High-Level Controls Module for Ancillary Service Providers (Volume 5)

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HIGH-LEVEL CONTROLS
MODULE

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Table of Contents: Page 1 of 2
MODULE: HC (High-Level Controls)
Table of Contents
Date Last
Changed
HC-A Introduction
HC-A.1 Purpose 2017
HC-A.2 Module History 2017
HC-B Scope of Application
HC-B.1 License Categories 2017
HC-1 The Board
HC-1.1 Principle 2017
HC-1.2 Role and Responsibilities 2017
HC-1.3 Composition 2017
HC-1.4 Decision Making Process 2017
HC-1.5 Independence of Judgment 2017
HC-1.6 Directors’ Access to Independent Advice 2017 HC-1.7 Directors’ Communication with Management 2017 HC-1.8 Committees of the Board 2017 HC-1.9 Evaluation of the Board and Each Committee 2017 HC-1.10 Annual Board Review and Certification 2017 HC-2 Approved Persons Loyalty HC-2.1 Principle 2017 HC-2.2 Personal Accountability 2017 HC-2.3 Avoidance of Conflicts of Interest 2017 HC-2.4 Disclosure of Conflicts of Interest 2017 HC-2.5 Disclosure of Conflicts of Interest to Shareholders 2017 HC-3 Audit Committee and Financial Statements Certification HC-3.1 Principle 2017 HC-3.2 Audit Committee 2017 HC-3.3 Audit Committee Charter 2017 HC-3.4 CEO and CFO Certifcation of Financial Statements 2017 HC-4 Appointment, Training and Evaluation of the Board HC-4.1 Principle 2017 HC-4.2 Board Nominations to Shareholders 2017 HC-4.3 Induction and Training of Directors 2017

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Table of Contents: Page 2 of 2
MODULE: HC (High-Level Controls)
Table of Contents (continued)
Date Last
Changed
HC-5 Remuneration of Approved Persons
HC-5.1 Principle 2017
HC-5.2 Role of Board of Directors 2017
HC-5.3 Standard for all Remuneration 2017
HC-5.4 Directors’ Remuneration 2017
HC-5.5 Senior Management Remuneration 2017
HC-6 Management Structure
HC-6.1 Principle 2017
HC-6.2 Establishment of Management Structure 2017 HC-6.3 Titles, Authorities, Duties and Reporting Responsibilities 2017 HC-6.4 Internal Audit 2017 HC-6.5 Compliance 2017 HC-7 Communication between Board and Shareholders HC-7.1 Principle 2017 HC-7.2 Conduct of Shareholders’ Meetings 2017 HC-7.3 Direct Shareholder Communication 2017 HC-7.4 Controllers 2017 HC-8 Corporate Governance Disclosure HC-8.1 Principle 2017 HC-8.2 Disclosure under the Commercial Companies Law 2001 and CBB Requirements 2017 HC-9 TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.1 The Board 2017 HC-9.2 Approved Persons Loyalty 2017 HC-9.3 Financial Statements Certification 2017 HC-9.4 Appointment, Training and Evaluation of the Board 2017 HC-9.5 Remuneration of Approved Persons 2017 HC-9.6 Management Structure 2017 HC-9.7 Communication between Board and Shareholders 2017 HC-9.8 Corporate Governance Disclosure 2017
Appendix A Audit Committee 2017
Appendix B Corporate Governance Disclosure to
Shareholders
2017

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-A.1: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-A: Introduction
HC-A.1 Purpose
Executive Summary
HC-A.1.1 This Module presents requirements that have to be met by ancillary service provider licensees with respect to:
(a) Corporate governance principles issued by the Ministry of Industry and Commerce as The Corporate Governance Code; and (b) Related high-level controls and policies. HC-A.1.2 The purpose of the Module is to establish best practice corporate governance principles in the Kingdom of Bahrain, and to provide protection for shareholders and other company stakeholders through compliance with those principles. HC-A.1.3 All references in this Module to ‘he’ or ‘his’ shall, unless the context otherwise requires, be construed as also being references to ‘she’ and ‘her’. The Comply or Explain Principle for Guidance Paragraphs HC-A.1.4 All ancillary service provider licensees must comply with the Guidance in Module HC or explain their noncompliance by way of a report to their shareholders and to the CBB annually (see Chapter HC-8). Monitoring and Enforcement of Module HC HC-A.1.5 It is the Board’s responsibility to see to the accuracy and completeness of the ancillary service provider licensee’s corporate governance guidelines and compliance with Module HC. Legal Basis HC-A.1.6 This Module contains the CBB’s Directive (as amended from time to time) relating to high-level controls and is issued under the powers available to the CBB under Article 38 of the Central Bank of Bahrain and Financial Institutions Law 2006 (‘CBB Law’), as amended. The Directive in this Module is applicable to ancillary service provider licensees (including their approved persons). HC-A.1.7 For an explanation of the CBB’s rule-making powers and different regulatory instruments, see Section UG-1.1.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-A.1: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-A: Introduction
HC-A.1 Purpose (continued)
Effective Date
HC-A.1.8 All ancillary service provider licensees to which Module HC applies should be in full compliance by the financial year end 2017. At every ancillary service provider licensee’s annual shareholder meeting held after [month year], corporate governance should be an item on the agenda for information and any questions from shareholders regarding the ancillary service provider licensee’s governance. Where possible, the ancillary service provider licensee should also have corporate governance guidelines in place at that time and should have a “comply or explain” report as described in Paragraph HC-A.1.8.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-A.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-A: Introduction
HC-A.2 Module History
HC-A.2.1 This Module was first issued in [month year]. Any material changes that have subsequently been made to this Module are annotated with the calendar quarter date in which the change was made: Chapter UG-3 provides further details on Rulebook maintenance and version control. HC-A.2.2 A list of recent changes made to this Module is detailed in the table below:
Module
Ref.
Change
Date
Description of Changes
Superseded Requirements
HC-A.2.3 This Module supersedes the following provisions contained in circulars or other regulatory requirements:
Document Ref. Subject
Standard Conditions and Licensing Criteria for providers of ancillary services to the financial sector. Board, Management and Staffing

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-B.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-B: Scope of Application
HC-B.1 License Categories
HC-B.1.1 The contents of this Module – unless otherwise stated – apply to card processing services, payment service providers and credit reference bureaus. HC-B.1.2 For TPAs, Shari’a advisory/review services, Crowdfunding Platform Operators and other Ancillary Service Providers, the applicable Guidance Paragraphs are included in Chapter HC-9. The Comply or Explain Principle (see Paragraph HC-A.1.4) applies to the content of
Chapter HC-9.
HC-B.1.3 Where reference is made to licensees, the scope of application refers to those licensees referred to under Paragraph HC-B.1.1.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.1 Principle
HC-1.1.1 All licensees must be headed by an effective, collegial and informed Board of Directors (‘the Board’).

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.2: Page 1 of 3
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.2 Role and Responsibilities
HC-1.2.1 All directors must understand the Board’s role and responsibilities under the Bahrain Commercial Companies Law (2001), as amended and any other laws or regulations that may govern their responsibilities from time to time. In particular:
(a) The Board’s role as distinct from the role of the shareholders (who elect the Board and whose interests the Board serves) and the role of officers (whom the Board appoints and oversees); and (b) The Board’s fiduciary duties of care and loyalty to the licensee and the shareholders (see HC-2.1). HC-1.2.2 The Board’s role and responsibilities include but are not limited to:
(a) Approving and reviewing at least annually the overall business performance and strategy for the licensee; (b) Reviewing regularly the implementation of the strategy and operational performance; (c) Causing financial statements to be prepared which accurately disclose the licensee’s financial position; (d) Monitoring management performance; (e) Reviewing regularly the level of risk; (f) Approving and reviewing at least annually systems and controls framework (including policies and procedures); (g) Approving the agenda for shareholders’ meetings; (h) Monitoring conflicts of interest and preventing abusive related party transactions; (i) Assuring equitable treatment of shareholders including minority shareholders; and (j) Setting out clearly and reviewing on a regular basis who has authority to enter the licensee into contractual obligations. HC-1.2.3 With respect to Subparagraph HC-1.2.2(j), the Board should set a materiality threshold so that contractual obligations above this set threshold are regularly reported to the Board. In setting the materiality threshold, the Board will consider the financial impact the contractual obligation may have in relation to its capital. .

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.2: Page 2 of 3
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.2 Role and Responsibilities (continued) HC-1.2.4 The members of the board of directors are responsible both individually and collectively for performing the responsibilities outlined in Paragraph HC-1.2.2 and must have sufficient expertise as a Board to understand the important issues relating to operation and control of the licensee. Although the Board may delegate certain functions to committees or management, it may not delegate its ultimate responsibility to ensure that an adequate, effective, comprehensive and transparent corporate governance framework is in place. This statement must be clearly communicated to Board members and senior management. HC-1.2.5 When a member of the board of directors is inducted, the chairman of the Board, or the licensee’s legal counsel or compliance officer, or other individual delegated by the chairman of the board, should review the Board’s role and duties with that person, particularly covering legal and regulatory requirements and Module HC (see also HC￾4.3.1). HC-1.2.6 The licensee should have a written appointment agreement with each director which recites the directors’ powers and duties and other matters relating to his appointment including his term, the time commitment envisaged, the committee assignment if any, his remuneration and expense reimbursement entitlement, and his access to independent professional advice when that is needed. HC-1.2.7 The Board should adopt a formal Board charter or other statement specifying matters which are reserved to it, which should include but need not be limited to the specific requirements and responsibilities of board directors. Additional Guidance HC-1.2.8 In assessing the licensee’s strategic plans (see Paragraph HC-1.2.2), the CBB would expect the Board to address the licensee’s current and future aspirations with respect to its position in the market place, its size, products, value and other key aspirations that would be considered important by investors. Furthermore, the Board should demonstrate that it is able to identify proactively and understand the significant risks that the licensee faces in achieving its business objectives. A description of the licensee’s strategy should be included in the annual financial statements.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.2: Page 3 of 3
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.2 Role and Responsibilities (continued) HC-1.2.9 The Board must have effective policies and processes in place for:
(a) Ensuring a formal and transparent Board nomination process; (b) Appointing senior managers, and ensuring that they have the necessary integrity, technical and managerial competence, and experience; (c) Overseeing succession planning, and minimising undue reliance on key individuals; (d) Reviewing key senior management and Board remuneration packages and ensuring such packages are consistent with the corporate values and strategy of the licensee and encourage prudent risk taking; (e) Monitoring and evaluating management’s performance in implementing agreed strategy and business plans, and ensuring appropriate resources are available; and (f) Approving budgets and reviewing performance against those budgets. HC-1.2.10 The Board must be able to demonstrate that the licensee’s operations, individually and collectively:
(a) Are measured, monitored and controlled by appropriate, effective and prudent risk management systems commensurate with the scope of the licensee’s activities. The systems must produce information on a timely basis, and in a form and quality appropriate to the needs of the different recipients; (b) Are supported by an appropriate control environment. The risk management and financial reporting functions must be independent of business lines and must be run by individuals not involved with the day-to-day running of the various business areas; and (c) Make effective use of the work of internal and external auditors.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.3: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.3 Composition
HC-1.3.1 The Memorandum and Articles of Association of licensees must adequately set out procedures for the appointment, removal and retirement of directors. HC-1.3.2 The Board should have a minimum of 3 members and no more than 15 members, and should regularly review its size and composition to ensure that it is small enough for efficient decision-making yet large enough to have members who can contribute from different specialties and viewpoints. The Board should recommend changes in Board size to the shareholders when a needed change requires amendment of the ancillary service provider licensee’s Memorandum of Association. HC-1.3.3 It is not expected that every Board member is proficient in all areas, but collectively the Board is expected to have the required expertise. The CBB expects Board members to undertake relevant training on a regular basis to help them fulfill their responsibilities as board members. HC-1.3.4 Potential non-executive directors should be made aware of their duties before their nomination, particularly as to the time commitment required. Where applicable, the Nominating Committee should regularly review the time commitment required from each non-executive director and should require each non-executive director to inform the Committee before he accepts any Board appointments to another company. One person should not hold more than three directorships in public companies in Bahrain with the provision that no conflict of interest may exist, and the Board should not propose the election or reelection of any director who does. HC-1.3.5 To fulfil its responsibilities outlined in Section HC-1.2, the Board of licensees must periodically assess its composition and size and, where appropriate, reconstitute itself and its committees by selecting new directors to replace long-standing members or those members whose contributions to the licensee or its committees is not adequate. HC-1.3.6 To demonstrate compliance with Rule HC-1.3.5, the Board should be able to demonstrate that it regularly considers (e.g. every one or two years) the mix of executive, non-executive and independent non-executive Directors, and skills and experience, that it requires. See also Paragraph HC-1.3.2. HC-1.3.7 A Board member may have a maximum of two Directorships of financial institutions inside Bahrain. However, two Directorships of the same license would not be permitted. Licensees may approach the CBB for exemption from this limit where the Directorships concern financial institutions within the same group.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.3: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.3 Composition (continued)
HC-1.3.8 The appointment of Board members is conditional on the approval of the CBB (See
Section AU-1.2).

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.4: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.4 Decision Making Process
HC-1.4.1 The Board must be collegial and deliberative, to gain the benefit of each individual director’s judgment and experience. HC-1.4.2 The chairman must take an active lead in promoting mutual trust, open discussion, constructive dissent and support for decisions after they have been made. HC-1.4.3 The Board must meet frequently but in no event less than four times a year. All directors must attend the meetings whenever possible and the directors must maintain informal communication between meetings. HC-1.4.4 Individual board members must attend at least 75% of all Board meetings in a given financial year to enable the Board to discharge its responsibilities effectively (see table below). Voting and attendance proxies for board meetings are prohibited at all times. Meetings per year 75% Attendance requirement 4 3 5 4 6 5 7 5 8 6 9 7 10 8 HC-1.4.5 The absence of Board members at Board and committee meetings must be noted in the meeting minutes. In addition, Board attendance percentage must be reported during any general assembly meeting when Board members stand for re-election (e.g. Board member XYZ attended 95% of scheduled meetings this year). HC-1.4.6 In the event that a Board member has not attended at least 75% of Board meetings in any given financial year, the licensee must immediately notify the CBB indicating which member has failed to satisfy this requirement, his level of attendance and any mitigating circumstances affecting his non-attendance. The CBB shall then consider the matter and determine whether disciplinary action, including disqualification of that Board member pursuant to Article 65 of the CBB Law, is appropriate. Unless there are exceptional circumstances, it is likely that the CBB will take disciplinary action.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.4: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.4 Decision Making Process (continued)
HC-1.4.7 To meet its obligations under Rule HC-1.4.3 above, the Board should meet preferably no less than four times per year. The CBB recommends that meetings should take place once every quarter to address the Board’s responsibilities for management oversight and performance monitoring. Furthermore, Board rules should require members to step down if they are not actively participating in Board meetings. Board members are reminded that non attendance at board meetings does not absolve them of their responsibilities as directors. It is important that each individual director should allocate adequate time and effort to discharge his responsibilities. All Directors are expected to contribute actively to the work of the Board in order to discharge their responsibilities and should make every effort to attend board meetings where major issues are to be discussed. Licensees are encouraged to amend their Articles of Association to provide for telephonic and videoconference meetings. Participation in board meetings by means of video or telephone conferencing is regarded as attendance and may be recorded as such. HC-1.4.6 At least half the Board meetings of Bahraini licensees in any twelve￾month period must be held in the Kingdom of Bahrain. HC-1.4.7 The chairman must ensure that all directors receive an agenda, minutes of prior meetings, and adequate background information in writing before each Board meeting and when necessary between meetings. All directors must receive the same Board information. At the same time, directors have a legal duty to inform themselves and they must ensure that they receive adequate and timely information and must study it carefully. HC-1.4.8 The Board must maintain adequate records of its meetings, such that key decisions and how they are arrived at can be traced.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.5: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.5 Independence of Judgment
HC-1.5.1 The Board must ensure that it has at least one independent director (in addition to its Chairman), in order to provide sufficient independent scrutiny of management. HC-1.5.2 Every director must bring independent judgment to bear in decision￾making. No individual or group of directors must dominate the Board’s decision-making and no one individual must have unfettered powers of decision. HC-1.5.3 Executive directors must provide the Board with all relevant business and financial information within their cognizance, and must recognise that their role as a director is different from their role as an officer. HC-1.5.4 Non-executive directors must be fully independent of management and must constructively scrutinise and challenge management including the management performance of executive directors. HC-1.5.5 The chairman of the Board should be an independent director so that there will be an appropriate balance of power and greater capacity of the Board for independent decision making. HC-1.5.6 The chairman and/or deputy chairman must not be the same person as the CEO. HC-1.5.7 The Board should review the independence of each director at least annually in light of interests disclosed by them. Each independent director shall provide the Board with all necessary and updated information for this purpose. HC-1.5.8 To facilitate free and open communication among independent directors, each Board meeting should be preceded or followed with a session at which only independent directors are present, except as may otherwise be determined by the independent directors themselves.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.6: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.6 Directors’ Access to Independent Advice HC-1.6.1 The Board must ensure that individual directors have access to independent legal or other professional advice at the licensee’s expense whenever they judge this necessary to discharge their responsibilities as directors and this must be in accordance with the licensee’s policy approved by the Board. HC-1.6.2 Individual directors must also have access to the licensee’s corporate secretary, who must have responsibility for reporting to the Board on Board procedures. Both the appointment and removal of the corporate secretary must be a matter for the Board as a whole, not for the CEO or any other officer. HC-1.6.3 Whenever a director has serious concerns which cannot be resolved concerning the running of the licensee or a proposed action, he should consider seeking independent advice and should ensure that the concerns are recorded in the Board minutes and that any dissent from a Board action is noted or delivered in writing. HC-1.6.4 Upon resignation, a non-executive director should provide a written statement to the chairman, for circulation to the Board, if he has any concerns such as those in Paragraph HC-1.6.3.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.7: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.7 Directors’ Communication with Management HC-1.7.1 The Board must encourage participation by management regarding matters the Board is considering, and also by management members who by reason of responsibilities or succession, the CEO believes should have exposure to the directors.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.8: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.8 Committees of the Board
HC-1.8.1 The Board must create specialised committees as and when such committees are needed. HC-1.8.2 Licensees should consider the need for an Executive Committee to review and make recommendations to the whole Board on company actions, or a Risk Committee to identify and minimise specific risks of their business. HC-1.8.3 The Board or a committee may invite non-directors to participate in, but not vote at committee meetings so that the committee may gain the benefit of their advice and expertise in financial or other areas. HC-1.8.4 Committees must act only within their mandates and therefore the Board must not allow any committee to dominate or effectively replace the whole Board in its decision-making responsibility. HC-1.8.5 Committees may be combined provided that no conflict of interest might arise between the duties of such committees. HC-1.8.6 Every committee should have a formal written charter similar in form to the model charter which is set forth in Appendix A of this Module for the Audit Committee.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.9: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.9 Evaluation of the Board and Each Committee HC-1.9.1 At least annually the Board must conduct an evaluation of its performance and the performance of each committee and each individual director. HC-1.9.2 The evaluation process must include:
(a) Assessing how the Board operates, especially in light of Chapter HC-1; (b) Evaluating the performance of each committee in light of its specific purposes and responsibilities, which shall include review of the self-evaluations undertaken by each committee; (c) Reviewing each director's work, his attendance at Board and committee meetings, and his constructive involvement in discussions and decision-making; and (d) Reviewing the Board’s current composition against its desired composition with a view toward maintaining an appropriate balance of skills and experience and a view toward planned and progressive refreshing of the Board. HC-1.9.3 The Board should report to the shareholders, at each annual shareholder meeting, that evaluations have been done.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.10: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.10 Annual Board Review and Certification HC-1.10.1 The Board must assess and document each year whether the internal corporate governance processes that it has implemented have successfully achieved their objectives, and consequently whether the Board has fulfilled its responsibilities for directing and monitoring the overall conduct of the licensee’s affairs. HC-1.10.2 The results of the review referred to in Paragraph HC-1.10.1 must be summarised in a written certification, to be signed by all Board members, and sent to the CBB within 3 months of the financial year￾end of the licensee. The Board must report any material deficiencies identified during the review, along with an action plan and timescales for their correction. HC-1.10.3 The Board certification comprises a prescribed standard statement, to be signed by all Board members, attached to which should be a summary of the steps the Board has taken in carrying out the review; a summary of the results of that review; and a summary action plan (with timescales) for addressing any identified material deficiencies. HC-1.10.4 The prescribed standard statement referred to in Paragraph HC-1.10.3 is as follows:
“We, the Directors of [insert licensee name], do hereby confirm that we have undertaken the review required under Rule HC-1.10.1 of Volume 5 (Ancillary Service Providers) of the CBB Rulebook. The scope of this review was in accordance with the requirements specified in Paragraph HC-1.10.5 of Volume 5 (Ancillary Service Providers) of the CBB Rulebook. The summary results of this review, setting out (i) the actions taken to carry out this review; (ii) any material deficiencies identified as a result of the review; and (iii) an action plan and timescales for the correction of any such deficiencies (where appropriate), are attached. We understand that it is a breach of our licensing conditions to provide false or misleading information to the CBB, or to withhold material information that may reasonably be expected to be provided to the CBB. [signed and dated by all Board Directors]”

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-1.10: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-1: The Board
HC-1.10 Annual Board Review and Certification (continued) HC-1.10.5 The Board's review should cover the following specific matters:
(a) That the Board has reassessed the licensee’s objectives and plans, and has reviewed the licensee’s corporate strategy document; (b) That the Board has reassessed the licensee’s overall risk profile, and its mapping of risks and the control environment put in place to meet those risks. The Board should comment whether the control environment remains effective and appropriate; (c) That the Board has assessed the licensee’s internal controls, to confirm that these are based on established policies and procedures approved by the Board and provide reasonable assurance of the integrity and reliability of its financial records; (d) That the Board has assessed whether adherence to established internal limits and controls was continuously monitored; (e) That the Board has assessed that all new (or material changes to) significant policies, procedures and products introduced by the licensee since the last Board certification were appropriately reviewed and approved at the time; (f) That the Board has assessed that management and staff have complied with the licensee’s corporate code of conduct (see Paragraph HC-2.2.4); and (g) That in the period under review, the Board had received and reviewed the external auditor’s management letter within six months of the (previous) financial year end, together with comments on the letter and proposed actions, from the licensee’s audit committee and senior management. HC-1.10.6 With respect to HC-1.10.5 (g), a Director’s certificate received (for example) no later than 31 March 2004, covering the year ending 31 December 2003, would need to certify that the management letter for the year ending 31 December 2002 was received and reviewed by the Board by 30 June 2003.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.1 Principle
HC-2.1.1 The approved persons must have full loyalty to the licensee.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.2: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.2 Personal Accountability
HC-2.2.1 The Board and its members must act with honesty, integrity, due skill and care, and in the best interests of the licensee, its shareholders and clients. HC-2.2.2 In assessing compliance with Paragraph HC-2.2.1, the CBB will take into account all actions of the Board and its members. The interest of the licensee includes the licensee’s continued compliance with all relevant rules and regulations, and the interests of employees, clients and other stakeholders. The interest of shareholders includes the current and future value of the licensee, its status as a going concern, transparency and disclosure of information to the market. The interest of clients includes ensuring that the licensee fulfils its obligations under its terms of business and treats all clients fairly and pays equal regard to the interests of all clients. HC-2.2.3 Each member of the board must understand that under the Commercial Companies Law 2001, as amended, he is personally accountable to the licensee and the shareholders if he violates his legal duty of loyalty to the ancillary service provider licensee, and that he can be personally sued by the licensee or the shareholders for such violations. HC-2.2.4 A licensee’s Board must establish and disseminate to all employees of the licensee a corporate code of conduct. HC-2.2.5 The code of conduct must establish standards by giving examples or expectations as regards:
(a) Honesty;
(b) Integrity;
(c) The avoidance or disclosure of conflicts of interest; (d) Maintaining confidentiality; (e) Professionalism; (f) Commitment to the law and best practices; and (g) Reliability. HC-2.2.6 The Board must establish and disseminate to employees policies and processes for the identification, reporting and prevention or management of potential conflicts of interest, including matters such as:
(a) Related party transactions;
(b) The misuse of the licensee’s assets; and (c) The use of privileged information for personal advantage (‘insider trading’).

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.2: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.2 Personal Accountability (continued)
HC-2.2.7 Any transaction in which Board members or any member of management have potential conflicts of interest should either be proscribed or require formal documented approval by the Board, with measures taken to manage those conflicts (see also Paragraph HC-2.4.1). HC-2.2.8 The Board must ensure that policies and procedures are in place to ensure that necessary customer confidentiality is maintained. HC-2.2.9 The duty of loyalty includes a duty not to use property of the licensee for his personal needs as though it was his own property, not to disclose confidential information of the licensee or use it for his personal profit, not to take business opportunities of the licensee for himself, not to compete in business with the licensee, and to serve the licensee’s interest in any transactions with the company in which he has a personal interest. HC-2.2.10 For purposes of Paragraph HC-2.2.9, an approved person must be considered to have a “personal interest” in a transaction with the company if:
(a) He himself;
(b) A member of his family (i.e. spouse, father, mother, sons, daughters, brothers or sisters); or (c) Another company of which he is a director or controller, is a party to the transaction or has a material financial interest in the transaction. (Transactions and interests which are de minimis in value must not be included.)

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.3: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.3 Avoidance of Conflicts of Interest
HC-2.3.1 Licensees must maintain an organisational structure that minimises the risk of conflicts of interest arising. HC-2.3.2 For the purposes of Rule HC-2.3.1, the CBB would expect licensees to separate front and back office functions. HC-2.3.3 Each approved person must make every practicable effort to arrange his personal and business affairs to avoid a conflict of interest with the licensee. HC-2.3.4 Board members must absent themselves from any discussion or decision-making that involves a subject where they are incapable of providing objective advice, or which involves a subject, transaction or proposed transaction where there is a potential conflict of interest.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.4: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.4 Disclosure of Conflicts of Interest
HC-2.4.1 Each approved person of licensees must inform the entire Board of conflicts of interest as they arise. Board members must abstain from voting on the matter in accordance with the relevant provisions of the Commercial Companies Law 2001, as amended. This disclosure must include all material facts in the case of a contract or transaction involving the approved person. The approved persons must understand that any approval of a conflict transaction is effective only if all material facts are known to the authorising persons and the conflicted person did not participate in the decision. HC-2.4.2 Board members must declare annually in writing all of their interests (and those of their family) in other enterprises or activities (whether as a Director, shareholder, senior executive or other form of participation) to the Board (or appropriate Board sub-Committee). HC-2.4.3 The Board should establish formal procedures for:
(a) Periodic disclosure and updating of information by each approved person on his actual and potential conflicts of interest; and (b) Advance approval by directors or shareholders who do not have an interest in the transactions in which a card processing services’, credit reference bureaus’, and payment service providers’ approved person has a personal interest. The Board should require such advance approval in every case.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-2.5: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-2: Approved Persons Loyalty
HC-2.5 Disclosure of Conflicts of Interest to Shareholders HC-2.5.1 The ancillary service provider licensee must disclose to its shareholders through Annual General Meetings any abstention from voting motivated by a conflict of interest and must disclose to its shareholders any authorisation of a conflict of interest contract or transaction in accordance with the Commercial Companies Law 2001, as amended.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-3.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-3: Audit Committee and Financial Statements
Certification
HC-3.1 Principle
HC-3.1.1 The Board of all licensees must have rigorous controls for financial audit and reporting, internal control, and compliance with law.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-3.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-3: Audit Committee and Financial Statements
Certification
HC-3.2 Audit Committee
HC-3.2.1 The Board of licensees should establish an audit committee HC-3. 2.2 The audit committee should have at least three directors. HC-3.2.3 For purposes of Paragraph HC-3.2.2, the majority of the directors should be independent including the Chairman. HC-3.2.4 Where there is an audit committee, it must:
(a) Review the company’s accounting and financial practices; (b) Review the integrity of the licensees’ financial and internal controls and financial statements; (c) Review the licensees’ compliance with legal requirements; (d) Recommend the appointment, compensation and oversight of the licensees’ external auditor; and (e) Recommend the appointment of the internal auditor (whether in￾house or outsourced). HC-3.2.5 The Board or Audit Committee must ensure that the external audit firm and its partners are truly independent of the licensee and have no financial or other relationship with the licensee. Audit findings must be used as an independent check on the information received from management about the licensees’ operations and performance and the effectiveness of internal controls.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-3.3: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-3: Audit Committee and Financial Statements
Certification
HC-3.3 Audit Committee Charter
HC-3.3.1 The audit committee should adopt a written charter which shall, at a minimum, state the duties outlined in Paragraph HC-3.2.4 and the other matters included in
Appendix A to this Module.
HC-3.3.2 A majority of the audit committee should have the financial literacy and information technology qualifications stated in Appendix A. HC-3.3.3 The Board should adopt a “whistleblower” program under which employees can confidentially raise concerns about possible improprieties in financial or legal matters. Under the program, concerns may be communicated directly to any audit committee member or, alternatively, to an identified officer or employee who will report directly to the Audit Committee on this point.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-3.4: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-3: Audit Committee and Financial Statements
Certification
HC-3.4 CEO and CFO Certification of Financial Statements HC-3.4.1 To encourage management accountability for the financial statements required by the directors, the licensee’s CEO and chief financial officer should state in writing to the audit committee and the Board as a whole that the licensee’s interim, where applicable, and annual financial statements present a true and fair view, in all material respects, of the licensee’s financial condition and results of operations in accordance with applicable accounting standards.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-4.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-4: Appointment, Training and Evaluation of the
Board
HC-4.1 Principle
HC-4.1.1 Licensees must have rigorous procedures for appointment, training and evaluation of the Board.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-4.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-4: Appointment, Training and Evaluation of the
Board
HC-4.2 Board Nominations to Shareholders
HC-4.2.1 Each proposal by the Board to the shareholders for election or reelection of a director must be accompanied by a recommendation from the Board, and the following specific information:
(a) The term to be served, which may not exceed three years (but there need not be a limit on reelection for further terms); (b) Biographical details and professional qualifications; (c) In the case of an independent director, a statement that the Board has determined that the criteria of independent director have been met; (d) Any other directorships held; (e) Particulars of other positions which involve significant time commitments, and (f) Details of relationships between:
(i) The candidate and the licensee, and
(ii) The candidate and other directors of the licensee.
HC-4.2.2 The chairman of the Board should confirm to shareholders when proposing re￾election of a director that, following a formal performance evaluation, the person’s performance continues to be effective and continues to demonstrate commitment to the role. Any term beyond six years (e.g. two three-year terms) for a director should be subject to particularly rigorous review, and should take into account the need for progressive refreshing of the Board. Serving more than six years is relevant to the determination of a non-executive director’s independence.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-4.3: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-4: Appointment, Training and Evaluation of the
Board
HC-4.3 Induction and Training of Directors
HC-4.3.1 The chairman of the Board of licensees must ensure that each new director receives a formal and tailored induction to ensure his contribution to the Board from the beginning of his term. The induction must include meetings with senior management, visits to company facilities, presentations regarding strategic plans, significant financial, accounting and risk management issues, compliance programs, its internal and external auditors and legal counsel. HC-4.3.2 All continuing directors must be invited to attend orientation meetings and all directors must continually educate themselves as to the licensee’s business and corporate governance. HC-4.3.3 Management, in consultation with the chairman of the Board, should hold programs and presentations to directors respecting the licensees’ business and industry, which may include periodic attendance at conferences and management meetings.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-5.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-5: Remuneration of Approved Persons
HC-5.1 Principle
HC-5.1.1 The licensee must remunerate approved persons fairly and responsibly.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-5.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-5: Remuneration of Approved Persons
HC-5.2 Role of Board of Directors
HC-5.2.1 The Board of Directors must:
(a) Review the licensee’s remuneration policies for the approved persons, which must be approved by the shareholders; (b) Make recommendations regarding remuneration policies and amounts for specific persons to the whole Board, taking account of total remuneration including salaries, fees, expenses and employee benefits; and (c) Remunerate Board members based on their attendance and performance.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-5.3: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-5: Remuneration of Approved Persons
HC-5.3 Standard for all Remuneration
HC-5.3.1 Remuneration (including incentives, bonuses and other rewards) of approved persons must be sufficient enough to attract, retain and motivate persons of the quality needed to run the licensee successfully, but the licensee must avoid paying more than is necessary for that purpose. HC-5.3.2 Where remuneration is structured so as to link rewards to corporate and individual performance, criteria should avoid excessive focus on short-term profitability measures, without due regard to the longer-term consequences of actions taken.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-5.4: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-5: Remuneration of Approved Persons
HC-5.4 Directors’ Remuneration
HC-5.4.1 The review of Directors’ remuneration must be a standing item on the licensee’s Annual General Meeting agenda, and must be considered by shareholders at every Annual General Meeting. Directors’ remuneration (including pension and severance arrangements) and bonuses must be clearly disclosed in the annual financial statements. HC-5.4.2 Directors’ remuneration should also comply with all applicable laws, such as Legislative Decree No. 21 of 2001, with respect to promulgating the Commercial Companies Law. HC-5.4.3 Remuneration of non-executive directors must not include performance-related elements such as grants of shares, share options or other deferred stock-related incentive schemes, bonuses, or pension benefits.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-5.5: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-5: Remuneration of Approved Persons
HC-5.5 Senior Management Remuneration
HC-5.5.1 Remuneration of senior management must be structured so that a portion of the total is linked to licensee and individual performance and aligns their interests with the interests of the shareholders. HC-5.5.2 Such rewards may include grants of shares, share options and other deferred stock￾related incentive schemes, bonuses, and pension benefits which are not based on salary. HC-5.5.3 If a senior manager is also a director, his remuneration as a senior manager must take into account compensation received in his capacity as a director. HC-5.5.4 All share incentive plans must be approved by the shareholders. HC-5.5.5 All performance-based incentives should be awarded under written objective performance standards which have been approved by the Board and are designed to enhance shareholder and company value, and under which shares should not vest and options should not be exercisable within less than two years of the date of award of the incentive. HC-5.5.6 All policies for performance-based incentives should be approved by the shareholders, but the approval should be only of the plan itself and not of the grant to specific individuals of benefits under the plan.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.1 Principle
HC-6.1.1 The Board of licensees must establish a clear and efficient management structure.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.2 Establishment of Management Structure HC-6.2.1 The Board must approve and review at least annually the licensees’ management structure and responsibilities. HC-6.2.2 The Board must appoint senior management whose authority must include management and operation of current activities of the licensees, reporting to and under the direction of the Board. The senior managers must include at a minimum:
(a) A CEO;
(b) A chief financial officer;
(c) A corporate secretary;
(d) An internal auditor (see HC-6.4 and AU-1.2); (e) A compliance officer (seeHC-6.5 and AU-1.2); and and must also include such other approved persons as the Board considers appropriate and as a minimum must include persons occupying controlled functions as outlined in Paragraph AU-1.2.2.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.3: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.3 Titles, Authorities, Duties and Reporting Responsibilities HC-6.3.1 Licensees must maintain clearly documented and communicated staff responsibilities and reporting lines. HC-6.3.2 For the purposes of Rule HC-6.3.1, licensees should maintain and document their delegated authority structure as well as written terms of reference for staff positions. HC-6.3.3 The Board must adopt by-laws prescribing each senior manager’s title, authorities, duties and internal reporting responsibilities. This must be done in consultation with the CEO, to whom the other senior managers should normally report. HC-6.3.4 The provisions referred to in Paragraph HC-6.3.3 must include but should not be limited to the following:
(a) The CEO must have authority to act generally in the licensee’s name, representing the licensee’s interests in concluding transactions on the licensee’s behalf and giving instructions to other approved persons and licensee employees; (b) The chief financial officer must be responsible and accountable for:
(i) The complete, timely, reliable and accurate preparation of the licensee’s financial statements, in accordance with the accounting standards and policies of the licensee (see HC￾3.4.1); and (ii) Presenting the Board with a balanced and understandable assessment of the licensee’s financial situation; (c) The corporate secretary’s duties must include arranging, recording and following up on the actions, decisions and meetings of the Board and of the shareholders (both at annual and extraordinary meetings) in books to be kept for that purpose; (d) The internal auditor’s (see HC-6.4) duties must include providing an independent and objective review of the efficiency of the licensee’s operations. This would include a review of the accuracy and reliability of the licensee’s accounting records and financial reports as well as a review of the adequacy and effectiveness of the licensee’s risk management, control, and governance processes; and

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.3: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.3 Titles, Authorities, Duties and Reporting Responsibilities (continued) (e) The compliance officer’s (see HC-6.5) duties include maintaining effective systems and controls for compliance with applicable requirements in the Kingdom’s legislation and those set by the CBB, and those established under any other statute or regulator to which they are subject. HC-6.3.5 The Board should also specify any limits which it wishes to set on the authority of the CEO or other senior managers, such as monetary maximums for transactions which they may authorize without separate Board approval. HC-6.3.6 The corporate secretary should be given general responsibility for reviewing the licensee’s procedures and advising the Board directly on such matters. Whenever practical, the corporate secretary should be a person with legal or similar professional experience and training. HC-6.3.7 At least annually the Board shall review and concur in a succession plan addressing the policies and principles for selecting a successor to the CEO, both in emergencies and in the normal course of business. The succession plan should include an assessment of the experience, performance, skills and planned career paths for possible successors to the CEO.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.4: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.4 Internal Audit
HC-6.4.1 Licensees must establish an internal audit function to monitor the adequacy of their systems and controls. HC-6.4.2 The internal audit function must be independent of the senior management, reporting either to the Board or its Audit committee. The internal audit function must not be combined with any other function. HC-6.4.3 The CBB would normally expect larger licensees to maintain the internal audit function within the organisation (or at least to be provided from within the licensees’ group, where relevant, providing this doesn’t impair the level of internal audit scrutiny applied to the licensees). The CBB will however consider allowing small licensees to outsource part or all of their internal audit function to third party providers. HC-6.4.4 Where licensees outsource part or all of their internal audit function, the outsourcing arrangements must provide for an adequate level of scrutiny of the licensees, and must comply with the requirements contained in Chapter RM-3. A licensee cannot outsource its internal audit function to its external auditor. HC-6.4.5 Prior approval from the CBB is required for material outsourcing arrangements, including all outsourcing of internal audit. Note that in all such cases, the licensee retains ultimate responsibility for the adequacy of its outsourcing function, and is required to identify the person within the licensee responsible for internal audit: this person should be an approved person (see Section AU-1.2 and Modue RM-to be issued). HC-6.4.6 Internal audit functions must have terms of reference that clearly indicate:
(a) The scope and frequency of audits;
(b) Reporting lines; and
(c) The review and approval process applied to audits.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.4: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.4 Internal Audit (continued)
HC-6.4.7 Paragraph HC-6.4.6 applies irrespective of whether the internal audit function is outsourced. Where it is outsourced, the CBB would expect to see these matters addressed in the contract with the outsourcing provider. HC-6.4.8 Internal audit functions must report directly to the Audit committee. They must have unrestricted access to all the appropriate records of the licensees. They must have open and regular access to the Audit Committee, the Board, the Chief Executive, and the licensees’ external auditor. HC-6.4.9 Internal audit functions must have adequate staff levels with appropriate skills and knowledge, such that they can act as an effective challenge to the business. Where the function is not outsourced, the head of function must be a senior and experienced employee. Internal audit functions must not perform other activities that compromise their independence.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-6.5: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-6: Management Structure
HC-6.5 Compliance
HC-6.5.1 Licensees must take reasonable care to establish and maintain effective systems and controls for compliance with applicable requirements in the Kingdom’s legislation and those set by the CBB, and those established under any other statute or regulator to which they are subject. HC-6.5.2 Depending on the nature, scale and complexity of its business, licensees should consider having a separate compliance function. A compliance function should:
(a) Document its organisation and responsibilities; (b) Be appropriately staffed with competent individuals; (c) Have unrestricted access to the licensees’ relevant records; and (d) Have ultimate recourse to the Board. HC-6.5.3 The compliance function must not be combined with the internal audit function or any other operational function as such combination may lead to a conflict of interest.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-7.1: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-7: Communication between Board and
Shareholders
HC-7.1 Principle
HC-7.1.1 The licensees must communicate with shareholders, encourage their participation, and respect their rights.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-7.2: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER HC-7: Communication between Board and
Shareholders
HC-7.2 Conduct of Shareholders’ Meetings
HC-7.2.1 The Board must observe both the letter and the intent of the Company Law’s requirements for shareholder meetings. Among other things:
(a) Notices of meetings must be honest, accurate and not misleading. They must clearly state and, where necessary, explain the nature of the business of the meeting; (b) Meetings must be held during normal business hours and at a place convenient for the greatest number of shareholders to attend; (c) Notices of meetings must encourage shareholders to participate by proxy and must refer to procedures for appointing a proxy and for directing the proxy how to vote on a particular resolution. The proxy agreement must list the agenda items and must specify the vote (such as “yes,” “no” or “abstain”); (d) Notices must ensure that all material information and documentation is provided to shareholders on each agenda item for any shareholder meeting, including but not limited to any recommendations or dissents of directors; (e) The Board must propose a separate resolution at any meeting on each substantially separate issue, so that unrelated issues are not “bundled” together; (f) In meetings where directors are to be elected or removed the Board must ensure that each person is voted on separately, so that the shareholders can evaluate each person individually; (g) The chairman of the meeting must encourage questions from shareholders, including questions regarding licensees’ corporate governance guidelines; (h) The minutes of the meeting must be made available to shareholders upon their request as soon as possible but not later than 30 days after the meeting and must be endorsed at the next general assembly; and (i) Disclosure of all material facts must be made to the shareholders. HC-7.2.2 The licensees should require all directors to attend and be available to answer questions from shareholders at any shareholder meeting and, in particular, ensure that the chairs of the audit, remuneration and nominating committees are ready to answer appropriate questions regarding matters within their committee’s responsibility (it being understood that confidential and proprietary business information may be kept confidential).

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-7.2: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER HC-7: Communication between Board and
Shareholders
HC-7.2 Conduct of Shareholders’ Meetings (continued) HC-7.2.3 The licensee must require its external auditor to attend the annual shareholders’ meeting and be available to answer shareholders’ questions concerning the conduct and conclusions of the audit. HC-7.2.4 A licensee must maintain a company website. The licensee must dedicate a specific section of its website to describing shareholders’ rights to participate and vote at each shareholders’ meeting, and must post significant documents relating to meetings including the full text of notices and minutes. HC-7.2.5 The licensee may also consider establishing an electronic means for shareholders’ communications including appointment of proxies. For confidential information, the licensee should grant a controlled access to such information to its shareholders. HC-7.2.6 In notices of meetings at which directors are to be elected or removed the licensee should ensure that:
(a) Where the number of candidates exceeds the number of available seats, the notice of the meeting should explain the voting method by which the successful candidates will be selected and the method to be used for counting of votes; and (b) The notice of the meeting should present a factual and objective view of the candidates so that shareholders may make an informed decision on any appointment to the board.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-8.1: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-8: Corporate Governance Disclosure
HC-8.1 Principle
HC-8.1.1 The licensees must disclose their corporate governance.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-8.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER HC-8: Corporate Governance Disclosure
HC-8.2 Disclosure under the Commercial Companies Law 2001 and CBB Requirements HC-8.2.1 The Board must oversee the process of disclosure to all stakeholders. The Board must ensure that the licensees’ communications are fair, transparent, comprehensive and timely. HC-8.2.2 In each licensee:
(a) The Board must adopt written corporate governance guidelines covering the matters stated in Module HC and other corporate governance matters deemed appropriate by the Board. Such guidelines must include or refer to the principles and rules of Module HC; (b) The licensee must publish the guidelines on their website (see HC-7.2.4); (c) At each annual shareholders’ meeting the Board must report on the licensee’s compliance with their guidelines and Module HC, and explain the extent if any to which they have varied them or believe that any variance or noncompliance was justified; and (d) At each annual shareholders’ meeting the Board must also report on further items listed in Appendix B. Such information must be maintained on the licensee’s website or held at the licensee’s premises on behalf of the shareholders.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.1: Page 1 of 3
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.1 The Board HC-9.1.1 All TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers should be headed by an effective, collegial and informed Board of Directors (‘the Board’). Role and Responsibilities HC-9.1.2 All members of the board of directors should understand the Board’s role and responsibilities under the Bahrain Commercial Companies Law (2001) and its amendments and any other laws or regulations that may govern their responsibilities from time to time. In particular:
(a) The Board’s role as distinct from the role of the shareholders (who elect the Board and whose interests the Board serves) and the role of officers (whom the Board appoints and oversees); and (b) The Board’s fiduciary duties of care and loyalty to the TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers and the shareholders (see HC-9.2). HC-9.1.3 The Board’s role and responsibilities include but are not limited to:
(a) The overall business performance and strategy for the TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers; (b) Causing financial statements to be prepared which accurately disclose the TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers financial position; (c) Monitoring management performance; (d) Approving the agenda for shareholders’ meetings; (e) Monitoring conflicts of interest and preventing abusive related party transactions; and (e) Assuring equitable treatment of shareholders including minority shareholders. HC-9.1.4 The members of the board of directors are responsible both individually and collectively for performing the responsibilities outlined in Paragraph HC-9.1.3. Although the Board may delegate certain functions to committees or management, it may not delegate its ultimate responsibility to ensure that an adequate, effective, comprehensive and transparent corporate governance framework is in place. HC-9.1.5 When a member of the board of directors is inducted, the chairman of the Board, assisted by company legal counsel or compliance officer, should review the Board’s role and duties with that person, particularly covering legal and regulatory requirements and Module HC. HC-9.1.6 The TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers should have a written appointment agreement with each director which recites the directors’ powers and duties and other matters relating to his appointment including his term, the time commitment envisaged, the

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.1: Page 1 of 3
committee assignment if any, his remuneration and expense reimbursement entitlement, and his access to independent professional advice when that is needed. HC-9.1.7 The Board should adopt a formal Board charter or other statement specifying matters which are reserved to it, which should include but need not be limited to the specific requirements and responsibilities of board directors.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.1: Page 2 of 3
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.1 The Board (continued) Composition HC-9.1.8 The Board should have no more than 15 members, and should regularly review its size and composition to ensure that it is small enough for efficient decision-making yet large enough to have members who can contribute from different specialties and viewpoints. The Board should recommend changes in Board size to the shareholders when a needed change requires amendment of the TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers’ Memorandum of Association. HC-9.1.9 Potential non-executive directors should be made aware of their duties before their nomination, particularly as to the time commitment required. The Board should regularly review the time commitment required from each non-executive director and should require each non-executive_director to inform the Board before he accepts any Board appointments to another company. One person should not hold more than three directorships in public companies in Bahrain with the provision that no conflict of interest may exist, and the Board should not propose the election or reelection of any director who does. Decision Making Process HC-9.1.10 The Board should be collegial and deliberative, to gain the benefit of each individual director’s judgment and experience. HC-9.1.11 The chairman should take an active lead in promoting mutual trust, open discussion, constructive dissent and support for decisions after they have been made. HC-9.1.12 The Board should meet frequently but in no event less than four times a year. All directors should attend the meetings whenever possible and the directors should maintain informal communication between meetings. HC-9.1.13 The chairman should ensure that all directors receive an agenda, minutes of prior meetings, and adequate background information in writing before each Board meeting and when necessary between meetings. All directors should receive the same Board information. At the same time, directors have a legal duty to inform themselves and they should ensure that they receive adequate and timely information and should study it carefully.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.1: Page 3 of 3
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.1 The Board (continued) Directors’ Communication with Management HC-9.1.14 The Board should encourage participation by management regarding matters the Board is considering, and also by management members who by reason of responsibilities or succession, the CEO believes should have exposure to the directors. HC-9.1.15 Non-executive directors should have free access to the TPAs, Shari’a advisory/review services, crowdfunding platform operators and other ancillary service providers’ management beyond that provided in Board meetings. Such access should be through the Chairman of the Audit Committee or CEO. The Board should make this policy known to management to alleviate any management concerns about a director’s authority in this regard.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.2: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.2 Approved Persons Loyalty HC-9.2.1 The Board should establish formal procedures for:
(a) Periodic disclosure and updating of information by each approved person on his actual and potential conflicts of interest; and (b) Advance approval by directors or shareholders who do not have an interest in the transactions in which a TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider ‘approved person has a personal interest. The Board should require such advance approval in every case. Disclosure of Conflicts of Interests to Shareholders HC-9.2.2 The TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider should disclose to its shareholders in the Annual Report any abstention from voting motivated by a conflict of interest and should disclose to its shareholders any authorisation of a conflict of interest contract or transaction in accordance with the Company Law.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.3: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.3 Financial Statements Certification HC-9.3.1. The Board should have rigorous controls for financial audit and reporting, internal control, and compliance with law. CEO and CFO Certification of Financial Statements HC-9.3.2 To encourage management accountability for the financial statements required by the directors, the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service provider’s CEO and chief financial officer should state in writing to the audit committee and the Board as a whole that the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service provider’s interim and annual financial statements present a true and fair view, in all material respects, of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service provider’s financial condition and results of operations in accordance with applicable accounting standards.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.4: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.4 Appointment, Training and Evaluation of the Board HC-9.4.1. The TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider should have rigorous procedures for appointment, training and evaluation of the Board. Induction and Training of Directors HC-9.4.2 The chairman of the Board should ensure that each new director receives a formal and tailored induction to ensure his contribution to the Board from the beginning of his term. The induction should include meetings with senior management, visits to company facilities, presentations regarding strategic plans, significant financial, accounting and risk management issues, compliance programs, its internal and external auditors and legal counsel. HC-9.4.3 All continuing directors should be invited to attend orientation meetings and all directors should continually educate themselves as to the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service provider’s business and corporate governance. HC-9.4.4 Management, in consultation with the chairman of the Board, should hold programs and presentations to directors respecting the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service provider’s business and industry, which may include periodic attendance at conferences and management meetings. The Board should oversee directors’ corporate governance educational activities.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.5: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.5 Remuneration of Approved Persons HC-9.5.1 The TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider should remunerate approved persons fairly and responsibly. HC-9.5.2 Remuneration of approved persons should be sufficient enough to attract, retain and motivate persons of the quality needed to run the TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider successfully, but the TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service provider should avoid paying more than is necessary for that purpose.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.6: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.6 Management Structure HC-9.6.1 The Board of the TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service providers should establish a clear and efficient management structure. Establishment of Management Structure HC-9.6.2 The Board should appoint senior management whose authority should include management and operation of current activities of the TPA, Shari’a advisory/review service, crowdfunding platform operator and other ancillary service providers, reporting to and under the direction of the Board. The senior managers should include at a minimum:
(a) A CEO;
(b) A chief financial officer;
(c) A corporate secretary; and
(d) An internal auditor (see AU-1.2) and should also include such other approved persons as the Board considers appropriate and as a minimum should include persons occupying controlled functions as outlined in Paragraph AU-1.2.2. Titles, Authorities, Duties and Reporting Responsibilities HC-9.6.3 The Board should adopt by-laws prescribing each senior manager’s title, authorities, duties and internal reporting responsibilities. This should be done in consultation with the CEO, to whom the other senior managers should normally report. HC-9.6.4 These provisions should include but should not be limited to the following:
(a) The CEO should have authority to act generally in the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’name, representing the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s and other ancillary service providers’ interests in concluding transactions on the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service provider’sbehalf and giving instructions to other senior managers and TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ employees;

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.6: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.6 Management Structure (continued) (b) The chief financial officer should be responsible and accountable for:
(i) The complete, timely, reliable and accurate preparation of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ financial statements, in accordance with the accounting standards and policies of the TPA, Shari’a advisory/review services, crowdfunding platform operator or other ancillary service providers (see HC-9.3.2); and (ii) Presenting the Board with a balanced and understandable assessment of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ financial situation; (c) The corporate secretary’s duties should include arranging, recording and following up on the actions, decisions and meetings of the Board and of the shareholders (both at annual and extraordinary meetings) in books to be kept for that purpose; and (d) The internal auditor’s duties should include providing an independent and objective review of the efficiency of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ operations. This would include a review of the accuracy and reliability of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ accounting records and financial reports as well as a review of the adequacy and effectiveness of the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ risk management, control, and governance processes. Titles, Authorities, Duties and Reporting Responsibilities HC-9.6.5 The Board should also specify any limits which it wishes to set on the authority of the CEO or other senior managers, such as monetary maximums for transactions which they may authorise without separate Board approval. HC-9.6.6 The corporate secretary should be given general responsibility for reviewing the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ procedures and advising the Board directly on such matters. Whenever practical, the corporate secretary should be a person with legal or similar professional experience and training. HC-9.6.7 At least annually the Board should review and concur in a succession plan addressing the policies and principles for selecting a successor to the CEO, both in emergencies and in the normal course of business. The succession plan should include an assessment of the experience, performance, skills and planned career paths for possible successors to the CEO.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.7: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.7 Communication between Board and Shareholders HC-9.7.1 The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should communicate with shareholders, encourage their participation, and respect their rights. Conduct of Shareholders’ Meetings HC-9.7.2 The Board should observe both the letter and the intent of the Company Law’s requirements for shareholder meetings. Among other things:
(a) Notices of meetings should be honest, accurate and not misleading. They should clearly state and, where necessary, explain the nature of the business of the meeting; (b) Meetings should be held during normal business hours and at a place convenient for the greatest number of shareholders to attend; (c) Notices of meetings should encourage shareholders to participate by proxy and should refer to procedures for appointing a proxy and for directing the proxy how to vote on a particular resolution. The proxy agreement should list the agenda items and should specify the vote (such as “yes,” “no” or “abstain”); (d) Notices should ensure that all material information and documentation is provided to shareholders on each agenda item for any shareholder meeting, including but not limited to any recommendations or dissents of directors; (e) The Board should propose a separate resolution at any meeting on each substantially separate issue, so that unrelated issues are not “bundled” together; (f) In meetings where directors are to be elected or removed the Board should ensure that each person is voted on separately, so that the shareholders can evaluate each person individually; (g) The chairman of the meeting should encourage questions from shareholders, including questions regarding the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ corporate governance guidelines; (h) The minutes of the meeting should be made available to shareholders upon their request as soon as possible but not later than 30 days after the meeting; and (i) Disclosure of all material facts should be made to the shareholders. HC-9.7.3 The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should require all directors to attend and be available to answer questions from shareholders at any shareholder meeting and, in particular, ensure that the chairs of the audit, remuneration and nominating committees are ready to answer appropriate questions regarding matters within their committee’s responsibility (it being understood that confidential and proprietary business information may be kept confidential). HC-9.7.4 The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should require its external auditor to attend the annual shareholders’ meeting and be available to answer shareholders’ questions concerning the conduct and conclusions of the audit.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.7: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.7 Communication between Board and Shareholders (continued) HC-9.7.5 A TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should maintain a company website. The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should dedicate a specific section of its website to describing shareholders’ rights to participate and vote at each shareholders’ meeting, and should post significant documents relating to meetings including the full text of notices and minutes. The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers may also consider establishing an electronic means for shareholders’ communications including appointment of proxies. For confidential information, the TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should grant a controlled access to such information to its shareholders. HC-9.7.6 In notices of meetings at which directors are to be elected or removed the TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should ensure that:
(a) Where the number of candidates exceeds the number of available seats, the notice of the meeting should explain the voting method by which the successful candidates will be selected and the method to be used for counting of votes; and (b) The notice of the meeting should present a factual and objective view of the candidates so that shareholders may make an informed decision on any appointment to the board.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Section HC-9.8: Page 1 of 1
MODULE HC: High-Level Controls
CHAPTER
HC-9: TPAs, Shari’a Advisory/Review Services, Crowdfunding Platform Operators and Other Ancillary Service Providers HC-9.8 Corporate Governance Disclosure HC-9.8.1 The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should disclose its corporate governance. Disclosure under the Commercial Companies Law 2001 HC-9.8.2 In each TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers:
(a) The Board should adopt written corporate governance guidelines covering the matters stated in Module HC and other corporate governance matters deemed appropriate by the Board. Such guidelines should include or refer to the principles and rules of Module HC; (b) The TPA, Shari’a advisory/review services, crowdfunding platform operators or other ancillary service providers should publish the guidelines on its website, if it has a website (see HC-10.7.5); (c) At each annual shareholders’ meeting the Board should report on the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ compliance with its guidelines and Module HC, and explain the extent if any to which it has varied them or believes that any variance or noncompliance was justified; and (d) At each annual shareholders’ meeting the Board should also report on further items listed in Appendix D. Such information should be maintained on the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ website or held at the TPA’s, Shari’a advisory/review services’, crowdfunding platform operator’s or other ancillary service providers’ premises on behalf of the shareholders.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Appendix A: Page 1 of 2
MODULE HC: High-Level Controls
CHAPTER Appendix A : Audit Committee
Appendix A Audit Committee
Committee Duties
The Committee’s duties shall include those stated in Paragraph HC-3.2.4. Committee Membership and Qualifications The Committee shall have at least three members. Such members must have no conflict of interest with any other duties they have for the ancillary service provider licensee. A majority of the members of the committee including the Chairman shall be independent directors and non-executive directors. The Board must satisfy itself that at least a majority of the committee has recent and relevant financial ability and experience, which includes:
(a) An ability to read and understand corporate financial statements including an ancillary service provider licensee’s balance sheet, income statement and cash flow statement and changes in shareholders’ equity; (b) An understanding of the accounting principles which are applicable to the ancillary service provider licensee’s financial statements; (c) Experience in evaluating financial statements that have a level of accounting complexity comparable to that which can be expected in the ancillary service provider licensee’s business; (d) An understanding of internal controls and procedures for financial reporting; and (e) An understanding of the audit committee’s controls and procedures for financial reporting. Committee Duties and Responsibilities In serving those duties, the Committee shall:
(a) Be responsible for the selection, appointment, remuneration, oversight and termination where appropriate of the external auditor, subject to ratification by the ancillary service provider licensee’s Board and shareholders. The external auditor shall report directly to the committee; (b) Make a determination at least once each year of the external auditor’s independence, including:
(i) Determining whether its performance of any non-audit services compromised its independence (the committee may establish a formal policy specifying the types of non-audit services which are permissible) and; (ii) Obtaining from the external auditor a written report listing any relationships between the external auditor and the ancillary service provider licensee or with any other person or entity that may compromise the auditor’s independence; (c) Review and discuss with the external auditor the scope and results of its audit, any difficulties the auditor encountered including any restrictions on its access to requested information and any disagreements or difficulties encountered with management;

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Appendix A: Page 2 of 2
MODULE HC: High-Level Controls
CHAPTER Appendix A : Audit Committee
Appendix A Audit Committee (continued)
(d) Review and discuss with management and the external auditor each annual and each quarterly financial statements of the ancillary service provider licensee including judgments made in connection with the financial statements; (e) Review and discuss and make recommendations regarding the selection, appointment and termination where appropriate of the head of internal audit and head of compliance and the budget allocated to the internal audit and compliance function, and monitor the responsiveness of management to the committee’s recommendations and findings; (f) Review and discuss the adequacy of the ancillary service provider licensee’s internal auditing and compliance personnel and procedures and its internal controls and compliance procedures, and any risk management systems, and any changes in those; (g) Oversee the ancillary service provider licensee’s compliance with legal and regulatory requirements; and (h) Review and discuss possible improprieties in financial reporting or other matters, and ensure that arrangements are in place for independent investigation and follow-up regarding such matters. Committee Structure and Operations The committee shall elect one member as its chair. The committee shall meet at least four times a year. Its meetings may be scheduled in conjunction with regularly-scheduled meetings of the entire Board. The committee may meet without any other director or any officer of the ancillary service provider licensee present. Only the committee may decide if a non-member of the committee should attend a particular meeting or a particular agenda item. Non-members who are not directors of the ancillary service provider licensee may attend to provide their expertise, but may not vote. It is expected that the external auditor’s lead representative will be invited to attend regularly but that this shall always be subject to the committee’s decision. The committee shall report regularly to the full Board on its activities. Committee Resources and Authority The committee shall have the resources and authority necessary for its duties and responsibilities, including the authority to select, retain, terminate and approve the fees of outside legal, accounting or other advisors as it deems necessary or appropriate, without seeking the approval of the Board or management. The ancillary service provider licensee shall provide appropriate funding for the compensation of any such persons. Committee Performance Evaluation The committee shall prepare and review with the Board an annual performance evaluation of the committee, which shall compare the committee’s performance with the above requirements and shall recommend to the Board any improvements deemed necessary or desirable to the committee’s charter. The report must be in the form of a written report provided at any regularly scheduled Board meeting.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Appendix B: Page 1 of 3
MODULE HC: High-Level Controls
CHAPTER Appendix B : Corporate Governance Disclosure to
Shareholders
Appendix B Corporate Governance Disclosure to Shareholders
The ancillary service provider licensee shall disclose the following items to the shareholders. Ownership of Shares
1. Distribution of ownership by nationality
2. Distribution of ownership by size of shareholder
3. Ownership by Government
4. Names of shareholders owning 5% or more and, if they act in concert, a description of the voting,
shareholders’ or other agreements among them relating to acting in concert, and of any other direct and indirect relationships among them or with the ancillary service provider licensee or other shareholders Board, Board Members and Management
1. Board’s functions – rather than a general statement (which could be disclosed simply as the
Board’s legal obligations under the law) the ‘mandate’ of the Board should be set out
2. The types of material transactions that require Board approval
3. Names, their capacity of representation and detailed information about the directors, including
directorships of other Boards, positions, qualifications and experience (should describe each director as executive or non-executive)
4. Number and names of independent members
5. Board terms and the start date of each term
6. What the Board does to induct/educate/orient new directors
7. Director’s ownership of shares
8. Election system of directors and any termination arrangements
9. Director’s trading of ancillary service provider licensee’s shares during the year
10. Meeting dates (number of meetings during the year)
11. Attendance of directors at each meeting
12. Aggregate remuneration to board members
12A. The remuneration policy of the ancillary service provider licensee for board members and senior management
13. List of senior managers and profile of each
14. Shareholding by senior managers
15. Aggregate remuneration paid to the senior management
16. Details of stock options and performance-linked incentives available to executives
17. Whether the Board has adopted a written code of ethical business conduct, and if so the text
of that code and a statement of how the Board monitors compliance.

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Appendix B: Page 2 of 3
MODULE HC: High-Level Controls
CHAPTER Appendix B : Corporate Governance Disclosure to
Shareholders
Appendix B: Corporate Governance Disclosure to Shareholders
(continued)
Committees
1. Names of the Board committees
2. Functions of each committee
3. Members of each committee divided into independent and non-independent
4. Minimum number of meetings per year
5. Actual number of meetings
6. Attendance of committees’ members
7. [This item was deleted in January 2012].
8. Work of committees and any significant issues arising during the period
Corporate Governance
1. Separate section in the Annual Report
2. Reference to Module HC and its principles
3. Changes in Module HC that took place during the year
Auditors
1. The charters and a list of members of the Audit (including external and internal; financial and
non-financial experts) Committee of the Board.
2. Audit fees
3. Non-Audit services provided by the external auditor and fees
4. Reasons for any switching of auditors and reappointing of auditors

Central Bank of Bahrain
Rulebook
Volume 5:
Specialised Licensees
(Ancillary Service Providers)
HC: High-level Controls 2017
Appendix B: Page 3 of 3
MODULE HC: High-Level Controls
CHAPTER Appendix B : Corporate Governance Disclosure to
Shareholders
Appendix B Corporate Governance Disclosure to Shareholders
(continued)
Other

1. Related party transactions
2. Approval process for related party transactions
3. Means of communication with shareholders and investors
4. Separate report on Management Discussion and Analysis is included in the Annual Report –
   in particular, this should identify and comment on the management of principal risks and uncertainties faced by the business.
5. Review of internal control processes and procedures.
6. Announcements of the results in the press should include at least the followings:
   (a) Balance sheet, income statement, cash flow statement, statement of comprehensive income and changes in shareholders’ equity (b) Auditor (c) Auditor’s signature date (d) Board approval date Set out directors responsibility with regard to the preparation of financial statements Conflict of Interest – any issues arising must be reported, in addition describe any steps the Board takes to ensure directors exercise independent judgment in considering transactions and agreements in respect of which a director or executive officer has a material interest. Board of Directors – whether or not the Board, its committees and individual directors are regularly assessed with respect to their effectiveness and contribution.