Instruction (Historical) No. 4/2025

Instruction No. 4/2025 BO No. 3/2025 Supplement • 2025/03/20 .................................................................................................................................................................................................. Topics Supervision :: Internal Control Mod. 99999911/T – 01/14 Index Text of the Instruction [heading of previous Article 13] [heading of previous Article 14] Annex I - Amendment to Annex I to Instruction No. 18/2020 on risk categories RISK CATEGORIES Annex II - Amendment to Annex II to Instruction No. 18/2020 on the deficiency classification methodology Annex III - Amendment to Annex III to Instruction No. 18/2020 on deficiency reporting I. Deficiencies classified at level F3 (high) and F4 (very high) Annex IV - Reporting of the universe of employees who have a material impact on the institution's risk profile Annex V - Republication of Instruction No. 18/2020 (as referred to in Article 5) Annex I - Risk categories Annex II - Deficiency classification methodology Annex III - Deficiency reporting I. Deficiencies classified at level F3 (high) and F4 (very high) Annex IV - Reporting of the universe of employees who have a material impact on the institution's risk profile Text of the Instruction Subject: Amending Instruction No. 18/2020, regarding reporting duties concerning conduct and organizational culture and governance and internal control systems

Instruction No. 18/2020 of the Bank of Portugal (“Instruction No. 18/2020” or “Instruction”) regulates, in accordance with the principle of proportionality, the reporting duties to the competent supervisory authority incumbent upon the entities covered by Bank of Portugal Notice No. 3/2020 (“Notice No. 3/2020” or “Notice”), concerning conduct and organizational culture and governance and internal control systems.

In parallel with the update of the Notice, carried out through Bank of Portugal Notice No. 2/2025, it is also necessary to update the Instruction, particularly regarding the reference and reporting date for the self-assessment report on the adequacy and effectiveness of organizational culture and governance and internal control systems of supervised institutions and related documents. The annual report shall now be prepared with reference to September 30 of each year, instead of November 30. The entities obliged to report shall submit the report to the competent supervisory authority by November 15 of each year, instead of December 31.

The reporting to the competent supervisory authority of the universe of employees who have a material impact on the institution's risk profile shall now be carried out by January 31 of each year, and the remuneration information to be reported in this context refers to the previous year, as provided for in Article 10 of the Instruction. The new Annex IV to the Instruction defines the information structure to be considered for reporting purposes.

Additionally, this opportunity is also used to update the Annexes to the Instruction, highlighting the update of Annex I which includes the (non-exhaustive) risk categories that must be considered by the entities covered by the Notice for the purpose of reporting deficiencies to the competent supervisory authority.

In line with the changes introduced to the Notice, the following reports are now provided for in the Instruction:

• Report regarding the appointment of the statutory auditor or statutory audit firm, provided for in point (i) of Article 39 of Notice No. 3/2020, applicable to institutions authorized to receive deposits, except for the Mutual Agricultural Credit Savings Banks that are part of the Integrated System of Mutual Agricultural Credit (new Article 12);
• Report by credit institutions, provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies, equally applicable in the cases provided for in paragraph 4 of Article 109 of the same instrument (new Article 13), as provided for in Article 33, paragraph 8, point (g) of Notice 3/2020.

In view of the changes established by the amending Instruction, it is also decided to republish Instruction No. 18/2020 with the changes introduced by this Instruction.

The draft of this Instruction was subject to public consultation, having consulted the Securities Market Commission and the Insurance and Pension Funds Supervisory Authority.

In these terms, the Bank of Portugal, in the exercise of the powers conferred upon it by the provisions of paragraph 2 of Article 85, paragraph 3 of Article 115-G, paragraph 8 of Article 115-X, point (f) of paragraph 1 of Article 116, and point (c) of Article 133 of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of December 31, determines the following:

Article 1. Object This Instruction amends Instruction No. 18/2020 of the Bank of Portugal.

Article 2. Amendment to Instruction No. 18/2020 of the Bank of Portugal 1 – Article 1 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 1. […] […] a) […] b) The content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; c) […] d) […] e) The report regarding the appointment of the statutory auditor or statutory audit firm, provided for in point (i) of Article 39 of Bank of Portugal Notice No. 3/2020. f) The report to the competent supervisory authority provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies, equally applicable in the cases provided for in paragraph 4 of Article 109 of the same instrument.”

2 – Article 2 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 2. […] 1 - […] a) […] b) […] c) Description, organized by risk categories to which the institution is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies that are not yet fully corrected: i)[…] ii) Deficiencies detected by supervisory authorities. d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) […] f) Express declarations of the management body and the supervisory body on the adequacy of the classification and reclassification assigned to the deficiencies, taking into account the methodology contained in Annex II to this Instruction; g) […] h) […] i)[…] j) Assessment on the fulfillment of the conditions provided for in point (a) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent risk management function, description of the mechanisms implemented to comply with the provisions of the same article; k) Assessment on the fulfillment of the conditions provided for in point (b) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent compliance function, description of the mechanisms implemented to comply with the provisions of the same article; l) Assessment on whether the requirements provided for in paragraphs 7 and 8 of Article 16 of Bank of Portugal Notice No. 3/2020 are met and, if these conditions are met, and the institution chooses to outsource the entire internal audit function, justification for this choice; m) If the institution has chosen to combine the risk management and compliance functions into a single structural unit, in accordance with paragraphs 1 and 5 of Article 16 of Bank of Portugal Notice No. 3/2020, assessment by the management body on the maintenance of the adequacy of this option in light of the nature, scope, and complexity of the institution's activities; n) Report on the analysis of the management framework for information and communication technology risk, provided for in paragraph 5 of Article 6 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of December 14, 2022; o) Express declarations of the risk management and compliance functions on, respectively, the compliance of transactions concluded with related parties with the institution's risk profile, as well as compliance with the policy in force in the institution on the matter and with the applicable legislation and regulation. 2 - The reference date for the report referred to in paragraph 1 is September 30 of each year, and the competent supervisory authority may request institutions, at any time, updated information on its content, namely status updates on the implementation of measures intended to correct the reported deficiencies.”

3 – Article 3 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 3. […] 1 - For the purposes of the provision in point (c) of paragraph 1 of the previous article, the description of deficiencies classified at level F3 “high” or level F4 “very high”, taking into account the methodology contained in Annex II, is carried out in the format contained in Table I of Annex III to this Instruction. 2 - For the purposes of the provision in point (c) of paragraph 1 of the previous article, the description also includes the number of deficiencies classified at level F1 “low” or level F2 “moderate”, taking into account the methodology contained in Annex II, and is carried out in the format contained in Table II of Annex III to this Instruction. 3 - The institution maintains detailed documented information on deficiencies classified at level F1 “low” or level F2 “moderate”, which shall be made immediately available to the competent supervisory authority upon request. 4 - For the purposes of the provision in point (d) of paragraph 1 of the previous article, the description is carried out in the format contained in Tables III and IV of Annex III to this Instruction. 5 - [previous paragraph 4] 6 - [previous paragraph 5] 7 - The tables contained in Annex III to this Instruction are available on the BPnet system and are reported to the competent supervisory authority in editable format.”

4 – Article 4 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 4. […] 1 - The parent company of a financial group shall submit to the competent supervisory authority the annual group self-assessment report, provided for in Article 58 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements: a) […] b) […] c) Description, organized by risk categories to which the financial group is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies identified in the group that remain open, with identification of the entity to which they relate: i) Deficiencies detected within the scope of control actions and assessments carried out by the statutory auditor or statutory audit firm, by the parent company or by any branch; ii) Deficiencies detected by supervisory authorities; iii) […] d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) Express declarations of the management body and the supervisory body of the parent company on the adequacy of the classification assigned to deficiencies classified at level F3 “high” or level F4 “very high”, taking into account the methodology contained in Annex II and assessment of the impact that such deficiencies have on the group's internal control system; f) Copy of the multi-year internal audit action plan of the parent company relating to organizational culture and governance and internal control systems of the financial group and indication of the date of the last audit action carried out, with express confirmation that all relevant components of the financial group are included in the plan; g) […] h) […] 2 - For the purposes of the provisions in points (c) and (d) of the previous paragraph, the description of deficiencies is carried out in the format contained in Annex III to this Instruction. 3 - If it considers the justification for the exemption from the obligation to prepare individual reports insufficient, in accordance with paragraph 7 of Article 58 of Bank of Portugal Notice No. 3/2020, the competent supervisory authority may request its preparation at any time, and the parent company must take this into account in the annual group self-assessment report. 4 - The reporting of deficiencies is carried out, in editable format, through the tables contained in Annex III to this Instruction, which are available on the BPnet system.”

5 – Article 5 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 5. […] The management body of institutions that correspond to entities authorized to receive deposits shall ensure that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 2 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year.”

6 – Article 6 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 6. […] 1 - The management body of institutions not covered by the provisions of the previous article shall ensure that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including only the elements referred to in points (c) and (d) of paragraph 1 of Article 2 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year. 2 - The institutions referred to in this article shall immediately submit to the competent supervisory authority the other elements referred to in Article 2, whenever requested to do so.”

7 – Article 7 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 7. […] 1 - The management body of the parent company of a financial group shall ensure that the annual group self-assessment report referred to in paragraph 3 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 4 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year. 2 - The provisions of Articles 5 and 6 of this Instruction do not apply to branches of a financial group, the provisions of the final part of paragraph 5 of Article 54 of Bank of Portugal Notice No. 3/2020 applying to them.”

8 – Article 8 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 8. […] 1 - The annual report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies must contain: a) A description of the means for receiving, processing, and archiving reports of irregularities provided for in paragraph 1 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; b) […] i) […] ii) […] iii) […] iv) […] v) […] vi) […] vii)[…] viii) Date of completion of the procedure and justification for any extensions of the initially defined deadline; ix) [previous sub-point (viii)] c) […] 2 - […] 3 - […]”

9 – Article 9 of Instruction No. 18/2020 of the Bank of Portugal shall have the following wording:

“Article 9. […] 1 - The report referred to in the previous article is prepared with reference to September 30 of each year and submitted to the competent supervisory authority by November 15 of each year. 2 - The reports concerning institutions integrated into the Integrated System of Mutual Agricultural Credit are submitted by the Central Savings Bank of Mutual Agricultural Credit to the competent supervisory authority by December 15 of each year.”

10 – Chapter VI shall now aggregate the previous Chapters VI and VII and be composed of Articles 10 to 13 of Instruction No. 18/2020 of the Bank of Portugal, which shall have the following wording:

“CHAPTER VI Other reports Article 10. […] 1 - The reporting to the competent supervisory authority of the universe of employees who have a material impact on the institution's risk profile, provided for in point (c) of paragraph 1 of Article 41 of Bank of Portugal Notice No. 3/2020, is carried out by January 31 of each year and includes at least the following elements regarding each employee: a) […] b) […] c) […] d) […] e) Total annual remuneration earned in the year prior to the reporting year, disaggregated between fixed and variable remuneration and calculated in accordance with regulatory technical standards for the purposes of the qualitative and quantitative criteria appropriate to identify the categories of personnel whose professional activities have a material impact on their risk profile. 2 - The provisions of the previous paragraph cover all employees with a material impact on the institution's risk profile, as well as those who meet the quantitative criteria but whose professional activities have been assessed as not having a material impact on the institution's risk profile. 3 - In the case of financial groups, the report is carried out by the parent company and includes all employees with a material impact on the risk profile of the set of institutions, financial or non-financial, integrated into the supervision perimeter on a consolidated basis. 4 - The reporting referred to in this article is carried out in editable format, through the table contained in Annex IV to this Instruction, which is available on the BPnet system.”

Article 11. […] […] a) […] b) […]

Article 12. Report on the appointment of the statutory auditor or statutory audit firm Except for the Mutual Agricultural Credit Savings Banks that are part of the Integrated System of Mutual Agricultural Credit, institutions authorized to receive deposits shall submit to the competent supervisory authority, with a minimum advance of 30 days prior to submission to the competent body of proposals for the appointment or election of a statutory auditor or statutory audit firm, demonstration of the adequacy of the proposals in light of the requirements established in the applicable legislation and regulation, including the internal analysis supporting the selection.

Article 13. Report provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies 1 - In cases where, in accordance with the provisions of paragraph 2 of Article 85 and paragraph 4 of Article 109 of the General Regime of Credit Institutions and Financial Companies, the management body of a credit institution considers that the presumption of the indirect nature of the granting of credit to one or more entities covered by that provision has been rebutted, the credit institution shall submit to the competent supervisory authority, with a minimum advance of 30 days relative to the moment when the credit is granted: a) Certified copy of the minutes of the meeting where such decision was taken, which must contain the description of the covered operation and the grounds for the decision; b) Copy of all information elements, and respective documentation, that served as the basis for the rebuttal of the presumption. 2 - Any project to alter the operations covered by the previous paragraph is, after compliance with the provisions of paragraph 4 of Article 33 of Bank of Portugal Notice No. 3/2020, and in the event that the operation is carried out, communicated by the credit institution to the competent supervisory authority with a minimum advance of 30 days relative to its production of effects.”

11 – Chapter VII shall now deal with the matters of the previous Chapter VIII and is composed of the previous Article 12 of Instruction No. 18/2020 of the Bank of Portugal, which becomes Article 14, with the following wording:

“CHAPTER VII [heading of previous Chapter VIII] Article 14. [heading of previous Article 12] 1 - The documents reported to the competent supervisory authority under this Instruction are submitted through the BPnet system, regulated by an Instruction of the Bank of Portugal, with the exception of the reports referred to in Articles 11 to 13 of this Instruction. 2 - The reports referred to in Articles 11 to 13 of this Instruction are submitted to the competent supervisory authority by letter or by email.”

12 – Chapter VIII shall now deal with the matters of the previous Chapter IX and is compos