INSTRUCTION N°22 (Modification n°2) on Risk Management for Credit Institutions and Financial Companies

BANQUE CENTRALE DU CONGO

THE GOVERNOR

**INSTRUCTION N° 22 TO CREDIT INSTITUTIONS AND FINANCIAL COMPANIES RELATING TO RISK MANAGEMENT (Modification n° 2)

The Central Bank of Congo,

Having regard to the Organic Law n°18/027 of 13 December 2018 on the organization and functioning of the Central Bank of Congo, specifically Articles 10, 11 and 25;

Having regard to Law n°22/069 of 27 December 2022 on the activity and supervision of credit institutions, specifically Title II;

Having regard to Law n°22/068 of 27 December 2022 on the fight against money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, specifically Titles I and III;

Having regard to Law n°15/003 of 12 February 2015 on the activity of leasing, specifically Articles 6 and 7;

Enacts the following provisions:

TITLE I: GENERAL PROVISIONS

CHAPTER I: OBJECT AND SCOPE

Article 1:

This Instruction aims to define the prudential rules relating to the risk management of credit institutions and financial companies referred to in Article 2.

Article 2:

This Instruction applies to the Credit Institutions and financial companies listed below, hereinafter referred to as "subject institutions":

• banks;
• savings banks;
• leasing companies;
• factoring companies;
• guarantee companies;

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

BANQUE CENTRALE DU CONGO CONTINUED, PAGE 2

• electronic money institutions;
• payment institutions;
• specialized financial institutions.

CHAPTER II: DEFINITIONS

Article 3:

For the purposes of this Instruction, the following terms are understood as:

• credit or counterparty risk: the risk of a counterparty failing to honor its commitments towards the subject institution;
• market risk: the risk of losses linked to market price variations. They include:
  • the risk of losses on financial instrument positions on and off the balance sheet due to unfavorable developments in market prices;
  • the exchange risk resulting from an adverse evolution of foreign currency prices converted into domestic currency due to an open position, either spot or forward, in a foreign currency;
• liquidity risk: the risk for the institution not being able to meet its commitments at maturity or not being able to unwind a position due to a market situation;
• operational risks: the risk of losses resulting from deficiencies or failures attributable to procedures, personnel, internal systems or external events. Operational risk includes legal risk, but excludes strategic and reputational risks;
• legal risk: the risk of any dispute with a counterparty, resulting from imprecision, gap or insufficiency likely to be attributable to the institution in respect of its operations;
• interest rate risk: the risk incurred due to the unfavorable evolution of interest rates on all balance sheet and off-balance sheet operations of the institution, with the exception of operations covered by the market risk monitoring system;

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

BANQUE CENTRALE DU CONGO CONTINUED, PAGE 3

• settlement risk: the risk incurred during the period separating the moment when the payment or delivery instruction of a financial instrument sold can no longer be unilaterally cancelled and the final receipt of the purchased financial instrument or the corresponding cash;
• intermediation risk: the risk of failure of an order giver or a counterparty in the context of a transaction on financial instruments in which the subject institution provides its guarantee of good performance;
• risk management system: a system comprising a strategy, policies and procedures with the objective of identifying, analyzing, measuring, monitoring, mitigating and controlling risks of various natures to which subject institutions are exposed;
• risk appetite: the overall degree and types of risks, previously set and lower than the risk tolerance, that a bank is willing to assume to achieve its strategic objectives and its activity plan;
• risk tolerance: the maximum level of risk that the institution is able to assume, given its equity, its risk management, its control capabilities so as to comply with all regulatory requirements;
• intraday: during the day or within the day;
• overnight: immediately or from one day to the next;
• stop-losses: contain the deficit or stop the deficit.

TITLE II: ADEQUACY OF RISK MONITORING TO THE RISK PROFILE OF THE SUBJECT INSTITUTION

Article 4:

The subject institution is required to put in place a risk management system enabling it to identify, analyze, measure, monitor, mitigate and control risks of various natures to which its activities expose it, notably credit or counterparty risk, exchange risk, other market risks, interest rate risk, liquidity risk, money laundering and terrorism financing risk, operational risk including risks inherent to information systems, outsourced activities and banking correspondence.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

BANQUE CENTRALE DU CONGO

The risk management system must be adapted to the organization, nature, volume and degree of complexity of the activities and operations of the subject institution and be subject to regular adjustment based on the evolution of its risk profile and its environment, on the legal, operational, financial and market levels in particular.

The subject institution is required to put in place an internal process for periodic evaluation of the overall adequacy of its equity vis-à-vis its risks.

**Article 5:**

The subject institution is required to put in place a policy for monitoring the management and control of risks enabling it to adapt the intensity of its monitoring measures to the level of sensitivity of the risks incurred.
When the subject institution is supervised on a consolidated basis, the risk monitoring of the entire group must be ensured by the parent company on a consolidated basis.

**Article 6:**

The subject institution is required to establish a risk map which must meet the following characteristics:

- all gross risks must be listed exhaustively and be subject to an evaluation;
- the risk mitigation mechanisms implemented must be taken into account in this evaluation, to show residual risks;
- the level of sensitivity of residual risks is evaluated on a normalized scale, according to a robust methodology approved by the deliberative body.

The result of the risk mapping must be contained in a document updated as needed, at least once a year, validated by the executive body, approved by the deliberative body and disseminated to the heads of operational business lines and control functions.

**Article 7:**

In addition to the details of the exposures of each risk of the subject institution concerning all its operational processes, the risk map must take into account relevant and adapted information and indicators of the activity of said institution, notably:

CONTINUED, PAGE 4

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

BANQUE CENTRALE DU CONGO

- conjuncture or failure indicators for credit risk;
- macroeconomic indicators for credit risk or financial risks;
- incidents of all natures impacting the risk management of the subject institution, such as operational incidents, limit breaches or cash deficits. Information relating to all these incidents is stored in a database provided for this purpose.

**Article 8:**

The deliberative body is required, based in particular on the risk indicators identified in the risk map, the macroeconomic environment of the subject institution, its financial situation, the expectations and support of its shareholders, to determine and approve the risk tolerance, representing the absolute limit to which the subject institution can be exposed without jeopardizing the continuity of operations.

This limit must be compatible with the level of equity and regulatory prudential requirements.

The risk tolerance must be contained in a formalized document, revised and approved at least once a year by the deliberative body or as needed.

Any operation or incident that would lead to breaching the risk tolerance threshold defined by the deliberative body must be brought without delay to the attention of the latter and to the Central Bank of Congo by the risk manager of the subject institution.

**Article 9:**

The level of residual risk resulting from the mapping must be subject to formal acceptance by the deliberative body, after revision by the executive body.

When the level of residual risk is deemed excessive or if it is not in conformity with the risk appetite policy established by the deliberative body, additional risk mitigation measures must be taken and subject to monitoring of their effective impact on the reduction of residual risk.

Failing that, the risk acceptance strategy must be modified accordingly and approved by the deliberative body.

CONTINUED, PAGE 5

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

BANQUE CENTRALE DU CONGO

The risk appetite policy must be contained in a document approved at least once a year by the deliberative body. It provides, on the one hand, for quantitative criteria expressed in terms of revenues, the level of equity, risk indicators, liquidity and any other relevant parameter, and, on the other hand, for qualitative guidelines concerning reputational and ethical risks as well as the anti-money laundering and counter-terrorism financing and proliferation framework.

**Article 10:**

The risk management and monitoring policy must be formalized and validated by the executive body. It is approved by the deliberative body.

It must specify the operating modes of the risk management function, the distribution of roles and responsibilities and the information exchanges between the various stakeholders such as the heads of operational business lines, the risk management officer, the executive body, the risk committee, the deliberative body and the heads of internal control functions.

The risk management and monitoring policy must provide that risk zones identified as the most sensitive are subject to reinforced management and monitoring measures.

**Article 11:**

Any major alteration of the institution's exposure to risks or any significant incident likely to impair compliance with prudential regulation, whether originating from an internal event at the institution or an external shock, such as a sudden conjunctural deterioration of the environment, must be brought without delay to the attention of the Central Bank of Congo by the executive body or, failing that, by the head of one of the control functions provided for in Instruction n° 17.

Concurrently with this priority information to the Central Bank of Congo, the deliberative body must be informed and meet without delay to decide on corrective measures.

CONTINUED, PAGE 6

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

BANQUE CENTRALE DU CONGO

TITLE III: RISK MANAGEMENT SYSTEM

Article 12:

The subject institution must implement, for each significant risk, a system for identifying, analyzing, measuring, monitoring, mitigating and controlling risks comprising notably:

- the definition of the policy regarding each risk, formulated by the executive body and approved by the deliberative body;
- an appropriate organization of activities generating this risk;
- the formalization of procedures and specific limits for this risk;
- the operational management rules for activities and processes generating this risk;
- the risk measurement procedures;
- the risk monitoring procedures;
- the procedures for permanent and periodic control of the risk;
- the risk mitigation procedures put in place;
- information on the risk provided to the executive and deliberative bodies and to the Central Bank of Congo.

Article 13:

The systems for identifying, analyzing, measuring, monitoring, mitigating and controlling risks must be adapted to the organization, nature, volume and degree of complexity of the institution's activities, as well as to its risk profile, according to modalities validated by the executive body and approved by the deliberative body.

Article 14:

The subject institution must put in place (i) early warning indicators for the early detection of difficulties and the identification of potential occurrences of risks of all natures and (ii) confirmed warning indicators, which allow them to identify realized risk events. These indicators may optionally include quantitative thresholds.

The triggering of alerts leads the subject institution to quickly implement preventive or corrective actions adapted to the problems identified.

CONTINUED, PAGE 7

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

BANQUE CENTRALE DU CONGO

TITLE IV: RISK MANAGEMENT FUNCTION

CHAPTER I: ORGANIZATION AND GOVERNANCE

Article 15:

The subject institution is required to designate a person in charge of the risk management function.

Article 16:

The appointment of the head of the risk management function is approved by the deliberative body after the concurring opinion of the risk committee, on the proposal of the executive body. However, their effective assumption of duties is subject to the prior approval of the Central Bank of Congo under the conditions set out in the regulatory provisions relating to approvals and prior authorizations.

Article 17:

The head of the risk management function, whose title or positioning in the organization must place them at a high level, under the conditions provided for in Instruction n°17 and by the regulatory provisions relating to approvals and prior authorizations, is hierarchically attached to the executive body.

They are also attached to the deliberative body and, where applicable, to the risk committee, to which they report by virtue of a reinforced functional link.

Article 18:

The subject institution is required to create two committees to oversee risk management: (i) a specialized committee, called the risk committee, which assists the deliberative body in steering the risk policy, and (ii) an internal operational committee, called the risk management committee, which ensures the management and monitoring of risks under the auspices of the executive body.

Article 19:

The specialized committee of the deliberative body in charge of risk management is chaired by an independent director.

Its secretariat is provided by the head of the risk management function.

CONTINUED, PAGE 8

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

BANQUE CENTRALE DU CONGO

The risk committee assists the deliberative body in (i) defining the risk appetite, (ii) determining the risk tolerance, (iii) strategic orientations regarding risks and (iv) risk monitoring, based on the information transmitted by the executive body under the conditions provided for by the risk management and monitoring policy.

Article 20:

The executive body's risk management committee is composed, depending on the organization and risk profile of the subject institution, notably of senior heads of business lines, heads of internal control functions, accounting and financial officers and heads of other relevant support functions, such as IT.

The chairmanship of this committee is ensured by a member of the executive body and its secretariat by the head of the risk management function.

The periodicity of its meetings is established based on the risk profile of the subject institution.

The risk management committee is responsible for supervising the application by operational services of the risk appetite policy approved by the deliberative body, ensuring compliance with limits and examining risk monitoring indicators, warning indicators, as well as anomalies occurring in the execution of the risk policy.

The risk committee decides on the necessary remediation measures in case of non-compliance with the risk management and monitoring policy or the limits provided for within the framework of the risk appetite.

It proposes, where applicable, adjustments to the limit or risk management system, which the deliberative body must validate within a reasonable timeframe.

Article 21:

In small subject institutions and where the low complexity of risks justifies it, the risk management function may be merged with another second-line permanent control function, namely the compliance control function, after prior agreement of the Central Bank of Congo under the conditions provided for by the regulatory provisions relating to approvals and prior authorizations as well as corporate governance.

CONTINUED, PAGE 9

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

BANQUE CENTRALE DU CONGO

CONTINUED, PAGE 10

Article 22:

The risk management function must have resources adapted to the risk profile of the subject institution and appropriate expertise to ensure compliance with the risk appetite set by the deliberative body.

It must have unrestricted access, including IT access, to all information useful for the exercise of its mission in all risk-bearing areas of activity.

CHAPTER II: OUTSOURCING OF THE RISK MANAGEMENT FUNCTION

Article 23:

When the subject institution belongs to a banking group, part of the components of the risk management function may be outsourced within another entity of said banking group, provided that the latter is approved as a credit institution and subject to equivalent supervision in its home jurisdiction.

Such outsourcing must meet the following conditions:

- outsourcing can only take place after prior authorization from the Central Bank of Congo, based on a supporting file, previously approved by the deliberative body, under the conditions provided for by the regulatory provisions relating to approvals and prior authorizations;

- no component of the risk management function can be entrusted or subcontracted to an entity outside the group of affiliation or to a non-banking nature entity;

- the head of the risk management function must remain within the subject institution;

- in the event that the banking group of affiliation of the subject institution has adopted a matrix-type organization scheme with functional business lines sub-regional or global, each of the entities of the group to whom part of the risk management functions is entrusted must present all guarantees of independence vis-à-vis the operational departments whose risks they monitor;

- the IT systems for measuring and monitoring risks of the institution must be configured and operate under the effective responsibility of the executive body of the subject institution, taking into account the risk profile of the institution;

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

BANQUE CENTRALE DU CONGO

CONTINUED, PAGE 11

- a review of risk indicators must be carried out with a close periodicity and adapted to the nature of the risks considered. All these results must be available on-site in an exploitable form in the subject institution, to be made available to the Central Bank of Congo, upon its request;

- the subject institution must have on-site all documentation and procedures relating to the organization and configuration of risk control concerning it, including when these elements are produced by other entities of the banking group of affiliation, where applicable;

- direct and unrestricted access for the Central Bank of Congo to the heads of the development and monitoring of risk indicators and risk monitoring tools of the subject institution, when said heads are designated at the level of the affiliated banking group. This access must be ensured and organized by the subject institution at the request of the Central Bank of Congo according to the modalities defined by the latter.

In the event of intra-group outsourcing of the risk management function, the responsibility for it remains fully and entirely assumed by the deliberative body and by the executive body of the subject institution, each for what concerns them.

Article 24:

In the event of refusal of authorization for the outsourcing of the risk management function by the Central Bank of Congo, the latter may require the implementation of a risk management system placed under the auspices of a dedicated manager, appointed within the subject institution in accordance with this Instruction.


---

CHAPITRE III : AGREEMENT

Article 25 :

The appointment of the head of the risk management function is subject to the prior approval of the Central Bank of Congo, under the conditions set out in the regulatory provisions relating to approvals and prior authorizations.

The cessation of their functions must be brought to the knowledge of the Central Bank of Congo under the conditions set out in the aforementioned regulatory provisions.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

CONTINUED, PAGE 12

CHAPITRE IV : MISSIONS

Article 26 :

The risk management function has the following missions in particular:

- develop, for submission to the executive body, a risk management policy based on prudent procedures that allow for the detection, analysis, measurement, monitoring, mitigation, and control of risks, with a view to its approval by the deliberative body;

- coordinate and globally monitor the implementation of the risk appetite policy defined by the deliberative body based on risk tolerance;

- regularly review risk measurement systems, the methods for determining limits and their configuration to verify their relevance in light of, among other things, the evolution of activity, the market environment and analysis techniques, and its risk profile;

- issue a prior opinion on the launch of any new product, any new activity, any substantial modification in the marketing policy of a product line, or any entry into a new market, as well as on asset acquisition or disposal operations. The aforementioned opinion includes an assessment of the risks incurred, an appreciation of the conditions for risk control, and an opinion on the course of action to be taken regarding the project from the perspective of risk management;

- organize an escalation procedure in the event that its negative opinion is not taken into account, with a view to a decision at a higher delegation level. This procedure must provide for immediate notification by any means to the deliberative body when it is implemented.

Article 27 :

The risk management and monitoring policy implemented by the supervised establishment must meet the requirements of early detection of difficulties with a view to early intervention to remedy them.

To this end, the head of the risk management function, the executive body, the risk committee, and the deliberative body, each for their part, must ensure that the risk control framework includes operating modes, instruments, and reporting adapted to include early warning indicators for all types of risks to be monitored.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 13

Article 28 :

The supervised establishment is required to put in place a system for the identification, analysis, measurement, monitoring, and control of risks related to new products, new activities, and exceptional operations.

This system must allow in particular:

- the approval, by the deliberative body or by a committee created for this purpose, of any new product or new activity, or any exceptional operation involving a significant level of risk likely to deviate from the previously established risk strategy;

- the definition of the conditions for controlling the risks induced by the design of a new product or the launch of a new activity, in particular the description of their characteristics, the analysis of the impact of the resulting risks on the supervised establishment, the identification of the necessary technical and human resources, the typology of authorized counterparties, and the procedures to be implemented for the management and evaluation of the associated risks.

CHAPITRE V : MONITORING AND REPORTING

Article 29 :

The deliberative and executive bodies are required to maintain the supervised establishment's exposures to credit risk, foreign exchange risk, and other market risks, global interest rate risk, liquidity risk, and operational risk within the overall limits set by the regulations in force.

The executive body may assign specific exposure limits to operational entities, established in a manner consistent with the different overall limits.

The supervised establishment is required to ensure the regular updating of said limits, at least once a year, taking into account in particular the level of its own funds and the evolution of risks as resulting from the regularly updated risk map.

Article 30 :

Exposure limits must be monitored automatically using features provided for this purpose in the computerized management systems of the various activities.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 14

Limit breaches must trigger automated alerts to the hierarchical managers in charge of the concerned activities, according to their level of delegation, as well as to the head of the risk management function and, where applicable, to the executive body and other internal control functions.

The handling of breaches and alerts must be the subject of formalized processes monitored by the aforementioned managers in order to implement appropriate regularization measures while ensuring their traceability.

Article 31 :

When the risk profile and the diversity of the supervised establishment's activities require it, the risk management committee may be assisted by sub-committees tasked with monitoring certain categories of specific risks, including:

- the credit risk sub-committee;
- the financial risk sub-committee, responsible for monitoring foreign exchange risk and other market risks, asset-liability management, and the monitoring of liquidity risk; and
- the operational risk sub-committee, responsible in particular for IT risks, incident handling, and business continuity.

To this end, the executive body must ensure the overall coherence, effectiveness, and efficiency of the committee system put in place for risk management.

Article 32 :

The control of compliance with limits must result in the internal control committee preparing a periodic report for the attention of the executive and deliberative bodies through its specialized risk committee.

This report must include an explanation of the breaches as well as the measures to remedy them and, where applicable, proposals or recommendations for modifying existing limits.

Article 33 :

The specialized risk committee is required to inform the deliberative body of any malfunctions affecting the compliance with the establishment's risk appetite policy.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 15

The deliberative body must set a threshold beyond which it must be systematically informed of significant incidents affecting the financial situation, compliance with prudential regulations, or activity. An emergency procedure must be instituted to inform it without delay of any major incident likely to seriously impair the continuity of operations.

The deliberative body, assisted by the specialized risk committee, must approve the risk management framework in accordance with the risk appetite policy it defines. It instructs, where applicable, the executive body to make any necessary adaptations to strengthen this framework.

Article 34 :

The head of the risk management function is required, at least once a quarter, to present the results of risk monitoring to the deliberative body and its specialized risk committee using adapted summary statements.

It must produce an annual report on the exercise of its risk management and monitoring responsibilities, which is integrated into the annual internal control and risk management report transmitted to the Central Bank of Congo under the conditions provided for in Instruction No. 17.

TITLE V: RULES FOR THE MANAGEMENT OF DIFFERENT CATEGORIES OF RISKS
CHAPTER I: CREDIT OR COUNTERPARTY RISK
Section 1: Credit or Counterparty Risk Strategy and Governance

Article 35 :

The deliberative body of the supervised establishment is required to determine the nature and level of appropriate credit or counterparty risks in light of the policy defined for the conduct of activity, the implementation of which is the responsibility of the executive body.

The deliberative body must further:

- define, on the proposal of the executive body, adapted strategies for controlling credit or counterparty risk. These strategies must take into account, among other things, the level of own funds, the macroeconomic environment, the business climate, and the ability to control risk under satisfactory conditions;

- formally approve the provisions of said strategies at least once a year; and

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

- set the appetite for this risk in order to determine the level of risk the bank is willing to assume in light of its risk tolerance capacity.

Article 36 :

The strategies, policies, procedures, and limits for credit or counterparty risk management developed by the executive body must be approved by the deliberative body.

These strategies must be documented, regularly re-evaluated to estimate their impact on the results and own funds of the supervised establishment, and amended where necessary to take into account changes in the economic climate and environment.

The strategies, policies, procedures, and limits for credit or counterparty risk management must be appropriately disseminated within the supervised establishment.

The supervised establishment must organize training and awareness sessions to enable the relevant personnel to adopt these strategies, policies, procedures, and limits for managing this risk.

Article 37 :

The deliberative body must put in place a formalized decision-making procedure, derogatory to the defined credit risk policy and otherwise compliant with regulations, providing for rapid intervention at appropriate hierarchical levels.

Decisions falling directly under the deliberative body must at minimum concern:

- the examination of claims on related parties, which must in all cases respect the conditions provided for in Article 42 of this Instruction;

- the analysis of significant or atypical exposures, beyond thresholds and criteria set;

- the examination of consolidated exposures and significant concentrations, beyond determined thresholds.

CONTINUED, PAGE 16

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

Section 2: Rules for the Management of Credit or Counterparty Risk

Article 38 :

The supervised establishment is required to have a credit risk selection procedure and a risk measurement system allowing it in particular to:

- centrally identify its on-balance sheet and off-balance sheet risks with respect to a counterparty or related counterparties, and therefore considered as a single beneficiary;

- understand the different categories of risk levels based on qualitative and quantitative information;

- monitor concentration risk using documented procedures;

- evaluate its credit risk control framework;

- monitor residual risk using documented procedures;

- verify the adequacy of the diversification of claims in light of its credit risk policy.

Article 39 :

The supervised establishment must put in place a formalized credit granting system comprising in particular the following elements:

- powers of delegation regarding the authorization and revision of credits, including signature credits or off-balance sheet credits approved by the deliberative body on the proposal of the executive body. These delegations must reflect the capacity of the concerned hierarchical levels to commit the funds of the supervised establishment;

- granting procedures systematically providing for a double review of credit requests and their revision. Beyond a risk significance threshold defined by the deliberative body, this double review is organized within credit committees. The risk management function is systematically associated at the appropriate hierarchical level depending on the amount and nature of the credit. The risk management function must give an independent opinion on the risk analysis, the quality and appropriateness of the credit, and where applicable, on the conditions necessary for the control of credit or counterparty risk, such as additional guarantees or specific contractual clauses;

CONTINUED, PAGE 17

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

- when a disagreement between the commercial line and the "risk" line manifests itself during the double examination of a request at a given delegation level, the credit request must be submitted to a higher decision-making instance, according to a formalized escalation procedure. At the highest level, the credit committee, comprising besides the general management and representatives of the credit line, the head of the risk management function, is responsible for the final credit granting decision, except for derogatory cases submitted to the deliberative body.

Article 40 :

Credit granting and revision procedures must provide for the creation of files comprising in particular the most recent financial statements as well as other quantitative and qualitative information allowing for the appreciation of credit risk, including:

- the financial situation of the beneficiary, in particular its repayment capacity including received guarantees;

- the nature of the activities carried out by the credit applicant;

- the asset base of its main shareholders or partners;

- the client's propensity to honor its commitment;

- the overall profitability of operations carried out with the client, based on the forward-looking analysis of related charges and revenues as well as on relevant average data including: (i) the share of overheads, (ii) the cost of funding, (iii) the cost of potential counterparty default risk, and (iv) the remuneration of own funds.

Financial statements must be certified by an external auditor for companies having this obligation under the OHADA Uniform Act on Company Law.

Article 41 :

Credit granting and revision procedures must provide for the conditions for the creation and monitoring of received guarantees, amendments, and related documentation, within a framework guaranteeing the legal security of the management process of said guarantees. These provisions apply to all forms of credit risk mitigation.

The value of received guarantees must be reviewed regularly and at least once a year.

CONTINUED, PAGE 18

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

CONTINUED, PAGE 19

Article 42 :

Credits to related parties must be granted under the same market conditions as other credits to clients of the same nature, including in particular the amount, interest rate, maturity, guarantee, or contractual provisions.

The supervised establishment must, when granting and revising this type of credit, take the necessary measures to avoid conflicts of interest, in particular by excluding interested persons from the granting and monitoring process for the entire duration of the credit.

However, employees of the supervised establishment may benefit from preferential conditions that are part of their overall remuneration, provided that this applies equally to all personnel.

Article 43 :

The supervised establishment must put in place an internal rating system for its counterparties based on a risk-based approach using a set of relevant analysis criteria for the evaluation of credit risk.

Section 3: Measurement and Monitoring of Credit or Counterparty Risk

Article 44 :

The supervised establishment must put in place credit risk measurement systems allowing in particular to aggregate its exposures across all on-balance sheet and off-balance sheet operations with a counterparty or a set of related counterparties, and therefore considered as a single counterparty.

Article 45 :

The supervised establishment is required, in accordance with the regulatory provisions relating to the classification and provisioning of claims, to promptly downgrade and provision claims on counterparties whose solvency is impaired or appears to be undergoing rapid deterioration.

Article 46 :

The supervised establishment must conduct an evaluation of the quality of its entire credit portfolio at least once a quarter. This examination is validated by the credit committees at the appropriate delegation level.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

CONTINUED, PAGE 20

Article 47 :

The executive body must conduct, at least once a semester, a post-factum analysis of the profitability of credit operations for its entire credit portfolio. This analysis is conducted either individually or by categories of homogeneous credits, according to their type or their sectoral or geographical groupings.

Article 48 :

The supervised establishment must equip itself with systems for the measurement, monitoring, and control of credit concentration risk.

Credit concentration risk monitoring systems must take into account the concentration of risks on the same individual counterparty or group of interests, as well as concentrations by type of credit, by economic sector, by geographic zone, by country, and by type of guarantee or security.

Article 49 :

The supervised establishment must put in place adequate mechanisms allowing it to ensure:

- the application within itself of the strategies, policies, and procedures for credit or counterparty risk management put in place;
- the permanent relevance of these strategies, policies, and procedures to carry out any necessary updates;
- compliance with limits on exposures to the same counterparties and related parties;
- the application of the credit risk identification process;
- the application of the credit risk analysis and evaluation process;
- the application of the credit risk measurement and monitoring process;
- compliance with the credit risk governance rules established between the deliberative body and the executive body;
- the adequacy of its regulatory own funds in light of its credit risk profile;
- the application of credit risk mitigation mechanisms for prudent management.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd
---