Instruction No. 4/2025

Instruction No. 4/2025 BO No. 3/2025 Supplement • 2025/03/20 .................................................................................................................................................................................................. Topics Supervision :: Internal Control Mod. 99999911/T – 01/14 Index Text of the Instruction [heading of previous Article 13] [heading of previous Article 14] Annex I - Amendment to Annex I to Instruction No. 18/2020 on risk categories RISK CATEGORIES Annex II - Amendment to Annex II to Instruction No. 18/2020 on the deficiency classification methodology Annex III - Amendment to Annex III to Instruction No. 18/2020 on deficiency reporting I. Deficiencies classified at level F3 (high) and F4 (very high) Annex IV - Reporting of the universe of employees who have a material impact on the institution's risk profile Annex V - Republication of Instruction No. 18/2020 (as referred to in Article 5) Annex I - Risk categories Annex II - Deficiency classification methodology Annex III - Deficiency reporting I. Deficiencies classified at level F3 (high) and F4 (very high) Annex IV - Reporting of the universe of employees who have a material impact on the institution's risk profile Text of the Instruction Subject: Amending Instruction No. 18/2020, regarding reporting duties concerning conduct and organizational culture and governance and internal control systems

Bank of Portugal Instruction No. 18/2020 (“Instruction No. 18/2020” or “Instruction”) regulates, in accordance with the principle of proportionality, the reporting duties incumbent upon the entities covered by Bank of Portugal Notice No. 3/2020 (“Notice No. 3/2020” or “Notice”), concerning conduct and organizational culture and governance and internal control systems.

In parallel with the update of the Notice, carried out through Bank of Portugal Notice No. 2/2025, it is also necessary to update the Instruction, particularly regarding the reference and reporting date for the self-assessment report on the adequacy and effectiveness of organizational culture and governance and internal control systems of supervised institutions and related documents. The annual report is now prepared with reference to September 30 of each year, instead of November 30. Entities obliged to report must submit the report to the competent supervisory authority by November 15 of each year, instead of December 31.

The reporting to the competent supervisory authority of the universe of employees who have a material impact on the institution's risk profile must now be carried out by January 31 of each year, and the remuneration information to be reported in this context relates to the previous year, as provided for in Article 10 of the Instruction. The new Annex IV to the Instruction defines the information structure to be considered for reporting purposes.

Additionally, this opportunity is also used to update the annexes to the Instruction, highlighting the update of Annex I which includes the (non-exhaustive) risk categories that must be considered by the entities covered by the Notice for the purpose of reporting deficiencies to the competent supervisory authority.

In line with the changes introduced to the Notice, the following reports are now provided for in the Instruction:

• Report regarding the appointment of the statutory auditor or statutory audit firm, provided for in point (i) of Article 39 of Notice No. 3/2020, applicable to institutions authorized to receive deposits, except for Mutual Agricultural Credit Societies that are part of the Integrated System of Mutual Agricultural Credit (new Article 12);
• Report by credit institutions, provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies, equally applicable in the cases provided for in paragraph 4 of Article 109 of the same instrument (new Article 13), as provided for in Article 33, paragraph 8, point (g) of Notice 3/2020.

In view of the changes enshrined by the amending instruction, it is also decided to republish Instruction No. 18/2020 with the changes introduced by this Instruction.

The draft of this Instruction was subject to public consultation, with the Securities Market Commission and the Insurance and Pension Funds Supervisory Authority being consulted.

In these terms, Bank of Portugal, using the powers conferred upon it by the provisions of paragraph 2 of Article 85, paragraph 3 of Article 115-G, paragraph 8 of Article 115-X, point (f) of paragraph 1 of Article 116, and point (c) of Article 133 of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of December 31, determines the following:

Article 1. Object This Instruction amends Bank of Portugal Instruction No. 18/2020.

Article 2. Amendment to Bank of Portugal Instruction No. 18/2020 1 – Article 1 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 1. […] […] a) […] b) The content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; c) […] d) […] e) The report regarding the appointment of the statutory auditor or statutory audit firm, provided for in point (i) of Article 39 of Bank of Portugal Notice No. 3/2020. f) The report to the competent supervisory authority provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies, equally applicable in the cases provided for in paragraph 4 of Article 109 of the same instrument.”

2 – Article 2 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 2. […] 1 - […] a) […] b) […] c) Description, organized by risk categories to which the institution is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies that are not yet fully corrected: i)[…] ii) Deficiencies detected by supervisory authorities. d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) […] f) Express declarations of the management body and the supervisory body regarding the adequacy of the classification and reclassification assigned to the deficiencies, taking into account the methodology contained in Annex II to this Instruction; g) […] h) […] i)[…] j) Assessment regarding the fulfillment of the conditions provided for in point (a) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent risk management function, description of the mechanisms implemented to comply with the provisions of the same article; k) Assessment regarding the fulfillment of the conditions provided for in point (b) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent compliance function, description of the mechanisms implemented to comply with the provisions of the same article; l) Assessment regarding whether the requirements provided for in paragraphs 7 and 8 of Article 16 of Bank of Portugal Notice No. 3/2020 are met and, if these conditions are met, and the institution chooses to outsource the entire internal audit function, justification for this choice; m) If the institution has chosen to combine risk management and compliance functions into a single structural unit, in accordance with paragraphs 1 and 5 of Article 16 of Bank of Portugal Notice No. 3/2020, assessment by the management body regarding the maintenance of the adequacy of this option in light of the nature, scope, and complexity of the institution's activities; n) Report on the analysis of the management framework for information and communication technology risk, provided for in paragraph 5 of Article 6 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of December 14, 2022; o) Express declarations by the risk management and compliance functions regarding, respectively, the compliance of transactions concluded with related parties with the institution's risk profile, as well as compliance with the policy in force at the institution on the matter and with applicable legislation and regulation. 2 - The reference date for the report referred to in paragraph 1 is September 30 of each year, and the competent supervisory authority may request updated information on its content from institutions at any time, namely status updates on the implementation of measures intended to correct the reported deficiencies.”

3 – Article 3 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 3. […] 1 - For the purposes of the provisions of point (c) of paragraph 1 of the previous article, the description of deficiencies classified at level F3 “high” or level F4 “very high”, taking into account the methodology contained in Annex II, is carried out in the format contained in Table I of Annex III to this Instruction. 2 - For the purposes of the provisions of point (c) of paragraph 1 of the previous article, the description also includes the number of deficiencies classified at level F1 “low” or level F2 “moderate”, taking into account the methodology contained in Annex II, and is carried out in the format contained in Table II of Annex III to this Instruction. 3 - The institution maintains detailed documented information on deficiencies classified at level F1 “low” or level F2 “moderate”, which are made immediately available to the competent supervisory authority upon request. 4 - For the purposes of the provisions of point (d) of paragraph 1 of the previous article, the description is carried out in the format contained in Tables III and IV of Annex III to this Instruction. 5 - [previous paragraph 4] 6 - [previous paragraph 5] 7 - The tables contained in Annex III to this Instruction are available on the BPnet system and are reported to the competent supervisory authority in editable format.”

4 – Article 4 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 4. […] 1 - The parent company of a financial group submits to the competent supervisory authority the annual group self-assessment report, provided for in Article 58 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements: a) […] b) […] c) Description, organized by risk categories to which the financial group is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies identified in the group that remain open, with identification of the entity to which they relate: i) Deficiencies detected within the scope of control actions and assessments carried out by the statutory auditor or statutory audit firm, by the parent company or by any branch; ii) Deficiencies detected by supervisory authorities; iii) […] d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) Express declarations of the management body and the supervisory body of the parent company regarding the adequacy of the classification assigned to deficiencies classified at level F3 “high” or level F4 “very high”, taking into account the methodology contained in Annex II and assessment of the impact that such deficiencies have on the group's internal control system; f) Copy of the multiannual internal audit action plan of the parent company relating to organizational culture and governance and internal control systems of the financial group and indication of the date of the last audit action carried out, with express confirmation that all relevant components of the financial group are included in the plan; g) […] h) […] 2 - For the purposes of the provisions of points (c) and (d) of the previous paragraph, the description of deficiencies is carried out in the format contained in Annex III to this Instruction. 3 - If it considers the justification for excluding the obligation to prepare individual reports insufficient, in accordance with paragraph 7 of Article 58 of Bank of Portugal Notice No. 3/2020, the competent supervisory authority may request its preparation at any time, and the parent company must take this into consideration in the annual group self-assessment report. 4 - The reporting of deficiencies is carried out, in editable format, through the tables contained in Annex III to this Instruction, which are available on the BPnet system.”

5 – Article 5 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 5. […] The management body of institutions that correspond to entities authorized to receive deposits ensures that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 2 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year.”

6 – Article 6 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 6. […] 1 - The management body of institutions not covered by the provisions of the previous article ensures that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including only the elements referred to in points (c) and (d) of paragraph 1 of Article 2 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year. 2 - The institutions referred to in this article submit immediately to the competent supervisory authority the other elements referred to in Article 2, whenever requested to do so.”

7 – Article 7 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 7. […] 1 - The management body of the parent company of a financial group ensures that the annual group self-assessment report, referred to in paragraph 3 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 4 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year. 2 - The provisions of Articles 5 and 6 of this Instruction do not apply to branches of a financial group, applying to them the provisions in the final part of paragraph 5 of Article 54 of Bank of Portugal Notice No. 3/2020.”

8 – Article 8 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 8. […] 1 - The annual report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies must contain: a) A description of the means for receiving, processing, and archiving reports of irregularities provided for in paragraph 1 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; b) […] i) […] ii) […] iii) […] iv) […] v) […] vi) […] vii)[…] viii) Date of completion of the procedure and justification for any extensions of the initially defined deadline; ix) [previous sub-point (viii)] c) […] 2 - […] 3 - […]”

9 – Article 9 of Bank of Portugal Instruction No. 18/2020 shall have the following wording:

“Article 9. […] 1 - The report referred to in the previous article is prepared with reference to September 30 of each year and submitted to the competent supervisory authority by November 15 of each year. 2 - The reports concerning institutions integrated into the Integrated System of Mutual Agricultural Credit are submitted by the Central Mutual Agricultural Credit Society to the competent supervisory authority by December 15 of each year.”

10 – Chapter VI now aggregates the previous Chapters VI and VII and is composed of Articles 10 to 13 of Bank of Portugal Instruction No. 18/2020, which shall have the following wording:

“CHAPTER VI Other reports Article 10. […] 1 - The reporting to the competent supervisory authority of the universe of employees who have a material impact on the institution's risk profile, provided for in point (c) of paragraph 1 of Article 41 of Bank of Portugal Notice No. 3/2020, is carried out by January 31 of each year and includes at least the following elements regarding each employee: a) […] b) […] c) […] d) […] e) Total annual remuneration earned in the year prior to the reporting year, disaggregated between fixed and variable remuneration and calculated in accordance with regulatory technical standards for the purposes of the qualitative and quantitative criteria appropriate to identify the categories of personnel whose professional activities have a material impact on their risk profile. 2 - The provisions of the previous paragraph cover all employees with a material impact on the institution's risk profile, as well as those who meet the quantitative criteria but whose professional activities have been assessed as not having a material impact on the institution's risk profile. 3 - In the case of financial groups, the report is carried out by the parent company and includes all employees with a material impact on the risk profile of the set of institutions, financial or otherwise, integrated into the supervision perimeter on a consolidated basis. 4 - The reporting referred to in this article is carried out in editable format, through the table contained in Annex IV to this Instruction, which is available on the BPnet system.”

Article 11. […] […] a) […] b) […]

Article 12. Reporting of the appointment of the statutory auditor or statutory audit firm Except for Mutual Agricultural Credit Societies that are part of the Integrated System of Mutual Agricultural Credit, institutions authorized to receive deposits submit to the competent supervisory authority, with a minimum advance of 30 days prior to submission to the competent body of proposals for the appointment or election of a statutory auditor or statutory audit firm, evidence of the adequacy of the proposals in light of the requirements established in applicable legislation and regulation, including the internal analysis supporting the selection.

Article 13. Reporting provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies 1 - In cases where, in accordance with the provisions of paragraph 2 of Article 85 and paragraph 4 of Article 109 of the General Regime of Credit Institutions and Financial Companies, the management body of a credit institution considers that the presumption of the indirect nature of the granting of credit to one or more entities covered by that provision has been rebutted, the credit institution submits to the competent supervisory authority, with a minimum advance of 30 days relative to the moment when the credit is granted: a) Certified copy of the minutes of the meeting where such decision was taken, which must contain the description of the operation covered and the grounds for the decision; b) Copy of all information elements, and respective documentation, that served as the basis for the rebuttal of the presumption. 2 - Any project to alter the operations covered by the previous paragraph is, after compliance with the provisions of paragraph 4 of Article 33 of Bank of Portugal Notice No. 3/2020, and in the event that the operation is carried out, communicated by the credit institution to the competent supervisory authority with a minimum advance of 30 days relative to its production of effects.”

11 – Chapter VII now deals with the matters of the previous Chapter VIII and is composed of the previous Article 12 of Bank of Portugal Instruction No. 18/2020, which becomes Article 14, with the following wording:

“CHAPTER VII [heading of previous Chapter VIII] Article 14. [heading of previous Article 12] 1 - The documents reported to the competent supervisory authority under this Instruction are submitted through the BPnet system, regulated by Bank of Portugal Instruction, with the exception of the reports referred to in Articles 11 to 13 of this Instruction. 2 - The reports referred to in Articles 11 to 13 of this Instruction are submitted to the competent supervisory authority by letter or by electronic mail.”

12 – Chapter VIII now deals with the matters of the previous Chapter IX and is compos