Instructions for Compliance Function in Banks

10/2/4/12296 6/12/1427 Hijri 26/12/2006 Instructions for Compliance Number (33/2006) Issued pursuant to the Provisions of Article (99/B) of the Banking Law In view of recent banking developments that emphasize the importance of establishing proper management methodology principles in banks and the importance of mechanisms and frameworks that promote proper practices and maintain correct values and actions in banking, and to assert the outlook of the Central Bank of Jordan in creating a banking system that operates efficiently and competitively and in a manner that abides by international standards, we hereby list instructions for the compliance function that banks are required to observe and take the necessary steps to implement. First: Definitions:

1. Compliance Function: An independent function aimed at assuring the compliance of the bank and its internal policies with all laws, regulations, instructions, orders, codes of conduct, standards, and sound banking practices issued by local and international supervisory authorities that specify, evaluate and extend advice and guidance, as well as monitor and report to the board of directors the extent of the bank’s compliance.
2. Compliance Risks: Risks of legal or regulatory sanctions, financial loss or loss to reputation a bank may suffer as a result of failure to comply with laws, regulations, rules, codes of conduct, and sound banking practices applicable to its banking activities.
3. Executive Management: General managers, their deputies and assistants, advisors and similar positions at the bank or its' subsidiaries. Second: Responsibilities of the Board of Directors and the Executive Management: A. Board of Directors:
4. Approve the compliance policy, evaluate the level of efficiency with which the bank manages compliance risks at least once a year, and revise them upon making any changes.
5. Oversee the implementation of this policy. The Board may delegate this task to an appropriate board level committee.
6. Take the necessary measures to enhance the values of integrity and sound professional practices throughout the bank. Compliance with applicable laws, regulations, instructions, orders and standards should be viewed as an essential means to this end.

B. The Executive Management:

1. Set a written compliance policy and approve it by the board of directors, specifying basic principles to be followed by the management and staff, and explaining the main processes by which compliance risks are to be identified and managed through at all levels of the bank, in addition to reviewing this policy periodically and updating it if need be.
2. Communicate the compliance policy to all departments and bank employees in such a way that each employee who finds outor suspects breaches of the laws, regulations, instructions, orders, or sound banking practices, or non-conformity with work procedures with it shall be required to report this to the Head of Compliance.
3. Assert that appropriate corrective or disciplinary measures have been applied in case non-compliance breaches were discovered, and reporting this to the Board of Directors or the Compliance Committee immediately (especially in cases that subject the bank to legal penalties, large financial losses or reputation losses). Banks should specify the limits at which the Central Bank of Jordan is to be informed, and report each case separately.
4. Adhere to separating the non-compliance function and other internal audit procedures, at the same time the internal audit policies and programs should include auditing compliance function activities.
5. Set a plan, at least once a year, to manage compliance risks in cooperation with the monitoring compliance function. Such plans should address any shortfalls as well as related to how effectively existing compliance risks have been managed, and should identify the need for any additional policies or procedures to deal with new compliance risks identified as the annual compliance risks assessment.
6. Set up a permanent and effective department for compliance function at the bank as part of the compliance policy, whose task is to identify and evaluate basic compliance risks faced by the bank that is consistent with the following principles: A. To be independent from other activities and functions of the bank. B. The function of compliance monitoring should appear on the bank’s organizational structure and should have actual presence. C. Set a clear and organized framework for the responsibilities and procedures that guarantee an effective flow of work in this function and specify its relationship with other departments and functions at the bank. D. Guarantee that enough authority is given to compliance function staff to contact any employee of the bank and inspect files and records, and to access the necessary information that allows them to carry out their responsibilities. E. Availability of authorities to carry out necessary investigations to find out the reasons behind breaches and request assistance from specialists at the bank (legal department, internal audit department) or any other external party without breaching provisions of banking confidentiality as stipulated in the Banking Law.

F. Specify the duties of officials in this function in preparing reports to be submitted to board of directors or its Compliance Committee, with a copy to the executive management. G. Provide the Compliance function with sufficient human resources to allow it to carry out its responsibilities efficiently and effectively. H. There should be a Head of Compliance to carry out comprehensive responsibilities in coordinating the management of compliance risks at the bank, and to be responsible for managing daily duties of the Compliance function, as well as control the activities of Compliance function staff. I. Compliance function staff and the Head of Compliance in particular, should not be tasked with executive functions that conflict with their responsibilities of compliance or other functions assigned to them. J. Staff carrying out Compliance functions should have the following qualities:

1. Qualifications, experience, professional and personal qualities that enable them to carry out their specific duties efficiently.
2. Sound understanding of laws, rules, standards that the bank should comply with, and their impact on the bank’s operations.
3. Keeping up-to-date with developments in laws, rules and standards that the bank should comply with, through regular and systematic education and training. Third: Compliance Function Responsibilities:
4. Assist executive management and the bank staff in managing compliance risks faced by the bank.
5. Advise executive management on laws, rules and standards applied including keeping them informed on any amendments in the area.
6. Provide the board of directors with the results arrived at in the event of a breach of a specific law or policies, and make the necessary recommendations to limit pursuant risks, and provide the executive management with a copy.
7. Evaluate the level of suitability of the bank’s compliance measures and guidelines, follow up on any deficiencies discovered, and formulate appropriate suggestions to effect amendments.
8. Define, document and evaluate compliance risks associated with the bank’s activities according to previously well-studied principles, including compliance risks associated with the development or creation of a new banking product.
9. Educate staff on compliance issues and prepare written guidelines, such as a manual for compliance – that is consistent with the volume, nature and complexity of the bank's operations and internal system - practice guidelines and internal codes of conduct.
10. Assure and adhere to the compliance policy by performing sufficient and representative compliance testing. The results of the compliance testing should be reported up to the board of directors or its committee, and copying the executive management, whereby the reports include the compliance risks

assessment, the tests carried out during the report period, the breaches, the deficiencies exposed, and the corrective measures taken. 8. Prepare a compliance program that sets out its planned activities and duties referred to in items (1-7) above. Fourth: General Provisions:

1. The bank shall provide the Central Bank of Jordan with its policy as approved by the board of directors upon undertaking the implementation of these instructions, upon effecting any amendments, and upon every evaluation.
2. Policies of monitoring compliance by foreign banks operating in the Kingdom and any amendments to them are to be approved by the Regional Director in Jordan, and the Head of Compliance of the group, provided it is presented to the bank’s Board of Directors at a later stage.
3. The Central Bank of Jordan shall be provided with the names, qualifications and expertise of the Head and staff of the compliance function as well as any amendments effected therein.
4. Banks, in light of the size and complexities of their operations, may organize the compliance function in the form of a separate unit or by allocating staff for compliance function in its various departments, keeping in mind the need to avoid any conflict in the duties assigned to them.
5. Banks shall comply with current laws and regulations in all areas in which they operate, and the organization, structure and responsibilities of the compliance function must be in line with the organizational and legal requirements.
6. These instructions shall apply to banks operating in the Kingdom and their subsidiaries. Fifth: These instructions shall come into effect after three months from the date of their issue. The Governor Dr. Umayya Toukan