Instruction No. 77/AMF-UMOA/2023 on the Internal Control and Risk Management Framework of the Regional Securities Market (BRVM)

INSTRUCTION No. 77 /AMF-UMOA/2023

RELATIVE TO THE INTERNAL CONTROL AND RISK MANAGEMENT FRAMEWORK OF THE REGIONAL SECURITIES MARKET (BRVM)

The Financial Markets Authority of the West African Monetary Union,

Having regard to the Revised Treaty of the West African Monetary Union (UMOA) of July 12, 2019, which entered into force on October 1, 2022, modifying the name of the Regional Council for Public Savings and Financial Markets (CREPMF) to the Financial Markets Authority of the UMOA (AMF-UMOA);

Having regard to the Convention of July 3, 1996 establishing the Regional Council for Public Savings and Financial Markets, particularly its Annex regarding the composition, organization, functioning, and powers of the Regional Council for Public Savings and Financial Markets;

Having regard to the General Regulation No. 001/97 of November 28, 1997, relating to the organization, functioning, and control of the regional financial market, particularly Articles 10 and 16;

Having regard to Instruction No. 2/97 of November 29, 1997, relating to the authorization of the Regional Securities Market;

Having regard to Decision No. 004 of April 29, 2021/CM/UMOA appointing the President of the Regional Council for Public Savings and Financial Markets;

Having regard to the deliberations of the AMF-UMOA at its 50th extraordinary session held on September 24, 2021 via videoconference;

Having regard to the deliberations of the AMF-UMOA at its 98th ordinary session held on December 23, 2023, in Cotonou, Republic of Benin;

DECIDES:

TITLE 1. GENERAL PROVISIONS

Article 1 Definitions
For the purposes of this Instruction, the following terms are understood as:

a) Internal Audit: An independent and objective activity that gives an organization assurance on the degree of control of its operations, provides advice to improve them, and contributes to creating added value. Internal audit must evaluate the organization's governance, risk management, and control processes, and contribute to their improvement based on a systematic, methodical, and risk-based approach.

b) Risk Appetite: The level and type of risk that the BRVM is willing to assume in its exposures and activities to achieve its strategic objectives and obligations.

c) Regional Securities Market or BRVM: The company authorized, by Approval from the AMF-UMOA, to exercise on the entire territory of the UMOA States, the activities of listing securities, as well as the dissemination of stock market information.

d) Internal Audit and Compliance Charters: Documents that define the positioning of the internal audit and compliance functions within the approved structure and specify the organization, powers, responsibilities, and operating procedures of said functions.

e) Risk Map: A synthetic and visual representation of the BRVM's risks. It thus constitutes a tool for highlighting risks to be covered as a priority. The risk map is established based on a rigorous system for identifying and evaluating risks inherent to the BRVM from internal factors (business and activities, organizational changes, etc.) and external factors (economic conditions, technological progress, legislative and regulatory changes, etc.).

f) Audit Committee: A committee established by the deliberative body to assist it in the exercise of its missions, and in particular to verify the reliability and transparency of financial information, assess the relevance of accounting methods as well as the quality of the internal control framework and the risk management framework, evaluate the audit strategy and propose, where appropriate, avenues for improvement.

g) Internal Control: Measures put in place by the executive bodies with the aim of ensuring that:

• the objectives set by the BRVM are realistic and achieved;
• resources are used economically and efficiently, and risks are adequately controlled;
• assets are protected;
• financial and management information is complete and reliable;
• laws and regulations as well as internal policies, plans, rules, and procedures are respected.

h) Control Cycle: The interval during which all activities and entities of the BRVM will have been verified at least once by the internal audit function.

i) Internal Control Framework (ICF): The set of rules, methods, and control measures governing the organizational and operational structure of the BRVM. It includes reporting processes and control functions.

j) Control Functions: The functions independent of operational management, whose role is to provide objective assessments regarding the quality and effectiveness of the ICF, governance frameworks, non-compliance risk management, in order to facilitate the control of activities and risks incurred. They notably include the internal audit function, the risk management function, and the compliance function.

k) Risk Management: The set of strategies, policies, and procedures put in place so that any significant risk and any associated risk concentration are detected, measured, limited, controlled, and mitigated, and reported on, in a timely and exhaustive manner.

l) Current Standards: The set of rules governing the exercise of the BRVM's activities, notably:

• legal and regulatory provisions;
• internal codes of conduct and ethics;
• principles for Market Infrastructures issued by the Basel Committee and the International Organization of Securities Commissions (IOSCO).

m) Deliberative Body: The Board of Directors in joint-stock companies or the collegiate body in companies constituted under another form. It is invested with all powers to act in all circumstances on behalf of the BRVM, within the limits of the corporate purpose and powers reserved for the General Meeting.

n) Executive Body: Any committee or structure that contributes to the day-to-day management of the BRVM and ensures the effective implementation of the activity orientation defined by the deliberative body.

o) Audit Trail: A set of internal procedures to ensure the traceability of operations, to justify any information by an original document from which it must be possible to trace back, through an uninterrupted path, to the summary document and vice versa, and to explain the evolution of balances from one accounting closing to another, thanks to the retention of movements affecting accounting items.

p) Compliance Risk: The risk of judicial, administrative, or disciplinary sanction, financial loss, or reputational damage that the BRVM may suffer due to non-compliance with the current standards governing the exercise of its activities.

q) Operational Risk: The risk of losses resulting from deficiencies or failures attributable to processes, people, internal systems, or external events. This notion includes legal risk but excludes strategic and reputational risks.

r) Strategic Risk: The risk that the BRVM's business strategies are ineffective, not well implemented, or not adapted to changes affecting the commercial context.

Article 2 Purpose
This Instruction sets the rules regarding the internal control framework applicable to the BRVM, the objective of which is to:

• verify that the operations carried out, the organization, and internal procedures are in compliance with current legislative and regulatory provisions, professional and ethical standards and practices, as well as the orientations of the deliberative and executive bodies;
• ensure that the orientations, instructions, and limits set by the deliberative body regarding risks are strictly respected;
• ensure the reliability of accounting and financial information, particularly regarding the conditions for collecting, evaluating, recording, preserving, and making this information available.

It also sets the rules regarding risk management applicable to the BRVM, as defined in Article 1 of said Instruction.

Article 3 Scope of Control
The corporate governance of the BRVM integrates an ICF on which the sound and prudent management of the entity must rest. This framework includes:

• the monitoring of the reliability and integrity of financial and operational information and the means used to identify, assess, classify, and report this information;
• the verification of the compliance of operations carried out and the organization with current legislative, regulatory, and prudential provisions, professional and ethical standards and practices, orientations, and decisions of the deliberative and executive bodies, notably regarding risks, powers, and signatures, as well as internal procedures;
• the monitoring and evaluation of the effectiveness of the entity's risk management framework.

The organization of internal control must rely on the control environment, risk assessment, control activities, information and communication, and monitoring.

Article 4 Control Environment
The deliberative body must ensure the establishment of an adequate control environment, which constitutes the framework and structure necessary for the achievement of the internal control framework's objectives.

An adequate control environment implies:

• the commitment of governance bodies to promoting integrity and ethical values within the BRVM;
• the establishment of a culture that highlights, at all levels of the organization, the importance of internal control;
• effective involvement of the deliberative body in monitoring the components of the internal control framework;
• a clear and coherent definition of missions, functions, and responsibilities, including explicit delegations of power regarding limits;
• the existence of competent personnel and a human resource management framework allowing the BRVM to attract, develop, and maintain skills linked to its objectives;
• strong adherence by personnel to the control requirements assigned to them as well as the duty to account for their responsibilities in this matter;
• supervision by each hierarchical manager of the effective application of internal control procedures by their collaborators;
• the definition of qualitative criteria by the deliberative and executive bodies of the BRVM to measure and evaluate the effectiveness of the Internal Control Framework.

Article 5 The Defense Lines of the ICF
The ICF is organized to provide objective assessments of the BRVM's situation, risk control, and the compliance of its functioning with current rules and procedures. It includes:

• permanent first-level control, which corresponds to all controls carried out by operational units and their hierarchy in the context of processing daily operations, constituting the first line of defense;
• permanent second-level control, which corresponds to controls executed by support functions independent of operational units, forming the second line of defense represented by the compliance and risk management functions;
• periodic control, which corresponds to post-facto controls carried out within the framework of an audit plan developed from a risk map, constituting the last line of defense represented by the internal audit function. The audit plan developed through a risk-based approach must be realistic and flexible to allow for the respect of the control cycle and the handling of unforeseen activities. It must regularly be updated to respond to changes in the internal and external environment of the BRVM.

Article 6 Responsibility of the Deliberative Body
The deliberative body is ultimately responsible for the existence of an internal control framework within the BRVM as well as for the proper application of the ICF to the entire organization of the approved structure. It is required to:

• define and validate, at an adapted periodicity, the acceptable level of risk to which the BRVM is exposed, notably by setting acceptable limits for counterparty, liquidity, and market risks as well as by putting in place appropriate frameworks to manage operational and compliance risks;
• ensure the establishment and updating of an organization, policies, and written internal control procedures for the sound and prudent management of the BRVM's activities;
• ensure the separation of incompatible tasks, notably decision-making, holding of assets, recording, and control functions;
• ensure that control functions have appropriate means to execute their missions with full independence.

Article 7 Audit Committee
The minimum prerogatives of the Audit Committee consist of:

• examining the effectiveness of the ICF put in place to identify, assess, manage, and control financial and non-financial risks;
• evaluating the internal audit policy and the control cycle, including the escalation policy upon the materialization of significant risks;
• participating in the selection of Statutory Auditors and examining the conclusions of their work, in accordance with legal and regulatory provisions;
• analyzing the compliance with ethical and accounting principles applied with current professional standards and practices;
• thoroughly examining annual summary statements before their presentation to the deliberative bodies;
• providing governance bodies with reasonable assurance regarding the quality and effectiveness of the internal control framework, governance frameworks, and risk management frameworks to facilitate their control of the BRVM's activities and risks incurred.

It also makes proposals to said bodies to strengthen the effectiveness of these systems and frameworks.

Article 8 Responsibilities of the Executive Body
The executive body is required to put in place an ICF conforming to best practices and to monitor its adequacy and effectiveness. The ICF must be adapted to the BRVM's risk profile.

The executive body ensures that policies and procedures are developed and effectively applied by persons with the necessary competence in this matter and that all concerned persons understand and assume their responsibilities in this regard. It defines escalation criteria in response to the materialization of risks and ensures the implementation of appropriate measures.

It must notably:

• ensure the proper functioning of internal control and risk management frameworks and take necessary measures to remedy, in a timely manner, any deficiency or insufficiency identified;
• inform control functions, in a timely manner, of all new developments, initiatives, projects, products, and operational changes as well as related risks;
• ensure that appropriate measures are taken within the set deadlines to implement all corrective actions resulting from recommendations of internal audit, Statutory Auditors, or the AMF-UMOA;
• promote the independence of control functions and make available the necessary resources to carry out their missions;
• regularly report to the deliberative body on the effectiveness of the internal control framework.

Article 9 Personnel Obligations
Each member of the BRVM personnel must:

• diligently perform all control activities assigned to them;
• have access to all necessary information to notably establish, operate, and monitor the internal control framework.

TITLE 2. COMPLIANCE MANAGEMENT

Article 10 Characteristics of the Compliance Policy
The BRVM must equip itself with a compliance policy that, notably:

• ensures respect for the fundamental principles set by the deliberative body;
• establishes the compliance function within the BRVM;
• prescribes the development of a compliance charter;
• specifies the fundamental aspects of compliance risk;
• establishes the responsibilities of governance bodies in implementing the compliance risk management framework;
• institutes a continuous training program for employees and all those responsible for implementing and monitoring the compliance policy.

Article 11 Compliance Charter
The compliance charter must notably:

• state the objectives of the compliance function, establish its independence, and define its responsibilities and competencies;
• clearly describe the relationships of the compliance function with other control functions and BRVM services that perform tasks related to its responsibilities;
• grant the compliance function the right to communicate with any member of personnel and to access any physical or electronic file necessary for the exercise of its responsibilities;
• confer upon the compliance function the power to initiate investigations;
• formalize the tasks and obligations of the compliance function that can be delegated to other BRVM services and functions or outsourced to external providers;
• define the conditions under which the compliance function can resort, if necessary, to external experts.

The compliance charter must reflect developments recorded in current standards. The BRVM is required to update it as soon as possible to take these changes into account.

Any project to outsource the compliance function must be approved by the deliberative body and submitted for authorization from the AMF-UMOA before its implementation.

Article 12 Independence
The compliance function must be independent of the units it controls. To ensure the independence of this function, the executive body must ensure the establishment of an organizational framework free from conflicts of tasks and functions. Furthermore, the resources dedicated to it must not be in a situation of conflict of interest.

Article 13 Resources
The compliance function must have access to the deliberative and executive bodies to report. It must be adapted to the size of the BRVM, the nature and complexity of its activities, as well as its risk profile.

The BRVM must designate a head of the function responsible for coordinating the organization-wide management of compliance risk as well as for supervising the activities of the function. The head of the compliance function must have proven experience in audit and compliance.

Article 14 Competence
The human resources assigned to the compliance function must possess a high level of knowledge of the BRVM's activities and the standards applicable to it.

The BRVM must take provisions so that these human resources keep their knowledge of said standards up to date.

Article 15 General Responsibilities
The compliance function is responsible for assisting the executive body in identifying and diligently managing any risk of non-compliance by the BRVM with the obligations imposed on it by current standards governing the exercise of its activities.

Article 16 Specific Responsibilities
The specific responsibilities of the compliance function consist notably of:

• identifying and communicating to all concerned personnel the current standards governing the exercise of the BRVM's activities;
• proactively identifying, assessing, and managing compliance risks, including during the development of new products or markets, activities, or issuer and member relationships with BRVM services.

Furthermore, if the BRVM has a Committee for New Products or Markets, the compliance function must be represented there.

The compliance function must also:

• centralize and analyze all breaches of current standards and the compliance policy;
• recommend corrective measures to remedy identified breaches and insufficiencies;
• monitor the implementation of all its recommendations;
• evaluate the adequacy of the compliance policy, with regard to developments recorded in the BRVM's activities, current standards, and based on identified insufficiencies. It must, where appropriate, formulate amendment proposals;
• ensure diligent implementation of the compliance policy. The compliance function must ensure that the rules established in the compliance policy are translated into procedures, compliance manuals, and internal controls for areas directly falling under the compliance function. Areas of intervention directly falling under the compliance function notably include the fight against money laundering and terrorist financing as well as the protection of the interests of issuers and investors.

Furthermore, other prerogatives compatible with its missions may be entrusted to it, notably ensuring liaison with external regulatory and standardization bodies.

The compliance function must be involved and consulted prior to the establishment of internal control procedures.

It must constantly ensure that the BRVM's compliance policy is respected at all levels of the organization, notably:

• Sensitizing and training personnel: The compliance function must initiate actions aimed at sensitizing and training personnel on the importance of adopting current standards and respecting the compliance policy. It establishes and implements, for this purpose, a training program for personnel.
• Documenting its work: The compliance function is required to document all its work to guarantee the traceability of its interventions and conclusions.

Article 17 Detection of Compliance Anomalies
All significant compliance anomalies and deficiencies that would constitute a breach of AMF-UMOA regulatory provisions must be the subject of specific documentation addressed to the BRVM's deliberative body and to the AMF-UMOA.

Reports from the compliance function containing findings implicating management cannot be modified by the latter.

However, the persons implicated may formulate observations on the findings drawn up. The observations formulated must be attached to the control report.

Non-compliance with these provisions exposes offenders to sanctions provided for by regulation, without prejudice to criminal sanctions.

Article 18 Control of the Compliance Function by the Internal Audit Function
The activities of the compliance function must be subject to periodic review by the internal audit function. To avoid any conflict of responsibility and function, the compliance function cannot be part of the internal audit function.

Article 19 Reporting by the Head of Compliance to the Governance Bodies
The head of the compliance function must communicate significant compliance incidents and breaches of the compliance policy to the governance bodies as soon as possible. He or she reports to the deliberative body or a specialized committee to which he or she is attached, at least once a year, on the execution of his or her mission. He or she produces a semi-annual report on the assessment of compliance risk. This report must be adapted to the risk profile and activities of the BRVM and cover in particular:

• the achievements of the compliance function, with regard to the objectives set for it;
• the human and material resources deployed to achieve its objectives;
• the mapping of compliance incidents across the BRVM, highlighting the main shortcomings identified, corrective measures taken, and follow-up carried out.

TITLE 3. RISK MANAGEMENT

Article 20 Principle of Proportionality
The BRVM must put in place a risk management framework enabling it to fully manage legal, counterparty, liquidity, and operational risks, as well as any other risks.

Article 21 Strategies, Policies, and Procedures
The risk management framework must be based on well-documented strategies, policies, and procedures that allow for the identification, measurement, assessment, monitoring, reporting, and control of all significant risks of the BRVM.

The strategies, policies, and procedures must be dynamic, so as to reflect the evolution of the BRVM's risk appetite, its risk profile, as well as market conditions and the macroeconomic environment.

The BRVM must ensure the implementation of strategies, policies, and procedures enabling a global view, at the organization level, of its exposures to each type of risk.

Article 22 Risk Mapping
The risk management framework must include a risk map validated by the deliberative body, which lists, assesses, and prioritizes all risks of the BRVM. The BRVM is required to put in place this steering tool in order to ensure good management and adequate monitoring of risks. The updating of the map must be dynamic, with a global review at least once a year.

Article 23 Risk Culture
The BRVM must encourage the development of risk culture at all levels of its organization, in particular through training and awareness-raising actions for its staff.

Article 24 Risk Appetite and Limit Management
The BRVM must put in place a risk appetite framework approved, supervised, and reviewed annually by the Board of Directors and implemented by the executive body. The BRVM is also required to:

• set global limits and operational limits at the level of its different entities. These limits must be established in a coherent manner, in accordance with the BRVM's risk appetite, its risk profile, and its financial base;
• ensure that the relevant staff properly understand these limits and that regular internal communication takes place;
• put in place a framework for identifying and managing limit breaches, including a procedure for reporting breaches to the appropriate hierarchical level, regularization, monitoring of regularization, and sanctions in the event of persistent breaches;
• clearly define the procedure to be followed to submit, diligently, to the examination and authorization of the competent bodies, cases of exceptions to the established policies, procedures, and limits.

Article 25 Information Systems
The BRVM must put in place information and risk control systems that allow it to obtain in due time the information necessary for the implementation of risk management policies and procedures.

To this end, the BRVM must put in place a risk data governance framework, an architecture for risk-related data, and an IT infrastructure.

The information systems put in place by the BRVM should, in particular:

• allow, both in normal situations and during crisis periods, to precisely measure and aggregate risk exposures across the entire BRVM in due time, to manage individual risk exposures, as well as their interdependencies, and to assess the impact of various economic and financial shocks that could affect it;
• monitor its exposures to identified risks;
• adapt to measure and evaluate the size, composition, and quality of risk exposure at the BRVM level and for all types of risks, products, and counterparties;
• ensure the availability, quality, reliability, and integrity of data;
• guarantee the timely transmission to the governance bodies of all relevant and useful information for their decision-making.

Article 26 Crisis Simulation
The BRVM must establish crisis simulation programs for risk management purposes, in order to assess the potential impact of severe but plausible adverse scenarios on its financial soundness.

These programs must include all significant risks to which the BRVM is exposed. They must, furthermore, provide for corrective measures when the results of crisis simulations reveal potential weaknesses that could have a negative impact on the financial soundness of the BRVM.

Article 27 Roles and Obligations of the Governance Bodies
The governance bodies must in particular:

• ensure that the BRVM is equipped with a risk management framework compliant with the provisions of this Instruction;
• put in place a risk management function covering all significant risks, at the BRVM level, and having attributions distinct from those of the operational units;
• preserve the existence of an independent risk management function equipped with the necessary resources as well as sufficient authority to carry out its missions;
• fully exercise the responsibilities assigned to them in matters of risk, in accordance with the provisions set out in the Instruction on the Governance of the Regional Securities Exchange.

Article 28 Roles and Obligations of the Risk Management Function
The risk management function must in particular:

• apply the risk strategy approved by the deliberative body and ensure the development of all policies and procedures related to risk management;
• contribute to the effective implementation within the BRVM of an integrated risk management framework supported by reliable governance involving the governance bodies;
• identify, assess, monitor, and control all significant risks in a timely manner;
• improve the systems, policies, processes, and reports related to risk management;
• develop and implement, subject to examination and approval by the deliberative body, the risk management framework, which includes risk culture at the BRVM level, risk appetite, and limits;
• put in place an early warning system aimed at detecting cases of breach of the risk appetite and limits set by the deliberative body;
• steer or even veto any decision that generates significant risk-taking for the BRVM, report to the governance bodies on all these matters, and propose appropriate measures to mitigate these risks.

The risk management function must not be involved in operational activities, in particular those that generate revenue. It must maintain its independence vis-à-vis the operational entities, while working in close collaboration with them.

The human resources assigned to the risk management function must possess a high level of knowledge of the BRVM's activities, all risks to which it is exposed, as well as the manner in which these risks are managed. The BRVM takes provisions so that these human resources keep their knowledge of risk management up to date.

Article 29 Head of the Risk Management Function
The head of the risk management function must have proven experience in the field. He or she is in particular responsible for:

• monitoring the development and implementation of the risk management framework;
• constantly strengthening the skills of his or her teams;
• providing assistance to the deliberative body or the risk committee, where applicable, when determining and monitoring risk appetite and limits;
• participating, jointly with the executive body, in the monitoring of risk performance and compliance with limits.

The head of the risk management function must be involved in key decision-making processes related to strategic planning, capital and liquidity planning, the development and implementation of the remuneration system, new products, services, and markets, as well as important strategic initiatives and operations.

Article 30 Risk Control
The BRVM's risk management framework must integrate rigorous internal controls, adapted to the scale, nature, and complexity of its exposures. This framework must also be subject to annual review by internal audit and statutory auditors, who independently assess the effectiveness of the BRVM's risk assessment and measurement systems and processes.

Article 31 Reporting to the Deliberative Body
A report on the nature and level of exposure to each type of risk incurred by the BRVM, as well as its capital and liquidity needs, must be submitted to the deliberative body at least once per semester. This report, based on reliable and up-to-date information, must also report in particular on:

• the nature and level of the BRVM's concentration risk exposure, including in particular exposures by counterparty, sector, and geographic zone;
• major operational loss events;
• transactions with related parties, including non-performing loans and uncollectible receivables;
• highlights related to each type of risk identified in the BRVM's risk map.

Article 32 Operational Loss Events
Operational loss events or operational incidents must be classified into one of the seven categories defined below, in order to ensure consistency at the level of identification, assessment, and setting of operational risk management objectives at the BRVM level:

1. internal fraud: risk of losses due to intentional acts, involving at least one internal party to the BRVM, aimed at defrauding, misappropriating assets belonging to the BRVM or its clients, manipulating information, circumventing regulations, legislation, or the BRVM's policy;
2. external fraud: risk of losses resulting from acts by a third party aimed at defrauding, misappropriating assets belonging to the BRVM or its clients, manipulating information, or circumventing legislation;
3. employment practices and workplace safety: risk of losses arising from acts non-compliant with legislation or conventions related to employment, health, or safety, including disputes or disagreements between the BRVM and its employees;
4. client, product, and business practices: risk of losses resulting from unintentional failure or negligence in meeting professional obligations towards clients, or from a failure attributable to the nature or design of a given product;
5. damage to physical assets: risk of losses related to destruction or damage resulting from natural disasters or external causes;
6. business interruption and system failures: risk of losses resulting from business interruptions or malfunctions of technological systems;
7. execution, delivery, and process management: risk of losses related to a failure in the processing of a transaction or in the management of processes and losses incurred in the context of relationships with commercial counterparties and suppliers.

Article 33 Collection of Operational Loss Data
The BRVM must collect data related to operational loss events. The process relating to it must be documented and updated periodically. The collected loss data must meet certain minimum criteria, in order to standardize the collection process across the BRVM as well as across the financial market and facilitate comparative analyses. Losses must be direct, intact, integral, and traceable:

• a loss is direct when the event had a recognized negative direct impact on the BRVM's results and, consequently, was accounted for. This consists of all internal and external expenses/incurred by the BRVM that would not have been incurred without the event. Opportunity costs and lost revenues related to the event, costs related to modifications made to a process or the addition of post-event controls, costs of reactive or proactive investment programs related to the event are not considered direct;
• data integrity means that the data accurately represent operational losses;
• data integrity (completeness) means that the data include all operational losses suffered by the BRVM, including those related to credit and market risks, up to the collection threshold approved by the deliberative body;
• traceability stems from the fact that the completeness and integrity of the data are ensured by their reconciliation with appropriate accounting entries and by their validation by the BRVM's head.

Each event causing losses must be documented and stored in a database, in compliance with the policies defined by the BRVM regarding data retention. The documentation must include, among other things, the internal file reference, the category of operational loss events, the type of risk, the description of the incident, as well as the entities or business lines concerned, where applicable.

Article 34 Operational Risk Management Tools
Operational risk management must cover all seven categories of operational loss events cited in Article 32. To identify and assess operational risk, the BRVM may use in particular the following management tools:

• operational risk self-assessments;
• operational process mapping;
• risk and performance indicators for monitoring operational risk and internal control framework effectiveness indicators;
• analyses of operational loss events both inside and outside the BRVM;
• risk analyses specific to each product, process, and system in place;
• scenario analyses.

The tools put in place must be used uniformly across all units to achieve a complete assessment of operational risk exposure.

Article 35 Control and Mitigation of Operational Risk
The BRVM must take preventive measures to reduce operational losses resulting from deficiencies related in particular to:

• documentation, updating, and compliance with procedures;
• securing the BRVM's assets and their use;
• upgrading skills and employee training;
• regular verification and reconciliation of operations and accounts;
• the development, implementation, and updating of a physical and logical security framework for the information system and telecommunications infrastructure;
• adequate coverage of values by insurance policies.

Article 36 Management of Risks Related to New Products, Processes, Systems, and Activities
The operational risk management framework must, among other things:

• take into account the identification and assessment of risks inherent to new products, new activities, major acquisition operations, as well as those resulting from changes in systems, processes, or business models;
• allow for the identification of the most significant among them and the appreciation of the BRVM's vulnerability to these risks;
• take into account both internal and external factors that could prevent the BRVM from achieving its objectives.

The procedures and policies put in place must allow for understanding and managing these new risks. This process must take into account in particular:

• the inherent risks related thereto;
• the modifications to the risk profile and the resulting risk appetite;
• the necessary controls, risk mitigation strategies and processes, as well as residual risk.

Article 37 General Principles on Outsourcing
The use of outsourcing does not relieve the BRVM's governance bodies of their obligations regarding the compliance of contracts with the legal and regulatory requirements applicable to outsourced activities. Furthermore, it does not exempt them from their obligations towards all stakeholders, in particular members, Statutory Auditors, and Supervisory Authorities. It does not modify the conditions for exercising the authorization.

Before entering into an outsourcing contract, the BRVM must evaluate its appropriateness and conduct a thorough assessment of the related risks. This contract must be submitted for prior approval by the deliberative body, which must in particular:

• examine, at least twice a year, the complete list of outsourcing contracts;
• familiarize itself with the execution reports of said contracts transmitted to it by the executive body.

The BRVM must ensure that contractual provisions allow:

• the provision to Statutory Auditors and AMF-UMOA of all information necessary for the exercise of their controls;
• the keeping of accounting records as well as the production of reporting statements in accordance with current provisions;
• the preservation of information system security and the confidentiality of information;
• the protection of the consumer and investor privacy.

All physical and electronic data of the BRVM must be available in the UMOA, notwithstanding outsourcing and any provision taken as part of their backup and business continuity plans. To this end, the following must be kept and permanently accessible in the UMOA:

• IT servers storing data and hosting applications;
• all physical files related to personnel, assets, market operations and related matters, as well as all other transactions carried out by the BRVM;
• archives and various documents during the period set by legal and regulatory provisions.

In the absence of primary servers in the UMOA, secondary backup servers must be available in the Union with replication of all data.

Any outsourcing contract project must be submitted for prior assessment by AMF-UMOA before implementation. Furthermore, AMF-UMOA reserves the right to order the realization of an external audit of the service provider.

Article 38 Service Contract
The outsourcing of an activity must be based on solid contracts and/or service agreements, which must in particular specify unequivocally:

• a detailed description of the outsourced activities, the nature and scope of the expected services as well as the costs borne by the BRVM;
• the respective duties and obligations of the service provider and the BRVM;
• the type and frequency of information that the BRVM receives from the service provider;
• the BRVM's assets that the service provider may use, namely data, hardware, software, or intellectual property;
• termination conditions, including the service provider's notice period and the requirement to return the BRVM's assets within the set deadlines;
• measures to be taken by the service provider to guarantee the continuity of the assigned activity in the event of events that could prevent the provision of expected services;
• qualitative and quantitative performance indicators allowing the BRVM to evaluate the service provider's performance at least once a year.

The contract must contain necessary clauses regarding confidentiality, professional secrecy, and intellectual property. It must be submitted for a legal opinion before any approval by the deliberative body.

Article 39 Service Provider Assessment
Prior to the conclusion of any outsourcing contract, the BRVM is required to conduct a thorough assessment or due diligence of the service provider's technical, financial, and operational capacity.

This assessment must be updated at least once a year as well as upon the renewal and renegotiation of the outsourcing contract. It must be documented.

Article 40 Management of risks related to outsourcing
The BRVM is required to:

• adopt policies and procedures that define the terms of outsourcing and enable it to adequately identify, measure, mitigate, and control risks related to outsourcing;
• integrate outsourced activities into its internal control framework;
• possess internal competencies enabling it to monitor the operational management of the outsourcing contract and the assessment of received services;
• have a contingency and business continuity plan for outsourced activities aimed at ensuring the BRVM's operational continuity following the termination of the outsourcing contract, or the provider's inability to honor its commitments, or a voluntary decision by the BRVM to repatriate outsourced activities;
• ensure adequate monitoring of outsourced activities and ensure that the provider conducts regular control of its business continuity plan in case of failure and has the required competencies and resources to correct them;
• produce, in the internal audit report, a summary of the results of controls performed related to outsourced activities.

TITLE 4. EXERCISE OF INTERNAL AUDIT

Article 41 Establishment of the internal audit function
The BRVM must establish an internal audit function that has sufficient status, competencies, resources, and authority to execute its missions effectively and objectively. The mission, powers, and responsibilities of internal audit are described in an internal audit charter that is an integral part of the BRVM's internal procedures.

It adopts a systematic and disciplined approach to control actions based on a control plan established from a map listing the risks it incurs.

Article 42 Responsibilities of the internal audit function
The internal audit function assists the members of the deliberative and executive bodies respectively in their mission of supervision and management. To this end, it must in particular:

• have an internal audit charter, control procedures, and a code of ethics;
• have a clear mandate independent of the audited activities, including the activities of other control functions;
• adopt efficient tools enabling it to perform risk-based surveillance of all BRVM activities as well as monitoring the implementation of recommendations, classified by degree of criticality;
• benefit from complete access to all physical and electronic data necessary for the accomplishment of its mission;
• perform a periodic evaluation of the effectiveness of all other control functions, notably the risk management and compliance functions;
• conduct periodic reviews of the responsibilities and functions of persons holding key positions, to ensure that these managers are not able to conceal inappropriate conduct.

Article 43 Competencies and professional awareness
Internal auditors must possess the knowledge, skills, and other competencies necessary for the exercise of their individual responsibilities. The internal audit team must collectively possess or acquire the knowledge, skills, and other competencies necessary for the exercise of its responsibilities.

The head of internal audit is required to seek the advice and assistance of qualified and independent resources if internal auditors do not possess the knowledge and skills necessary to carry out part of their mission.

Internal auditors must bring to their work the diligence and know-how expected of a reasonably informed and competent internal auditor. Professional awareness does not imply infallibility.

The internal audit function must be equipped with competencies in the area of infrastructure and information system security to better understand the controls required in this matter.

Article 44 Appointment of the Head of the internal audit function
Upon proposal of the executive body, the deliberative body appoints a Head of the internal audit function who must have functional independence and enjoy extended prerogatives regarding the scope of his interventions and the communication of his work to said bodies.

To consecrate this independence, the Head of the internal audit function must, at least, be functionally attached to the deliberative body, to which he reports.

Article 45 Revocation of the Head of the internal audit function
The BRVM is required, within fifteen (15) days after revocation, to inform the AMF-UMOA, indicating the reasons.

Article 46 Responsibility of the Head of the internal audit function
The Head of the internal audit function is responsible for managing the Internal Audit function. He must be attached to a level of the organization that allows the internal audit function to exercise its responsibilities.

He is responsible for drawing up the control plan based on the risk map, getting involved in its implementation, ensuring respect for the control cycle, and ensuring the quality of the function's work. He verifies that identified internal control anomalies and deficiencies are documented in a written report.

He drafts the internal audit charter, ensures its regular revision, and disseminates it to all stakeholders after its approval by the deliberative body through the audit committee.

The head of internal audit must, at least once a year, confirm to the Board the independence of the audit within the organization.

The head of internal audit must communicate and dialogue directly with the Board of Directors.

The Head of the internal audit function may, if this does not entail a conflict of interest:

• be involved upstream in projects to proactively identify and evaluate potential non-compliance issues and risks;
• help sensitize and train staff and provide guidance to personnel members regarding the appropriate application of laws and regulations.

Article 47 Internal audit charter
The head of internal audit must draft and revise, at least every three years, the internal audit charter and submit it for approval by the deliberative body through the Audit Committee before its implementation.

The internal audit charter specifies the position of the internal audit function within the BRVM's organization, its mission, its powers, its obligations, and its scope of intervention. It defines the characteristics of the function and its mode of operation and communication with persons not belonging to the function.

Article 48 Audit plan
The head of the audit function must establish an annual or multi-annual audit plan based on risks. He must also communicate to the deliberative body, for examination and approval, his audit plan, his needs, and any significant changes likely to occur during the fiscal year. This plan, established from a risk map of the BRVM, must in particular:

• rely on a rigorous assessment of risks related to all its activities and entities;
• integrate the assessment of human, material, and financial resources necessary for the implementation of planned actions;
• be realistic and flexible to allow respect for the audit cycle and the handling of unforeseen activities;
• be updated to respond to changes in its internal and external environment.

The internal audit function may initiate missions not included in its control schedule when particular circumstances require it, or upon request of the deliberative body, specialized Committees, or the General Director.

Article 49 Audit trail
The internal audit function must guarantee the existence of an audit trail as defined in o) of Article 1 and ensure compliance with the provisions of the accounting reference framework. The constituent elements of the audit trail must be retained for at least ten (10) years.

Article 50 Maintenance and security of computerized data
The internal audit function must include internal procedures for backup and recovery of systems using computerized data, appropriate development and maintenance policies for these systems, as well as physical and logical access security controls.

Article 51 Review of the audit report by the Audit Committee
Internal audit reports are brought to the attention of the Audit Committee to be subject to adequate examination and follow-up.

TITLE 5. REPORTING TO THE AMF-UMOA

Article 52 Semi-annual and occasional reporting to the AMF-UMOA
The BRVM must transmit to the AMF-UMOA, by August 15 at the latest, a consolidated semi-annual report presenting by category the work carried out by the compliance, risk management, and internal audit functions.

In addition, the BRVM informs the AMF-UMOA without delay of all deficiencies identified by the control functions and having a significant impact on the BRVM's reputation and/or its financial solidity.

Article 53 Annual reporting
The BRVM must transmit to the AMF-UMOA, by May 15 at the latest, for the previous fiscal year, a consolidated annual report presenting by category the work carried out by the internal control functions.

This report must previously be validated by the BRVM's deliberative body.

Article 54 Content of internal audit reports
The presentation format of internal audit reports intended for the AMF-UMOA is specified by an AMF-UMOA Circular.

TITLE 6. TRANSITIONAL AND FINAL PROVISIONS

Article 55 Transitional provisions
The Regional Securities Exchange has a maximum period of two (02) years from its signature date to comply with the provisions of this Instruction.

Article 56 Sanctions
Non-compliance with the rules provided by this Instruction is sanctioned by the AMF-UMOA, in accordance with the regulatory provisions in force on the Regional Financial Market of the UMOA.

Article 57 Publication and entry into force
This Instruction, which will be published wherever necessary, repeals all prior contrary provisions and enters into force from its signature date.

The BRVM is required to transmit a copy to all members of the deliberative body and to the Statutory Auditors.

Done in Abidjan, on DEC. 29, 2023

For the UMOA Financial Markets Authority
The President

Badanam PATOKI