Instruction No. 29/2025 On Corporate Governance Of Authorized Banks In Timor-Leste

INSTRUCTION No. 29/2025
ON CORPORATE GOVERNANCE OF AUTHORIZED BANKS IN TIMOR-LESTE Considering that banks serve a critical role in providing financial services, facilitating payments, and supporting commercial activity and a sound corporate governance is essential for maintaining financial system stability and public trust. Taking into account that banks must also observe high standards of governance and accountability since they operate in a position of trust within the economy and are key contributors to economic development. Furthermore, the globalization of financial markets, complex corporate structures, advances in technology, and product innovation increase the need for transparency, accountability, and robust governance. Considering the Sections 16, 17 and 18 of the Regulation No. 2000/8 of February 25 on Bank Licensing and Supervision, hereinafter referred as the “Regulation”. Considering Principle 14 of the Core Principles for Effective Banking Supervision (Basel Committee on Banking Supervision - BCBS) on Corporate Governance requiring banks and banking groups to have robust corporate governance policies and processes covering, among others, strategic direction, group and organizational structure, control environment, responsibilities of the banks’ Boards and senior management, commensurate with the risk profile and systemic importance of the bank. The Governing Board of Banco Central de Timor-Leste (BCTL), in accordance with Section 46 of Regulation no. 2000/8 of 25 February and Article 31 paragraph 1 of Law no. 5/2011 of 15 June, hereby resolves to approve the following Instruction:
CHAPTER I
GENERAL PROVISIONS

Article 1
Definitions
The following definitions apply to this Instruction:
a) Bank: is defined in accordance with the Regulation 2000/8. b) BCTL refer to the Banco Central de Timor-Leste. c) Board of Directors: also, Board or the Governing Board, is the governing body responsible for overseeing the management of the bank. d) Control Functions: functions that operate independently from business management and are tasked with providing objective assessments, assurance, and reporting. These include, at a minimum, the risk management function, compliance function, and internal audit function.

e) Corporate Governance: refers to the system of structures, processes, and principles by which the business and affairs of a bank are directed and managed. It aims to ensure the institution's safety and soundness while enhancing shareholder value. This includes a framework of checks and balances designed to facilitate sound decision-making and a balanced approach to risk and return. f) Compliance Function: is an independent function reporting directly to the Board of Directors or a designated Board Committee. It is responsible for identifying, assessing, advising on, monitoring, and reporting compliance risks, including risks of legal or regulatory sanctions, financial loss, or reputational harm arising from non-compliance with applicable laws, regulations, codes of conduct, and established standards. g) Duty of Care: is the obligation of board members to act with due diligence and prudence in the discharge of their responsibilities. This requires decision-making based on informed and careful consideration, comparable to the actions of a prudent person in managing their own affairs. h) Duty of Loyalty: means the obligation of board members to act in good faith and in the best interests of the bank, avoiding personal interests or those of third parties that may conflict with the interests of the bank or its stakeholders. i) Executive Director: a member of the board who also holds managerial responsibilities within the bank. In contrast, a non-executive director serves on the board without engaging in dayto-day management. j) Independent Director: is a board member who: a) is not a shareholder or a representative of any shareholder; b) has not held any executive position within the bank or its holding company in the preceding three financial years; and c) has no significant contractual or financial relationship with the bank or its holding company. k) Internal Control System: means a coherent framework of policies, procedures, and control mechanisms that ensure effective governance of the bank's organizational and operational structure, including risk management, compliance, and internal audit. l) Non-Executive Director: is a board member who is not involved in the daily operations of the bank and is not an employee of the institution or any of its subsidiaries. A Non-Executive Director may, however, represent the interests of shareholders. m) Risk Appetite: is the aggregate level and types of risk a bank is willing to accept in pursuit of its strategic objectives, taking into account its risk capacity and aligned with its overall business plan. n) Risk Appetite Framework (RAF): is the structured approach through which a bank establishes, communicates, and monitors its risk appetite. The RAF includes a risk appetite statement, risk limits, and delineates the roles and responsibilities for its implementation and oversight. It must cover all material risks and align with the bank’s strategic objectives and reputation considerations. o) Risk
Appetite Statement (RAS): is a formal, written articulation of the types and levels of risk a bank is willing to accept or avoid in order to achieve its objectives. It includes quantitative indicators (e.g., capital, earnings, liquidity) and qualitative guidance covering aspects such as conduct, reputational risk, and regulatory compliance. p) Risk Capacity: is the maximum level of risk a bank is capable of assuming, based on its capital strength, risk management capabilities, control environment, and regulatory constraints.

q) Risk Culture: is the collective norms, attitudes, and behaviors that shape how risks are understood, communicated, and managed across the institution. A strong risk culture promotes risk awareness, prudent risk-taking, and adherence to internal controls. r) Risk Governance Framework: is a component of the broader corporate governance framework that defines how the board and management determine the bank’s risk strategy, establish and oversee risk appetite and limits, and ensure effective risk identification, assessment, management, and control. s) Risk Limits: are the quantitative thresholds that operationalize the bank’s risk appetite, allocated across business units, legal entities, or risk categories to control risk exposures within acceptable bounds. t) Risk Management: is the set of processes by which a bank identifies, assesses, monitors, controls, mitigates, and reports material risks and concentrations in a timely and comprehensive manner. u) Risk Profile: is a point-in-time assessment of the bank’s aggregate risk exposures, either gross (before mitigation) or net (after mitigation), categorized by risk type and based on current or forward-looking data. v) Senior Management: refers to any officer of the bank, including the Chief Executive Officer, Vice President(s), General Manager, Chief Financial Officer, Chief Lending Officer, Chief Treasury Officer, or any other officer with authority to make binding commitments on behalf of the institution. w) Significant Shareholder: For the purpose of this instruction, significant shareholders are the principal shareholders as defined in Section 49(r) of the Regulation 2000/8, or a person that owns directly or indirectly ten percent (10%) or more of any class of voting shares of a bank.

Article 2
Objectives and Applicability

This Instruction seeks to establish minimum corporate governance standards that all licensed
banks in Timor-Leste must meet.
The document has also the objectives of promoting high ethical standards within the financial
sector and enhancing public confidence in the financial system through robust governance practices.
This instruction applies to all banks and to all branches of foreign banks licensed to operate in
Timor-Leste.
Institutions, licensed under Instruction nº 06/2010, dated of 17 de December, on the Licensing
and Supervision of Other Deposit Taking Institutions (ODTIs), are subject to the Instruction where applicable. Those institutions are expected to have relatively basic risk management systems and internal controls, information systems, and internal audit that are appropriate for the size of the institution and the nature, scope, and risk of its activities.

CHAPTER II
SHAREHOLDERS

Article 3
Approval of Significant Shareholders
Each significant shareholder shall be subject to prior approval by the BCTL, in accordance with the Regulation, and Instruction 2000/1 of 20 October on Application for Banking License and Instruction 2001/1 of 11 April.

Article 4
Authority and Responsibilities of Shareholders

Shareholders shall act jointly and severally to:
a) Ensure that only qualified, competent, and reputable individuals are appointed to the Board of Directors; b) Hold the Board Directors accountable for the effective and prudent governance of the institution; c) Take corrective action, including the replacement of underperforming Bord of Directors or ineffective board compositions; d) Prevent conflicts of interest by ensuring that directors do not serve on multiple boards within the same sector.
Shareholders shall be entitled to:
a) Secure methods for share ownership registration; b) Freely transfer shares; c) Access timely and relevant corporate information; d) Participate and vote in general meetings; e) Elect and remove Board of Directors; f) Receive a fair share of the bank’s profits.
They shall also have the right to participate in key corporate decisions, including amendments to
foundational documents, share issuance or acquisition, and significant corporate transactions such as mergers, acquisitions, or asset sales.
Institutional shareholders shall disclose how they exercise their ownership rights, particularly
where they hold assets in a fiduciary capacity.
Article 5
Voting Rights
Shareholders shall have the opportunity to participate and vote effectively at general meetings,
with clear disclosure of procedures and rules.
Adequate notice, agenda, and supporting documentation must be provided in a timely manner.
Voting shall be possible both in person and in absentia, with equal validity given to all votes
cast.

Article 6
Equitable Treatment of Shareholders

All shareholders, including minority and foreign shareholders, must be treated equitably.
Shareholders within the same class of shares shall have identical rights.
Mechanisms must be in place to protect minority shareholders from unfair practices by
controlling shareholders.
All shareholders shall be informed of the rights and characteristics of the different classes of
shares.
Article 7
Legal Rights and Duties
Shareholders are obliged to the responsibilities, and have the rights, set by Law No. 10/2017, of 17 Mayl, on Commercial Companies, respected the limits established by Regulation 2000/8.
Article 8
Charter and By-Law
Each bank shall have a Charter, in accordance with Section 15.1 of the Regulation 2000/8, that
shall specify, among other requirements, the jurisdiction and authority of the Board.
The Charter must define the roles, responsibilities, and authority of the Board of Directors,
individual directors, and board committees.
The Charter shall:
a) Guide the conduct of board business and promote transparency and accountability. b) Define the procedures for appointment, tenure, renewal, and removal of board members. c) Establish the scope of delegation to board committees and management. d) Provide for board evaluation procedures; and e) Be reviewed at least every three years or upon significant changes in governance structures or strategy.
No amendment of the charter of a bank shall take effect without the prior written consent of the
BCTL.
Each bank shall be governed by internal by-laws, approved by its Governing Board, which in
compliance with its charter shall establish:
a) the structure of the organization and administration of the bank, including its operational and administrative units, their sub-units and functions, supervisory positions, and reporting relationships. b) the duties of each departmental director and the units under his or her direction and supervision. c) the functions of the Audit Committee, the Risk Management Committee (or separate Credit and Asset and Liability Management Committees), and other permanent internal committees; and d) the limits of the authority of the administrators and other employees of the bank to engage in financial activities in the name and for the account of the bank.

CHAPTER III
BOARD OF DIRECTORS

Article 9
Appointment and Approval of Directors

The appointment of directors to the board of a bank shall be subject to prior written approval by
BCTL, in accordance with Section IV.A of Instruction 2000/4, on Qualifications of Administrators.
Institutions shall not confirm any appointment without such approval.
A proposed board member shall meet the minimum standards set by Section III.A of Instruction
2000/4, on Qualifications of Administrators, which requires among other items:
a) Be of sound mind and not legally declared otherwise by a court of competent jurisdiction; b) Not to be bankrupt or under bankruptcy proceedings; c) Possess demonstrable skills and professional experience relevant to the institution’s business, including but not limited to finance, banking, economics, law, and accounting; d) Be of proven integrity and good moral character.
The approval process must follow the prescription of Section IV of Instruction 2000/4, on
Qualifications of Administrators.
A proposed director may be disqualified under the following circumstances:
a) Previous involvement in the management of an institution that was declared insolvent, liquidated, or bankrupt, unless non-involvement in the failure can be demonstrated; b) Prior directorship in an institution placed under official administration; c) History of illegal, unethical, or imprudent conduct, including involvement in financial crimes or practices that compromise integrity and sound judgment; d) Being under suspension or removal from a directorial or executive role in a bank; e) Other reasons, in accordance with Regulation 2000/8 and Instruction 2000/4, on Qualifications of Administrators.
The BCTL may suspend or remove any individual director, or suspend or dissolve the entire board,
where reasonable cause exists, including but not limited to:
a) Failure to uphold fiduciary responsibilities. b) Conduct detrimental to the institution’s or clients' reputation; and c) Non-compliance with supervisory directives.
No individual shall serve simultaneously on the boards or in executive roles of more than one
bank or affiliated entities.
Article 10
Composition of the Board
The board shall be composed of individuals with diverse professional backgrounds and relevant
expertise to ensure effective oversight.
The Board size shall range from 3 to 7 members, in accordance with the Regulation 2000/8, and
must always comprise an odd number to facilitate decision-making, with a mandate of up to four years, the re-appointment being admitted.
No more than two senior executives, including the Chief Executive Officer, may serve on the
Board, subject to BCTL approval.
At least two-thirds of members should possess expertise relevant to the bank’s operations.
At least one-third of board members shall be independent and non-executive, selected based on
merit and not representing shareholder or special interests.
At least two-thirds of directors shall reside within the country to ensure quorum at all times,
subject to exceptions for remote meetings.
The Board of a bank and its members cannot delegate their responsibilities to others.
The bank shall appoint a board’s Chairperson, who must be a non-executive director and not
chair any board committee.
No two members considered family-related persons under Section 29.2, item c, of Regulation
and the definitions of Instruction 2000/6 on Transactions with Related Persons may simultaneously hold the roles of chairperson and CEO or other senior management positions.
The Chairperson has the following responsibilities:
a) Ensure regular and orderly conduct of board meetings; b) Facilitate board discussions and decision-making; c) Encourage full participation from all directors; d) Provide all relevant information to board members; b) Oversee performance reviews of ineffective directors; c) Implement board effectiveness assessments; d) Ensure timely and accurate recording of meeting minutes and follow-up on actions.
The Board of Directors shall be guided by the following principles:
a) Receive timely, accurate information for performance evaluation and decision-making; b) Fulfill responsibilities as outlined in this regulation; c) Maintain orientation and training programs for directors; d) Enforce policies on related party transactions; e) Prohibit insider trading and self-dealing; f) Be well-informed, diligent, independent, and loyal to institutional interests; g) Remain fully conversant with applicable regulations and internal policies.
The Board of Directors may, where appropriate, engage the services of independent external
advisors, including legal, financial, or technical experts, to provide objective advice on specific matters under its consideration.
Additionally, the Board of Directors may appoint non-voting advisory directors to contribute
specialized expertise, provided such individuals are subject to the same standards of integrity and confidentiality applicable to voting directors.
The use of such advisors should be documented, reviewed periodically, and evaluated for
independence and relevance.
Article 11
Board Meetings and Attendance
The Board of Directors shall meet no fewer than four times per calendar year, with meetings
distributed reasonably throughout the year.
A quorum shall consist of no fewer than two-thirds of Board Members, physically or virtually
present.
No board meeting shall be held without the presence of at least one independent non-executive
director.
All Directors shall attend a minimum of 75% of board meetings annually, except where justified
by extraordinary circumstances.
A Director who fails to attend three consecutive board meetings without valid justification may be
subject to removal.
Attendance shall be recorded and monitored as part of board performance evaluation.
The minutes of all board meetings shall be documented clearly and comprehensively. Minutes
shall include:
a) Attendance; b) Key discussion points; c) Decisions taken; and d) Any dissenting views expressed.
Minutes shall be approved at the subsequent board meeting and retained for a minimum of ten
years.
Article 12
Duties and Responsibilities of Directors
Directors, members of the Board Directors, shall:
a) Act in good faith and in the best interest of the institution; b) Exercise duty of care, skill, and diligence; a) Avoid conflicts of interest and disclose any actual or potential conflict immediately; b) Maintain the confidentiality of all board matters.
The Board of Directors has the responsibility of ensuring:
a) Sound corporate governance practices; b) Effective internal control systems and risk management frameworks; c) Compliance with applicable laws, regulations, and internal policies; d) Integrity and independence of the internal audit function; e) Adequate financial reporting and disclosure practices; f) Ethical conduct and fair treatment of clients and employees.
The Board of Directors shall define the bank’s strategic goals and long-term objectives, oversee
the development and approval of business plans and budgets, and monitor performance against set targets and adjust strategies as needed.
The Board of Directors is responsible for appointing, monitoring, and, where necessary, replacing
the Chief Executive Officer and other Senior Management.
The Board of Directors shall ensure appropriate succession planning.
The Board of Directors is also responsible for approving the remuneration structure of senior
executives in line with risk-adjusted performance and long-term sustainability.
The Board of Directors shall ensure that effective governance structures are in place for the
oversight of information and communication technology (ICT) and management information systems, including cybersecurity, business continuity, and data integrity.
The Board of Directors shall approve an ICT strategy aligned with the institution’s overall risk
appetite and strategic plan. It shall receive regular reports on ICT performance, operational resilience, significant incidents, and cybersecurity threats.
Oversight shall extend to third-party technology providers and outsourcing arrangements critical
to operations.
The Board of Directors shall conduct an annual self-assessment to evaluate its performance and
effectiveness. The assessment shall include feedback on individual director’s contributions. Findings from the evaluation shall be used to improve board functioning and inform training or restructuring needs.
The Board of Directors shall undergo an orientation program upon appointment. Directors should
engage in ongoing training and professional development to maintain current knowledge of the bank’s operations, regulatory requirements, and emerging risks.

Article 13
Basel III Capital and Liquidity Oversight

The Board of Directors shall ensure that the bank maintains internal governance and control
systems to comply with Basel III capital adequacy, leverage ratio, liquidity coverage ratio (LCR), and net stable funding ratio (NSFR) requirements.
The Board shall oversee the preparation, accuracy, completeness, and timeliness of all related
prudential returns and regulatory disclosures submitted to the BCTL.
The Board shall ensure implementation of an Internal Capital Adequacy Assessment Process
(ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP), consistent with the bank’s risk profile and strategic objectives.
Article 14
Stress Testing and Forward-Looking Risk Assessment
Banks shall establish governance frameworks for stress testing and scenario analysis covering
credit, market, operational, and liquidity risks.
Stress testing results shall be reviewed by the Risk Management Committee and reported to
the Board of Directors at least annually.
The Board shall ensure that stress test outcomes are incorporated into capital planning,
liquidity management, and strategic decision-making.
Article 15
Board Committees
The Board of Directors shall establish committees to support its oversight functions and to ensure
focused governance in key areas such as audit, risk, remuneration, and nominations.
Each committee shall operate under a formal written charter approved by the Board of Directors,
clearly setting out its mandate, responsibilities, authority, composition, and reporting obligations.

Article 16
Audit Committee

The Board of Directors shall establish an Audit Committee that shall consist of three (3) members
appointed by the general meeting of shareholders of the bank for periods of two (2) years.
The Audit Committee has the following minimum requirements:
a) Members of the Board shall not serve on the Audit Committee. b) The Audit Committee should report to an independent non-executive director who is not the chair of the board; and c) Members shall collectively possess appropriate financial literacy and at least one member shall have relevant audit or accounting expertise.
Responsibilities of the Audit Committee shall include:
a) Establish appropriate accounting procedures and accounting controls for the bank and supervise compliance with such procedures; b) Oversight the financial reporting and disclosure; c) Commission audits at the expense of the bank; d) Review the internal and external audit plans, processes, and results; e) Monitor the effectiveness and independence of the internal audit function and the external auditor; and f) Evaluate the adequacy of internal controls and accounting systems.
Article 17
Risk Management Committee
The Board of Directors shall establish a Risk Management Committee with the following
characteristics:
a) Comprised primarily of non-executive directors, with a majority being independent; b) Chaired by an independent director, distinct from the chair of the board and the chair of the Audit Committee; c) Members shall possess sufficient knowledge of risk management and the institution’s business model;
Responsibilities shall include:
a) Oversight of the risk management framework, including the risk appetite and risk strategy; b) Monitoring of material risk exposures and emerging risks; c) Review of the adequacy and effectiveness of risk policies, limits, and internal controls.
Article 18
Other Committees
The Board of Directors shall establish a Remuneration Committee with the following minimum
standards:
a) Comprised entirely of non-executive directors, the majority of whom shall be independent; b) Chaired by an independent non-executive director; c) Responsibilities shall include:
i. Development and oversight of the institution’s remuneration framework, including
policies for senior management and risk-takers;
ii. Ensuring alignment of remuneration practices with the institution’s risk profile,
long-term objectives, and performance;
iii. Evaluation of remuneration proposals to avoid excessive risk-taking and to
promote sound governance;
iv. Review annually the remuneration plan for alignment with regulatory expectations
and sound governance practices;
v. Ensure that remuneration frameworks incorporate deferral, claw-back, and malus
arrangements, in line with Basel III principles, to discourage excessive risk-taking and align compensation with long-term financial soundness and capital adequacy.
The Board of Directors shall establish a Nominations or Governance Committee, comprised
primarily of independent non-executive directors, with the following functions:
a) Identification, evaluation, and nomination of candidates for board and senior management appointments, include training and development to prepare internal candidates for advancement; b) Oversight of board composition and succession planning, which should be reviewed annually; c) Promotion of diversity, inclusion, and balance of skills and experience on the board; d) Oversight of the board’s self-assessment and evaluation processes.
Instead of the Risk Management Committee, mentioned in Article 17, banks can establish a
Credit Committee and an Asset Liability Management Committee (ALCO)
The Credit Committee has the primary responsibility to oversee the bank’s credit risk
management framework and ensure sound credit governance.
The Credit Committee shall, at a minimum, be responsible for:
a) Reviewing and approving the institution’s overall credit policy and ensuring it aligns with the institution’s risk appetite and strategic objectives; b) Considering and deciding upon credit proposals that exceed the approval authority delegated to the Credit Risk Management Committee or executive management; c) Reviewing credit decisions made by the Credit Risk Management Committee to ensure consistency with established policies and risk limits; d) Ensuring that effective procedures, resources, and controls are in place to identify, monitor, and manage irregular or non-performing credit exposures, minimize credit losses, and maximize recoveries; e) Directing and overseeing all matters with a material impact on the current and prospective quality of the institution’s credit portfolio and credit risk management practices; f) Assisting the Board of Directors in discharging its duties with respect to the periodic review of the quality of the loan portfolio, adequacy of credit loss provisions, and compliance with applicable prudential standards on asset classification and provisioning; g) Ensuring the conduct of independent credit reviews that are free from influence by the individuals or committees involved in credit approval decisions; h) Ensuring that the credit policy, including lending risk limits and approval authorities, is reviewed and updated at least annually, or more frequently as warranted by changes in internal or external conditions.
The Credit Committee shall be composed of a combination of Board Members and Senior
Management, with a majority representation from the board to preserve oversight independence.
The committee shall convene at least quarterly, and additionally as required based on the bank’s
credit risk exposure or emerging issues.
The levels of authority delegated to senior management or internal credit committees for credit
approval shall be explicitly defined in the institution’s credit policy or by a formal resolution of the board of directors.
The Asset Liability Management Committee should be responsible for all responsibilities of the
Risk Management Committee referred in Article 17, except those taken by the Credit Committee.
Banks may establish other committees, such as anti-money laundering, ethics, conduct and
compliance committees.

Article 19
Committee Operations

Each committee shall meet with sufficient frequency to fulfill its mandate effectively, but not less
than twice per year, respected the minimum requirements set by Section 19 of Regulation 2000/8 for the Audit Committee and the Risk Management Committee.
Committees shall report regularly to the Board of Directors on their activities, findings, and
recommendations.
Committee meeting minutes shall be documented, approved, and retained.
Committees shall have access to independent advice and external expertise as needed, at the
institution’s expense.

CHAPTER IV
GOVERNANCE OF GROUP STRUCTURES

Article 20
Group-Wide Governance Framework

The Board of Directors, when it is the case, shall ensure that a consistent and effective
governance framework is applied across the group, including subsidiaries, branches, and significant affiliates.
This framework shall define roles, responsibilities, reporting lines, and internal control
expectations throughout the group structure.
The governance framework shall be proportionate to the complexity, risk profile, and geographic
reach of the group.
The parent institution shall establish mechanisms to ensure that all subsidiaries operate in
accordance with the group’s governance standards and risk appetite.
The bank’s and banking group’s operational structure and its risks cannot use structures that
impede transparency and adequate supervision.
Boards and Senior Management of subsidiaries shall have sufficient autonomy to fulfil their legal
and regulatory duties, while remaining aligned with group objectives and policies.
The group board should ensure effective oversight of material risks, business activities, and
compliance across all entities.
The group board shall oversee the establishment and implementation of a group-wide risk
management framework that:
a) Identifies and aggregates risks on a consolidated basis; b) Reflects the institution’s risk appetite and limits across entities and geographies; c) Ensures adequate risk reporting, escalation, and controls at both the parent and subsidiary levels.
The group risk management function shall be structured to ensure independence, authority, and
access to all necessary information within the group.
The group internal audit and compliance functions shall have clear authority and independence
to assess and monitor the effectiveness of internal controls and regulatory compliance across all group entities.
These functions should be reported regularly to the board or relevant board committees at both
the group and local levels.
The Board of Directors shall ensure that Board Members and Senior Management of group
entities meet standards of fitness and propriety equivalent to those applied at the parent bank.
Processes for assessing suitability, integrity, and competence shall be consistently applied across
the group, and in accordance with Section 16 of Regulation 2000/8 and Instruction 2000/4 on Qualifications of Administrators.
The group governance framework shall include mechanisms to ensure timely, accurate, and
comprehensive information flows between the parent and its subsidiaries.
These mechanisms shall facilitate effective oversight and strategic alignment without
undermining local decision-making authority where required by law or regulation.
The governance framework shall be adaptable to comply with applicable laws, regulations, and
supervisory expectations in each jurisdiction where the group operates.
The Board of Directors shall ensure that local governance arrangements remain consistent with
the group’s overall risk management and control of the environment, subject to necessary legal and regulatory accommodation.

CHAPTER V
MANAGEMENT GOVERNANCE

Article 21
Senior Management Governance

Banks shall ensure that the organization, procedures, and decision-making processes of Senior
Management are clearly defined, transparent, and conducive to effective governance and operational oversight.
The roles, responsibilities, and delegated authority of each Senior Management position,
including the Chief Executive Officer or Managing Director, shall be formally documented and communicated.
Members of Senior Management shall possess the requisite experience, competence, and
integrity necessary to effectively discharge their duties and manage personnel under their supervision.
Banks shall provide members of Senior Management with access to regular and relevant training
to maintain and enhance skills and knowledge appropriate to their areas of responsibility.
Appointments to Senior Management positions shall be made through a formal recruitment or
promotion process that considers the qualifications and suitability of the candidates for the intended roles.
Where board involvement in the appointment or review of senior management candidates is
required, senior management shall furnish all necessary information to facilitate the board’s assessment.
Senior Management shall be accountable for ensuring timely and appropriate responses to all
findings and recommendations issued by the internal audit function.
Article 22
Appointment and Confirmation of Senior Management
Banks shall adopt a formal process for the appointment of individuals to Senior Management
positions, which includes background verification, suitability assessment, and the completion of any previous BCTL approval requirements as applicable.
The appointment of a Senior Management shall only become effective upon the conclusion of a
defined internal approval process. In exceptional circumstances where business continuity is at risk due to a vacancy, an interim appointment may be made, provided that the full vetting process is completed within a defined and reasonable period not exceeding one month.
The bank shall ensure that personal declaration forms or equivalent disclosures are completed
for each proposed senior manager in accordance with applicable licensing or regulatory requirements.
The bank shall verify the accuracy and completeness of the information submitted and retain
documentation for inspection by the relevant authorities.

Article 23
Disqualification and Removal of Senior Management

A bank shall establish procedures to reassess the suitability of Senior Management on an
ongoing basis, including during the course of their employment.
A Senior Management shall be subject to disqualification or removal if, at any time, it is
determined that the individual:
a) Has engaged in conduct contrary to applicable laws or Instructions. b) Has acted in a manner detrimental to the interests of depositors, clients, or the public; c) Is no longer fit and proper to perform their duties due to newly revealed adverse information or misconduct.
The institution shall establish internal processes for the timely removal or replacement of any
disqualified senior manager, in accordance with legal and contractual obligations.
Article 24
Responsibilities of Senior Management
Senior Management shall have collective and individual responsibility for the sound operation of the institution and shall:
a) Ensure that the bank’s operations are aligned with the strategic objectives, risk appetite, and policies approved by the board of directors; b) Implement effective business strategies, risk management systems, risk culture, and internal controls for managing financial and non-financial risks, in accordance with the directions of the board and applicable legal and regulatory obligations; c) Ensure that staff members are adequately trained and capable of fulfilling their duties competently and ethically; d) Establish and maintain robust internal control systems to identify, measure, monitor, and manage all risks faced by the institution; e) Design and implement appropriate management information systems to support efficient decision-making and facilitate timely communication across all levels of the institution; f) Provide the Board of Directors with timely, accurate, and comprehensive information to enable it to monitor the institution’s performance, assess Senior Management effectiveness, and evaluate the adequacy of the internal control framework.

Article 25
Duties of the Chief Executive Officer

The Chief Executive Officer (CEO) or equivalent person shall be responsible to the Board of
Directors for the day-to-day management of the bank.
The Chief Executive Officer (CEO) shall:
a) Implement the policies and strategies approved by the Board of Directors; b) Ensure adherence to the bank’s personnel policies; c) Coordinate the functions and operations of various departments; d) Oversee the establishment and maintenance of effective internal control systems; e) Ensure the development and operation of reliable management information and communication systems; f) Provide the Board of Directors with regular and comprehensive reports on the institution’s operations, including but not limited to:
i. Performance analysis against budget and prior periods, with explanation of
variances;
ii. Financial position, including capital adequacy, liquidity, and asset quality;
iii. Income and expenditure trends;
iv. Deposit trends and profile;
v. Related party transactions and their compliance with internal and regulatory
requirements;
vi. Legal and regulatory compliance, including any violations and corrective
measures taken;
vii. Concentration risks and large exposure reports;
viii. Non-performing loans, including those involving related parties;
ix. External and internal audit findings, including audit committee reviews;
x. Any other matters of strategic, operational, or financial significance.
The Chief Executive Officer (CEO) shall be accountable for the effectiveness of control functions,
including compliance, internal controls, and information systems, and shall ensure that the institution operates in full compliance with applicable laws, regulations, and internal policies.
CHAPTER VI
RISK GOVERNANCE

Article 26
Risk Governance Framework

The Board of Directors shall be responsible for the oversight and effectiveness of the bank’s risk
governance framework.
An effective risk governance framework shall comprise:
a) A strong, institution-wide risk culture; b) A clearly articulated risk appetite, defined through a formal Risk Appetite Statement; c) Clearly assigned responsibilities for risk management and control functions.
The framework shall include defined procedures for addressing breaches of risk limits, including
escalation protocols, disciplinary actions for excessive risk-taking, and timely reporting to the board.

Article 27
Risk Culture

A bank shall promote a robust risk culture throughout all levels of the organization.
This risk culture shall:
a) Support the bank’s risk appetite and risk-taking behavior; b) Reinforce adherence to risk management policies and procedures; c) Ensure the operational effectiveness of the control functions.
Senior Management shall be responsible for communicating, maintaining, and reinforcing this
culture through appropriate channels and behaviors.

Article 28
Risk Appetite

The Board of Directors shall define and approve the institution’s risk appetite, ensuring its
alignment with the strategic objectives, capital planning, financial performance goals, and compensation structures.
The Risk Appetite Statement shall:
a) Be clear and easily understood by the Board of Directors, Senior Management, and relevant personnel; b) Include both quantitative and qualitative measures; c) Specify the levels and types of risk the institution is willing to accept in pursuit of its business objectives; d) Define the operational boundaries and strategic considerations guiding risk-taking activities; e) Be effectively communicated across the institution, linking risk appetite to decisionmaking at all levels.
The development and implementation of the Risk Appetite Statement shall be a collaborative
process involving board leadership, senior management, risk management, and relevant business functions.
Article 29
Risk Management Function
A banking institution shall establish an independent and adequately resourced risk management
function under the leadership of a Chief Risk Officer (CRO), who shall have direct access to the board or a board-level risk committee.
The risk management function shall:
a) Identify material individual, aggregate, and emerging risks; b) Assess and measure exposures to such risks; c) Develop and maintain the institution-wide risk governance framework, including risk culture, appetite, and limits, subject to board approval; d) Continuously monitor risk-taking activities and exposures against the approved risk appetite, limits, and capital/liquidity needs; e) Implement early warning mechanisms for potential breaches; f) Challenge and influence business decisions that may result in excessive or undesirable risk; g) Provide regular reports to senior management and the board or its relevant committees, including recommendations for risk mitigation.
The risk management function shall be independent from business units and shall not engage in
revenue-generating activities; and:
a) It shall have unrestricted access to all business lines and entities within the group that could generate material risk. b) Staff within the risk management function shall:
i. Be suitably trained and possess relevant qualifications, including expertise in
markets, products, and risk methodologies;
ii. Demonstrate the competence and willingness to challenge business decisions
that may increase risk exposure.

Article 30
Compliance Function

A bank institution shall maintain a dedicated compliance function responsible for ensuring
adherence to all applicable laws, regulations, codes of conduct, and internal policies, including those related to anti-money laundering and counter-financing of terrorism.
Senior Management shall establish a compliance policy approved by the Board of Directors. This
policy shall outline the principles and procedures for identifying and managing compliance risk throughout the organization.
The compliance function shall play a key role in promoting responsible conduct, corporate values,
and ethical standards.
The compliance function shall have sufficient authority, independence, resources, and direct
reporting access to the board or a designated board-level committee.
Compliance staff shall be qualified, experienced, and regularly trained to perform their duties
effectively.
The institution shall notify the board promptly upon the departure of the head of compliance,
including the reasons for the departure where applicable.
Article 31
Integration of Risk and Compliance Functions
Small banks may, subject to governance and proportionality principles, integrate risk
management and compliance functions.
Such integration should be adopted only where the nature, size, and complexity of the bank’s
operations justify it, and provided that the integrity, independence, and effectiveness of both functions are maintained.

Article 32
Internal Audit Function

The Internal Audit function shall provide independent and objective assurance to the Board of
Directors and Senior Management on the adequacy and effectiveness of the institution’s governance, risk management, and internal control systems.
The Internal Audit function shall:
a) Operate with a clearly defined mandate; b) Be independent from audited activities and functions;

c) Report directly to the Board of Directors or its Audit Committee; d) Be equipped with sufficient standing, authority, skills, and resources to carry out its responsibilities effectively.
3. Internal Auditors shall have unrestricted access to all functions, records, and personnel
necessary to perform their duties and shall be empowered to express concerns directly to the Board.
Chapter VII
TRANSPARENCY AND DISCLOSURES

Article 33
Governance Disclosures

Each bank shall publicly disclose material information on its governance structure and practices
to enhance stakeholder trust and accountability.
Disclosures shall include, at a minimum:
a) The composition and responsibilities of the Board of Directors and its committees; b) The governance framework, including key policies and procedures; c) The risk governance structure, including roles of control functions; d) The process for selecting, training, and evaluating Board Members and Senior Management.
The bank shall provide transparent and meaningful disclosures of its risk profile, risk
management framework, and internal control environment.
Disclosures shall be proportionate to the nature, size, and complexity of the institution and shall
include:
a) Key risk exposures and concentration risks; b) Risk appetite and limits structure; c) Significant risk management and mitigation strategies; d) Stress testing methodologies and outcomes, where relevant.

Article 34
IFRS Financial Reporting Oversight

The Board of Directors shall be responsible for ensuring that all financial statements are
prepared in accordance with International Financial Reporting Standards (IFRS) as adopted in Timor-Leste.
The Audit Committee, consistently with its attributions, shall oversee compliance with IFRS 9
Expected Credit Loss (ECL) provisioning requirements, including approval of key assumptions, methodologies, and governance of provisioning policies.
The Board shall ensure governance over fair value measurement and disclosure (IFRS 13),
including approval of valuation policies and independent validation of material valuation models.
Consolidated financial statements shall be prepared in accordance with IFRS 10 and IFRS 12,
ensuring that all subsidiaries, branches, and affiliates are appropriately consolidated and disclosed.

Article 35
External Auditor Independence

The Audit Committee shall ensure the independence, objectivity, and rotation of the external
auditor in line with Instruction 15/2021 of 25 November, which reflects the international best practices.
Any engagement of the external auditor for non-audit services shall be subject to prior approval
by the Audit Committee to prevent conflicts of interest.

Article 36
Remuneration Disclosures

Each bank shall disclose its remuneration policies and practices, particularly those applicable to
members of the Board of Directors, Senior Management, and material risk takers.
Disclosures shall cover:
a) The alignment of remuneration with risk-taking and long-term performance; b) Governance of remuneration decisions; c) The use of deferral, clawback, and malus arrangements. d) Aggregated quantitative information on remuneration outcomes.
All disclosures shall be clear, accurate, comprehensive, and presented in a manner accessible to
relevant stakeholders, including shareholders, investors, and regulators.
Disclosures shall be subject to internal review and, where appropriate, independent assurance
to ensure reliability and consistency with internal reports and regulatory submissions.
Disclosures shall be made on a regular basis and promptly updated in response to material
changes in governance arrangements, risk exposures, or financial condition.
The bank shall ensure that stakeholders are informed of material developments that could affect
the bank’s governance, risk profile, or long-term sustainability.
Article 37
Confidentiality and Legal Constraints
While promoting transparency, a bank shall ensure that disclosures respect legal, contractual,
and regulatory confidentiality requirements.
The bank shall maintain a management and governance structure that fosters accountability and
transparency at all organizational levels.
Every individual within the bank, regardless of role, shall be held personally accountable for
conduct that contravenes legal, regulatory, internal policy, or professional ethical standards.
Sensitive information shall only be withheld where necessary and shall be justified by reference
to applicable standards or supervisory guidance.
In accordance with Section 20 of the Regulation 2000/8, Board of Directors, Senior
Management, Employees, and Agents of a bank shall keep secrecy on any non-public information obtained in the course of their services to the bank, which can be disclosed only in accordance with the Regulation.
No bank shall conceal, convert, or transfer cash or other property, knowing that such property is
derived from criminal activity, for the purpose of concealing or disguising the illicit origin of the property or of assisting any person who is involved in such activity to evade the legal consequences of his action.

CHAPTER VIII
CODE OF ETHICS AND CONFLICT OF INTEREST

Article 38
Conflict of Interest

The Board of Directors and Senior Management shall, in accordance with Section 22 of the
Regulation 2000/8, disclose any personal or professional interest that might result in a conflict with the interest of the bank.
All the staff shall also be obliged to disclose any conflict of interest.
All directors must sign an annual declaration of conflict of interest, to be updated as
circumstances change.
A director or officer with a material interest in any matter shall recuse themselves from
deliberations and decision-making on that matter.
The institution shall maintain a register of conflicts of interest and implement policies for their
mitigation.
No individual shall engage, directly or indirectly, in any activity that competes with or
compromises the interests of the bank.
Where a transaction giving rise to a conflict of interest is unavoidable, it shall be conducted in
the ordinary course of business, on an arm-length and fully disclosed, with the affected individual recused from any related decision-making, and in compliance with the Instruction 2000/6 of December 26, on Transactions with Related Persons, Related Banks and Financial Institutions, and Affiliates.
The Board of Directors, Senior Management, and staff shall not use their position or influence
within the bank to obtain personal gain or to benefit related parties.
The code of ethics shall include measures to mitigate, monitor, and control any such conflicts in
the bank’s operations.
Any breach of conflict-of-interest policy shall be subject to disciplinary and legal actions as
appropriate.
Article 39
Code of Ethics
The Board of Directors shall adopt and maintain a formal code of ethics and standards of
business conduct that is applicable to Members of the Board, Senior Management, and all staff of the bank.
The Board of Directors shall ensure adherence to the code through clear policies, oversight
mechanisms, and regular training.
At a minimum, the code shall address the following areas:
a) Compliance with applicable laws and regulations; b) Identification and management of conflicts of interest; c) Ethical guidelines for sound decision-making; d) Channels for raising concerns or reporting misconduct without retaliation; e) Fair treatment of customers, employees, and third parties; f) Professional development responsibilities;

g) Internal and external communication protocols, including information disclosure to stakeholders; h) Whistleblowing procedures and protection mechanisms; i) Prohibition of illegal activities, including fraud, financial misreporting, market abuse, breach of sanctions, money laundering, financing of terrorism, anti-competitive behavior, bribery, and corruption; j) A general obligation for all employees to act with integrity, competence, diligence, and professionalism.

CHAPTER IX
FINAL PROVISIONS

Article 40
Review and Improvement

Banks shall review their internal governance at least annually, or more frequently in response to
significant changes in business activities or structure, risk profile and regulatory requirements.
Reviews shall include an assessment of the bank’s compliance with Basel III prudential
requirements and IFRS financial reporting standards, ensuring that governance structures and internal controls support accurate capital, liquidity, risk, and financial disclosures.
The BCTL may require additional measures or remediation where deficiencies are identified.
The BCTL reviews shall evaluate the effectiveness of corporate governance and compliance with
this Instruction and others related to the internal controls and auditing.
Article 41
Implementation

For existing banks, the effective implementation shall be within one year after the entry into force of this Instruction.

Article 42
Entry into force and Publication

This Instruction shall enter into force on the date of its publication in the Jornal da República.
In accordance with Article 66 paragraph 1 of the Organic Law of the Banco Central, this
Instruction shall be published in the Jornal of República.
Approved on 20 November 2025
Governor

Helder Lopes

Instruction No. 29/2025 On Corporate Governance Of Authorized Banks In Timor-Leste

Lineage: In force