BANQUE CENTRALE DU CONGO

THE GOVERNOR

INSTRUCTION NO. 008 TO MICROFINANCE INSTITUTIONS ON PRUDENTIAL RULES FOR INTERNAL CONTROL AND RISK MANAGEMENT

(Modification No. 1)

The Central Bank of Congo,

Having regard to the Organic Law No. 18/027 of December 13, 2018, on the organization and functioning of the Central Bank of Congo, particularly Articles 10, 11, and 25;

Having regard to Law No. 22/069 of December 27, 2022, on the activity and supervision of Credit Institutions, particularly Article 21;

Having regard to Law No. 002/2002 of February 2, 2002, on provisions applicable to Savings and Credit Cooperatives;

Having regard to Law No. 11/020 of September 15, 2011, setting rules relating to the microfinance activity in the DRC;

Having regard to Law No. 22/068 of December 27, 2022, on the fight against money laundering and the financing of terrorism and the proliferation of weapons of mass destruction;

Enacts the following provisions:

TITLE I: GENERAL PROVISIONS

CHAPTER I: OBJECT AND SCOPE

Article 1:

This Instruction aims to define the prudential rules for internal control and risk management applicable to the microfinance institutions referred to in Article 2 of this Instruction.

Article 2:

This Instruction applies to the following microfinance institutions, hereinafter referred to as "subject institutions":

• savings and credit cooperatives;
• microfinance companies;
• micro-credit enterprises.

---

CENTRAL BANK OF CONGO CONTINUED, PAGE 2

CHAPTER II: DEFINITIONS

Article 3:

For the purposes of this Instruction, the following terms are defined as:

• risk appetite: the overall degree and types of risks, previously set and lower than the risk tolerance, that a subject institution is willing to assume to achieve its strategic objectives and activity plan;

• audit charter: an official document that defines the mission, powers, and responsibilities of the internal audit function within an entity;

• ethics and compliance committee: a governance committee, emanating from the deliberative body, created to assist it in exercising its missions of monitoring compliance, ethics, and deontology;

• risk committee: a governance committee, emanating from the deliberative body, created to assist it in determining risk appetite, monitoring the implementation by the executive body of the risk appetite statement, and ensuring the supervision of the risk management function;

• audit committee: a governance committee, emanating from the deliberative body, created to assist it in exercising its monitoring missions, notably the evaluation of the quality of the internal control system and the steering of internal audit;

• internal control committee: an internal operational committee that ensures operational coordination between the second and third-level internal control functions (permanent control of operational activities, compliance, risk management, and internal audit) under the chairmanship of the executive body;

• risk management committee: an internal operational committee steered by the executive body, which implements the risk strategy defined by the deliberative body and ensures its proper application by operational services and the appropriate supervision provided by the head of the risk management function;

• conflicts of interest: a situation where the personal interests of a member of the governance bodies, a staff member, or those of persons with whom they have a close family link are not compatible with the interests of the subject institution and could, therefore, influence the impartiality expected of them in the performance of their duties;

• deliberative body: the body responsible, on behalf of the shareholders, for defining the strategic direction of the institution and the effective supervision of the management of activities. It is constituted as a board of directors;

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO

• executive body: the body responsible, on behalf of the deliberative body, for the day-to-day management of the subject institution's activities and the effective steering of the implementation of the strategic objectives and risk policy set by the deliberative body. It corresponds to the General Management or the Management;
• credit or counterparty risk: the risk of a counterparty failing to honor its commitments towards the subject institution;
• legal risk: the risk of any dispute with a counterparty, resulting from imprecision, gap, or insufficiency attributable to the institution regarding its operations;
• liquidity risk: the risk for the institution not being able to meet its commitments at maturity or not being able to unwind a position due to a market situation;
• market risk: the risk of losses related to market price variations. They include:
  • the risk of losses on positions in financial instruments on and off the balance sheet due to unfavorable developments in market prices;
  • exchange risk resulting from an adverse evolution of foreign currency prices converted into domestic currency due to an open position, either spot or forward, in a foreign currency;
• operational risks: the risk of losses resulting from deficiencies or failures attributable to procedures, personnel, internal systems, or external events. Operational risk includes legal risk, but excludes strategic and reputation risks;
• interest rate risk: the risk incurred due to the unfavorable evolution of interest rates on all on-balance sheet and off-balance sheet operations of the institution, except for operations covered by the market risk monitoring system;
• internal control system: the set of rules, methods, and control measures governing the organizational and operational structure of a subject institution. It includes reporting processes and control functions;
• risk management system: a system comprising a strategy, policies, and procedures aimed at identifying, analyzing, measuring, monitoring, mitigating, and controlling risks of various natures to which subject institutions are exposed;
• risk tolerance: the maximum level of risk that the institution is able to assume, given its own funds, risk management, and control capabilities, in order to comply with all regulatory requirements;

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO

CHAPTER III: BASIC PRINCIPLES OF INTERNAL CONTROL

Article 4:

The internal control system consists of a device and functions put in place by the deliberative body and implemented by the executive body to ensure control, at all levels, of the subject institution's activities and operations.

Article 5:

Subject institutions determine the structure and sizing of their internal control system based on their risk profile, as determined by the executive body and approved by the deliberative body. They take into account, in the architecture of control functions and their hierarchical positioning, the characteristics and typology of the activities they carry out.

Subject institutions take into account, where applicable, in the organization of their internal control system, the internal standards of the group to which they belong, while ensuring that the adopted provisions comply with this Instruction.

TITLE II: INTERNAL CONTROL DEVICE

Article 6:

Subject institutions are required, in accordance with the provisions of this Instruction, to equip themselves with an adequate internal control device. This device must be adapted to the nature and volume of their activities, their size, their locations, and the various types of risks to which they are exposed.

Article 7:

The internal control device notably includes:

• a system to control operations and internal procedures;
• an organization for the accounting of operations and information processing to ensure the reliability of the conditions for the collection, processing, dissemination, and retention of accounting and financial data;
• systems to measure, control, and monitor risks and results;
• a documentation and information system guaranteeing the effectiveness of internal channels for the circulation of documentation and information as well as their dissemination to third parties.

Subject institutions must have a management information system.

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 5

## CHAPTER I: SYSTEM FOR CONTROLLING OPERATIONS AND INTERNAL PROCEDURES

### Article 8:

The system for controlling operations and internal procedures must enable subject institutions to ensure, under optimal conditions of security, reliability, and completeness, notably:

- the conformity of operations carried out, the organization, and internal procedures with current legal and regulatory provisions, professional and ethical standards and practices, as well as with internal instructions of the executive body taken in application of the orientations of the deliberative body;
- strict respect for decision-making and risk-taking policies and procedures, as well as management standards and limits set by the executive body;
- the quality of accounting and financial information intended for the deliberative body, the executive body, the Central Bank of Congo, or the public;
- the conditions for the evaluation, recording, retention, and availability of this information, particularly the existence and quality of the audit trail;
- the security and quality of information and communication systems;
- the execution within reasonable timeframes of corrective measures decided upon to remedy findings made by the various internal control and risk management functions.

### Article 9:

Subject institutions are required to draft and keep up to date procedure manuals relating to all their activities. These documents must notably describe the methods for recording, processing, and reporting information, the procedures for engaging and monitoring operations, the corresponding accounting schemes, as well as reporting methods.

Each service or operational unit belonging to the internal control system must be equipped with a regularly updated manual in which the procedures for executing the operations it is charged with performing are recorded. These manuals are defined by the executive body, approved by the deliberative body, and then disseminated to personnel.

## CHAPTER II: ACCOUNTING CONTROL DEVICE

### Article 10:

The device for controlling the accounting of operations must enable subject institutions to ensure the reliability and completeness of the recording of their accounting and financial data and to ensure the availability of information in accordance with the current accounting legislation of the financial sector.

---

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 6

### Article 11:

The methods for accounting recording of operations in regulatory and published financial statements must provide for a set of procedures guaranteeing the audit trail, enabling:

- the reconstruction of all operations in chronological order;
- the justification of any information by an original document from which it must be possible to trace back through an uninterrupted path to the summary document and vice versa;
- the explanation of the evolution of accounting balances from one closing to the next by retaining the recording of movements affecting accounting items.

Any exception to the preceding principles, regarding the justification of an accounting balance or the publication of information, must be the subject of a detailed justification, published in the annexes of the financial statements and approved by the statutory auditors.

### Article 12:

The information contained in accounting statements and that necessary for the calculation of management standards and prudential ratios, as well as periodic and prudential declarations intended for the Central Bank of Congo, must comply with the provisions of the previous article of this Instruction.

## CHAPTER III: DOCUMENTATION AND INFORMATION SYSTEM

### Article 13:

Subject institutions are required to establish and keep up to date documentation that specifies the devices intended to ensure the proper functioning of internal control, notably:

- the different levels of responsibility;
- the attributes assigned and the means allocated to the functioning of internal control devices;
- the rules that ensure the independence of these devices under the conditions provided for in this Instruction;
- procedures relating to the security of information and communication systems and the business continuity plan;
- the description of systems for measuring, limiting, monitoring, and controlling risks;
- the mode of organization and functioning of the compliance control device.

---

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 7

The documentation system must be organized to ensure the availability of documentation, upon request by the deliberative body, the executive body, the audit committee, or other specialized committees of the deliberative body provided for in Instruction No. 007, the statutory auditors, and the Central Bank of Congo.

### Article 14:

Subject institutions belonging to a group established in the Democratic Republic of Congo or abroad are required to have on site all documents concerning them relating to audits, controls, procedures, or decisions on activity orientation or internal control and risk management policy, established at the group level or by any external auditor or consultant.

## CHAPTER IV: INFORMATION SECURITY MANAGEMENT

### Article 15:

Subject institutions must define the level of information security deemed desirable in relation to the requirements of their sectors of activity. They ensure that their information systems are adapted to the risks inherent in their operations and to the characteristics of their organization and operating modes.

### Article 16:

Information security is ensured by an information security officer, a function dedicated and independent from that in charge of the operational management of the information system. In the case where the size of the subject institution does not justify the appointment of a dedicated information security officer, the risk management function assumes this role.

The information security officer ensures that information security issues are properly addressed and organized within the subject institution and that they give rise to the issuance of internal rules which he supervises the implementation of. Developments in the information system, notably projects, the use of new techniques, and outsourcing, are systematically subject to security analyses submitted to him, also considering the cyber dimension.

Furthermore, he must ensure that:

- the hardware equipment of the information system is subject to adequate protection against physical and logical risks of intrusion or destruction;
- access management and user authentication of the information system are controlled;
- data is protected in full confidentiality through protection solutions according to their degree of sensitivity;

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO CONTINUED, PAGE 8

• detection mechanisms used to identify abnormal actions on systems and data are in place to detect potential internal or external fraud;
• technological monitoring through continuous learning, notably concerning cyber security, is followed by the deliberative body and the executive body.

TITLE III: FUNCTIONAL COMPONENTS OF INTERNAL CONTROL

Article 17:

The internal control system consists of three (3) complementary functions, not exclusive of one another, as follows:

• permanent first-level control ensured by the operational staff themselves;

• permanent second-level control ensured, retrospectively and recurrently, by dedicated teams controlling the compliance and quality of the implementation of operational processes, which do not exercise operational functions.

This control is composed of the following three functions:

• the permanent control function of operational activities;

• the compliance function;

• the risk management function.

• third-level control performed periodically, under the responsibility of the deliberative body through its audit committee, by an independent internal audit function intervening on documents or on-site within the framework of missions.

Article 18:

Subject institutions ensure a strict separation of first, second, and third-level control functions.

Within the second-level control, they ensure a strict separation between the compliance, permanent control of operational activities, and risk management functions.

The heads of permanent control of operational activities, compliance, risk management, and internal audit must be approved by the Central Bank of Congo under the conditions provided for in Instruction No. 41.

First-level permanent control cannot, in any case, be merged with another level of control.

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO CONTINUED, PAGE 9

Article 19:

The functions of head of second-level permanent control in its three components and those of head of third-level periodic control must be entrusted to senior management executives, presenting all guarantees of morality, honorability, competence, and professional experience.

They are appointed by the executive body, after prior agreement of the deliberative body. The latter must also approve their dismissal or cessation of functions.

Their hierarchical positioning in the organizational chart of subject institutions must confer upon them the necessary authority to issue an independent opinion vis-à-vis operational departments.

The heads of permanent control of operational activities, compliance, risk management, and internal audit must hold a hierarchical rank immediately below the General Management.

CHAPTER I: FIRST-LEVEL PERMANENT CONTROL

Article 20:

Subject institutions are required to put in place in each operational unit a first-level control function, charged with ensuring on a daily basis the processing of operations according to the principles and procedures defined by the hierarchy, and notably guaranteeing the separation of sensitive functions and respect for the institution's risk-taking policy.

Article 21:

First-level controls are performed by:

• hierarchical managers, primarily;
• distinct operational staff, where applicable, in the form of cross-checks;
• operational teams themselves, within the framework of their usual activities to ensure the traceability of their actions;
• automated functionalities provided for this purpose in the information systems for processing operations.

CHAPTER II: SECOND-LEVEL PERMANENT CONTROL

Article 22:

The second-level permanent control device of subject institutions is organized into three functions with different missions, namely:

• second-level control of operational activity;
• the compliance function;
• the risk management function.

Subject institutions may request prior authorization from the Central Bank of Congo to merge certain second-level control functions under the conditions provided for in Instruction No. 41.

563, Colonel Tshatshi Boulevard - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO CONTINUED, PAGE 10

Article 23:

Subject institutions are required, according to methods adapted to their size, risk profile, and the nature of their activities, to have staff performing second-level permanent controls on all operational activities and independently from the units ensuring the processing of these activities.

Section 1: Second-Level Control of Operational Activity

Article 24:

Subject institutions must equip themselves with a second-level control function for operational activity.

Article 25:

The head and staff of the second-level control function for operational activity must have the appropriate expertise to control all activities. They report on the controls performed using formalized reporting states, auditable by third-level periodic control or by the Central Bank of Congo.

Article 26:

---

The second-level operational activity control ensures the proper execution of first-level permanent controls. In this context, it has at its disposal surveillance tools to ensure that operational units comply with the activity procedures defined by the deliberative body and implemented by the executive body. It determines a program of recurring controls focusing primarily on the most sensitive operational processes of the supervised establishment, as provided for by the risk map, to ensure the rigor of their execution in accordance with the procedures approved by the deliberative body.

The second-level operational activity control function ensures the proper execution of corrective measures decided following controls carried out by it, by the periodic third-level control, and, where applicable, by the Central Bank of Congo.

The findings made by the second-level operational activity control function are formalized to ensure their traceability and auditability. They are communicated to the concerned operational units for correction without delay, with a copy to the executive body. Control reports may also recommend general recommendations aimed at improving the quality of operational processes.

Article 27:

The head of the second-level operational activity control function presents the results of its controls to the deliberative body at least twice a year, using appropriate summary statements.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

---

CENTRAL BANK OF CONGO CONTINUED, PAGE 11

In the event of persistent non-implementation of corrective actions recommended at the end of its controls, it transmits a special report to the executive body, or directly to the deliberative body, according to the modalities defined by the supervised establishment.

Section 2: Compliance Function

Article 28:

Supervised establishments are required to establish a compliance control function, responsible for ensuring the compliance of their activities with current laws and regulations, including those relating to the fight against money laundering and terrorist financing and the proliferation of weapons, as well as to the ethical and deontological rules defined by the deliberative body. These rules must be formalized in an ethics charter or code of deontology disseminated to all staff and members of the governance bodies.

Article 29:

The Ethics and Compliance Committee has the role, in particular, to:

• supervise and control the compliance control function;
• ensure the compliance of the supervised establishment's activities with the current legislative, regulatory, and administrative framework;
• examine correspondence exchanges between the supervised establishment and supervisory authorities;
• issue opinions on the establishment's draft code of deontology as well as any other document concerning the ethics and compliance policy developed by the executive body;
• examine internal control reports to ensure the proper execution of the aforementioned policy;
• examine alerts raised by staff using their right to alert in matters of compliance, as well as reports produced by the compliance control function;

Article 30

The deliberative body has the role, in particular, to:

• establish the basic principles of the compliance policy to which the supervised establishment must adhere in the exercise of its activities;
• ensure the implementation, by the executive body, of a compliance function and promote a positive attitude towards compliance;
• approve the compliance policy and charter established by the executive body;
• annually evaluate the management of the non-compliance risk of the supervised establishment, based on specific reporting established by the executive body. This mission may, however, be delegated to the Supervisory Board or Audit Committee.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO CONTINUED, PAGE 12

Article 31:

The executive body has the mission, in particular, to:

• set up a compliance function and designate its head;
• develop the compliance policy and charter and ensure their implementation;
• permanently ensure the adequacy of the compliance policy relative to the size of the supervised establishment as well as the nature, volume, and complexity of its activities. It also verifies the application and respect of this policy and takes, without delay, the necessary corrective measures to redress the shortcomings identified by the compliance function or by internal audit;
• keep the deliberative body informed about non-compliance risks incurred;
• prepare at least once a year a report, addressed to the deliberative body or the Supervisory Board or the audit committee, on the achievement of the compliance function's objectives, the human and material resources deployed for this purpose, the main work of this function, any identified shortcomings, the corrective measures decided and their follow-up.

Article 32:

The organization of the compliance function must meet the following conditions:

• the compliance function is an independent structure from operational entities and directly attached to the executive body;
• it ensures the coordination of non-compliance risk management within the supervised establishment;
• the compliance function must be exclusive of the exercise of any other function within the supervised establishment to avoid any potential conflict of interest;
• certain tasks related to the responsibilities of the compliance function may be delegated to services, cells, or departments. In this case, the compliance function assumes a coordination role between the entities responsible for executing the tasks resulting from its responsibilities;
• the outsourcing of the compliance function to a third party is not authorized. However, the supervised establishment may use the expertise or technical means of third parties. It may, where applicable, establish a functional link with the compliance function of the group to which it belongs;
• persons in charge of the compliance function must possess a high level of competence in the field of banking and financial activities and an in-depth knowledge of current rules and standards.

Article 33:

The compliance policy must identify in particular the fundamental aspects of non-compliance risk, explain the principles set by the deliberative body, define the role and objectives of the compliance function, and set up a continuous training program.

This policy must also provide for the development of a compliance charter that:

• exposes the objectives of the compliance function, establishes its independence, and defines its responsibilities and competencies;

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO CONTINUED, PAGE 13

• describes relations with other functions responsible for risk management and control as well as with internal audit;
• clearly specifies the reporting lines, relations, and reporting between the various entities involved in the management and control of non-compliance risk, specifying in particular that the responsibility for delegated tasks lies with the compliance function;
• grants the compliance function the right of access to any information necessary for the execution of its missions;
• confers on the compliance function the right to conduct investigations;
• establishes the right to contact the executive body and, where applicable, the deliberative body or members of the Supervisory Board or audit committee or an ad hoc committee;
• defines the modalities and conditions under which this function may resort, if necessary, to external experts.

Article 34:

The supervised establishment is required to designate a person in charge of the compliance function.

The compliance function is notably responsible for the following missions:

• the listing of current norms governing the exercise of the supervised establishment's activities. These norms must be communicated to all concerned staff;
• the identification of the non-compliance risk incurred by the supervised establishment and its evaluation to determine the importance and the consequences that follow from it. It establishes procedures for: • control of the compliance of operations carried out with respect to current rules and norms; • identification and measurement of the non-compliance risk inherent to any new type of activity, product, clientele, or significant transformation on existing products, as well as exceptional operations; • permanent monitoring of modifications or changes that may occur in the texts applicable to operations carried out by the supervised establishment;
• the formalization of procedures and instructions for the implementation of the compliance policy;
• the examination for opinion of correspondence exchanges between the supervised establishment and supervisory authorities;
• the coordination of the implementation of the framework for the fight against money laundering, terrorist financing, and the proliferation of weapons.

The compliance function ensures that the supervised establishment has norms governing the exercise of daily operations of all its activities. These norms must be an integral part of the instructions, operational procedures, and internal control for areas directly related to compliance.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO CONTINUED, PAGE 14

Article 35:

The compliance function is also involved, for activities that do not directly fall under compliance, in the preparation and implementation of operational and internal control procedures, in particular:

• the regular verification of compliance with the policy, procedures, and instructions in matters of compliance. It also sets up indicators to analyze and monitor detected problems as well as to recommend corrective measures to be taken;

• the centralization of all information on problems and malfunctions identified with respect to current norms. In the case where the supervised establishment belongs to a group, these procedures must cover the modalities for centralizing information emanating from the group;

• the awareness-raising and training of all its staff, including executives, on the importance and procedures for compliance control related to the operations they perform.

Article 36:

The compliance function must issue a prior conforming opinion before any launch of a new product, new activity, any substantial modification in the marketing policy of a product line, or any entry into a new market. Exceptional acquisition or disposal of asset operations must also be subject to a prior conforming opinion from compliance.

In the event of non-takeover of a negative opinion from compliance, the head of compliance is required to inform the executive body, or directly the deliberative body. The executive body establishes an annual report provided for in this Instruction in which this opinion and the follow-up given to it are mentioned.

Article 37:

The activities of the compliance function must be included in the scope of intervention of internal audit. The latter must evaluate the functioning and effectiveness of this function.

Internal audit must communicate to the head of the compliance function any malfunctions related to non-compliance risk identified within the framework of its control missions.

Article 38:

The head of the compliance function must prepare, at least once a year, a report on its activities which he addresses to the executive body. The latter transmits said report to the deliberative body via the Supervisory Board or Audit Committee.

A copy of this report must be sent to the Direction of the Supervision of Financial Intermediaries of the Central Bank of Congo, no later than the sixth month following the end of the previous fiscal year.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO

CONTINUED, PAGE

15

Article 39:

The compliance function must document the work carried out in accordance with the responsibilities assigned, in particular to trace interventions as well as observations retained.

It reports to the executive body and, where applicable, to the deliberative body, audit/Supervisory Board and Ethics and Compliance committees, on the problems and malfunctions observed at the level of procedures, the compliance policy, as well as the measures taken in this regard.

It must also communicate these malfunctions to internal audit.

Section 3: Risk Management

Article 40:

Supervised establishments must put in place a risk management system allowing the identification, analysis, measurement, monitoring, or control of risks of different natures to which their activities expose them.

This system must be adapted to the nature, volume, and degree of complexity of the activities and operations of the supervised establishment and adjusted regularly according to its risk profile and the evolution of markets.

Supervised establishments must put in place processes for the global evaluation of prudential own funds with regard to these risks.

Article 41:

The risks to which supervised establishments are exposed are notably credit or counterparty risk, market risk, operational risk, interest rate risk, liquidity risk, as well as those related to outsourced activities.

The supervised establishment must implement, for each significant risk, a device for the identification, analysis, measurement, monitoring, mitigation, and control of risks comprising in particular:

• the definition of the policy regarding each risk, formulated by the executive body and approved by the deliberative body;
• an appropriate organization of activities generating this risk;
• the formalization of procedures and specific limits for this risk;
• operational management rules for activities and processes generating this risk;
• risk measurement procedures;
• risk monitoring procedures;
• permanent and periodic risk control procedures;
• risk mitigation procedures;
• information on the risk provided to the executive and deliberative bodies and to the Central Bank of Congo.

563, Boulevard Colonel Tshatshi - Kinshasa - Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO

Article 42: The supervised establishment is required to establish a risk map that must meet the following characteristics:

• all raw risks must be listed exhaustively and be subject to an evaluation;
• the risk mitigation mechanisms implemented must be taken into account in this evaluation, to show residual risks;
• the level of sensitivity of residual risks is evaluated on a standardized scale, according to a robust methodology approved by the deliberative body. The result of the risk map must be contained in a document updated as needed, at least once a year, validated by the executive body, approved by the deliberative body, and disseminated to the heads of operational business lines and control functions.

Article 43: The risk map must take into account, in addition to the detail of exposures of each risk of the supervised establishment concerning all its operational processes, relevant and adapted information and indicators of the activity of said establishment, in particular:

• conjuncture or failure indicators for credit or counterparty risk;
• macroeconomic indicators for credit risk or financial risks;
• incidents of all natures impacting the risk management of the supervised establishment, such as operational incidents, limit breaches, or cash deficits. Information relating to all these incidents is stored in a database provided for this purpose.

Article 44: The deliberative body is required, based in particular on the risk indicators identified in the risk map, the macroeconomic environment of the supervised establishment, its financial situation, the expectations and support of its shareholders, to determine and approve the risk tolerance, representing the absolute limit to which the supervised establishment can be exposed without calling into question the continuity of operations. This limit must be compatible with the level of own funds and regulatory prudential requirements. The risk tolerance must be contained in a formalized document, revised and approved at least once a year by the deliberative body or as needed.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO

Any operation or incident that would lead to crossing the risk tolerance threshold defined by the deliberative body must be brought without delay to the knowledge of the latter and to the Central Bank of Congo by the risk manager of the supervised establishment.

Article 45: The level of residual risk resulting from the map must be subject to formal acceptance by the deliberative body, after revision by the executive body. When the level of residual risk is judged excessive or if it is not in conformity with the risk appetite policy established by the deliberative body, additional risk mitigation measures must be taken and be subject to monitoring of their effective impact on the reduction of residual risk. Failing this, the risk acceptance strategy must be modified accordingly and approved by the deliberative body. The risk appetite policy must be contained in a document approved at least once a year by the deliberative body. It provides, on the one hand, for quantitative criteria expressed in terms of revenues, the level of own funds, risk indicators, liquidity, and any other relevant parameter, and, on the other hand, for qualitative orientations concerning reputation and ethical risks as well as the framework for the fight against money laundering and terrorist financing and proliferation.

Article 46: The supervised establishment is required to put in place a risk management and monitoring policy allowing the adaptation of the intensity of its monitoring measures to the level of sensitivity of the risks incurred. The risk management and monitoring policy must be formalized and validated by the executive body and approved by the deliberative body. It must specify the operating modes of the risk management function, the distribution of roles and responsibilities, and the information exchanges between the various stakeholders such as heads of operational business lines, the risk management head, the executive body, the risk committee, the deliberative body, and other heads of internal control functions. The risk management and monitoring policy must provide that risk zones identified as the most sensitive are subject to enhanced management and monitoring measures.

Article 47: The supervised establishment is required to designate a person in charge of the risk management function.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 18

The risk management function has the missions, in particular:

- to develop, for submission to the executive body, the risk management policy based on prudent procedures that allow the detection, analysis, measurement, monitoring, mitigation, and control of risks, with a view to its approval by the deliberative body;

- to coordinate and globally monitor the execution of the risk appetite policy defined by the deliberative body according to risk tolerance;

- to regularly re-examine risk measurement systems, the modalities for determining limits and their configuration to verify their relevance with regard in particular to the evolution of activity, the market environment, analysis techniques, and its risk profile;

- to issue a prior opinion before any launch of a new product, new activity, any substantial modification in the marketing policy of a product line, or any entry into a new market as well as on acquisition or disposal of asset operations. The aforementioned opinion includes an evaluation of the risks incurred, an appreciation of the conditions for risk control, and an opinion on the follow-up to be given to the project from the point of view of risk management;

- to organize an escalation procedure in the event of non-takeover of its negative opinion with a view to a decision at a higher delegation level. This procedure must provide for immediate information by any means to the deliberative body when it is implemented.

**Article 48:**

The deliberative and executive bodies are required to maintain within the global limits set by current regulations, the exposures of the supervised establishment to credit, exchange, and other market risks, global interest rate risk, liquidity, and operational risks.

The executive body may assign specific exposure limits to operational entities, established in a manner consistent with the different global limits.

The supervised establishment is required to ensure the regular updating of said limits, at least once a year, taking into account in particular the level of its own funds and the evolution of risks as it results from the regularly updated risk map.

**Article 49:**

---

Exposure limits to risks must be monitored automatically using features provided for this purpose in the information management systems of the various activities.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe  
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

```markdown
CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 19

Exceedances of limits must trigger automated alerts to the hierarchical managers in charge of the relevant activities, according to their level of delegation, as well as to the head of the risk management function and, where applicable, to the executive body and other internal control functions.

The handling of exceedances and alerts must be subject to formalized processes monitored by the aforementioned managers in order to implement appropriate regularization measures ensuring their traceability.

**Article 50:**

The specialized risk committee is required to inform the deliberative body of any malfunctions affecting compliance with the risk appetite policy of the regulated institution.

The deliberative body must set a threshold beyond which it must be systematically informed of significant incidents affecting the financial situation, compliance with prudential regulation, or activity. An emergency procedure must be established to inform it without delay of any major incident likely to seriously jeopardize business continuity.

The deliberative body, assisted by the specialized risk committee, must approve the risk management framework in accordance with the risk appetite policy it defines. It instructs, where applicable, the executive body to make any necessary adjustments to strengthen this framework.

**Article 51:**

The head of the risk management function is required, at least once per quarter, to present the results of risk monitoring to the deliberative body and its specialized risk committee using appropriate summary reports.

It must produce an annual report on the exercise of its risk management and monitoring responsibilities, which is integrated into the annual internal control and risk management report transmitted to the Central Bank of Congo under the conditions provided by this Instruction.

**CHAPTER III: THIRD-LEVEL CONTROL**

**Article 52**

Third-level control or periodic control is ensured by an independent function in charge of internal audit, which has the mission of verifying, in particular, the compliance of operations, the management of incurred risks, compliance with procedures and regulations, the effectiveness and compliance of risk monitoring and management frameworks, as well as any other subject relating to the activity of the regulated institution and its subsidiaries.

This periodic control is carried out through on-site control missions.

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe  
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd

CENTRAL BANK OF CONGO                                                                 CONTINUED, PAGE 20

**Article 53:**

Internal audit is functionally attached to the audit committee or Supervisory Council. The audit committee or Supervisory Council holds at least four meetings per year. It may associate with its work the heads of the internal control and risk management functions, as well as the statutory auditors of the regulated institution, and summon any useful person to these works.

**Article 54:**

In application of the audit charter or internal control charter approved by the deliberative body, the audit committee or Supervisory Council has, in particular, the following responsibilities:

- supervise and control the internal control functions;
- approve the annual or multi-annual programs of second-level permanent control and internal audit;
- ensure complete coverage of the regulated institution's activities by internal controls and internal or external audits;
- ensure that all activities of the regulated institution are verified by internal audit according to a cycle whose duration cannot exceed three years, adjustable according to the risk profile;
- ensure the adequacy of the internal control system to the activities of the regulated institution;
- assess the adequacy of the human resources and material means allocated to the internal control functions;
- ensure that internal controllers and auditors possess the necessary skills and propose, if necessary, measures to strengthen their expertise;
- provide an assessment of the quality of the internal control system, in particular the coherence of the devices for identification, analysis, measurement, monitoring, and management of risks, and propose, where applicable, appropriate corrective actions;
- verify the reliability and accuracy of financial information intended for the deliberative body, the Central Bank of Congo, and third parties, and provide an assessment of the relevance of the accounting methods adopted for the preparation of individual and consolidated accounts;
- evaluate the relevance of corrective measures taken or proposed to fill gaps or deficiencies identified in the processing of operations, following control or audit reports, where applicable, in the internal control system;
- ensure the effective and rapid implementation of corrective measures recommended by the control and audit functions and, where applicable, alert the deliberative body or directly the Central Bank of Congo in case of non-implementation;

563, Boulevard Colonel Tshatshi - Kinshasa – Gombe  
Email: sgouverneur@bcc.cd - Website: http://www.bcc.cd