Industry Consolidated Comments – FIMA Governance Standard Chapters 3 and 4

1 | P a g e Industry Comments Template Standard 3.10 and 4.19 -Governance Company Name: STD/REG No. & Section/Clause: Comment/Description of issue: Proposed Amendment/Solution: Alexander Forbes and the retirement funds under its administration FM.S.3 .10 CIS.S.4 .19 Clause 6(b) The clause is not clear. Amend as follows: (b) the board must have knowledge and skills required for to effectively governing a regulated entity. This includes expertise in finance, accounting, the role of control functions, investment analysis and portfolio management, and an understanding of the obligations relating to fair treatment of customers; and Accepted. FM.S.3 .10 CIS.S.4 .19 Clause 8(b) Principles of Corporate Governance allow for a non￾independent chairperson as long as there is a lead independent chair. The Standard should allow for a lead independent chairperson in the instance that the chairperson is not independent Declined the concept “lead independent chairperson” is contradictory– the chairperson is either independent or not. In our case we prescribe the Chairperson to be independent because it is good governance. However nothing prevents the regulated entity to make temporary arrangements in its governance frameworks for when the Chairperson is conflicted however that arrangement should be the exception and not the rule. FM.S.3 .10 CIS.S.4 .19 Clause 11(d) The clause contains typing and grammatical errors. Amend as follows: (d) ensure that the any service provider does not unduly influence the management of the regulated entity. Noted. FM.S.3 .10 CIS.S.4 Is the intention that a person cannot be an independent director if they are employed by any regulated entity? Amend as follows: 13. An independent director must not be an employee of a the regulated entity or an employee of a related party. Clarification. The intention is that an employee of the regulated entity is barred from acting as an independent director. The proposed amendment is accepted. NAMFISA Response to Comment:

2 | P a g e .19 Clause 13 FM.S.3 .10 CIS.S.4 .19 Clause 32 Should this not only be limited to independent directors? Independence is catered for by the 1/3 requirement. Amend as follows: Tenure of office and appointment 32. (1) To ensure independence and reduce the risk of familiarity, no independent non￾executive director may serve for more than three consecutive terms, and the tenure for one term may not exceed a period of three years. (2) After serving the maximum of three consecutive terms, a minimum period of at least three years must lapse without being involved in the regulated entity before the same person may be appointed as an independent non￾executive director on the Board. Declined. Non-executive directors, while not involved in the day-to-day management of a regulated entity, often have existing ties to it (for example, as former executives). Without a limit on their tenure, the risk of familiarity grows, leading them to lose objectivity and shift from independent watchdogs to comfortable allies of management. To mitigate this, most governance frameworks cap non-executive directors’ service at around nine consecutive years to preserve independence and ensure fresh oversight. Accepted. Standard bank [CIS.S.4.19] 1 (b); 1(b) (i); 9; 33(a) Definitions- “conflict of interest”-auditor For the avoidance of doubt, reference to auditor should be amended to external auditor. Declined. The remainder of the clause already frames the auditor as a business relationship, hence the use of the term “client.” So, the word “external” is redundant. 1(b); 1(b) (i) Definitions- “conflict of interest” – “service provider” We recommend amending service provider to third party service provider in line with international best practice. We further propose defining a third party service provider as: “an entity, which has entered into a business relationship or arrangement Accepted.

3 | P a g e with a regulated entity, for the provision of goods and/or services”. 1(c) Definitions-“key persons”- “Responsible person” For avoidance of doubt, we recommend including a definition of a responsible person. Declined. This term is consistent with the definition of “key person” in the Fit and Proper Standard. Further, the responsible person is not in isolation it is the person responsible for managing, or overseeing the activities of the regulated entity. 6 Board Composition There seems to be a contradiction between the expectation of the level of skill that the board members individually and collectively must have. Section 6(a) requires: “The board must collectively and individually have” Whilst section 6 (c) indicates that while certain areas of expertise may lie in some, but not all members. It is, therefore, advisable to that the level of skill is addressed at either individual or collective, separately and not as read in context. Clarification 6(a) requires the board to collectively and individually have and maintain skills, knowledge and understanding of the regulated entity. 6(c ) recognizes that there certain board members who are experts in an area but that the board is encouraged to have a diverse set of experts. Therefore the clauses are complimentary with each other. Board Composition We noted that reporting structure is not defined and its intended purpose also remains unclear. We therefore recommend rephrasing this section as follows: The board shall maintain a defined governance framework, including a formally designated Chairperson and additional board members as required to fulfill structural, functional, and compliance objectives.

4 | P a g e 8 Board Chairperson This section deals with the duties of the Board Chairperson. We propose rephrasing the heading to “Duties of the Board Chairperson” to reflect the section’s content. Accepted. 9 Independence and Conflict of Interest For the avoidance of doubt, the term “other officers” should be defined to clearly articulate who will regarded as other officers. Declined, other officers will be deleted because it is superfluous. 12(c) Independence and Conflict of Interest For the avoidance of doubt, the term personal service contract should be defined. Declined, however we will remove the reference to “personal” to read clear. 12(e) Independence and Conflict of Interest The term “significant contributions” is vague and ambiguous. For the avoidance of doubt, we recommend that the term be defined with specific reference to a monetary value. Declined. The term has been adopted to reflect that “significant contributions” should be assessed in relation to the size of the regulated entity. 12 (h) Independence and Conflict of Interest For the avoidance of doubt the term “immediate family” should be defined or linked to the relevant legislation (such as the Labour Act, 2007). Accepted, immediate family will be defined to include: a) child, including a child adopted in terms of any law, custom or tradition; b) spouse; c) parent, grandparent, brother or sister, of the employee; or father-in-law or mother-in-law of the employee. 13; 14 Independence and Conflict of Interest For the avoidance of doubt, the term ‘related party’ must be defined. We further recommend that provision be made for an exception process on a case-by-case basis, as an absence of such a process may potentially lead to additional costs for the subsidiary entity. Please note that clause 1(2)(a)- (d) outlines what and who a related party is. 18; 8(d) Performance evaluation of board Section 18 is a repetition of section 8. In addition, there is an inconsistency between section 18 and section 8 on the basis that section 18 prescribes that performance be evaluated annually, while section 8 provides that the evaluation be done regularly. We, therefore, recommend removing Accepted.

5 | P a g e section 8 (d), as its intended purpose is addressed under section 18. 19; 21 Performance Evaluation of Board Section 21 is a repetition of section 19. One of these sections should therefore be deleted. Accepted 23 Internal Audit This section makes the establishing of an internal audit function a mere option. The quality of assurance is compromised in absence of an internal audit function of the regulated entity. Kindly reconsider mandatory internal audit provisions, to ensure King IV and potential King Code V principles reflected here. Declined, it is the board’s prerogative to determine whether its structure and business operations warrant the establishment of an internal audit function. 32(1) Tenure of office and appointment This section is silent in terms of the tenure of the audit firm. We therefore recommend including a specific provision for the tenure of the audit firm, which should preferably be capped at 10 years in line with the King IV recommendation. As per clause 33(1)(a) the tenure of the auditor is limited to no more than five consecutive years. 46(b) (iv) Risk Management We recommend rephrasing this section to ensure alignment with the International Standard Organisations (ISO) 31000 Principles on Risk Management. Accepted 57 (a) Regulated entity information and access to regulated entity information Consider replacing the term “unfettered” with unrestricted to reflect plain language. Accepted NASIA Definitions

1. (1) [CIS.S.4.19] e) “regulated entity” means any of the following entities registered under Chapter 4 of the Act: We note the inclusion of collective investment schemes within the ambit of “regulated entities”. Collective investment schemes (CIS) are typically not structured as legal entities in their own right in the e) “regulated entity” means any of the following entities registered under Chapter 4 of the Act: (i) authorised representative; (ii) collective investment scheme that is a company or other legal entity with a governing body; (iii) custodian; Clarification the definition of collective investment scheme under FIMA means a scheme, in whatever form, including an open ended investment company, pursuant to which members of the public are invited or permitted to invest money or other assets in a portfolio, and under the terms of which - (a) two or more investors contribute money or other assets to and hold a participatory

6 | P a g e (i) authorised representative ; (ii) collective investment scheme; (iii) custodian; (iv) manager; (v) nominee company; or trustee Namibian landscape. Given that a CIS is typically established in terms of a deed and does not have its own board, board committees and senior management we suggest that the standard clarify that it seeks to make provision specifically for where a CIS is structured as its own legal entity. (iv) manager; (v) nominee company; or trustee interest in a portfolio of the scheme through shares, units or any other form of participatory interest; and (b) the investors share the risk and the benefit of investment in proportion to their participatory interest in that portfolio or on any other basis determined in the deed,. The phrase “in whatever form” is broad and all encompassing to include CISs that are structed as legal entities and those that are not.

1. (1) (e) “regulated entity” means any of the following entities registered under Chapter 3 of the Act: (i) authorised user; (ii) central securities depository; (iii) exchange; investment manager; Clarity is sought on whether an unlisted investment manager registered under the Pension Fund Regulations meets the definition of Investment Manager (“investment manager” means a company that is in the business of investment management;) This is a fundamental issue which has not been clarified in the Act nor in the latest regulations. An investment manager is defined under Chapter 3 of FIMA and does not include an unlisted investment manager. Board composition
2. (2) The board must have a balanced power structure, with one-third of its members being independent directors. The requirement that one￾third of board members be independent may lead to unintended consequences: The Namibian market has a limited pool of suitably experienced independent directors, that are not conflicted due to existing 5 (2) The board must have a balanced power structure, that supports objective oversight and sound governance and with one-third of its members being independent directors regulated entities must aim to have at least one-third of their board comprised of independent directors. Declined. The requirement for at least one-third of board members to be independent stands as a minimum governance standard. While market limitations are recognized, maintaining this baseline is considered essential for objective oversight;.

7 | P a g e appointments by other financial institutions (particularly given the large number of entities registered with NAMFISA), which potentially leads to repeat appointments and weakens the intended benefit. Based on NAMFISA’s Q1 2025 Quarterly Statistics, there are 234 regulated entities excluding 831 microlenders, if each needed to have at least 2 independent directors, there would need to be at least 468 qualified and suitable experienced independent directors in the market. We do not believe that the market offers a sufficient number of independent directors. In member -governed or smaller institutions, non

• independent but experienced directors often provide essential context and continuity. Based on the above adopting a principles -based approach allows for flexibility and ensures that governance standards are met without compromising the availability of qualified directors. To address these issues, we suggest the following adjustment: Permit regulated entities to justify board composition based on size, risk profile and governance effectiveness.

8 | P a g e Rationale: • Substance over form: Shifting to a principles￾based model promotes substance-over-form in governance. • This model is widely recognised in local and international codes and principles. • This approach ensures regulatory expectations remain realistic and implementable without compromising oversight and integrity. Our proposed amendment aims to balance the need for independent oversight with the practical realities of the Namibian market, ensuring that governance remains effective and contextually appropriate. Board chairperson 8. The chairperson of the board must- … (b) be independ ent within the meaning of this Standard Please refer to our comments under 5.2. In line with risk-based supervision and a principle￾based approach to corporate governance, we advocate for the appointment of a lead independent director where the chairperson is not independent. 8. The chairperson of the board must- … (b) be independent within the meaning of this Standard. Where the chairperson is not independent, the board must appoint Declined. Good corporate governance demands an independent chairperson. However, nothing prevents the regulated entity to make alternative arrangements to manage the situation for when the chairperson is conflicted.

9 | P a g e Regulated industries in the capital markets include both private and public entities of varying sizes and operations. The pool of experienced unconflicted directors compared to the number of regulated entities in Namibia is relatively small. Additionally we often find that where a non￾independent chair is appointed, the chair has deeper understanding of the organization and can offer better insight and oversight over key opportunities and risks leading to stronger board oversight. a lead independent director from among the independent members of the board. The lead independent director must provide leadership to ensure the independence of the board is maintained, support the chairperson in delivering effective governance, and serve as a point of contact for stakeholders and board members where necessary. Independence and conflict of interest 9. A member of the board, principal officer, employee, other The current wording of Section 9, requiring all employees, officers, auditors, and service providers to report conflicts of interest directly to the board is too broad and operationally impractical. In practice, employees and 9. A member of the board, principal officer, employee, other officers, auditor and other service providers must report to tThe board must ensure that appropriate policies and procedures exist to manage and report any conflict of interest encountered by board members, principal officer, other officers, employees, auditors and other Clarification the purpose of this clause is to ensure the board receives conflict of interest registers of employees, board members and service providers. It is not intended for the reporting to be made directly to the board by these parties. The revised clause to read: All conflicts of interest encountered before or during the performance of duties by any

10 | P a g e officers, auditor and other service providers must report to the board any conflict of interest encountered during the performance of their duties. officers (especially those not in senior leadership positions) should not be expected to bypass established internal governance structures to report directly to the board. Doing so risks overburdening the board with day-to-day operational details and may undermine the role of Compliance and line managers in the effective identification and management of conflicts. Moreover, such a directive could inadvertently discourage employees from reporting conflicts due to the perceived formality or seriousness of going preceding service providers during the performance of their duties which may have a significant impact on the operations, reputation or regulatory compliance of the entity. board member, the principal officer, employees, officers, auditors, or third-party service providers must be disclosed and reported to the board. the regulated entity serves as a director; (h) is not a member of the immediate family of any person described in paragraphs (a) to (g); or has not had any of the relationships described in paragraphs (a) to (g) with any affiliate of the regulated entity. judgment, and may undermine effective governance, especially in the case of highly specialized or regulated subsidiaries requiring deep institutional knowledge. We offer the following rationale for the suggested changes: Rationale: • This approach introduces a substance-over- form test, common in global governance frameworks. • This approach provides flexibility while maintaining safeguards to ensure the director’s ability to act independently. required to make disclosure within the preceding three one years; (g) is not employed by a public listed company or an unlisted company at which an executive officer of the regulated entity serves as a director; (h) is not a member of the immediate family of any person described in paragraphs (a) to (g); or has not had any of the relationships described in paragraphs (a) to (g) with any affiliate of the regulated entity where such relationship would reasonably be expected to impair the director’s objectivity in exercising judgment on matters pertaining to the regulated entity. The concern about limited independent directors is noted. Requiring one-third independent board members, even in smaller market like ours, enhances market credibility and investor confidence by ensuring objective oversight and reducing insider dominance. While the talent pool may be limited, the long-term benefit is a more professional and trusted financial sector which is appropriate for our market size.

11 | P a g e • It is aligned with international best practices, such as those adopted by certain financial regulatory authorities that allow group independence under specific criteria. • It is not as restrictive for directors who work in distinct divisions and territories of the group. By adopting these international best practices, the proposed amendment ensures that the definition of an independent director remains practical and implementable while maintaining the integrity of Namibia’s governance standards. 14. An independent director of a holding company or a related party is not deemed or considered independent of a subsidiary within the group. Section 14 presents a significant challenge for governance within group structures by categorically denying independent status to a director of a holding company or related party when serving on the board of a subsidiary. This blanket restriction does not consider the context or nature of the director’s relationship with the subsidiary, and it contradicts common governance practices in group structures where independent group￾level directors often serve on subsidiary boards to provide strategic oversight and ensure consistency in strategy, governance, risk management and compliance. This 14. An independent director of a holding company or a related party is not deemed or considered independent of a subsidiary within the group. We recommend that section 14 be deleted in its entirety. If the deletion is not acceptable, we propose that the regulator consider the alternative approach outlined below. 14. (1) An independent director of a holding company or a related party is not deemed or considered independent of a subsidiary within the group unless:. (a) it can be reasonably demonstrated that: i) the director is not involved in Accepted. Section 14 deleted.

12 | P a g e experience can enhance the quality of oversight. The provision assumes a conflict of interest solely by virtue of group affiliation, which may not reflect the substance of the relationship or the director’s ability to act independently at the subsidiary level. This approach risks excluding highly qualified directors who have no material connection to the subsidiary’s operations or management and who understand their fiduciary duties, and are otherwise capable of exercising independent, objective and unfettered judgment. The clause further neglects to consider the prevalence of group structures within our local industry. The majority of regulated entities operate within a group structure and categorically assuming that directorship on one group entity the day -to -day decision making and management of the subsidiary; ii) the director is capable of exercising objective, independent judgment in relation to the affairs of the subsidiary; and any potential conflicts of interest are disclosed and appropriately managed in accordance with the group’s governance framework. extinguishes independence if appointed to another group entity creates an unjustified and pervasive constraint to all regulated entities. Consider a fully Namibian group, consisting of an investment manager and a manager of the collective scheme (“manco”) which is a fully

owned subsidiary of the investment manager. In such a case an independent director of the investment (2) Where a director of a holding company or related party is deemed independent based on the criteria in subsection 1 (a), the subsidiary board must assess and record the basis upon which such a director is considered independent.

13 | P a g e manager is automatically disqualified from being an independent director on the manco, although no conflict exists. Market constraints on unconflicted independent directors illustrated in section 5(2) are also exacerbated because where the group has to find additional independent directors for each entity which reduces the pool of unconflicted experienced directors further. In effect, Section 14 limits the talent pool for subsidiary boards and hinders efficient governance by imposing formal rather than risk -based criteria while increasing overall costs. We further offer the following rationale for the proposed amendments: • This approach preserves regulatory intent by requiring subsidiaries to perform a formal independence assessment but avoids blanket prohibition. It allows for board effectiveness by allowing for flexibility, while ensuring • independence is not compromised. This approach enables greater flexibility in structuring

14 | P a g e effective boards, especially for regulated entities requiring expertise and consistency in governance. • This approach aligns with global best practices, which allow for independence in substance, not just in form. • It ensures transparency and accountability through documented assessments of independence. It promotes efficient oversight without compromising governance standards upheld Performance evaluation of board 20. Subject to the Act, the board must ensure that –… (e) the chairperson of the board, or a committee appointed by the board, must evaluate the performance of the principal officer at least annually. It is important to focus on the key principles of corporate governance, a principle -based approach in ensuring the board discharges its fiduciary duties and risk -based supervision. The complexity and size of the regulated entity play a role, and the available expertise to evaluate day -to

day performance might differ amongst directors of the board and in certain instances a specific non

• executive director might be best placed. Additionally, where no subcommittees are constituted, the responsibility would fall solely on the chairperson, who may not be the most suitable individual to perform the assessment. We propose

20. Subject to the Act, the board must ensure that – … (e) the chairperson of the board, or a committee appointed by the board, must evaluate the performance of the principal officer is evaluated at least annually. Accepted.

15 | P a g e amending the section to emphasize the board’s obligation to ensure proper performance evaluations of the principal officer are conducted, rather than prescribing the format. Internal Audit 23. The board must consider whether the structure and operations of the regulated entity would benefit from the introduction of an internal audit function. Where the entity is part of a larger group, the Internal Audit function is often managed at the group level. In such instances, we note that the board’s consideration would relate to leveraging the group’s Internal Audit function to effectively manage both costs and risks. 23. The board must consider whether the structure and operations of the regulated entity would benefit from the introduction of an internal audit function, either at group level or directly. Accepted 24. Where the board decides to introduce an internal audit function, the board must ensure that – … (c) the board is ultimately responsible for the appointment and performance assessment of the head of internal audit; ... To align with the proposal for section 23. It allows the regulated entity to adopt appointment and assessment practices that align with its structure and operations. 24. Where the board decides to introduce an internal audit function, the board must ensure that – … (c) the board is ultimately responsible for the a head of internal audit is appointed appointment and their performance assessed assessment of the head of internal audit; Declined, if the board determines whether it introduces the internal audit function at group level or at the regulated entity level, then the same board must appoint and assess the performance of the internal audit function it appointed. Board Committees 25. Pursuant to section 398 of the Act, the Establishment of committees Section 398 of the Act states “The board of a financial institution may appoint from among their 25. (a) Pursuant to section 398 of the Act, the regulated entity’s board may must set up the committees necessary for the performance of the following Part a) is accepted.

16 | P a g e regulated entity’s board must set up the committees necessary for the performance of the following functions, but not limited to – (a) audit; (b) investment; (c) risk management; (d) ethics; (e) nomination and remuneration; and information technology. number such other committees… as they consider necessary”. The Act therefore contemplates the regulated entity having the ability to decide for itself what committees it requires. We note the use of the word ‘must’ in the standard which obliges the regulated entity to establish all these listed committees. To align with the Act, we propose the wording of the standard be adapted to meet the Act and allow a regulated entity to assess its own committee needs based on the entity’s structure and operations. Unintended consequences of obligating the regulated entity include: • Creating complexity and cost without necessarily improving oversight; • Boards may face duplication of functions or stretched capacity where the same individuals serve on multiple committees; and • It may distract from strategic governance by increasing administrative demands I.e. in the instance of operating under a dual-listed company (DLC) structure. Under this arrangement, the DLC functions, but not limited to- ensure effective oversight of key areas of risk and strategic importance, including but not limited to – i) Audit ii) Investment iii) Risk management iv) Ethics; v) Nomination and Remuneration; and vi) Information Technology (b) Notwithstanding subsection (a), the board may (i) establish separate or combined committees, or may retain direct board oversight; and in the case of entities that form part of a group with an integrated governance framework, rely on group-level committees or structures, provided they are fit for purpose, adequately resourced, and effective in overseeing the relevant functions. (c) The board must periodically assess the adequacy and performance of its governance structures. Part b) is declined because the onus is on the board to determine whether they should follow group level committees or they require their own at subsidiary level.

17 | P a g e Board is supported by a range of established committees that assist in the discharge of its oversight responsibilities across the Group. This includes an integrated governance framework that enables coordinated risk oversight and control across both listed entities and their subsidiaries. We propose a more flexible regime that: • Expressly permits combined committees (e.g. Audit and Risk) where appropriate. • Permits direct board oversight of key areas without requiring sub

committees for lower

• risk or smaller entities. • Encourages performance

based assessments of governance structures over prescriptive form. • Allows companies that are part of a group of companies to design governance practices that are fit for purpose. Subcommittee composition We furthermore request

18 | P a g e clarification under Section 25 as to whether group-level board committees may be recognised as fulfilling the requirement for board committees under this section, or whether separate, local board-level committees are expected at each regulated entity level, even where a robust and integrated governance structure is in place with the local board demonstrating their assessment of optimal oversight over delegated functions. If group-level committees are permitted, it will; • introduce flexibility while preserving accountability; • encourage a risk- and performance-based approach over rigid form; and recognize group-level governance arrangements common in global and regional organizations. Tenure of office and appointment 32. (1) To ensure independence and reduce the familiarity, risk of no non￾executive director may Section 32 imposes a strict tenure limit of nine consecutive years for non￾executive directors (NEDs), with a mandatory three-year cooling-off period before reappointment. It is important to balance the need for independence and reduction 32. (1) To ensure independence and reduce the risk of familiarity, no independent non-executive director may serve for more than three consecutive terms, and the tenure for one term may not exceed a period of three years unless: (a) the director passes an Declined. Non-executive directors, while not involved in the day-to-day management of a regulated entity, often have existing ties to it (for example, as former executives). Without a limit on their tenure, the risk of familiarity grows, leading them to lose objectivity and

19 | P a g e serve for more than three consecutive terms, and the tenure for one term may not exceed a period of three years. (2) After serving the maximum of three consecutive terms, a minimum period of at least three years must lapse before the same person may be appointed as a non-executive director again. of familiarity risk with the importance of continuity, skills and knowledge on the board to ensure a strong board with effective oversight, particularly also for smaller entities and given the context described in earlier sections. The section is also particularly broad since it applies to all non- executive directors and not only independent non- executive directors. Furthermore, independence and effectiveness can be tested through rigorous annual board assessments, and continued service need not automatically compro mise objectivi ty. International governance standards increasingly favour a principle-based approach, recognising that independence may be retained beyond fixed tenure limits if supported by formal assessments and appropriate disclosures. In achieving the appropriate balance, we therefore recommend that this section only applies to independent non-executive and that we follow an approach aligned with international governance codes. Rationale for some of the amendments: • This approach still promotes board independence test each year after the 9-year mark; and (b) the board ensures that the considerations and outcome of the independence assessment are (i) in line with the independence criteria as set out in this Standard; and (ii) formally documented. (2) After serving the maximum of three consecutive terms and where an independent director is no longer found to be independent, a minimum period of at least three years must lapse before the same person may be appointed as an independent non-executive director again. shift from independent watchdogs to comfortable allies of management. To mitigate this, most governance frameworks cap non-executive directors’ service at around nine consecutive years to preserve independence and ensure fresh oversight.

20 | P a g e independence and mitigates familiarity risk. • The amendment provides flexibility given the constraints illustrated in s 5(2) faced by many groups and companies in specialised fields. • By requiring annual board evaluations, formal documentation, and public disclosure of any extended tenure, the amendment ensures transparency and accountability. It promotes thoughtful, principle- and evidence-based decision￾making. This approach mirrors widely accepted governance codes and principles. 33. (1) To ensure independence and reduce the risk of familiarity in respect of the auditor of the regulated entity, the auditor must be appointed for a fixed period and – (a) the auditor may not serve for more than five consecutive years; and the auditor must comply with the In the case where S33 is meant to reference the audit firm, we wish to highlight the limitations of mandatory firm rotation:

1. Potential loss of institutional knowledge and disruption of audit quality during the transition period. A new audit firm lacks the in-depth understanding of the entity which could lead to lower quality audits in the initial periods. Too frequent audit firm rotation is therefore not recommended, as it takes time to regain
2. (1) To ensure independence and reduce the risk of familiarity in respect of the auditor of the regulated entity, the auditor must be appointed for a fixed period and – (a) the auditor may not serve for more than five consecutive years; and the auditor must comply with the partner rotation requirements prescribed by the Code of Ethics issued by the International Ethics Standards Board for Accountants. Accepted in part: The proposal to align the auditor rotation requirement to the audit partner is accepted. The suggestion to entirely remove the fixed term and rely solely on internal quality reviews (such as appointing a second senior audit professional) is not accepted.

21 | P a g e partner rotation requirements prescribed by the Code of Ethics issued by the International Ethics Standards Board for Accountants. (2) After serving as the auditor for the maximum period of five consecutive years, a minimum period of at least three years must lapse before the same auditor may be appointed again. the in-depth entity￾specific understanding. 2. Onboarding new auditors typically has a cost impact. 3. The small and specialized nature of the capital markets reduces the options available for qualified auditors. As such rotation often ends up being between the same limited number of firms and audit partners which does little to reduce familiarity risk. The limitations above are supported by the fact that the IESBA does not have an audit firm rotation requirement and it is therefore best practice not to provide audit firm rotation. Rotation 34. The board must establish an arrangement for periodic, staggered rotation of directors and chairpersons of committees or tenure limits to serve on a committee by introducing members with new expertise and perspectives We suggest that the rotation should only apply to directors, and not to committee chairpersons and committee members. If the requirement is that the directors are rotated, this will organically filter down to the committees. It also remains important that the risk of familiarity and the benefit of obtaining fresh perspectives are balanced with valuable board oversight supported by knowledge and experience. Section 32 also already 34. The board must establish an arrangement for appropriate periodic, staggered rotation of directors and chairpersons of committees or tenure limits to serve on a committee by introducing members directors with new expertise and perspectives while retaining valuable knowledge, skills and experience and maintaining continuity to avoid undue concentration of power and promote fresh perspectives. The addition of the word “appropriate” before “periodic” is declined because periodic is appropriate. The suggestion to limit the rotation requirement to directors only (excluding committee chairpersons and members) is declined because separate rotation for committee chairs and members remains important to prevent entrenchment and ensure diversity of perspectives.

22 | P a g e while retaining valuable knowledge, skills and experience and maintaining continuity to avoid undue concentration of power and promote fresh perspectives introduces requirements to ensure familiarity risk is reduced. We suggest the addition of the word “appropriate” as “periodic” on its own is not clear, and “appropriate” allows for a consideration of the circumstances in line with principle-based good corporate governance. Internal controls 42. The oversight responsibilities of the board requires that there must be – (a) a regular assessment of the performance of the persons and entities involved in the operations of the regulated entity in terms of service level agreements, mandates, and performance contracts; a regular review of services and fees and all costs associated with the operations of the regulated entity to ensure that they are appropriate; (c) a The provision is too broad and would extend the board’s oversight obligations to non￾core functions (e.g. management of building facilities). We therefore suggest that it speak specifically to material business functions. 42. The oversight responsibilities of the board requires that there must be – (a) a regular assessment of the performance of the persons and entities that perform material business functions for involved in the operations of the regulated entity in terms of service level agreements, mandates, and performance contracts; a regular review of material services and fees and all material costs associated with the operations of the regulated entity to ensure that they are appropriate; Declined, the board is accountable for principal and material business functions. Therefore limiting the board’s oversight functions to material business functions is limiting the board’s accountability.

23 | P a g e regular review of the information processes, operational software systems and accounting and financial reporting systems involved in the operation of the regulated entity; Risk management 46. Subject to the Act – (a) the board may delegate oversight of the regulated entity’s risk management function to an appropriate board committee; The proposed standard permits delegation of risk oversight to a Board Committee, but it does not clarify whether this includes group-level committees in centralised governance models. We request confirmation, in guidance or regulation, that delegation to a group-level committee, such as a group Audit and Risk Committee, is acceptable where proper terms of reference and the necessary entity-level board oversight remains in place. Rationale Ensures that the delegation to group-level committees is explicitly permitted while maintaining the necessary oversight and accountability at the entity level. 46. Subject to the Act – (a) the board may delegate oversight of the regulated entity’s risk management function to an appropriate board committee, including group-level committees, provided that: (i) proper terms of reference are established for the group-level committee; and the necessary entity-level board oversight remains in place to ensure accountability and effective risk management. Declined, the phrase “an appropriate board committee” is intentionally broad to be suitable for various business structures who have group level committees or not. 54. The board must ensure that there are processes in place enabling The nature of “risk disclosure” to stakeholders is unclear – clarity is requested in this regard. In addition, we propose that the term “stakeholders” is too wide, 54. The board must ensure that there are processes in place enabling complete, Accepted.

24 | P a g e complete, timely, relevant, accurate and accessible risk disclosure to stakeholders. and that the word “relevant” be included Regulated entity expenses 55. The board must perform regular review of services, against set performance standards, fees and all costs associated with the operation of the regulated entity to ensure that they are appropriate. To ensure that the board’s focus remain strategic oversight, we would suggest the following rewording to focus on key functions only. 55. The board must ensure that a perform regular review of services, against set performance standards, fees and all costs associated with the principal and material functions operation of the regulated entity is performed to ensure that they are appropriate. Declined. Your proposal diluting board accountability and weakening oversight of areas that may initially appear minor but could materially impact the entity. The broader wording is deliberate to ensure comprehensive governance Regulated entity information and access to regulated entity information 57. Subject to the Act, the board must ensure that- … (e) all communication with stakeholders must be responded to promptly by or on behalf of the board and with thoroughness. The word stakeholder is very broad and hence the provision is onerous as there are multiple stakeholders and communications, each with varying degrees of relevance and urgency. We propose that the responses be commensurate with the relevance and urgency of the stakeholder and subject matter. 57. Subject to the Act, the board must ensure that- … (e) all communication with relevant stakeholders must be responded to promptly by or on behalf of the board and with appropriate thoroughness. Accepted in part: The reference to “all” is accepted. The removal of “promptly” is declined because regulated entities mare expected to timely communicate with stakeholders.

25 | P a g e 6. The board of a regulated entity must have necessary qualifications, knowledge, skills and expertise to effectively lead, direct and oversee the regulated entity’s business to ensure it is conducted in a sound and prudent manner, and for this purpose – … (b) the board must have knowledge and skills required for effectively governing a regulated entity, finance, accounting, the role of control functions, investment analysis and portfolio management, and obligations relating to fair treatment of customers; and We note that the board composition requirement includes a defined list of categories of knowledge and skills which we believe could not be exhaustive and runs the risk of not contemplating the full scope of skills requirement for every type of regulated entity. For example we find that have a legal skills are important to a board, yet it is not included in the list. Our suggestion is to frame the requirement in terms of its objective which broadens the scope and at the same time empowers the boards to focus on the specific skills necessary for their entity’s operations. As an example, it is likely overly prescriptive to require investment analysis and portfolio management skills and experience for a nominee company’s board. 6. The board of a regulated entity must have necessary qualifications, knowledge, skills and expertise to effectively lead, direct and oversee the regulated entity’s business to ensure it is conducted in a sound and prudent manner, and for this purpose – … (b) the board must have knowledge and appropriate skills required for effectively governing a the regulated entity, finance, accounting, the role of control functions, investment analysis and portfolio management, and obligations relating to fair treatment of customers; and Declined. Chapter 3 are specialized entities that deal in securities because of the niche market they operate in, it is best to expect the board to have relevant expertise. 26. (2) Pursuant to sub-clause (1), This prescriptive list of policies to be in place is likely not suitable for all regulated entities. For example, a 26. Pursuant to sub-clause (1), the regulated entity must establish and maintain a comprehensive suite of governance Accepted

26 | P a g e the policies must comprise of the following, but not limited to – (a) investment management; (b) risk management : (c) conflict of interest; (d) complaints management ; (e) information technology; remuneration; nominee or an exchange would not require an investment management policy. We suggest a more principle-based approach is taken. Alternatively, we recommend the deletion of (a). policies that reflect its key operational, ethical, regulatory and strategic responsibilities. policies must comprise of the following, but not limited to – (a) investment management; (ab) risk management: Role of the board in setting the regulated entity strategy 38. The board must identify key performance and risk areas as well as the associated performance and risk indicators and measures, and this would include areas such as finance, ethics, conduct, compliance and sustainability. To avoid the risk of excluding other key metrics, such as those in the operational areas, we suggest framing the clause on an in-principle basis. 38. The board must identify key performance and risk areas as well as the associated performance and risk indicators and measures across key functions and areas of the regulated entity , and this would include areas such as finance, ethics, conduct, compliance and sustainability. Accepted 46. Subject to the Act – (a) the board may delegate All regulatory expectations and prescribed characteristics must be clearly anchored in the enabling legislation or legally 46. Subject to the Act, (a) the board must ensure that the regulated entity maintains a risk management framework that is Declined. The proposed version is overly broad which creates interpretation issues on the extent of the scope of the framework. The original version remains.

27 | P a g e oversight of the regulated entity’s risk management function to an appropriate board committee; (b) the board must ensure that the frameworks and processes in place to assist in anticipating these risks have the following characteristics: (i) insight

• the ability to identify the cause of the risk, where there are multiple causes or root causes that are not immediately obvious; delegated authority. Policies developed in response to regulatory guidance should distinguish between enforceable legal obligations and aspirational or best practice standards, ensuring that governance frameworks remain both compliant and credible. We believe that the characteristics noted here are valid but better placed in a guidance note. strategically governed and operationally sound. While the board may delegate oversight to an appropriate committee, it retains ultimate accountability for ensuring that the entity’s risk frameworks and processes are designed to anticipate and respond to existing and emerging risks. may delegate oversight of the regulated entity’s risk management function to an appropriate board committee; (ii) informatio n

comprehensive information about all aspects of risks and risk sources, especially of financial risks; (iii) incentives

the ability to separate risk origination and risk ownership ensuring proper We suggest a more principled approach be taken. Alternatively consider replacing the current list with a set of practical, auditable characteristics, aligned with established international standards. (b) the board must ensure that the frameworks and processes in place to assist in anticipating these risks have the following characteristics: (i) insight

• the ability to identify the cause of the risk, where there are multiple causes or root causes that are not immediately obvious; (ii) information
• comprehensive information about all aspects of risks and risk sources, especially of financial risks; (iii) incentives
• the ability to separate risk origination and risk ownership ensuring proper due diligence and accountability;

28 | P a g e due diligence and accountability; (iv) instinct

the ability to avoid following the herd when there are systemic and pervasive risks; (v) independen ce

• the ability to view the regulated entity independently from its environment; and interconnectivity

the ability to identify and understand how risks are related, especially when their relatedness might exacerbate the risk. (iv) instinct

• the ability to avoid following the herd when there are systemic and pervasive risks; (v) independence
• the ability to view the regulated entity independently from its environment; and interconnectivity
• the ability to identify and understand how risks are related, especially when their relatedness might exacerbate the risk. .

1. (1) Insertion suggested The term Executive Directors is referenced throughout the standards; however, it is not defined in Section 1, unlike Non

Executive Directors, which are clearly defined. While Senior Management has also been defined, it is recommended that Executive Directors be defined separately to ensure clarity and consistency in interpretation.

1. (1) (g) “executive director” means an individual involved in the day -to -day operations of the regulated entity or its subsidiaries; Accepted
2. (1) (e) “regulated entity” means any of the following entities The entry “(xiii) stockbroker;” appears incomplete, as there are no words following it.
3. (1) (e) “regulated entity” means any of the following entities registered under Chapter 3 of the Act: … (ix) securities clearing house; Accepted

29 | P a g e registered under Chapter 3 of the Act: … (ix) securities clearing house; (x) securities dealer; (xi) securities ratings agency; (xii) self￾regulatory organisation ; or stockbroker; and Delete the word “and” after “(xiii) stockbroker;” and replace it with a full stop. (x) securities dealer; (xi) securities ratings agency; (xii) self-regulatory organisation; or stockbroker; and 8. The chairperson of the board must – (e) preside over board meetings and ensuring that time in meetings is used productively. Grammatical error 8. The chairperson of the board must – (e) preside over board meetings and ensure ensuring that time in meetings is used productively. Accepted 11. (d) ensure that the any service provider do not unduly influence the management of the regulated entity. Grammatical error Reference should be made to Senior Management, not just Management, to maintain consistency with terminology used throughout the standards. 11. (d) ensure that the any service providers do not unduly influence the senior management of the regulated entity. Accepted, “any” is deleted. 12. (h) is not a member of the immediate family of any person described in paragraphs (a) to (g) Clarification required on the meaning of “immediate family” Suggest a cross-reference to (a)(i) and (ii) in the definition of associate (in the FIM Act) or other appropriate reference be inserted to clarify what is meant by immediate family. Accepted. immediate family will be defined to include: (i) a child, including a child adopted in terms of any law, custom or tradition; (ii) the spouse; (iii) a parent, grandparent, brother or sister; or (iv) a father-in-law or mother-in-law,

30 | P a g e of the regulated entity’s employee, director or key person; MMN GROUP PART 1: GOVERNANCE BY THE BOARD Clause 1(c) Definition of ‘Key Person’ The definition of ‘key person’ as defined in the Standard, in particular the reference to shareholding differs from GEN.S.10.2. Under the provisions of this proposed Standard, shareholding is referenced to as 20% while in GEN.S.10.2, the shareholding threshold is 25%. It is proposed that there be a uniform definition adopted for the concept ‘key persons’ across all Standards. Noted to align with the GEN S.10.2 Clause 1(d) Recommendation that the definition of Non-Executive Director be enhanced and that provision also be made for the classification of directors who are employed at holdings company level however not involved in the day- to-day management of the regulated entity. Recommended definition ‘Non-Executive Director means a director who is not in the full time employ of the regulated entity or its subsidiaries. An individual in the full time employment of the holding company or its subsidiaries would also be considered to be a non-executive director unless such individual by his/her conduct or executive authority could be construed to be directing the day-to-day management of the regulated entity or its subsidiaries. Such Directors shall not be considered Independent Non￾Executive Directors. Proposal to redefine a non-executive director accepted. Clause 1(f) Definition of ‘Senior Management’ The concept senior management is not defined in GEN.S.10.2. Is the intention that senior management would also be considered key persons for purposes of GEN.S.10.2 or is the concept Recommended definition ‘Executive Management’ means the team of individuals, by whatever name described, who are in the direct employment of, or acting for, or by arrangement with the regulated entity, who exercise significant influence over the regulated entity and its day to day Accepted.

31 | P a g e senior management unique to the proposed standard? Furthermore, considering the definition of senior management, would it not be prudent to rather used the concept ‘Executive Management’ operations and who hold executive powers conferred on them, with and by the authority of the board of the regulated entity’ Clause 2(c) Recommended that the definition of subsection (c) be extrapolated to included key persons as designated under the provisions of GEN.S.10.2. Proposed amendment to Par. 2(c). ‘a member of senior management and a designated key persons of the regulated entity or close relative’ Accepted. Clause 5(2) Reference to is made an independent director however the concept of what constitutes independence is not clearly defined nor articulated. While it might be addressed to some extend in the provisions of GEN.S.10.8, it is still recommended that it be included into this Standard given the purpose of the Standard. Recommended definition: ‘Independent non-executive director means a non- executive director who meets the test for independence as set out in clause 12’ Accepted. Clause 6(b) When considering the provisions of GEN.S.10.2, in particular Schedule 1, specific reference is not made to all the skill sets set out herein (for example: control functions, TCF experience). It is recommended that the provisions of this clause be aligned with the qualification, training and experience as set out in GEN.S.10.2, alternatively that GEN.S.10.2 be amended to include the minimum standards as set out in FM.S.3.10 Accepted. Clause 7 What is meant by reporting structure within this context? Is this the corporate governance structure of the regulated entity (i.e. boards and subcommittees)? Please note that the intention of this clause is to ensure the board is structured. The reference to reporting will be removed to avoid confusion.

32 | P a g e Clause 8 While the responsibilities of the Chairperson are noted and agreed, it is recommended that consideration be given to the NAMCODE (Principle C2- 16 – principal 16.4) and that same be incorporated. Kindly clarify the comment and the proposal. Clause 13 This is a duplication of Clause 12 as provision has already been made for prohibition against employment and would recommend that it be incorporated into the provisions of Clause 12. Recommended that the provisions of paragraph (a) of clause 12 be reconsidered. Proposed rewording can be: (a) is not an employee nor has been employed by the regulated entity or related party in any executive capacity…..’ Accepted. Clause 14 While it is appreciated that these directors would not be considered Independent Non￾Executive Directors, they can also not be classified as Executive Directors, thereby substantiating the position that the concept Independent Non￾Executive Directors should be defined within the context of Board Governance. The Board may consist of Executive, Non-Executive and Independent Non￾Executive Directors, but the majority should always remain Independent (as determined by the independence criteria set out in clause 12). Accepted. Clause 23 Based on the wording of clause 23 read with clause 24, there appears to only be a mandatory assessment required to determine the need for an internal audit function and that it remains within the discretion of the Board to introduce the function following the assessment. Therefore if the Board has assessed the Correct. The current provision intentionally gives boards flexibility to determine whether an internal audit function is necessary, based on the entity’s scale, complexity, and risk profile. Because making the function mandatory in all cases could impose unnecessary costs and resource burdens, especially on smaller regulated entities where proportionality in governance arrangements is important.

33 | P a g e need for the function however found it not necessary, it would have fulfilled its obligations in terms of the provisions of clause 23. Is this understanding correct Clause 25 Under the provisions of the NAMCODE, in particular Principle C3-8, it provides that ‘smaller companies need not establish formal committees to perform these functions but should ensure that these functions are appropriately addressed by the Board’. This aligns with international best practices that recognise the ‘apply and explain’ principle allowing for proportionality in governance based on entity size and materiality. Is the expectation that, irrespective of the size of the regulated entity, that these governance structures should be put in place? If so, this places an excessive compliance burden on smaller regulated entities. Secondly, considering that some regulated entities are affiliates or subsidiaries within a larger group structure, making use of a centralised governance framework, is the expectation that subcommittees should be established for each individual It is recommended that the following sub-clauses be considered: 25(2) The regulated entity may, subject to the principles of effective oversight and proportionality, consolidate multiple functional oversight responsibilities into a single board committee, provided that such consolidation does not compromise the independence, expertise and effectiveness required for each oversight area. 25(3) Where functions are combined the regulated entity must ensure that: (a) the mandate, terms of reference and composition of the combined committee explicitly address each functional area of oversight; (b) the members of the combined committee collectively possess the requisite skills, knowledge and experience to discharge all responsibilities effectively; (c) adequate time and resources are allocated to address each area of responsibility without undue dilution of focus; and (d) the board remains ultimately accountable for ensuring that all regulatory and governance obligations pertaining to each Clarification: Section 398 of FIMA empowers boards to appoint subcommittees as they deem necessary. Clause 25 of the Standard was intended to align with this provision; however, the current wording renders it mandatory. Accordingly, the term “must” will be replaced with “may.”

34 | P a g e subsidiary under the group structure? If the aforementioned interpretation is correct, this places significant burden on these subsidiaries and pose a risk of fragmented decision making, creating bureaucrative delays and diluted accountability through dispersing oversight across multiple layers. A centralised governance framework within a group structure enables consistency of strategy, policies and risk appetite, ensuring group wide alignment and more efficient use of resources. Considering the aforementioned, mandating full independent governance structures at subsidiary and affiliate level, regardless of context, imposes unnecessary financial and administrative burdens as it risks creating governance structures that are costly, inefficient and misaligned with the realities of integrated group operations. It is recommended that provision be made for a regulated entity to collapse its structures while ensuring that there remains sufficient board oversight over the functional areas. oversight function are fully met. 25(4) The regulated entity shall review the appropriateness of such consolidation periodically and upon any material change in the entity’s structure, risk profile, or regulatory requirements.

35 | P a g e Recommend an additional clause under Clause 26 (new) alternatively as a further subsection of Clause 25, allowing for the use of a centralised governance framework within regulated entities depending on the nature, size and materiality of the regulated entity. In the alternative, should the expectation be for regulated entities to have independent governance structures, it is recommended that consideration be given to the use of a centralized model for financial intermediaries. It is recommended that consideration be given to the inclusion of the following additional clause (new clause): Centralised Governance Structures (1) A regulated entity that forms part of a group of companies may implement a centralised governance framework at group level, in place of establishing a fully independent governance structure at regulated entity level, provided that such framework demonstrably ensures effective oversight, accountability, and compliance with all applicable regulatory requirements of the regulated entity. (2) Where a centralised governance framework is applied, the regulated entity must ensure that: (a) the group-level governance bodies and committees explicitly include within their mandates the responsibilities and obligations of the regulated entity as a distinct legal and regulated person; (b) the group-level governance arrangements allocate sufficient time, expertise, and resources to address the regulated entity’s specific regulatory and business needs; (c) the regulated entity’s board retains ultimate responsibility and accountability for compliance with all legal and regulatory obligations applicable to the regulated entity; and potential conflicts of interest between the regulated entity and other group companies are identified, managed, and disclosed appropriately. (3) The appropriateness of relying on a centralised governance framework shall Declined. The onus is the board to determine whether it will adopt group policies or create its own.

36 | P a g e be reviewed periodically by the regulated entity, and any material change in the entity’s risk profile, complexity, or regulatory requirements shall trigger a reassessment of the governance structure. Clause 25(b) The Investment Standard under FIMA, requires the establishment of an Investment Committee, Investment Policy etc., which applies specifically to institutional investors. Financial intermediaries, such as asset managers, LISPs etc, are not regarded as institutional investors and therefore would not need to comply with that Standard. Is the intention that even entities that are not institutional investors should have investment committees? Clarification. That is the intention — to ensure prudent oversight of client assets, strengthen risk management, and provide proper checks and balances on investment decisions. It also aligns governance with international best practice and enhances market confidence by showing that investment matters are subject to rigorous oversight. However, applying this as a blanket requirement may be disproportionate depending on the size and complexity of the regulated entity/ intermediary. Therefore, the establishment of these committees will be reworded from “must” to “may”. Clause 25(f) Is it the intention for the Information Technology committee to oversee operational aspects associated to information technology or merely the management of IT risks and governance. If the latter is the intention, see proposed recommendation. Recommendation: ‘25(f) Information Technology Risk Management and Governance’ Clarification, it is intentionally broad to cater for all IT related issues. Clause 29 to 31 It is recommended that the provisions of Clause 29, 30 and 31 should be placed under ‘Board Committees’ and not ‘Delegation of Authority’ Accepted Clause 30 See comment made under Clause 6(b)

37 | P a g e Clause 34 Would recommend that reference be made to the provisions of the Companies Act. Accepted, the reference to the Companies Act is inserted. Clause 35 Would recommend that reference be made to the provisions of the Companies Act regarding the filling of vacancies to the Board. Accepted Clause 40 What is meant by the term ‘Compensation Mechanisms’? Does this mean remuneration in relation staff and the board? Clarification. Mechanism is meant to mean procedures. We will amend to include “procedures”. Clause 42(a) While it is appreciated that the Board has oversight responsibility to ensure that the operations of the regulated entity are conducted ethically, efficiently and in line with approved strategies and policies, the operational involvement should be oversight focused and not execution focused. The key operational oversight that should be exercised by the Board should be:

• policy framework
• performance oversight
• internal controls and compliance
• crisis and issue management
• succession planning culture and ethics Recommended that operational oversight should be:
• performance oversight (against budget)
• Third party Risk Management (relates to outsourced activities)
• Outsourcing Activities
• Internal controls and compliance
• Crisis and issue management
• Succession planning Culture and ethics (including conflict of interest) Declined. The clause is intentionally broad to cater for different business structures. The expanded oversight exceed the acceptable operational oversight required by the Board.

38 | P a g e Clause 46 Recommended that the provisions Clause 47 be reconsidered. Proposed rewording can be: ‘The board must have in place a risk management policy which must be reviewed regularly, but at least every two Declined. Clause 52 The provisions of Clause 52 is tantamount to an abdication of the responsibilities and accordingly needs to be reconsidered. The regulated entity remains ultimately responsible for the performance of all functions delegated. Recommended that the provisions of Clause 52 be reconsidered. Proposed rewording can be: ‘While the regulated entity is not expected to micro- manage the functions delegated to service providers, it retains ultimate accountability for those functions. Accordingly, any delegation must set out sufficient detail to ensure that the service provider clearly understands the board’s expectations and must include appropriate rights of recourse in the event of a breach by the service provider.’ Accepted Clause 53 Kindly see proposed recommendation under Clause 42. If the proposed recommendation is accepted, the provisions of clause 53 can be removed. Please note that clause 42 will not be deleted. Clause 55 & 56 Clause 55 and 56 can be considered duplication and it is recommended that they be combined, provided that the recommendations made under Clause 42 are accepted. Please note that clause 42 will not be deleted. Clause 62 & 63 Considering the provisions allocating responsibility to either the Risk or Audit Function, it substantiates the collapsing of functional oversight of the board Kindly engage further with the regulator because the comment is unclear.

39 | P a g e as per the recommendations made under Clause 25 General Comment Self-regulated organisations required to ensure compliance with all requirements relating to corporate governance (independence of directors, board composition, corporate governance structures etc.). It would be recommended that this be included into the proposed Standard to ensure alignment between existing public companies applying for recognition as self- regulated entities (as per the provisions of the proposed Standard) and those organisations / associations undergoing demutualisation (in accordance with FM.S.3.5) Please note that clause 2 of the Standard provides that the Standard is applicable to regulated entities. Regulated entities are defined under clause 1(e) and self regulatory organizations are included in 1(e )(xii) of the definition of regulated entity. Bank Windhoek Limited Clause 4 ( c) To delete “from” after abdicate in line 3 To read: “ … and the board may not abdicate any of its functions and responsibilities” Accepted. Clause 5 The whole board appointment process and specifically the appointment of the chairperson, must be clearly stipulated The amendment should include: • Appointment authority; • Who and how will chairperson be appointed/elected and term of chairperson • Maximum number of board members; To add “independent” before non￾executive in Clause 5(1)(a) Accepted the inclusion of appointment authority and process for the chairperson. However the other proposals are declined. It is the regulated entities discretion to determine the maximum number of its board members. Further to add “independent” before non-executive implies that all non executive directors are independent which is not the case.

40 | P a g e Clause 5 (3) To what standards will the company secretary be held against and how will their skills and qualifications be assessed in a transparent manner? Should outline the specific company skills a company secretary of the entity should have. May also include Namcode as a reference Declined, this is at the discretion of the regulated entity to determine. Clause 6 (a) To add “the” before necessary skills To read: “ and continue to maintain, including through training, the necessary skills…. Accepted Clause 6 (b) To rephrase the whole Clause to make it clear as to the exact skills that are required To read: The board must possess the requisite skill and knowledge to effectively govern the regulated entity. These would include financial and accounting skills, the role of control functions,,,, Declined. While specifying skill sets could improve clarity, a prescriptive list may unintentionally exclude relevant expertise for different entity types. Clause 7 Instead of stating that the board must have a report structure , it would be more useful to set out what the report structure should be and all committees must report to full board, whilst chairperson will report to the appointing authority The reporting structure to be fully outlined and inserted Declined. The current requirement allows boards to determine structures suited to their governance and statutory frameworks Clause 9 It would be useful to add that conflict of interest should be declared before and during the execution of duties … must report to the board any conflict of interest before and during the performance of their duties.. Accepted. Clause 11 (d) How will this be achieved? It is also advisable that entity operational issues be distinct from board responsibilities. Clause (11) (d ) to be couched under the Conflict of interest and procurement policy of the entity – the current phrasing creates impression that board will have operational powers. Accepted. Clause 23 The introduction of the Internal Audit should be a necessity – it is a line of defense to determine risks and to alert the board if there are The internal audit function within the entity must be peremptory Declined. The current provision intentionally gives boards flexibility to determine whether an internal audit function is necessary, based on the entity’s scale, complexity, and risk profile. Making the function mandatory in all cases could impose unnecessary costs and

41 | P a g e irregularities resource burdens, especially on smaller regulated entities where proportionality in governance arrangements is important Clause 27 The Clause is too light given the powers that the board could delegate Expand more on the issue of delegation and which powers may be delegated /or not. Clarification, we have deleted this clause and provided that the board remains responsible for all duties even though outsourced. Clause 33 To add Appointment of External Auditor as the heading as it is not the same as the information contained under Tenure and Office of appointment Add heading: Appointment of External Auditor/s Accepted Clause 34 Rotation to be amplified with a succession policy – this will ensure stability in the organization To add a sub-Clause speaking to succession and the development of a succession policy for the entity. Accepted Clause 42 It talks about the performance of persons - Would propose that all officers whose performance are to be assessed, be named. The latter would include the accounting officer and persons holding senior positions. Declined. These persons might differ according to size of entity, must be guided by risk framework Clause 56 To be rephrased to ensure that costs and expenditure are part of the quarterly reports presented to board for review and this should be aligned and compared with Clause 42(b) Board review of financial soundness of the entity is peremptory, must be elevated and clearly defined as part of the boards responsibilities to be assessed on a quarterly basis. Accepted CC Clause 57 Stakeholder communication by the board should be limited to board’s responsibility only and not operational matters. To read: “Board communication to stakeholders, in relation to board functions , must be responded to promptly …” Accepted Clause 64 Transmission of information should be done at quarterly board meetings unless it is urgent matters that would require board attention. Further the reporting Clause is Insert quarterly reports to be assessed by board. Expand the Clause to cover different reporting channels and add reasonable Declined, the board should have the discretion to determine the frequency of the reporting.

42 | P a g e vague and not clear on which reporting channels should be used. timely periods. Clause 65 ‘’Disclosure’’ should also include how to go about disclosing information to the public Expand the clause to include public disclosure to avoid having a separate Clause in the standards again. Declined, inserting “public” would be superfluous. First Rand Group (Ashburton Investments) Clause 6(b) The list of required of skills listed in the draft Standard could be limiting and prescriptive. Care must be taken to insert operational capabilities and skills sets usually required on management and junior staff (investment analysis) onto an oversight board as this may lead to board interference. The concept of “control functions” is not defined and a request is that this reference be omitted. It’s proposed that the listing of skills be removed or the catch all reference be drafted for any other skill identified by the board be inserted. The concept of “control functions” is not defined and a request is that this reference be omitted. Declined. Chapter 3 are specialized entities that deal in securities because of the niche market they operate in it is best to expect the board to have relevant expertise Clause 11 Clarity is sought on the meaning of independence in the context of this Clause. The reference to demonstration of independence in the way the board exercises its discretion. Clarity is sought for application. The reference to independence is not limited to director classification, but to the manner in which the board applies its judgment

43 | P a g e Clause 16, 19 and 21 The provisions are very closely aligned if not similar in wording. Proposal to retain 16 only Proposal to retain 16 only and delete 19 and 21 Accepted. Clause 20(c) Current wording states that the “evaluations must be conducted by the Chairperson…). Board evaluations are not conducted by the Chairperson, and it’s proposed that the principle be set out that “the Board must ensure that the board members are evaluation”. Could the drafters have intended the that the chairperson hold discussions with directors following the evaluation discussions? The provision can be deleted in its totality. The concept of board evaluations is already contained in the regulations and Good Governance Codes. Declined. Retaining the Chairperson’s role in board evaluations ensures direct accountability and leadership over governance processes Clause 20(d) Clarity is sought on why the executive director may not evaluate the Chairperson. The concept of a peer review mechanism should be applied for all directors irrespective of the other roles they hold, either of chairperson or executive director Deletion of the provision is proposed. Declined. Excluding executive directors from evaluating the Chairperson preserves the independence of board evaluations. Clause 22 The suggestion of the use of external expertise may lead to an expectation that this is best practice and lead to regulatory uncertainty. The board should be allowed to apply its discretion in this respect as with all other services that can either be conducted from in￾Deletion of the provision is proposed. Declined. Reference to external expertise should be retained to ensure that boards recognise the importance of independent, professional input in sensitive matters like board performance evaluations.

44 | P a g e house resources or by external consultants. Clause 23 It is an established practice that internal audit functions are shared from within group structures. Clarity is sought on whether the word “introduction” of an internal audit function would be for dedicated staff members employed in the entity or if Group resources are also deemed to be internal. The Standard can provide clarity Internal audit functions may be insourced from within Group structures. Clarity is sought and possible enhancement of the draft. The board must consider whether the structure and operations of the regulated entity would benefit from the introduction of an internal audit function, either at group level or directly Clause 33(1)(a) We respectfully propose that Clause 33(1)(a) be amended to provide flexibility where approval has been granted by the Regulator. The current wording states: “(a) the auditor may not serve for more than five consecutive years;” We suggest revising this to: “(a) the auditor may not serve for more than five consecutive years, unless otherwise approved by the Regulator;” This amendment would allow for alignment with instances where regulated entities, such as banks, have received formal approval from the Bank of Namibia to extend the tenure of their auditors beyond the five-year limit. Accepted. Clause 47 The review cycle of 3 years unless there is a need to make amendments is in line with practice and practical, considering the number of policies to be developed and only 4 board meetings for most entities. This will also align with the board term. Proposal of 3-year policy review cycle Accepted

45 | P a g e