the point of settlement finality defined and documented? How and to whom is this information disclosed? When funds move from one participant to the other. Finality is documented in the rules and procedures. Observed

Page 54 of 104 Principle Key Consideration Questions Comments RATING Q.8.1.2: How does the FMI’s legal framework and rules, including the applicable insolvency law(s), acknowledge the discharge of a payment, transfer instruction or other obligation between the FMI and its participants, or between participants? This is provided for in the legal framework and the NPS Act. Observed Q.8.1.3: How does the FMI demonstrate that there is a high degree of legal certainty that finality will be achieved in all relevant jurisdictions (for example, by obtaining a well￾reasoned legal opinion)? The Legal framework and Act ensure certainty. Observed Finality in the case of links Observed Q.8.1.4: How does the FMI ensure settlement finality in the case of linkages with other FMIs? Operational rules, contracts and agreements. Observed a) For an SSS, how is consistency of finality achieved between the SSS and, if relevant, the LVPS where the cash leg is settled? DVP model 1 Observed Key consideration 2: An FMI should complete final settlement no later than the end of the value date, and preferably intraday or in real time, to reduce settlement risk. An LVPS or SSS should consider adopting RTGS or multiple-batch processing during the settlement day. Final settlement on the value date Q.8.2.1: Is the FMI designed to complete final settlement on the value date (or same day settlement)? How does the FMI Yes, it is. Credit push system and transactions are real time. Mechanism that discards Observed

Page 55 of 104 Principle Key Consideration Questions Comments RATING ensure that final settlement occurs no later than the end of the intended value date? transactions that have a different value date. Q.8.2.2: Has the FMI ever experienced deferral of final settlement to the next business day that was not contemplated by its rules, procedures or contracts? If so, under what circumstances? If deferral was a result of the FMI’s actions, what steps have been taken to prevent a similar situation in the future? Yes, this has occurred when the system faced technical challenges. Improvement in monitoring tools that ensure that the turnaround time is limited. Engagement with ICT who have reinforced the RTGs servers to protect them from external challenges. Observed Intraday or real-time final settlement Observed Q.8.2.3: Does the FMI provide intraday or real-time final settlement? If so, how? How are participants informed of the final settlement? Real time settlement, participants get notifications from the system. Observed Q.8.2.4: If settlement occurs through multiple-batch processing, what is the frequency of the batches and within what time frame do they operate? What happens if a participant does not have enough funds or securities at the settlement time? Are transactions entered in the next batch? If so, what is the status of those transactions and when would they become final? Batches operate twice per day - 2 settlement cycles. Time frames are morning and afternoons. In the case of inadequate funds, the batch is queued, procedure is followed and eventually, institute the use of collateral by the relevant authorities. Transactions are not moved to the next batch. Observed Q.8.2.5: If settlement does not occur intraday or in real time, how has the LVPS or SSS considered the introduction of either of these modalities? N/A RTGS is real time Not applicable

Page 56 of 104 Principle Key Consideration Questions Comments RATING Key consideration 3: An FMI should clearly define the point after which unsettled payments, transfer instructions, or other obligations may not be revoked by a participant. Q.8.3.1: How does the FMI define the point at which unsettled payments, transfer instructions or other obligations may not be revoked by a participant? How does the FMI prohibit the unilateral revocation of accepted and unsettled payments, transfer instructions or obligations after this time? Currently, participants only access the system in real time, there is no facility for queueing. Observed Q.8.3.2: Under what circumstances can an instruction or obligation accepted by the system for settlement still be revoked (for example, queued obligations)? How can an unsettled payment or transfer instruction be revoked? Who can revoke unsettled payment or transfer instructions? Currently, participants only access the system in real time, there is no facility for queueing. The Operator can revoke unsettled instructions if in the form of a batch. Observed Q.8.3.3: Under what conditions does the FMI allow exceptions and extensions to the revocation deadline? Extensions are allowed in the case of batches. Observed Q.8.3.4: Where does the FMI define this information? How and to whom is this information disclosed? The relevant FMI or the participants. Observed Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking FMI has allowed other retail payment systems to settle through RTGS to improve Settlement risk-Currently, participants only access the Low – can be resolved during

Page 57 of 104 Principle Key Consideration Questions Comments RATING liquidity in the system. There is still a deferred net settlement of batches one per working day and envisage a situation where the settlement cycles are increased to reduce liquidity requirements system during working days for settlement once a day. normal course of business Currently, participants only access the system in real time, there is no facility for queueing Liquidity Risk for participants. Low – can be resolved during normal course of business Overall observance of Principle 8 Although transactions are not currently being queued, with the introduction of the ZWL we expect the queueing facility to be reintroduced. The system has not experienced significant reports of settlement delays from the consumers through the call center. Observed Principle 9: Money settlements: An FMI should conduct its money settlements in central bank money where practical and available. If central bank money is not used, an FMI should minimise and strictly control the credit and liquidity risk arising from the use of commercial bank money. Key Considerations for Money settlements Management Key consideration 1: An FMI should conduct its money settlements in central bank money, where practical and available, to avoid credit and liquidity risks. Q.9.1.1: How does the FMI conduct money settlements? If the FMI conducts settlement in multiple currencies, how does the FMI conduct money settlement in each currency? RTGS is settled in Central Bank Money. Observed

Page 58 of 104 Principle Key Consideration Questions Comments RATING Q.9.1.2: If the FMI does not settle in central bank money, why is it not used? The funds for accounts in RTGS USD are held in a Nostro accounts. Observed Key consideration 2: If central bank money is not used, an FMI should conduct its money settlements using a settlement asset with little or no credit or liquidity risk. Q.9.2.1: If central bank money is not used, how does the FMI assess the credit and liquidity risks of the settlement asset used for money settlement? Through continued monitoring of settlement bank in line with agreed procedures and processes with the banks. Observed Q.9.2.2: If the FMI settles in commercial bank money, how does the FMI select its settlement banks? What are the specific selection criteria the FMI uses? Through continued monitoring of settlement bank in line with agreed procedures and processes with the banks. Observed Key consideration 3: If an FMI settles in commercial bank money, it should monitor, manage, and limit its credit and liquidity risks arising from the commercial settlement banks. In particular, an FMI should establish and monitor adherence to strict criteria for its settlement banks that take account of, among other things, their regulation and supervision, creditworthiness, capitalisation, access to liquidity, and operational reliability. An FMI should also monitor and manage the concentration of credit and liquidity exposures to its commercial settlement banks. Q.9.3.1: How does the FMI monitor the settlement banks’ adherence to criteria it uses for selection? For example, how does the FMI evaluate the banks’ regulation, supervision, creditworthiness, capitalisation, access to liquidity and operational reliability? Through continued monitoring of settlement bank in line with agreed procedures and processes with the banks. Observed

Page 59 of 104 Principle Key Consideration Questions Comments RATING Q.9.3.2: How does the FMI monitor, manage and limit its credit and liquidity risks arising from the commercial settlement banks? How does the FMI monitor and manage the concentration of credit and liquidity exposures to these banks? Through continued monitoring of settlement bank in line with agreed procedures and processes with the banks. Observed Q.9.3.3: How does the FMI assess its potential losses and liquidity pressures as well as those of its participants if there is a failure of its largest settlement bank? Through continued monitoring of settlement bank in line with agreed procedures and processes with the banks. Observed Key consideration 4: If an FMI conducts money settlements on its own books, it should minimise and strictly control its credit and liquidity risks. Q.9.4.1: If an FMI conducts money settlements on its own books, how does it minimise and strictly control its credit and liquidity risks? Not applicable Not applicable Key consideration 5: An FMI’s legal agreements with any settlement banks should state clearly when transfers on the books of individual settlement banks are expected to occur, that transfers are to be final when effected, and that funds received should be transferable as soon as possible, at a minimum by the end of the day and ideally intraday, in order to enable the FMI and its participants to manage credit and liquidity risks. Q.9.5.1: Do the FMI’s legal agreements with its settlement banks state when transfers occur, that transfers are final when effected, and that funds received are transferable? Yes Observed

Page 60 of 104 Principle Key Consideration Questions Comments RATING Q.9.5.2: Are funds received transferable by the end of the day at the latest? If not, why? Are they transferable intraday? If not, why? End of day transfers in line with agreed processes and procedures Observed Overall observance of Principle 9 Observed Principle 10: Physical deliveries; An FMI should clearly state its obligations with respect to the delivery of physical instruments or commodities and should identify, monitor, and manage the risks associated with such physical deliveries. Key consideration 1: An FMI’s rules should clearly state its obligations with respect to the delivery of physical instruments or commodities. Q.10.1.1: Which asset classes does the FMI accept for physical delivery? Not applicable Not applicable Q.10.1.2: How does the FMI define its obligations and responsibilities with respect to the delivery of physical instruments or commodities? How are these responsibilities defined and documented? To whom are these documents disclosed? Not applicable Not applicable Q.10.1.3: How does the FMI engage with its participants to ensure they have an understanding of their obligations and the procedures for effecting physical delivery? Not applicable Not applicable Key consideration 2: An FMI should identify, monitor, and manage the risks and costs associated with the storage and delivery of physical instruments or commodities.

Page 61 of 104 Principle Key Consideration Questions Comments RATING Q.10.2.1: How does the FMI identify the risks and costs associated with storage and delivery of physical instruments or commodities? What risks and costs has the FMI identified? Not applicable Not applicable Q.10.2.2: What processes, procedures and controls does the FMI have to monitor and manage any identified risks and costs associated with storage and delivery of physical instruments or commodities? Not applicable Not applicable Q.10.2.3: If an FMI can match participants for delivery and receipt, under what circumstances can it do so, and what are the associated rules and procedures? Are the legal obligations for delivery clearly expressed in the rules and associated agreements? Not applicable Not applicable Q.10.2.4: How does the FMI monitor its participants’ delivery preferences and, to the extent practicable, ensure that its participants have the necessary systems and resources to be able to fulfil their physical delivery obligations? Not applicable Not applicable Overall observance of Principle 10 Not Applicable

Page 62 of 104 Principle Key Consideration Questions Comments RATING Principle 11: Central securities depositories: A CSD should have appropriate rules and procedures to help ensure the integrity of securities issues and minimise and manage the risks associated with the safekeeping and transfer of securities. A CSD should maintain securities in an immobilised or dematerialised form for their transfer by book entry. Key consideration 1: A CSD should have appropriate rules, procedures, and controls, including robust accounting practices, to safeguard the rights of securities issuers and holders, prevent the unauthorised creation or deletion of securities, and conduct periodic and at least daily reconciliation of securities issues it maintains. Safeguarding the rights of securities issuers and holders Q.11.1.1: How are the rights of securities issuers and holders safeguarded by the rules, procedures and controls of the CSD? Not applicable Not applicable Q.11.1.2: How do the CSD’s rules, procedures and controls ensure that the securities it holds on behalf of participants are appropriately accounted for on its books and protected from risks associated with the other services the CSD may provide? Not applicable Not applicable Q.11.1.3: How does the CSD ensure that it has robust accounting practices? Do audits review whether there are sufficient securities to satisfy customer rights? How frequently are end-to-end audits conducted to examine the procedures and internal controls used in the safekeeping of securities? Not applicable Not applicable

Page 63 of 104 Principle Key Consideration Questions Comments RATING Prevention of the unauthorised creation or deletion of securities Q.11.1.4: What are the CSD’s internal procedures to authorise the creation and deletion of securities? What are the CSD’s internal controls to prevent the unauthorised creation and deletion of securities? Not applicable Not applicable Periodic reconciliation of securities issues Q.11.1.5: Does the CSD conduct periodic and at least daily reconciliation of the totals of securities issues in the CSD for each issuer (or its issuing agent)? How does the CSD ensure that the total number of securities recorded in the CSD for a particular issue is equal to the amount of securities of that issue held on the CSD’s books? Not applicable Not applicable Q.11.1.6: If the CSD is not the official registrar of the issues held on its books, how does the CSD reconcile its records with official registrar? Not applicable Not applicable Key consideration 2: A CSD should prohibit overdrafts and debit balances in securities accounts. Q.11.2.1: How does the CSD prevent overdrafts and debit balances in securities accounts? Key consideration 3: A CSD should maintain securities in an immobilised or dematerialised form for their transfer by book entry. Where appropriate, a CSD should provide incentives to Not applicable Not applicable

Page 64 of 104 Principle Key Consideration Questions Comments RATING immobilise or dematerialise securities. Q.11.3.1: Are securities issued or maintained in a dematerialised form? What percentage of securities is dematerialised, and what percentage of the total volume of transactions applies to these securities? Not applicable Not applicable Q.11.3.2: If securities are issued as a physical certificate, is it possible to immobilise them and allow their holding and transfer in a book-entry system? What percentage of securities is immobilised, and what percentage of the total volume of transactions applies to immobilised securities? Not applicable Not applicable Q11.3.3: What incentives, if any, does the CSD provide to immobilise or dematerialise securities? Not applicable Not applicable Key consideration 4: A CSD should protect assets against custody risk through appropriate rules and procedures consistent with its legal framework. Q.11.4.1: How do the CSD’s rules and procedures protect assets against custody risk, including the risk of loss because of the CSD’s negligence, misuse of assets, fraud, poor administration, inadequate recordkeeping or failure to protect participants’ interests in their securities? Not applicable Not applicable

Page 65 of 104 Principle Key Consideration Questions Comments RATING Q.11.4.2: How has the CSD determined that those rules and procedures are consistent with the legal framework? Not applicable Not applicable Q.11.4.3: What other methods, if any, does the CSD employ to protect its participants against misappropriation, destruction and theft of securities (for example, insurance or other compensation schemes)? Not applicable Not applicable Key consideration 5: A CSD should employ a robust system that ensures segregation between the CSD’s own assets and the securities of its participants and segregation among the securities of participants. Where supported by the legal framework, the CSD should also support operationally the segregation of securities belonging to a participant’s customers on the participant’s books and facilitate the transfer of customer holdings. Not applicable Not applicable Q.11.5.1: What segregation arrangements are in place at the CSD? How does the CSD ensure segregation between its own assets and the securities of its participants? How does the CSD ensure segregation among the securities of participants? Not applicable Not applicable

Page 66 of 104 Principle Key Consideration Questions Comments RATING Q.11.5.2: Where supported by the legal framework, how does the CSD support the operational segregation of securities belonging to participants’ customers from the participants’ book? How does the CSD facilitate the transfer from these customers’ accounts to another participant? Not applicable Not applicable Key consideration 6: A CSD should identify, measure, monitor, and manage its risks from other activities that it may perform; additional tools may be necessary in order to address these risks. Not applicable Not applicable Q.11.6.1: Does the CSD provide services other than central safekeeping and administration of securities and settlement? If so, what services? Not applicable Not applicable Q.11.6.2: If the CSD provides services other than central safekeeping and administration of securities and settlement, how does it identify the risks associated with those activities, including potential credit and liquidity risks? How does it measure, monitor and manage these risks, including legally separating services other than safekeeping and administration of securities where necessary? Not applicable Not applicable Overall observance of Principle 11 Not Applicable

Page 67 of 104 Principle Key Consideration Questions Comments RATING Principle 12: Exchange-of-value settlement systems: If an FMI settles transactions that involve the settlement of two linked obligations (for example, securities or foreign exchange transactions), it should eliminate principal risk by conditioning the final settlement of one obligation upon the final settlement of the other. Key consideration 1: An FMI that is an exchange-of-value settlement system should eliminate principal risk by ensuring that the final settlement of one obligation occurs if and only if the final settlement of the linked obligation also occurs, regardless of whether the FMI settles on a gross or net basis and when finality occurs. Q.12.1.1: How do the FMI’s legal, contractual, technical and risk management frameworks ensure that the final settlement of relevant financial instruments eliminates principal risk? What procedures ensure that the final settlement of one obligation occurs if and only if the final settlement of a linked obligation also occurs? Not applicable Not applicable Q.12.1.2: How are the linked obligations settled – on a gross basis (trade by trade) or on a net basis? Not applicable Not applicable Q.12.1.3: Is the finality of settlement of linked obligations simultaneous? If not, what is the timing of finality for both obligations? Is the length of time between the blocking and final settlement of both obligations minimised? Are blocked assets protected from a claim by a third party? Not applicable Not applicable

Page 68 of 104 Principle Key Consideration Questions Comments RATING Q.12.1.4: In the case of a CCP, does the CCP rely on the DvP or PvP services provided by another FMI, such as an SSS or payment system? If so, how would the CCP characterise the level of its reliance on such services? What contractual relationship does the CCP have with the SSS or payment system to ensure that final settlement of one obligation occurs only when the final settlement of any linked obligations occurs? Not applicable Not applicable Overall observance of Principle 12 Not Applicable Principle 13 Participant-default rules and procedures; An FMI should have effective and clearly defined rules and procedures to manage a participant default that ensure that the FMI can take timely action to contain losses and liquidity pressures, and continue to meet its obligations. Key consideration 1: An FMI should have default rules and procedures that enable the FMI to continue to meet its obligations in the event of a participant default and that address the replenishment of resources following a default. Participant default rules and procedures Q.13.1.1: Do the FMI’s rules and procedures clearly define an event of default (both a financial and an operational default of a participant) and the method for identifying a default? How are these events defined? Operating rules and procedures. Credit push system, penalties associated with default Observed Q.13.1.2: How do the FMI’s rules and procedures address the following key aspects of a participant default:

Page 69 of 104 Principle Key Consideration Questions Comments RATING a) the actions that the FMI can take when a default is declared; Contact the parties involved so that they set the motion to rectify the position but no risk is involved as the system is credit push Observed b) the extent to which the actions are automatic or discretionary; For automatic actions, they are in-built in the system. For the discretionary actions, they are outlined in the rules Observed c) changes to normal settlement practices; The system caters for major changes in the normal settlement practices Observed d) the management of transactions at different stages of processing; In-built in the system Observed e) the expected treatment of proprietary and customer transactions and accounts; N/A Not applicable f) the probable sequencing of actions; Well laid down procedures Observed g) the roles, obligations and responsibilities of the various parties, including non-defaulting participants; and Well laid down procedures Observed h) the existence of other mechanisms that may be activated to contain the impact of a default? The use of collateral Observed Use of financial resources Q.13.1.3: How do the FMI’s rules and procedures allow the FMI to promptly use any financial resources that it maintains for covering losses and containing liquidity pressures arising from default, including liquidity facilities? Not applicable Not applicable

Page 70 of 104 Principle Key Consideration Questions Comments RATING Q.13.1.4: How do the FMI’s rules and procedures address the order in which the financial resources can be used? Not applicable Not applicable Q.13.1.5: How do the FMI’s rules and procedures address the replenishment of resources following a default? Not applicable Not applicable Key consideration 2: An FMI should be well prepared to implement its default rules and procedures, including any appropriate discretionary procedures provided for in its rules. Q.13.2.1: Does the FMI’s management have internal plans that clearly delineate the roles and responsibilities for addressing a default? What are these plans? Captured in our rules and procedures Observed Q.13.2.2: What type of communication procedures does the FMI have in order to reach in a timely manner all relevant stakeholders, including regulators, supervisors and overseers? Email, telephone, broadcasts Observed Q.13.2.3: How frequently are the internal plans to address a default reviewed? What is the governance arrangement around these plans? Annually or as and when it is required. The FMI involves participants and other stakeholders in the testing and review of its procedures. Observed Key consideration 3: An FMI should publicly disclose key aspects of its default rules and procedures. Q.13.3.1: How are the key aspects of the FMI’s participant default rules and procedures made publicly available? How do they address: currently, they are not publicly available, though they are well distributed to the participants Observed

Page 71 of 104 Principle Key Consideration Questions Comments RATING a) the circumstances in which action may be taken; It is covered in the rules Observed b) who may take those actions; It depends on the party that has defaulted Observed c) the scope of the actions which may be taken, including the treatment of both proprietary and customer positions, funds and assets; Not applicable Not applicable d) the mechanisms to address an FMI’s obligations to non￾defaulting participants; and Not applicable Not applicable e) where direct relationships exist with participants’ customers, the mechanisms to help address the defaulting participant’s obligations to its customers? Not applicable Not applicable Key consideration 4: An FMI should involve its participants and other stakeholders in the testing and review of the FMI’s default procedures, including any close-out procedures. Such testing and review should be conducted at least annually or following material changes to the rules and procedures to ensure that they are practical and effective. Q.13.4.1: How does the FMI engage with its participants and other relevant stakeholders in the testing and review of its participant default procedures? How frequently does it conduct such tests and reviews? How are these tests results used? To what extent are the results shared with the board, risk committee and relevant authorities? Not applicable Not Applicable

Page 72 of 104 Principle Key Consideration Questions Comments RATING Q.13.4.2: What range of potential participant default scenarios and procedures do these tests cover? To what extent does the FMI test the implementation of the resolution regime for its participants? Not applicable Not applicable Overall observance of Principle 13 Observed Principle 15 General business risk: An FMI should identify, monitor, and manage its general business risk and hold sufficiently liquid net assets funded by equity to cover potential general business losses so that it can continue providing services as a going concern. This amount should at all times be sufficient to ensure an orderly wind-down or reorganization of the FMI’s critical operations and services over an appropriate time period. Key Considerations for Management of General business risk Key consideration 1: An FMI should have robust management and control systems to identify, monitor, and manage general business risks, including losses from poor execution of business strategy, negative cash flows, or unexpected and excessively large operating expenses. Q.15.1.1: How does the FMI identify its general business risks? What general business risks has the FMI identified? Risk management Framework Observed Q.15.1.2: How does the FMI monitor and manage its general business risks on an ongoing basis? Does the FMI’s business risk assessment consider the potential effects on its cash flow and (in the case of a privately operated FMI) capital? Review periodically Risk management framework against risk within operations Observed

Page 73 of 104 Principle Key Consideration Questions Comments RATING Key consideration 2: An FMI should hold liquid net assets funded by equity (such as common stock, disclosed reserves, or other retained earnings) so that it can continue operations and services as a going concern if it incurs general business losses. The amount of liquid net assets funded by equity an FMI should hold should be determined by its general business risk profile and the length of time required to achieve a recovery or orderly wind-down, as appropriate, of its critical operations and services if such action is taken. Q.15.2.1: Does the FMI hold liquid net assets funded by equity so that it can continue operations and services as a going concern if it incurs general business losses? Not applicable Not applicable Q.15.2.2: How does the FMI calculate the amount of liquid net assets funded by equity to cover its general business risks? How does the FMI determine the length of time and associated operating costs of achieving a recovery or orderly wind-down of critical operations and services? Not applicable Not applicable Key consideration 3: An FMI should maintain a viable recovery or orderly wind-down plan and should hold sufficient liquid net assets funded by equity to implement this plan. At a minimum, an FMI should hold liquid net assets funded by equity equal to at least six months of current operating expenses. These assets are in addition to resources held to cover participant defaults or other risks covered under the financial resources principles. However, equity held under international risk-based capital standards can be included where relevant and appropriate to avoid duplicate capital requirements. Recovery or orderly wind-down plan Q.15.3.1: Has the FMI developed a plan to achieve a recovery or orderly wind-down, Not applicable Not applicable

Page 74 of 104 Principle Key Consideration Questions Comments RATING as appropriate? If so, what does this plan take into consideration (for example, the operational, technological and legal requirements for participants to establish and move to an alternative arrangement)? Resources Q.15.3.2: What amount of liquid net assets funded by equity is the FMI holding for purposes of implementing this plan? How does the FMI determine whether this amount is sufficient for such implementation? Is this amount at a minimum equal to six months of the FMI’s current operating expenses? Not applicable Not applicable Q.15.3.3: How are the resources designated to cover business risks and losses separated from resources designated to cover participant defaults or other risks covered under the financial resources principles? Not applicable Not applicable Q.15.3.4: Does the FMI include equity held under international risk-based capital standards to cover general business risks? Not applicable Not applicable Key consideration 4: Assets held to cover general business risk should be of high quality and sufficiently liquid in order to allow the FMI to meet its current and projected operating expenses under a range of scenarios, including in adverse market conditions. Q.15.4.1: What is the composition of the FMI’s liquid net assets funded by equity? Not applicable Not applicable

Page 75 of 104 Principle Key Consideration Questions Comments RATING How will the FMI convert these assets as needed into cash at little or no loss of value in adverse market conditions? Q.15.4.2: How does the FMI regularly assess the quality and liquidity of its liquid net assets funded by equity to meet its current and projected operating expenses under a range of scenarios, including in adverse market conditions? Not applicable Not applicable Key consideration 5: An FMI should maintain a viable plan for raising additional equity should its equity fall close to or below the amount needed. This plan should be approved by the board of directors and updated regularly. Not applicable Not applicable Q.15.5.1: Has the FMI developed a plan to raise additional equity? What are the main features of the FMI’s plan to raise additional equity should its equity fall close to or fall below the amount needed? Not applicable Not applicable Q.15.5.2: How frequently is the plan to raise additional equity reviewed and updated? Not applicable Not applicable Q.15.5.3: What is the role of the FMI’s board (or equivalent) in reviewing and approving the FMI’s plan to raise additional equity if needed? Not applicable Not applicable Overall observance of Principle 15 Observed

Page 76 of 104 Principle Key Consideration Questions Comments RATING Principle 16: Custody and investment risks: An FMI should safeguard its own and its participants’ assets and minimise the risk of loss on and delay in access to these assets. An FMI’s investments should be in instruments with minimal credit, market, and liquidity risks. Key consideration 1: An FMI should hold its own and its participants’ assets at supervised and regulated entities that have robust accounting practices, safekeeping procedures, and internal controls that fully protect these assets. Q.16.1.1: If the FMI uses custodians, how does the FMI select its custodians? What are the specific selection criteria the FMI uses, including supervision and regulation of these entities? How does the FMI monitor the custodians’ adherence to these criteria? Not applicable Not applicable Q.16.1.2: How does the FMI verify that these entities have robust accounting practices, safekeeping procedures, and internal controls that fully protect its and its participants’ assets? Not applicable Not applicable Key consideration 2: An FMI should have prompt access to its assets and the assets provided by participants, when required. Q.16.2.1: How has the FMI established that it has a sound legal basis to support enforcement of its interest or ownership rights in assets held in custody? Not applicable Not applicable Q.16.2.2: How does the FMI ensure that it has prompt access to its assets, including securities that are held with a custodian in Not applicable Not applicable

Page 77 of 104 Principle Key Consideration Questions Comments RATING another time zone or legal jurisdiction, in the event of participant default? Key consideration 3: An FMI should evaluate and understand its exposures to its custodian banks, taking into account the full scope of its relationships with each. Q.16.3.1: How does the FMI evaluate and understand its exposures to its custodian banks? In managing those exposures, how does it take into account the full scope of its relationship with each custodian bank? For instance, does the FMI use multiple custodians for the safekeeping of its assets to diversify exposure to any single custodian? How does the FMI monitor concentration of risk exposures to its custodian banks? Not applicable Not applicable Key consideration 4: An FMI’s investment strategy should be consistent with its overall risk-management strategy and fully disclosed to its participants, and investments should be secured by, or be claims on, high-quality obligors. These investments should allow for quick liquidation with little, if any, adverse price effect. Investment strategy Q.16.4.1: How does the FMI ensure that its investment strategy is consistent with its overall risk management strategy? How and to whom does the FMI disclose its investment strategy? Not applicable Not applicable

Page 78 of 104 Principle Key Consideration Questions Comments RATING Q.16.4.2: How does the FMI ensure on an ongoing basis that its investments are secured by, or are claims on, high-quality obligors? Not applicable Not applicable Risk characteristics of investments Not applicable Not applicable Q.16.4.3: How does the FMI consider its overall exposure to an obligor in choosing investments? What investments are subject to limits to avoid concentration of credit risk exposures? Not applicable Not applicable Q.16.4.4: Does the FMI invest participant assets in the participants’ own securities or those of its affiliates? Not applicable Not applicable Q.16.4.5: How does the FMI ensure that its investments allow for quick liquidation with little, if any, adverse price effect? Not applicable Not applicable Overall observance of Principle 16 Not applicable Principle 17: Operational risk; An FMI should identify all plausible sources of operational risk, both internal and external, and minimise their impact through the deployment of appropriate systems, controls, and procedures. Systems should ensure a high degree of security and operational reliability, and have adequate, scalable capacity. Business continuity plans should aim for timely recovery of operations and fulfilment of the FMI’s obligations, including in the event of a wide-scale disruption. Key Considerations for Management of Operational Risk

Page 79 of 104 Principle Key Consideration Questions Comments RATING Q.17.1.1: What are the FMI’s policies and processes for identifying the plausible sources of operational risks? How do the FMI’s processes identify plausible sources of operational risks, whether these risks arise from internal sources (for example, the arrangements of the system itself, including human resources), from the FMI’s participants or from external sources? Operating procedures, Risk management framework, ZETSS operating rules; Monitoring the system, System logs, Password management, access security, no two factor authentication(TFA); Issue to be addressed within the next six months. Observed Q.17.1.2: What sources of operational risks has the FMI identified? What single points of failure in its operations has the FMI identified? Power, telecommunication, civil unrest, fire. Observed Management of operational risk Q.17.1.3: How does the FMI monitor and manage the identified operational risks? Where are these systems, policies, procedures and controls documented? The FMI uses logs, call register and daily assessments. Management is by engagement with the relevant authorities. They are documented in the operating rules and procedures. Observed Policies, processes and controls Q.17.1.4: What policies, processes and controls does the FMI employ that are designed to ensure that operational procedures are implemented appropriately? To what extent do the FMI’s systems, policies, processes and controls take into consideration relevant international, national and All participants should adhere to the rules and procedures. There is a standing policy that all should sign that they understood the rules. Controls include passwords and no self authorisation. To a greater extent, the FMI adheres to international best practice. Observed

Page 80 of 104 Principle Key Consideration Questions Comments RATING industry-level operational risk management standards? Q.17.1.5: What are the FMI’s human resources policies to hire, train and retain qualified personnel, and how do such policies mitigate the effects of high rates of personnel turnover or key-person risk? How do the FMI’s human resources and risk management policies address fraud prevention? The FMI's Human Resources is covered by the Central Bank's Human Resources Management Policy. The FMI adheres to on the job training, attachments, engagements, attending relevant workshops within the region and beyond. The FMI also ensures job enrichment. Observed Q.17.1.6: How do the FMI’s change management and project management policies and processes mitigate the risks that changes and major projects inadvertently affect the smooth functioning of the system? The change management policy is signed at the highest level. There is a Test environment that ensures that any change aspect is effectively tested before being implemented. Observed Key consideration 2: An FMI’s board of directors should clearly define the roles and responsibilities for addressing operational risk and should endorse the FMI’s operational risk-management framework. Systems, operational policies, procedures, and controls should be reviewed, audited, and tested periodically and after significant changes. Roles, responsibilities and framework Q.17.2.1: How has the board of directors defined the key roles and responsibilities for operational risk management? The FMI has a risk management framework which feeds into the organisational risk framework Observed

Page 81 of 104 Principle Key Consideration Questions Comments RATING Q.17.2.2: Does the FMI’s board explicitly review and endorse the FMI’s operational risk management framework? How frequently does the board review and endorse the FMI’s operational risk management framework? It is reviewed as the organisational framework is being reviewed. Observed Review, audit and testing Observed Q.17.2.3: How does the FMI review, audit and test its systems, policies, procedures and controls, including its operational risk management arrangements with participants? How frequently does the FMI conduct these reviews, audits and tests with participants? 12-24 months’ resolution, market wide and DR tests not been conducted annually on a consistent basis. Users have not physically operated from the DR site even though remote access from the DR is being done. Partially Observed Q.17.2.4: To what extent, where relevant, is the FMI’s operational risk management framework subject to external audit? External auditors have audited the FMI. Observed Key consideration 3: An FMI should have clearly defined operational reliability objectives and should have policies in place that are designed to achieve those objectives. Q.17.3.1: What are the FMI’s operational reliability objectives, both qualitative and quantitative? Where and how are they documented? The system's uptime should be 99.999%. These are documented in the operational procedures. Observed Q.17.3.2: How do these objectives ensure a high degree of operational reliability? Speedy turnaround time to resolve any challenges on the system. Observed Q.17.3.3: What are the policies in place that are designed to achieve the FMI’s operational reliability objectives to ensure Business Continuity and the Disaster Recovery site ensures that the system is available to the participants at all times. Observed

Page 82 of 104 Principle Key Consideration Questions Comments RATING that the FMI takes appropriate action as needed? Key consideration 4: An FMI should ensure that it has scalable capacity adequate to handle increasing stress volumes and to achieve its service-level objectives. Q.17.4.1: How does the FMI review, audit and test the scalability and adequacy of its capacity to handle, at a minimum, projected stress volumes? How frequently does the FMI conduct these reviews, audits and tests? Stress testing is critical to assess system capacity. There is need for consistent annual Stress Testing. Observed Q.17.4.2: How are situations where operational capacity is neared or exceeded addressed? System upgrades - the system supplier can provide intermittent solutions. Observed Key consideration 5: An FMI should have comprehensive physical and information security policies that address all potential vulnerabilities and threats. Physical security Q.17.5.1: What are the FMI’s policies and processes, including change management and project management policies and processes, for addressing the plausible sources of physical vulnerabilities and threats on an ongoing basis? Controlled access and password management create physical barriers to address such threats. Observed Q.17.5.2: Do the FMI’s policies, processes, controls and testing appropriately take into consideration relevant international, national and industry-level standards for physical security? Physical security policy is in line with the relevant international, national, and industry-level standards. Observed

Page 83 of 104 Principle Key Consideration Questions Comments RATING Information security Q.17.5.3: What are the FMI’s policies and processes, including change management and project management policies and processes, for addressing the plausible sources of information security vulnerabilities and threats on an ongoing basis? It is managed by the organisational ICT policy. At departmental level, the information is safeguarded by access control, that is, password control and limited physical access. Observed Q.17.5.4: Do the FMI’s policies, processes, controls and testing appropriately take into consideration relevant international, national and industry-level standards for information security? Yes Observed Key consideration 6: An FMI should have a business continuity plan that addresses events posing a significant risk of disrupting operations, including events that could cause a wide-scale or major disruption. The plan should incorporate the use of a secondary site and should be designed to ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events. The plan should be designed to enable the FMI to complete settlement by the end of the day of the disruption, even in case of extreme circumstances. The FMI should regularly test these arrangements. Objectives of business continuity plan Q.17.6.1: How and to what extent does the FMI’s business continuity plan reflect objectives, policies and procedures that allow for the rapid recovery and timely resumption of critical operations following a wide-scale or major disruption? To a greater extent as the FMI has a DR site. Observed

Page 84 of 104 Principle Key Consideration Questions Comments RATING Design of business continuity plan Q.17.6.2: How and to what extent is the FMI’s business continuity plan designed to enable critical IT systems to resume operations within two hours following disruptive events, and to enable the FMI to facilitate or complete settlement by the end of the day even in extreme circumstances? To a greater extent. The proximity of the DR site allows that the operator can move to the DR site and resume operations within 2 hours. Observed Q.17.6.3: How is the contingency plan designed to ensure that the status of all transactions can be identified in a timely manner, at the time of the disruption; and if there is a possibility of data loss, what are the procedures to deal with such loss (for example, reconciliation with participants or third parties)? The FMI has data back up and replication with the DR site. Observed Q.17.6.4: How do the FMI’s crisis management procedures address the need for effective communications internally and with key external stakeholders and authorities? Business continuity procedures are used in the event of a crisis. Observed Secondary site Q.17.6.5: How does the FMI’s business continuity plan incorporate the use of a secondary site (including ensuring that the secondary site has sufficient resources, capabilities, functionalities and The DR site is appropriately located in an area with a distinct risk profile. Broadly Observed

Page 85 of 104 Principle Key Consideration Questions Comments RATING appropriate staffing arrangements)? To what extent is the secondary site located a sufficient geographic distance from the primary site such that it has a distinct risk profile? Q.17.6.6: Has the FMI considered alternative arrangements (such as manual, paper-based procedures or other alternatives) to allow the processing of time-critical transactions in extreme circumstances? We have alternatives in place. Observed Review and testing Q.17.6.7: How are the FMI’s business continuity and contingency arrangements reviewed and tested, including with respect to scenarios related to wide-scale and major disruptions? How frequently are these arrangements reviewed and tested? Review is done annually, or as and when it deems necessary. Observed Q.17.6.8: How does the review and testing of the FMI’s business continuity and contingency arrangements involve the FMI’s participants, critical service providers and linked FMIs as relevant? How frequently are the FMI’s participants, critical service providers and linked FMIs involved in the review and testing? Review process involves all relevant stakeholders. They are involved at every review. Observed

Page 86 of 104 Principle Key Consideration Questions Comments RATING Key consideration 7: An FMI should identify, monitor, and manage the risks that key participants, other FMIs, and service and utility providers might pose to its operations. In addition, an FMI should identify, monitor, and manage the risks its operations might pose to other FMIs. Risks to the FMI’s own operations Q.17.7.1: What risks has the FMI identified to its operations arising from its key participants, other FMIs, and service and utility providers? How and to what extent does the FMI monitor and manage these risks? Network, communications and power, reputational, operational, liquidity risks. Observed Q.17.7.2: If the FMI has outsourced services critical to its operations, how and to what extent does the FMI ensure that the operations of a critical service provider meet the same reliability and contingency requirements they would need to meet if they were provided internally? Contracts and service level agreements. Observed Risks posed to other FMIs Q.17.7.3: How and to what extent does the FMI identify, monitor and mitigate the risks it may pose to another FMI? Regular monitoring of the system. Observed Q.17.7.4: To what extent does the FMI coordinate its business continuity arrangements with those of other interdependent FMIs? Currently there is none. Observed Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking

Page 87 of 104 Principle Key Consideration Questions Comments RATING Need for annual Stress Testing and capacitation to do same The Bank cannot gauge risk and the adequacy of systems in the worst case scenarios, as well as evaluate internal processes and controls. Low – can be resolved during normal course of business The intermittent power outages has resulted in poor communication which in turn affects the free flow of transactions. There is need to continuously encourage participants to have reliable back up power facilities. Failure to settle transactions and instability on the market. Low – can be resolved during normal course of business DR tests not been conducted for the past 10 years. Users have not physically operated from the DR site even though remote access from the DR is being done. Operational risk Medium – 6 to 12 months No two factor authentication(TFA); Issue to be addressed within the next six months Cybersecurity risk High – needs immediate remediation The DR site is appropriately located in an area with a distinct risk profile, although it is located in a fire rated zone because of fuel tanks. Operational risk Medium – 12 to 18 months Overall observance of Principle 17 Notwithstanding the documented processes and procedures to mitigate Operational risk there for annual DR tests, installation of Two Factor Authentication . Broadly Observed

Page 88 of 104 Principle Key Consideration Questions Comments RATING Principle 18 Access and participation requirements: An FMI should have objective, risk-based, and publicly disclosed criteria for participation, which permit fair and open access. Key consideration 1: An FMI should allow for fair and open access to its services, including by direct and, where relevant, indirect participants and other FMIs, based on reasonable risk-related participation requirements. Participation criteria and requirements Q.18.1.1: What are the FMI’s criteria and requirements for participation (such as operational, financial and legal requirements)? Should be a registered financial institution whether a bank or deposit taking microfinance, as enshrined in the NPS act in relation to other relevant acts. Observed Q.18.1.2: How do these criteria and requirements allow for fair and open access to the FMI’s services, including by direct and, where relevant, indirect participants and other FMIs, based on reasonable risk-related participation requirements? Costs associated with participating on the FMI are well documented, outlined and accessible to prospective participants. Requirements to join are well laid down. Observed Access to trade repositories Q.18.1.3: For a TR, how do the terms of access for use of its services help ensure that competition and innovation in post-trade processing are not impaired? How are these terms designed to support interconnectivity with other FMIs and service providers, where requested? Not applicable Not Applicable

Page 89 of 104 Principle Key Consideration Questions Comments RATING Key consideration 2: An FMI’s participation requirements should be justified in terms of the safety and efficiency of the FMI and the markets it serves, be tailored to and commensurate with the FMI’s specific risks, and be publicly disclosed. Subject to maintaining acceptable risk control standards, an FMI should endeavour to set requirements that have the least-restrictive impact on access that circumstances permit. Justification and rationale of participation criteria. Q.18.2.1: How are the participation requirements for the FMI justified in terms of the safety and efficiency of the FMI and its role in the markets it serves, and tailored to and commensurate with the FMI’s specific risks? The FMI consult with relevant departments like Bank Supervision. The participant should be registered on SWIFT network prior to coming on board and the potential participant should have tested Relationship Management Agreements with other participants. Observed Q.18.2.2: Are there participation requirements that are not risk￾based but required by law or regulation? If so, what are these requirements? A participant should be regulated deposit taking institution. Observed Q.18.2.3: Are all classes of participant’s subject to the same access criteria? If not, what is the rationale for the different criteria (for example, size or type of activity, additional requirements for participants that act on behalf of third parties, and additional requirements for participants that are non-regulated entities)? All classes of participants are subject to the same criteria. Observed Least restrictive access Q.18.2.4: How are the access restrictions and requirements reviewed to ensure that they have the least restrictive access They are reviewed as and when the situation arises. Observed

Page 90 of 104 Principle Key Consideration Questions Comments RATING that circumstances permit, consistent with maintaining acceptable risk controls? How frequently is this review conducted? Disclosure of criteria Q.18.2.5: How are participation criteria, including restrictions in participation, publicly disclosed? They are not publicly shared but are given to potential applicants. Broadly Observed Key consideration 3: An FMI should monitor compliance with its participation requirements on an ongoing basis and have clearly defined and publicly disclosed procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meets, the participation requirements. Monitoring compliance Q.18.3.1: How does the FMI monitor its participants’ ongoing compliance with the access criteria? How are the FMI’s policies designed to ensure that the information it uses to monitor compliance with participation criteria is timely and accurate? They need to fulfil the requirement before coming on board. Observed Q.18.3.2: What are the FMI’s policies for conducting enhanced surveillance of, or imposing additional controls on, a participant whose risk profile deteriorates? Real time monitoring mechanisms and trend analysis. Observed Suspension and orderly exit Q.18.3.3: What are the FMI’s procedures for managing the suspension and orderly exit of a participant that breaches, or no longer meets, the participation requirements? According to NPS Act, clearing house rules, ZETSS Operating rules 2009 chapter 4 and 5, on the admission of new participants and withdrawal or suspension of participants. Observed

Page 91 of 104 Principle Key Consideration Questions Comments RATING These chapters clearly define requirements on admission, withdrawal and suspension from ZETSS. In both instances, authority is sought and given by the Central Bank and all other ZETSS participants are advised accordingly. Q.18.3.4: How are the FMI’s procedures for managing the suspension and orderly exit of a participant disclosed to the public? They are not publicly shared but are given to potential applicants. Broadly Observed Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking Access criteria not publicised on the website Reputation risk, there is need to enhance transparency by providing information to the public. Medium – 12 to 18 months Overall observance of Principle 18 Observed Principle 19: Tiered participation arrangements; An FMI should, to the extent practicable, identify, understand, and manage the risks to it arising from tiered participation arrangements. Key consideration 1: An FMI should ensure that its rules, procedures, and agreements allow it to gather basic information about indirect participation in order to identify, monitor, and manage any material risks to the FMI arising from such tiered participation arrangements. Tiered participation arrangements Q.19.1.1: Does the FMI have any tiered participation arrangements? If so, describe these arrangements. Yes. The Cheque clearing and Central Securities Depository for government securities. ZETSS has ability and capacity to monitor, account and record number of individual Observed

Page 92 of 104 Principle Key Consideration Questions Comments RATING transactions and their values for indirect participants like Cheque and ZIMSWITCH Clearing Houses. Such information is gathered and reported through Real Time Mechanism/Liquidity Optimizing Mechanism statements. There should be guidelines in place to ensure that participants understand risks associated with tiered participation arrangements. Q.19.1.2: How does the FMI gather basic information about indirect participation? Which information is collected and how frequently is it updated? The FMI gathers data through statistical information from the system. The FMI regularly reviews risks to which it may be exposed as a result of tiered participation arrangements and reports results of material risk to the board of directors and as well take mitigating action where appropriate. Observed Risks to the FMI Q.19.1.3: How does the FMI evaluate its risks arising from these arrangements? The FMI identifies, monitors, and manages the material risks to the FMI arising from tiered participation arrangements. Observed Q.19.1.4: What material risks to the FMI arising from tiered participation arrangements has the FMI identified? How has it mitigated these risks? Settlement risk mitigated through Delivery Versus Payment for CSD and collateral for clearing. There is manual interface in batch uploading. Observed Key consideration 2: An FMI should identify material dependencies between direct and indirect participants that might affect the FMI.

Page 93 of 104 Principle Key Consideration Questions Comments RATING Q.19.2.1: How does the FMI identify material dependencies between direct and indirect participants that might affect the FMI? Not applicable Not Applicable Key consideration 3: An FMI should identify indirect participants responsible for a significant proportion of transactions processed by the FMI and indirect participants whose transaction volumes or values are large relative to the capacity of the direct participants through which they access the FMI in order to manage the risks arising from these transactions. Not applicable Not Applicable Q.19.3.1: Has the FMI identified (a) the proportion of activity that each direct participant conducts on behalf of indirect participants in relation to the direct participants’ capacity, ( Not applicable Not Applicable b) direct participants that act on behalf of a material number of indirect participants, Not applicable Not Applicable (c) indirect participants responsible for a significant proportion of turnover in the system, and Not applicable Not Applicable (d) indirect participants whose transaction volumes or values are large relative to the capacity of the direct participant through which they access the FMI to manage risks arising from these transactions? Not applicable Not Applicable

Page 94 of 104 Principle Key Consideration Questions Comments RATING Q.19.3.2: What risks to the FMI arise, and how does the FMI manage these risks arising from key indirect participants? The FMI does not have any indirect participants. Not Applicable Key consideration 4: An FMI should regularly review risks arising from tiered participation arrangements and should take mitigating action when appropriate. Q.19.4.1: What are the FMI’s policies for reviewing its rules and procedures in order to mitigate risks to the FMI arising from tiered participation? How frequently is this review conducted? They are covered in the Operating rules and procedures and reviews are done annually. Observed Q.19.4.2: What criteria does the FMI use to determine when mitigating actions are required? How does the FMI monitor and mitigate its risks? Sanctions are used to influence discipline. Penalties are used to mitigate risk. Observed Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking The batches are manually uploaded Operational risk Medium – 12 to 18 months There should be guidelines in place to ensure that participants understand risks associated with tiered participation arrangements. Operational risk Low – can be resolved during normal course of business Overall observance of Principle 19 Observed Principle 20: FMI Links; An FMI that establishes a link with one or more FMIs should identify, monitor, and manage link-related risks. Key Considerations for Management of FMI Links

Page 95 of 104 Principle Key Consideration Questions Comments RATING Key consideration 1: Before entering into a link arrangement and on an ongoing basis once the link is established, an FMI should identify, monitor, and manage all potential sources of risk arising from the link arrangement. Link arrangements should be designed such that each FMI is able to observe the other principles in this report. Q.20.1.1: What process is used to identify potential sources of risk (such as, legal, credit, liquidity, custody and operational risks) arising from prospective links? How does this affect the FMI’s decision whether to establish the link? Operating rules and guidelines of CSD. In order to get trust from the investor DVP is used. Observed Q.20.1.2: What links have been established with other FMIs? How does the FMI identify, monitor and manage the risks arising from an established link on an ongoing basis? The RTGS and CSD are interfaced but are on different technological versions. Delivery versus Payment link. Continuous monitoring of the systems. Partially Observed Q.20.1.3: How does the FMI ensure that link arrangements are designed so that it is able to remain observant of the other principles? How frequently is this analysis conducted? No scheduled review but it can only be done as and when the need arises. Observed Key consideration 2: A link should have a well-founded legal basis, in all relevant jurisdictions, that supports its design and provides adequate protection to the FMIs involved in the link. Q.20.2.1: In which jurisdictions has the FMI established links? What are the relevant legal frameworks supporting the established links? In Zimbabwe. NPS Act, Operating rules and regulations, Securities Act. Observed Q.20.2.2: How does the FMI ensure that its links have a well￾Operating rules and regulations. Review of the Observed

Page 96 of 104 Principle Key Consideration Questions Comments RATING founded legal basis that support its design and provide it with adequate protection in all relevant jurisdictions? How does the FMI ensure that such protections are maintained over time? rules, regulations and the NPS Act. Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking The RTGS and CSD are on different technological versions. As such there is information asymmetric Operational risk Medium – 12 to 18 months Overall observance of Principle 20 Observed Principle 21 Efficiency and effectiveness: An FMI should be efficient and effective in meeting the requirements of its participants and the markets it serves Key Considerations for Management of efficiency and effectiveness Key consideration 1: An FMI should be designed to meet the needs of its participants and the markets it serves, in particular, with regard to choice of a clearing and settlement arrangement; operating structure; scope of products cleared, settled, or recorded; and use of technology and procedures. Q.21.1.1: How does the FMI determine whether its design (including its clearing and settlement arrangement, its operating structure, its delivery systems and technologies, and its individual services and products) is taking into account the needs of its participants and the markets it serves? The FMI is in constant communication with the market and receives feedback more often. Observed

Page 97 of 104 Principle Key Consideration Questions Comments RATING Q.21.1.2: How does the FMI determine whether it is meeting the requirements and needs of its participants and other users and continues to meet those requirements as they change (for example, through the use of feedback mechanisms)? FMI receives feedback from the market participants through various fora. Observed Key consideration 2: An FMI should have clearly defined goals and objectives that are measurable and achievable, such as in the areas of minimum service levels, risk￾management expectations, and business priorities. Q.21.2.1: What are the FMI’s goals and objectives as far as the effectiveness of its operations is concerned? Ensure settlement finality end of each business day and also efficient operation of the system. Observed Q.21.2.2: How does the FMI ensure that it has clearly defined goals and objectives that are measurable and achievable? Objectives and goals are defined in the operating rules. Observed Q.21.2.3: To what extent have the goals and objectives been achieved? What mechanisms does the FMI have to measure and assess this? To a greater extend the goals and objectives have been achieved. Logging calls and monitoring system closing time. Minute to minute monitoring of the system and checking the message inbox. Observed Key consideration 3: An FMI should have established mechanisms for the regular review of its efficiency and effectiveness. Q.21.3.1: What processes and metrics does the FMI use to evaluate its efficiency and effectiveness? Logging calls and monitoring system closing time. Minute to minute monitoring, message inbox. Uptime records. Observed Q.21.3.2: How frequently does the FMI evaluate its efficiency and effectiveness? On a daily basis the FMI evaluate its efficiency and effectiveness. Observed

Page 98 of 104 Principle Key Consideration Questions Comments RATING Overall observance of Principle 21 Observed Principle 22: Communication procedures and standards; An FMI should use or accommodate the relevant internationally accepted communication procedures and standards in order to facilitate efficient recording, payment, clearing, and settlement across systems. Key consideration 1: An FMI should use, or at a minimum accommodate, internationally accepted communication procedures and standards. Communication procedures Q.22.1.1: Does the FMI use an internationally accepted communications procedure and, if so, which one(s)? If not, how does the FMI accommodate internationally accepted communication procedures? Yes the FMI uses SWIFT. Observed Q.22.1.2: If the FMI engages in cross-border operations, how do the FMI’s operational procedures, processes and systems use or otherwise accommodate internationally accepted communication procedures for cross-border operations? Not applicable Not Applicable Communication standards Q.22.1.3: Does the FMI use an internationally accepted communications standard and, if so, which one(s)? If not, how does the FMI accommodate internationally accepted communication standards? Not applicable Not Applicable

Page 99 of 104 Principle Key Consideration Questions Comments RATING Q.22.1.4: If the FMI engages in cross-border operations, how do the FMI’s operational procedures, processes and systems use or otherwise accommodate internationally accepted communication standards for cross-border operations? Not applicable Not Applicable Q.22.1.5: If no international standard is used, how does the FMI accommodate systems that translate or convert message format and data from international standards into the domestic equivalent and vice versa? Not applicable Not Applicable Overall observance of Principle 22 Observed Principle 23: Disclosure of rules, key procedures, and market data; An FMI should have clear and comprehensive rules and procedures and should provide sufficient information to enable participants to have an accurate understanding of the risks they incur by participating in the FMI. All relevant rules and key procedures should be publicly disclosed. Key consideration 1: An FMI should adopt clear and comprehensive rules and procedures that are fully disclosed to participants. Relevant rules and key procedures should also be publicly disclosed. Rules and procedures Q.23.1.1: What documents comprise the FMI’s rules and procedures? How are these documents disclosed to participants? ZETSS rules and procedures are in place. They are given to participants during the on boarding process. Observed

Page 100 of 104 Principle Key Consideration Questions Comments RATING Q.23.1.2: How does the FMI determine that its rules and procedures are clear and comprehensive? Training sessions are offered to all joining participants to the FMIs. FMI also offer refresher course as per participants' request. Regular reviews. Observed Disclosure Observed Q.23.1.3: What information do the FMI’s rules and procedures contain on the procedures it will follow in non-routine, though foreseeable, events? Business Continuity, joining the FMI, Suspending a participants penalties among others. Observed Q.23.1.4: How and to whom does the FMI disclose the processes it follows for changing its rules and procedures? To participants through user groups. Observed Q.23.1.5: How does the FMI disclose relevant rules and key procedures to the public? System design is made available to participants upon joining, however it is not publicised for general public. Observed Key consideration 2: An FMI should disclose clear descriptions of the system’s design and operations, as well as the FMI’s and participants’ rights and obligations, so that participants can assess the risks they would incur by participating in the FMI. Q.23.2.1: What documents comprise information about the system’s design and operations? How and to whom does the FMI disclose the system’s design and operations? System user guides are available to the participants. Observed Q.23.2.2: How and to whom does the FMI disclose the degree of discretion it can exercise over key decisions that directly affect the operation of the system? To participants through information broadcasts. Observed Q.23.2.3: What information does the FMI provide to its Operating rules and guidelines. Observed

Page 101 of 104 Principle Key Consideration Questions Comments RATING participants about their rights, obligations and risks incurred through participation in the FMI? Key consideration 3: An FMI should provide all necessary and appropriate documentation and training to facilitate participants’ understanding of the FMI’s rules and procedures and the risks they face from participating in the FMI. Q.23.3.1: How does the FMI facilitate its participants’ understanding of the FMI’s rules, procedures and the risks associated with participating? Training sessions are offered to all joining participants to the FMIs. FMI also offer refresher course as per participants' request. Regular reviews. Rules and procedures available for participants. Observed Q.23.3.2: Is there evidence that the means described above enable participants’ understanding of the FMI’s rules, procedures and the risks they face from participating in the FMI? Feedback and measurement of how the participants are operating. Observed Q.23.3.3: In the event that the FMI identifies a participant whose behaviour demonstrates a lack of understanding of the FMI’s rules, procedures and the risks of participation, what remedial actions are taken by the FMI? Offer refresher courses. Observed Key consideration 4: An FMI should publicly disclose its fees at the level of individual services it offers as well as its policies on any available discounts. The FMI should provide clear descriptions of priced services for comparability purposes.

Page 102 of 104 Principle Key Consideration Questions Comments RATING Q.23.4.1: Does the FMI publicly disclose its fees at the level of its individual services and policies on any available discounts? How is this information disclosed? FMIs fees, charges and penalties, discounts are made available to all participants through the system. Any changes are communicated through letters. Observed Q.23.4.2: How does the FMI notify participants and the public, on a timely basis, of changes to services and fees? They are notified through letters and system notifications. Observed Q.23.4.3: Does the FMI provide a description of its priced services? Do these descriptions allow for comparison across similar FMIs? The information is available to the public for comparative purposes. Observed Q.23.4.4: Does the FMI disclose information on its technology and communication procedures, or any other factors that affect the costs of operating the FMI? Yes, it discloses to the participants information concerning upgrades etc. Observed Key consideration 5: An FMI should complete regularly and disclose publicly responses to the CPMI-IOSCO disclosure framework for financial market infrastructures. An FMI also should, at a minimum, disclose basic data on transaction volumes and values. Q.23.5.1: When did the FMI last complete the CPMI-IOSCO Disclosure framework for financial market infrastructures? How frequently is it updated? Is it updated following material changes to the FMI and its environment and, at a minimum, every two years? Annually Observed Q.23.5.2: What quantitative information does the FMI disclose to the public? How Transactional activities and information on ZETSS is Observed

Page 103 of 104 Principle Key Consideration Questions Comments RATING often is this information updated? available on the RBZ website for use by various stakeholders. Q.23.5.3: What other information does the FMI disclose to the public? How to use the system and operating times. Observed Q.23.5.4: How does the FMI disclose this information to the public? In which language(s) are the disclosures provided? Through website using English. Observed Key Conclusions Gap / shortcoming Risk associated with gaps Severity Ranking The operating rules and procedures are not on the FMI website Reputational risk Low – can be resolved during normal course of business Overall observance of Principle 23 Observed Overall ZETSS Rating Observed 8. CONCLUSION To enhance the safety and stability of the National Payment Systems the Bank continues to strive for safety and integrity of the payment, clearing and security settlement systems. Consistent with that, the Bank will also become more adept at anticipating and prioritising emerging threats, thereby becoming more responsive and effective at combating potential risks in the payment ecosystem. In this regard, Bank will continue to work towards ensuring the review of the legal framework, enabling two factor authentication on ZETSS, Disaster Recovery Testing on an annual basis, enhancement of the DR site, as well as ensure the upgrade of the CSD system.

Page 104 of 104 0000000