Identifying, Reporting and Managing of Operational Loss Events of Licensed Banks

()9 September 2026 BANKING ACT DIRECTIONS N0. 04 of 2026 IDENTIFYING, REPORTING AND MANAGING OF OPERATIONAL LOSS EVENTS OF LICENSED BANKS In exercise of the powers conferred under the provisions of the Banking Act No. 30 of 1988, as amended, the Central Bank of Sri Lanka, having considered that the stability and resilience of the banking sector are increasingly dependent on the robustness of operational risk management frameworks inter alia, hereby issues these Directions on Identifying, Reporting and Managing of Operational Loss Events of Licensed Commercial Banks and Licensed Specialised Banks (hereinafter referred to as licensed banks).

1. Empowerment 1.1 1.2
2. Sope ofApplication 2.1
3. Objective 3.1 In terms of Section 46(1) of the Banking Act, No. 3O of 1988, as amended, to ensure the soundness of the banking system, the Central Bank of Sri Lanka is empowered to issue Directions to licensed commercial banks regarding the manner in which any aspect of the business of such banks is to be conducted. In terms of Section 76J (1) of the Banking Act, to ensure the soundness of the banking system, the Central Bank of Sri Lanka is empowered to issue Directions to licensed specialised banks, regarding the manner in which any aspect of the business of such banks is to be conducted. These Directions shall be applicable to all licensed banks. Timely identification of loss events for managing and minimizing their potential impact on bank’s operations, reputation, and financial stability as early detection allows banks to take swift corrective actions, such as controlling the event, mitigating risks, and preventing recurrence.

09 September 2026 CENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS N0. 04 0f 2026 4. Responsibilities of the Board of Directors 3.2 3.3 4.1 The Board of Directors of the bank is primarily responsible for ensuring effective management of operational risks by establishing a sound operational risk management framework with an adequate system of internal controls and ensure that the senior management effectively implements such framework across the bank. 4.2 The Board of Directors shall: (a) Put in place well—defined policies, strategies, systems and procedures on operational risk management to identify, assess, evaluate, monitor, report and mitigate operational risk commensurate with size, scale, risk profile, diversity and complexity of operations of the bank. (b) Establish a strong control environment by ensuring separation of responsibilities and reporting lines between operational risk control functions, business lines and support functions in order to avoid conflicts of interest. (c) Review the operational risk management framework at least on an annual basis to ensure that the bank is managing the operational risks arising from internal failures, external threats, market changes and other environmental factors. This review process shall further aim to assess the industry Promoting an environment of transparency and accountability within licensed banks, which ensures that near-misses and actual losses are duly analysed. Improved reporting and monitoring operational loss events for maintaining operational resilience, ensuring regulatory compliance, and enhancing risk management practices.

0 8 September 2026 BANKING ACT DIRECTIONS N0. 04 0f 2026 5. Identiflcation, Assessment, Monitoring and Control of Operational Risk 4.3 5.1 5.2 5.3 best practices in operational risk management consistent with the bank’s activities, systems, and processes. (d) Ensure the availability of effective information systems and processes to regularly monitor and report material operational exposures based on internal loss events to the Board of Directors. (e) Ensure that the bank’s operational risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained, and competent staff, with suitable frequency. (f) Ensure that a framework is implemented to calculate, if needed, an additional capital charge for operational risk under Internal Capital Adequacy Assessment Process (ICAAP), based on the historical loss events for the last 5 years. The Board of Directors may delegate its operational risk management responsibilities to Board Integrated Risk Management Committee (BIRMC) of the bank, as appropriate. Licensed banks shall identify, assess, monitor and mitigate the operational risk inherent to all products, activities, processes, and systems in line with the Board approved policies and procedures. Licensed banks shall assess their vulnerabilities to above risk events. Licensed banks shall establish adequate systems and procedures to assess, report and mitigate the operational risks inherent to new products, activities, processes, and systems prior to being introduced or undertaken.

09 September 2026 CENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS N0. 04 of 2026 6. Classification of Operational Loss Events 7. Internal Reporting of Operational Loss Events 6.1 6.2 7.1 Licensed banks shall implement (a) a robust mechanism to detect, measure and report every operational loss event in a timely manner. (b) a well—defined taxonomy of operational loss events to ensure consistent classification, enabling banks to differentiate between high-impact and routine incidents. 7.2 Licensed banks shall establish clear guidelines and a centralised mechanism across the bank to report such events and shall Licensed banks shall identify, measure and monitor the following operational risk events for the purpose of these Directions. (a) Internal fraud (b) External fraud (c) Employment practices and workplace safety (d) Clients, products and business practices (e) Damage to physical assets (f) Business disruption and system failures (g) Execution, delivery and process management Licensed banks shall classify above operational risk events as critical, high, medium, or 10w according to a risk matrix developed by the bank, based on its potential impact and the likelihood of each risk event. The risk matrix shall consider a combination of quantitative thresholds such as financial impact and qualitative criteria such as reputational, regulatory, or operational disruption with the probability of occurrence. Such categorisation of each event shall ensure efficient resource allocation and shall help the bank in focusing on mitigating the most significant threats.

9% September 2026 CENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS N0. 04 0f 2026 8. Regulatory Reporting Requirement establish reporting protocols to ensure timely communication of these events across relevant departments and management levels with a view to implementing prompt corrective actions. 7.3 Licensed banks shall report the operational loss events t0 the Board of Directors/ BIRMC on a regular basis. 8.1 8.2 Licensed banks shall report loss events rated as Critical and High with a total gross loss equals to or exceeding Rs. 5 Mn within 24 hours of the identification to the Director Bank Supervision via techrisk.bsd@cbsl.1k, copying dbsd@cbsl.lk in the format given in Annex I hereto. Licensed banks shall report each operational loss event of the following nature to the Director Bank Supervision at the end of each quarter, within 15 working days, commencing 30 September 2026, through the web-based return code BSD-QF￾38-OLE: Reporting on Operational Loss Events of Licensed Banks. A template of the reporting format is given in Annex II. (a) All loss events rated as Critical, High, Medium or Low, where the gross loss of a loss event equals to or exceeding Rs. 500,000. (b) Recurring events of a similar nature resulting in a cumulative loss of Rs. 500,000 or more during the quarter. (c) Events occurring with very high frequency during the quarter Where the cumulative loss equals to or exceeding Rs. 500,000. (d) Any other significant loss event identified by the bank that could impact the bank or the banking industry.

0 8 September 2026 CENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS No. 04 of 2026 9. Definitions 9.1 Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk but excludes strategic and reputational risks. 9.2 Associated Business Lines: (a) (b) (C) (d) (6) (f) (g) Corporate Finance: Mergers and acquisitions, underwriting, privatisations, securitisation, research, debt (government, high yield), equity, syndications, Initial Public Offerings (IPO), secondary private placements. Trading & Sales: Fixed income, equity, foreign exchanges, credit products, funding, own position securities, lending and repos, brokerage, debt, prime brokerage and sale of government bonds to retail investors. Payment and Settlement: Payments and collections, inter— bank iimds transfers (RTGS, CEFT etc.), clearing and settlement. Agency Services: Escrow, securities lending (customers) corporate actions, depository services, issuer and paying agents, debenture trustee. Asset Management: Pooled, segregated, retail, institutional, closed, open, private equity. Retail Brokerage: Execution and full service. Retail Banking: (i) Retail lending, including trade finance, cash credit, bill of exchange and export and import finance facilities to retail customers, housing loans, loans against shares, banking services, trust and estates, retail deposits, and intra bank fund transfer on behalf.

CENTRAL BANK OF SRI LANKA 03 September 2026 BANKING ACT DIRECTIONS N0. 04 of 2026 (ii) Private lending (perscnal loans) and private (institutional) deposits, banking services, trust and estates, and investment advice. (iii) Card services include merchant/ commercial/ corporate cards. (h) Commercial Banking: Project finance, corporate loans, cash credit loans, real estate, export and import finance, trade finance, factoring, leasing, lending, guarantees including deferred payment and performance guarantees, letters of credit, bills of exchange, take-out finance, inter— bank lending other than in call money and notice money market. 9.3 Event Categories: (a) Internal fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involve at least one internal party. (b) External fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party. (c) Employment practices and workplace safety: Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal inj ury claims, or from diversity/ discrimination events. (d) Clients, products & business practices: Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and

CENTRAL BANK OF SRI LANKA 08 September 2026 BANKING ACT DIRECTIONS No. 04 0f 2026 suitability requirements), or from the nature or design of a product. (e) Damage to physical assets: Losses arising from loss or damage to physical assets from natural disaster or other events. (f) Business disruption and system failures: Losses arising from disruption of business or system failures. (g) Execution, delivery & process management: Losses from failed transaction processing or process management, from relations with trade counterparties and vendors. 9.4 Risklevels: (a) Critical risks: Pose severe threats to ‘bank’s financial stability or reputation, hence requiring immediate intervention. (b) High risks: Significant but manageable with swift corrective actions. (c) Medium risks: Have a moderate impact and can be addressed through routine controls. (d) Low risks: Minor and often require minimal monitoring. 10. Effective Date 10.1 These Directions shall come into effect from the date of ISSHaI’IC6. Chairman N7 Dr. P oflhe Nandalal Governing Weerasmghe M Board and G0vern0r offhe Central Bank ofSri Lanka \Qi‘qLy/

09 September 2026 Name of the Bank: Reporting Date:
CENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS Identifying, Reporting and Managing of Operational Loss Events (Template for Immediate Reporting)1 No. 04 of 2026 Annex I [1] Associated Business Line (i) Corporate Finance (ii) Trading & Sales (iii) Payment & Settlement (iv) Agency Services (v) Asset Management (vi) Retail Brokerage (vii) Retail Banking (viii) Commercial Banking [2] Event Category Internal Fraud External Fraud (i) (ii) (iii) (iV) (V) (vi) (vii) Employment practices and workplace safety Clients, products and business practices Damage to physical assets Business disruption and system failures Execution, delivery and process management [3] Risk Level (i) Critical (ii) High l Licensed banks shall report loss events rated as Critical and High with a total gross loss equals to or exceeding Rs. 5 Mn within 24 hours of the identification to the Director Bank Supervision via i:echrisk.bsd@cbsi.lk, copying dbsdgQcbslJkin the format given. Event Detected by or Reported to the bank (Date and Time) DD/MM/YYYY Hrs/Mins/Secs Date and Time of the Event Occurrence Associated Business Line “l Event Category [2] Event Description Risk Level [3' (As defined in the Directions) Total Gross Loss (Rs. Mn) Immediate Action/s Taken

CENTRAL BANK OF SRI LANKA 08 September 2026 BANKING ACT DIRECTIONS N0. 04 of 2026 Annex II BSD-QF-38-OLE: Report on Operational Loss Events 0f Licensed Banks Name 0f the Bank: Reporting Date: 1Associated Business Line ZEvent Category 3Risk Level Corporate Finance Internal Fraud Critical Trading & Sales External Fraud High Payment & Settlement Employment practices and workplace safety Medium Agency Services Clients, products and business practices Low Asset Management Damage to physical assets Retail Brokerage Business disruption and system failures Retail Banking Execution, delivery and process management Commercial Banking General Event Information Financial Impact Risk Assessment Remedial Actions §L-& é:5 E 5 tee >3 35§A>$ 3°: agafé E_= Egg: ahnageg m3.“ >°g mlg ‘3 EH8 :§E h5§ =03 gas cu a 5 sfé Ea “A“m %= <‘gm E‘9en a=0>H :6 Ha: 5.9 >5 Hm £ 0 Ea’m‘ :5 W:>35 3:8 g? a}: Gross Loss (Rs. '000) Amount Recovered Rs. '000) m 8z at: cg 2”m :g eat-c gpgngg “SElgé 3->= a.$,5e QEEO {-3 0gA o§ge aé a EE0% emEE E:.° Q, E:$3 bi”.2 3< “*5 i.° =3t H3 E“°: §a: moaa aR(5%° EA £ :0“ 0E? “Eh E35 2g: W: 0‘5 5gE3an e2 §>°° kg