Instruction No. 30/2025 on Internal Controls, Compliance and Internal Audit

INSTRUCTION № 30/2025
ON INTERNAL CONTROLS, COMPLIANCE AND INTERNAL AUDIT Considering that Section 23.1 of Regulation 2000/8, dated February 25, on Bank Licensing and Supervision (hereinafter referred as the “Regulation”), determines that banks shall conduct their administration and operations in accordance with sound administrative and accounting procedure, which is reinforced by Sections 27.1.(e) and 31.1 of the Regulation. Considering that Sections 19.1. a, b, and Section 19.3.c of the Regulation require the establishment of appropriate accounting procedures and accounting controls, and compliance with the laws and regulations applicable to banks. Considering Principle 26 of the Core Principles for Effective Banking Supervision (BCBS - Basel Committee on Banking Supervision), which recommends that banks have adequate internal control frameworks to establish and maintain an effectively controlled and tested operating environment for the conduct of their business, considering their risk profile. The Governing Board of Banco Central de Timor-Leste (BCTL), in accordance with Section 46 of Regulation no. 2000/8 of 25 February and Article 31 paragraph 1 of Law no. 5/2011 of 15 June, hereby resolves to approve the following Instruction:
CHAPTER I
GENERAL PROVISIONS

Article 1
Definitions
The following definitions apply to this Instruction:
a) Bank: is defined in accordance with the Regulation. b) BCTL refer to the Banco Central de Timor-Leste; c) Board of Directors: or the Governing Board, is the governing body responsible for overseeing the management of the bank. d) Compliance Function: is an independent function reporting directly to the Board of Directors or a designated Board Committee. It is responsible for identifying, assessing, advising on, monitoring, and reporting compliance risks, including risks of legal or regulatory sanctions, financial loss, or reputational harm arising from non-compliance with applicable laws, regulations, codes of conduct, and established standards.

e) Control Functions: functions that operate independently from business management and are tasked with providing objective assessments, assurance, and reporting. These include, at a minimum, the risk management function, compliance function, and internal audit function. f) Internal Control System: is a coherent framework of policies, procedures, and control mechanisms that ensure effective governance of the bank's organizational and operational structure, including risk management, compliance, and internal audit. g) Internal Audit Function: is an independent, objective assurance and consulting activity designed to add value and improve the bank’s operations. It helps the bank accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes. h) Risk Limits are the quantitative thresholds that operationalize the bank’s risk appetite, allocated across business units, legal entities, or risk categories to control risk exposures within acceptable bounds. i) Risk Management is a set of processes by which a bank identifies, assesses, monitors, mitigates, and reports material risks and concentrations in a timely and comprehensive manner. j) Senior Management: refers to any officer of the bank, including the Chief Executive Officer, Vice President(s), General Manager, Chief Financial Officer, Chief Lending Officer, Chief Treasury Officer, or any other officer with authority to make binding commitments on behalf of the institution.
Article 2
Purpose

1. This Instruction establishes the minimum standards and principles that banks must observe in
   designing, implementing, and maintaining effective internal control systems to ensure sound risk management, safeguard assets, ensure accurate and reliable financial reporting, and comply with applicable laws and regulations.

2. The Instruction also sets minimum standards and principles governing the compliance and
   internal audit functions of banks, to ensure independent and effective evaluation of internal controls, risk management, governance processes, and the reliability of financial and operational reporting.
   Article 3
   Scope

3. This instruction applies to all banks and to all branches of foreign banks licensed to operate in
   Timor-Leste.

4. Institutions, licensed under Instruction nº 06/2010, dated 17 December, on the Licensing and
   Supervision of Other Deposit Taking Institutions (ODTIs), are subject to the Instruction where applicable.

5. Those institutions are expected to have relatively basic risk management systems and internal
   controls, information systems, and internal audit that are appropriate for the size of the institution and the nature, scope, and risk of its activities.

6. When the size and complexity of the ODTI do not warrant a full-scale compliance or internal audit
   functions, the ODTI may rely on regular reviews of essential compliance and internal controls conducted by other institution personnel, independent of the area under review.

CHAPTER II
PRINCIPLES OF INTERNAL CONTROL

Article 4
Definition of Internal Control

Internal control shall be understood as a comprehensive process established by the bank’s Board of Directors, Senior Management, and all levels of personnel, designed to achieve the following objectives:
a) promote effective and efficient operations; b) ensure reliability, timeliness, and transparency of financial and management information; c) ensure compliance with applicable laws, regulations, and internal policies; d) safeguard assets against loss from unauthorized use or disposition.
Article 5
Core Components of Internal Control

Banks shall structure their internal control systems to include at minimum the following components:
a) Control Environment – A culture that promotes integrity, ethical values, and competence at all levels, supported by robust organizational structure, with clear arrangements for delegating authority and responsibility, sound human resources practices, and appropriate oversight. b) Risk Assessment – Ongoing and systematic identification, evaluation, and management of material risks affecting the bank’s objectives. c) Control Activities – Policies, procedures, and mechanisms established to ensure that risk responses are effectively carried out, including segregation of duties, cross checking, dual control of assets, double signatures, approval and authorization controls, verifications, and reconciliations of these processes. The separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities is essential. The safeguarding of the bank's assets is also relevant. d) Information and Communication – Systems that ensure the flow of reliable, timely, and relevant information both internally and externally to support decision-making and control. e) Monitoring and Corrective Actions – Regular review and evaluation of internal controls, to test adherence to and effectiveness of these controls as well as applicable laws and regulations, including by independent internal audit ((including those that are outsourced), compliance and other control functions, with prompt corrective measures as necessary.

CHAPTER III
ROLES AND RESPONSIBILITIES

Article 6
Board of Directors

1. The Board of Directors is ultimately responsible for ensuring that a bank has an internal control
   framework that is adequate to establish an effectively controlled and tested operating

environment for the conduct of their business, considering their risk profile with a forward-looking view.
2. The Board of Directors is also responsible for:
a) approving and periodically reviewing the overall business strategies and policies of the bank; b) understanding the major risks faced by the bank, setting acceptable levels for these risks, and ensuring that bank managers take the steps necessary to identify, measure, monitor and control these risks; c) approving the organizational structure; and d) ensuring that bank Board members monitor the effectiveness of the internal control system.
3. The Board of Directors shall conduct:
a) periodic discussions with Senior Management concerning the effectiveness of the bank's internal control system; b) a timely review of evaluations of internal controls made by Senior Management, internal auditors, and external auditors; c) periodic efforts to ensure that senior management has promptly followed up on recommendation and concerns expressed by auditors and the BCTL on internal control weaknesses; and d) a periodic review of the appropriateness of the bank's strategy and risk limits.
4. Pursuant to Section 19.1 of the Regulation, the Audit Committee can assist the Board of Directors
in fulfilling these responsibilities; however, pursuant to Section 16.5, the Board of Directors and its members cannot delegate their responsibilities to others.
5. The Board of Directors and Senior Management are responsible for promoting high ethical and
integrity standards, and for establishing a culture within the organization of the bank that emphasizes and demonstrates to all levels of personnel the importance of internal controls. Bank personnel must be informed of, and held responsible for, their role in the internal controls process.
6. The Board of Directors shall also oversee the integrity, independence, and effectiveness of
control functions, including internal audit, risk management, and compliance.
Article 7
Senior Management

1. The Senior Management is responsible for:
   a) implementing strategies, policies and the internal control framework approved by the Board of Directors; b) developing processes that identity, measure, monitor and control risk incurred by the bank; c) maintaining an organizational structure with clear lines of authority and responsibility for internal controls at all levels of the organization, assigning responsibility, authority and reporting relationships; d) ensuring adequate staffing and resources for control functions e) ensuring that delegated responsibilities are effectively carried out; f) setting appropriate internal control policies; g) monitoring the adequacy and effectiveness of the internal control system; and

h) promoting a culture of control consciousness, integrity, and compliance.
2. All material risks that could adversely affect the achievement of the bank's goals should be
recognized and continually assessed. This assessment should cover all risks facing the bank and the consolidated banking organization (credit risk, country and transfer risk market risk, interest rate risk, liquidity risk, operational risk, legal risk and reputation risk). Internal controls should be revised to appropriately address new or previously uncontrolled risks.
3. Senior Management shall ensure that the bank maintains adequate internal controls over
regulatory reporting, capital adequacy ratios, leverage ratio, and liquidity coverage ratio, as required under Basel III. They shall establish robust stress testing frameworks and scenario analyses for material risks, ensuring results are integrated into decision-making and capital planning.
Article 8
Basel III Capital and Liquidity Controls

1. Banks shall implement internal controls to ensure compliance with Basel III requirements on
   capital adequacy, liquidity coverage ratio, net stable funding ratio, leverage ratio, and stress testing. Internal controls shall ensure the accuracy, completeness, and timeliness of all related regulatory returns and disclosures.
2. Banks shall maintain systems capable of conducting forward-looking stress testing and scenario
   analyses across credit, market, operational, and liquidity risks.
3. The results of such stress testing shall be regularly reported to the Board of Directors and
   incorporated into strategic, risk management, and capital planning decisions. CAPTER IV THE CONTROL FUNCTION

Article 9
Control Functions

1. Control activities must be an integral part of the daily activities of a bank. An appropriate control
   structure should be established with control activities defined in every sector of the bank's operations.
2. The control structure should Include:
   a) Top level reviews. An adequate management information system should exist for the Board of Directors and Senior Management to review the bank’s progress toward established goals. b) Appropriate activity controls for each unit and sub-unit of the bank. Managers in charge of units and sub-units of the bank should receive standard performance and exception reports on a frequent basis for purposes of performing a functional review. c) Physical controls. Access to tangible assets, including cash and securities, should be controlled through physical limitations, dual custody, and periodic inventories. d) A system for checking compliance with exposure limits and following up on non￾compliance. Prudent limits on risk exposures should be established which are in addition to, but in compliance with, instructions of the BCTL. A process for reviewing compliance

with such limits and requirements for following up in instances of non-compliance should be established. e) A system of approvals and authorizations. A system of approval and authorization for bank transactions which exceed a certain limit should be established to ensure that a manager at an appropriate level is aware of the transaction or situation, and to establish accountability. f) A system of verification and reconciliation. Verifications of transaction details and activities as well as periodic reconciliations should be performed on a regular basis.

Article 10
Segregation of Duties

1. An appropriate segregation of duties should exist throughout the operational functions of the
   bank and personnel should not be assigned conflicting responsibilities.
2. Areas of potential conflicts of interest should be identified, minimized, and subject to careful,
   independent monitoring.
3. Banks shall ensure that conflicting duties and responsibilities are appropriately segregated to
   reduce the risk of error, fraud, and abuse.
4. No single individual shall control all key aspects of any critical operation.
5. The responsibilities and functions of key individuals should be subject to periodic reviews to
   ensure that they are not in a position to conceal inappropriate actions.
   CHAPTER V
   PRINCIPLES OF COMPLIANCE

Article 11
Responsibilities of the Board of Directors and Senior Management

1. The Board of Directors shall approve and oversee the implementation of the compliance policy
   and ensure that the bank maintains an effective, independent, and adequately resourced compliance function.
2. The Board of Directors shall ensure that Senior Management promotes a culture of compliance
   throughout the bank.
3. The Board of Directors shall periodically review the effectiveness of the compliance framework
   and take appropriate action to address any deficiencies.
4. Senior Management shall be responsible for implementing the compliance policy and ensuring
   that all business units observe those provisions.
5. Senior Management shall ensure that the compliance function is given authority, independence,
   and resources adequate for carrying out its responsibilities.
6. Senior Management shall establish a compliance culture that emphasizes integrity, ethical
   conduct, and adherence to all applicable obligations.

Article 12
Compliance Policy

1. Banks shall adopt a comprehensive compliance policy, approved by the Board of Directors,
   setting out the bank’s approach to compliance, including the identification, assessment, monitoring, and reporting of compliance risk.

2. The compliance policy shall be communicated to all employees and reviewed regularly, at least
   annually, and whenever there are significant regulatory or business changes.

3. The compliance policy shall explicitly cover the bank’s obligations in relation to insurance or risk
   transfer arrangements, including compliance with IFRS 17, contractual reviews, and associated regulatory reporting requirements.
   Article 13
   Organization and Responsibility of the Compliance Function

4. The compliance function shall be independent of operational and business functions and shall
   have direct access to the Board of Directors or its Audit/Compliance Committee.

5. The head of compliance shall not be assigned responsibilities that could compromise the
   function’s independence.

6. The compliance function shall have the authority to access all records, data, and employees
   necessary for discharging its duties.

7. The compliance function has among its responsibilities:
   a) Identify and assess the compliance risks associated with the bank’s business activities; b) Advise the Board and Senior Management on compliance laws, regulations, and standards; c) Monitor and report on the bank’s compliance with applicable obligations; d) Promote staff training and awareness on compliance issues; e) Assist in developing policies and procedures to manage compliance risk; and f) Conduct regular and ad hoc compliance reviews.

8. The compliance function shall also ensure that the bank’s use of insurance or risk transfer
   arrangements complies with all applicable legal and regulatory obligations, including those arising under IFRS 17. Where the bank engages insurance companies to cover exposures such as loan risk, the compliance function shall monitor the adequacy and legality of such arrangements, ensure accurate and transparent reporting in line with IFRS requirements, and coordinate with the internal audit function to avoid overlaps while preserving independence.

9. The compliance function shall be staffed by an adequate number of qualified personnel with the
   necessary skills, experience, and integrity to perform their duties effectively.

10. The compliance function shall provide regular reports, at least annually, and whenever
    necessary, to the Board of Directors or its designated committee on compliance matters, including significant breaches, deficiencies, and corrective actions.

11. The compliance function shall promptly report material compliance issues to Senior
    Management and, where appropriate, to the Board.

12. Compliance risk shall form part of the bank’s overall risk management framework. The
    compliance function shall coordinate with other control functions, including risk management and internal audit, while maintaining its independence.

13. Banks shall periodically review their compliance frameworks to ensure their continued adequacy
    and effectiveness in light of evolving regulatory requirements, market conditions, and the bank’s business activities.
    CHAPTER VI
    PRINCIPLES OF INTERNAL AUDIT

Article 14
Internal Audit Function

1. The bank shall have an internal audit function, independent of operational management and
   with sufficient standing, authority, and resources within the bank to carry out its responsibilities effectively.

2. The head of internal audit shall report functionally to the Audit Committee of the Board of
   Directors.

3. Internal auditors shall have unrestricted access to all records, personnel, systems, and physical
   properties relevant to the performance of their duties.

4. Internal auditors shall not assume operational responsibilities or be involved in activities that
   could compromise their objectivity.
   Article 15
   Responsibilities of Board of Directors, Audit Committee, and Senior Management

5. The Board of Directors, and the Audit Committee, shall:
   a) Approve and regularly review the internal audit charter and audit plan. b) Ensure the independence, competence, and adequacy of the internal audit function. c) Oversee the performance of the internal audit function and receive its reports directly. d) Approve the appointment, remuneration, and dismissal of the head of internal audit.

6. The Senior Management of the bank has the following responsibilities:
   a) Facilitate the implementation of an effective internal audit function; b) Ensure timely and adequate responses to internal audit findings and recommendations; and c) Avoid actions that could compromise the independence of internal audit.
   Article 16
   Scope of Internal Audit

7. The internal audit function shall cover at least the following:
   a) The adequacy and effectiveness of the internal control system, including financial, operational, compliance, and IT controls. b) The effectiveness of risk management and governance processes. c) The reliability and integrity of financial and management information. d) The safeguarding of assets and prevention/detection of fraud. e) The adequacy of compliance with laws, regulations, and internal policies. f) The evaluation of significant outsourcing arrangements and third-party service providers.

8. The internal audit function shall also cover validation of models and methodologies used for
   the calculation of Expected Credit Losses (ECL) under IFRS 9, including periodic back-testing and independent review. It shall assess the adequacy of internal controls over financial instrument disclosures required under IFRS 7, including credit, market, and liquidity risk disclosures.

9. It shall evaluate processes for fair value measurement in accordance with IFRS 13, including
   the appropriateness of inputs, assumptions, and hierarchy classifications.

10. For insurance activities, the internal audit shall review compliance with IFRS 17 requirements
    on insurance contract recognition, measurement, and disclosure.

Article 17
Audit Methodology and Planning

1. The internal audit function shall maintain a comprehensive audit universe and a risk-based audit
   plan, reviewed at least annually and approved by the Board of Directors or its Audit Committee.

2. Audit activities shall be conducted in accordance with internationally recognized internal
   auditing standards.

3. The audit plan shall be flexible to respond to emerging risks, regulatory changes, or significant
   incidents.
   Article 18
   Reporting and Follow-up

4. Internal audit shall issue written reports on its findings, conclusions, and recommendations
   addressed to Senior Management and the Board of Directors or Audit Committee.

5. The internal audit function shall monitor the implementation of its recommendations and report
   on outstanding issues.

6. All significant audit findings should be reported without delay to the Board of Directors or its
   Audit Committee, especially where they concern material deficiencies or breaches.
   Article 19
   Internal Audit Competence and Staffing

7. The internal audit function shall have staff with the necessary qualifications, experience, and
   technical knowledge, including expertise in risk management, accounting, Information Technology, and other relevant fields.

8. The bank should ensure sufficient staffing and budget for the internal audit function to carry out
   its duties effectively.

9. Banks shall provide ongoing training and development opportunities to internal audit staff to
   ensure that their knowledge and skills remain up to date with industry practices, regulatory requirements, and emerging risks.

Article 20
Quality Assurance and Improvement Program

1. The internal audit function shall maintain a quality assurance and improvement program that
   includes periodic internal and external assessments of the effectiveness and performance of the function.
2. An external quality assessment shall be performed at least once every five years by qualified,
   independent reviewers.
3. The results of quality assessments shall be reported to the Board of Directors or its Audit
   Committee and used to strengthen the internal audit function.

Article 21
Outsourcing Internal Audit

1. The internal audit function may outsource specific audit activities, provided that the bank retains
   full responsibility for the adequacy and effectiveness of internal audit.
2. The outsourcing arrangement shall ensure:
   a) Independence of the service provider from operational management; b) Adequate competence and capacity of the service provider; c) Clear contractual provisions on confidentiality, access to records, and reporting.
3. The head of internal audit shall oversee all outsourced audit activities and ensure that findings
   and recommendations are integrated into the bank’s internal reporting and follow-up processes.
   CHAPTER VII
   DOCUMENTATION AND MONITORING

Article 22
Documentation and Record Keeping

1. The bank must develop adequate and comprehensive internal financial, operational and
   compliance data, as well as external market information about events and conditions that are relevant to decision making.
2. Information should be reliable, timely, accessible, and provided in a consistent format.
3. Reliable information systems, covering all significant activities of the bank, must be in place.
   These systems, including those that hold and use data in an electronic form, must be secure, monitored independently and supported by adequate contingency arrangements.
4. Controls of information systems and technology should include both general and application
   controls:
   a) General controls ensure the continued, proper operation of computer systems and include in-house back-up and recovery procedures, software development and acquisition policies, maintenance procedures, and physical/logical access security controls. b) Application controls involve the processing of transactions and business activities and include edit checks and specific logical access controls unique to a business system. c) Contingency arrangements cover the risk of loss or extended disruption of bank services related to computer systems. Business resumption and contingency plans should

include the use of an alternate off-site facility and the recovery of critical systems supported by an external service provider.
5. Banks shall ensure that their information systems and reporting frameworks are consistent with
the Basel Committee Principles for Effective Risk Data Aggregation and Risk Reporting (BCBS 239), enabling timely, accurate, and comprehensive risk data consolidation across legal entities and business lines. Internal controls shall cover the preparation and disclosure of financial statements in compliance with International Financial Reporting Standards (IFRS), including but not limited to IFRS 7, IFRS 9, and IFRS 13.
6. The bank should establish effective channels of communication to ensure that all staff fully
understand and adhere to policies and procedures affecting their duties and responsibilities and to ensure that other relevant information is reaching the appropriate personnel.
7. Banks shall document their internal control framework, policies, procedures, and changes
thereto, and retain records sufficient to demonstrate compliance with this Instruction. Documentation shall be available for supervisory review.
8. Banks shall maintain comprehensive records of the internal audit charter, policies, audit plans,
reports, follow-up actions, quality assurance reviews, and related Board and committee minutes.

Article 23
Monitoring and Review

1. The overall effectiveness of the bank's internal controls should be monitored on an ongoing
   basis. Monitoring of key risks should be part of the daily activities of the bank as well as periodic evaluations by the business function itself and by internal audit.
2. There should be an effective and comprehensive internal audit of the internal control system
   carried out by operationally independent, appropriately trained and competent staff. The internal audit function, as part of the monitoring of the system of internal controls, should be reported directly to the Board of Directors or its Audit Committee, and to Senior Management
3. The internal audit function must be independent from the day-to-day functioning of the bank and
   must have access to all activities conducted by the bank, including branch and subsidiary operations.
4. The frequency and extent of internal audit review and testing of internal controls should be
   consistent with the nature, complexity, and risk of the bank's activities. Internal control deficiencies, whether identified by business line, internal audit, or other control personnel, should be reported in a timely manner to the appropriate level of managers and addressed promptly. Material internal control deficiencies should be reported to the Boad of Directors and Senior Management of the bank.
5. Banks shall conduct regular evaluations of the internal control system’s effectiveness, including
   through self-assessment and independent reviews. Findings shall be reported to Senior Management and the Board of Director, with corrective actions tracked and implemented.
6. Monitoring and review shall also include periodic validation of Basel III capital adequacy,
   leverage, liquidity coverage, and stress testing calculations and reporting. Banks must ensure that internal control deficiencies in these areas are promptly identified, reported to Senior Management and the Board of Directors, and remediated without delay.

CHAPTER VIII
FINAL PROVISIONS

Article 24
Supervisory Oversight

1. BCTL shall assess banks’ internal control systems as part of its supervisory processes and may
   require banks to take remedial measures where deficiencies are identified.
2. BCTL shall also assess the adequacy, independence, and effectiveness of the bank’s
   compliance and internal audit functions. Banks shall provide full access to all audit records and documentation upon request.
3. The exceptions conceded by this Instruction do not limit the authority of the BCTL to examine
   any bank or ODTI as frequently as deemed necessary.

Article 25
Repeal

The Instruction №. 2001/5, dated April 11, of the Central Payments Office is hereby revoked.

Article 26
Entry in Force

1. This Instruction shall entry in force on the date of publication in the Jornal da República.
2. In accordance with Article 66 paragraph 1 of the Organic Law of the Banco Central, this
   Instruction shall be published in the Official Gazette.
   Approved on 20 November 2025
   Governor
   Helder Lopes