Instructions for the Internal Capital Adequacy Assessment Process

Contents Subject Page Chapter One: Pillar 2 of the Basel Committee on Banking Supervision Regulations........................................ 2 First: The Two Main Axes of Pillar 2 of the Basel Committee on Banking Supervision Regulations....................2 Second: The Principle of Proportionality.....................................................................................................4 Chapter Two: Internal Capital Adequacy Assessment Process.............................................................5 Scope of Application of the Internal Capital Adequacy Assessment Process.....................................................6 Frequency of Submitting the Internal Capital Adequacy Assessment Process Document.....................................................6 Governance of the Internal Capital Adequacy Assessment Process..................................................6 The Internal Capital Adequacy Assessment Process as an Integral Part of the Comprehensive Management Framework....................8 Identifying All Material Risks and Considering Them in the Internal Capital Adequacy Assessment Process........10 Risk Measurement Methodologies for the Purpose of the Internal Capital Adequacy Assessment Process.......................10 Capital Adequacy Assessment........................................................................................12 Capital Planning.............................................................................................13 Stress Testing................................................................................................14 Periodic Review of the Internal Capital Adequacy Assessment Process...........................................15 General Provisions.....................................................................................................16 Appendix No. (1) Risks to be Measured..........................................................................17 Appendix No. (2) Report Components....................................................................................20

Chapter One Pillar 2 of the Basel Committee on Banking Supervision Regulations (Pillar 2 Supervisory Review Process) In the Central Bank of Jordan's pursuit of applying international best practices in banking supervision, Pillar 2 is being implemented as a complement to Pillar 1, in accordance with the Basel Committee on Banking Supervision framework. Pillar 2 aims to develop and utilize the best techniques for risk management in terms of monitoring and dealing with them, in addition to ensuring that banks maintain sufficient capital to meet all risks associated with their business. This is achieved by strengthening the link between the bank's risk profile, its risk management and mitigation systems, and its capital planning, such that the bank's management bears the responsibility for ensuring the bank holds sufficient capital to cover its risks beyond the minimum required limits. First: Pillar 2 is divided into two main axes First Axis (Relates to Banks) Banks are expected to establish sound, effective, and comprehensive procedures for assessing the size, types, and distribution of capital, and strategies for maintaining it continuously, in proportion to the risks they are exposed to or may be exposed to, in accordance with the Internal Capital Adequacy Assessment Process (ICAAP), and within a robust governance and internal control framework. Accordingly, every bank must continuously have mechanisms and work procedures to ensure this. Second Axis (Relates to the Supervisory Review Process, “SRP”) This axis is concerned with verifying that banks have sound arrangements, strategies, processes, and management mechanisms for the risks they are exposed to or may be exposed to – including those arising from stress testing results and systemic risks – and ensuring the existence of adequate capital and liquidity levels. Accordingly, and within this framework: The Central Bank will assess the effectiveness of banks' assessment of their capital needs relative to their risks and their adopted strategies, evaluate their ability to monitor and ensure compliance with capital adequacy requirements, and take necessary actions in light of the results of the Supervisory Review Process. The Central Bank expects banks to operate with capital adequacy ratios higher than the prescribed minimum limits, and may require banks to operate with capital adequacy ratios exceeding those limits, both at the individual bank level and/or at the aggregate banking sector level. The Central Bank will intervene at early stages to prevent capital from falling below the minimum required levels to face the risks the bank is exposed to, and will require immediate actions to address this in accordance with the provisions of Banking Law No. (28) of 2000 and its amendments, and any instructions issued thereunder in this regard. Furthermore, within the framework of the Supervisory Review Process (SRP), the Central Bank will assess the bank's Business Model Assessment, Governance and Risk Management Assessment, Assessment of Risks to Capital, and Assessment of Risks to Liquidity and Funding. The Supervisory Review Process will include dialogue between the Central Bank and the bank. The dialogue will primarily address the outcomes of the Supervisory Review Process, including several axes such as assessed risks during the Internal Capital Adequacy Assessment Process and their measurement methodologies and results, the bank's capital structure and capital planning, stress testing and its results, and any material matters affecting the results of the Supervisory Review Process. Based on the results of the Supervisory Review Process, the Central Bank will do the following: Take appropriate corrective actions. Subject the bank to an additional capital increase (Bank-Specific Pillar II Capital add-on) as determined by the Central Bank, where this requirement increases the minimum capital requirements for banks and for each bank individually. Oblige the bank to prepare and/or implement a satisfactory Capital Restoration plan and/or strengthen its capital to meet additional risks resulting from the review process. In addition to what is stated in item (6), the Central Bank, based on continuous follow-up and supervisory procedures, will intensify supervision of the bank and oblige it to take some or all of the corrective actions stipulated in the Banking Law and any instructions issued thereunder (including activating early intervention procedures) in this regard, in addition to obliging it to take one or more of the following actions: Strengthen the systems, procedures, and processes related to risk management and internal controls of the bank. Strengthen the Internal Capital Adequacy Assessment Process. Reduce risks, including imposing restrictions on/or prohibiting certain operations or branching. This is in case weaknesses or indicators of weakness are identified in the bank, including: Excessive risk-taking. Weakness in risk culture and governance. Unsound lending practices. Structural imbalances in the bank's liquidity management. Non-compliance with legislation and supervisory requirements. High concentration in the bank's portfolio (credit and/or investment). Breaches of approved bank policies and procedures. External factors, including risks of presence in specific geographical areas. Second: The Principle of Proportionality (Proportionality) This is considered one of the most important principles in the Supervisory Review Process, as the Central Bank will adopt the principle of proportionality and risk-based supervision principles during this process. The same applies to banks, where each bank must conduct the Internal Capital Adequacy Assessment Process taking into account the principle of proportionality, without affecting the importance and effectiveness of the Internal Capital Adequacy Assessment Process. This principle of proportionality will take into account at a minimum the following aspects: The nature, size, and complexity of the bank's business, the systemic importance of the bank, and the size of its customer base. The quality of the bank's products and services it provides. The bank's risk profile, including its external spread and the size of its external presences, and the extent to which it carries out high-risk operations. The adequacy of the organizational structure to ensure effective risk management and achieve effective supervision.

Chapter Two Internal Capital Adequacy Assessment Process (Internal Capital Adequacy Assessment Process, “ICAAP”) The Internal Capital Adequacy Assessment Process is an important input into the Supervisory Review Process (SRP), as it contributes to the Pillar 2 assessment process. Thus, a good internal assessment process reduces uncertainty regarding the assessment of risks the bank is exposed to or may be exposed to, and gives the Central Bank a higher level of confidence in the bank's ability to continue operations by maintaining sufficient capital and/or effectively managing its risks. This part of the instructions regulates the general provisions for conducting the Internal Capital Adequacy Assessment Process by banks in a way that contributes to improving this process, with a focus on specific key aspects from a supervisory perspective. It does not aim to define detailed requirements for all aspects related to the Internal Capital Adequacy Assessment Process, as the adequacy of applying this process in line with the bank's specific circumstances remains the bank's responsibility. These instructions are the minimum that banks must adhere to, in addition to being guided by papers issued by the Basel Committee on Banking Supervision and any subsequent papers issued by it, and observing international best practices in this regard. The Internal Capital Adequacy Assessment Process aims to ensure the availability of adequate capital levels consistent with the bank's risk profile, taking into account the effectiveness of risk management procedures, the adequacy of internal control systems, strategic planning, and the operating environment. The Internal Capital Adequacy Assessment Process must be forward-looking and comprehensive for all risks. The Internal Capital Adequacy Assessment Process is not just a report prepared by the bank; it is a rigorous process characterized by the following: Effective oversight by the bank's Board of Directors, Senior Executive Management, and relevant committees. Sound capital assessment. A comprehensive process for identifying, assessing, measuring, mitigating, controlling, monitoring, and timely reporting of risks. Effective and comprehensive internal control and oversight systems. Appropriate information management systems at the business lines level and at the bank level (banking group). Monitoring and reporting. Accordingly, the Central Bank expects the bank regarding the Internal Capital Adequacy Assessment Process to do the following: Design the general framework for the Internal Capital Adequacy Assessment Process in line with the size and quality of risks and plan capital accordingly. Define the functions and departments involved in designing and preparing the elements and stages of the Internal Capital Adequacy Assessment Process, and reviewing them, including the independent verification process. Develop Internal Capital Adequacy Assessment Process procedures. Ensure the comprehensiveness and suitability of the internal assessment process with the nature of risks associated with the bank's activities and the circumstances in which it operates, from inception and continuously. Prepare the Internal Capital Adequacy Assessment Process document, ensuring at a minimum compliance with the requirements contained in these instructions. Despite the relationship between the capital held by the bank to face its risks and the strength and effectiveness of its risk management and internal control processes, increasing capital should not be seen as the only option for dealing with increasing risks facing the bank. Other methods must be considered, such as strengthening risk management, improving internal control methods, setting internal limits, and supporting and strengthening provisions and reserves. Therefore, capital should not be considered a substitute for inadequate internal control processes and risk management processes. Scope of Application of the Internal Capital Adequacy Assessment Process All banks operating in the Kingdom must comply with the application of the Internal Capital Adequacy Assessment Process. All Jordanian banks must apply the Internal Capital Adequacy Assessment Process at the following levels: Banking group. Branches in Jordan and abroad. Branches in Jordan. Frequency of Submitting the Internal Capital Adequacy Assessment Process Document All banks operating in the Kingdom must provide the Central Bank with the results of the Internal Capital Adequacy Assessment Process annually, by the end of April each year at the latest, and it must be approved by the Board of Directors for Jordanian banks, and by the Regional Manager for foreign bank branches operating in the Kingdom. Governance of the Internal Capital Adequacy Assessment Process The Board of Directors and Senior Executive Management must ensure that the bank maintains an appropriate level and quality of capital in accordance with its risk profile and business plans. The Board of Directors, Senior Executive Management, and committees concerned with the Internal Capital Adequacy Assessment Process must, at least annually: Understand the nature and materiality of inherent risks in the bank's activities. Discuss the results of the Internal Capital Adequacy Assessment Process effectively and efficiently, including the results of stress testing. Ensure that the Internal Capital Adequacy Assessment Process is subject to sound corporate governance. Ensure regular internal review by the three lines of defense. The Board of Directors is responsible for: Approving acceptable risk levels and the framework for the Internal Capital Adequacy Assessment Process. Ensuring that the strategic plan clearly includes the size and quality of capital required currently and the target level, in line with strategic objectives, taking into account the dividend distribution policy and targeted growth rates. Approving the key elements related to the Internal Capital Adequacy Assessment Process and endorsing the results of the process annually. In the case of foreign bank branches operating in the Kingdom, approval must be from the Regional Manager. Ensuring that management establishes a framework for assessing various risks and develops a system that links risks to the bank's capital level, and ensuring that it fulfills its responsibilities in developing and effectively implementing the Internal Capital Adequacy Assessment Process. Ensuring the existence of approved policies and documented procedures related to the Internal Capital Adequacy Assessment Process, and ensuring the bank's compliance with these policies. Ensuring the consistency of the Internal Capital Adequacy Assessment Process with the bank's decision-making process. Ensuring that the entire Internal Capital Adequacy Assessment Process is conducted at least once a year and updated when needed, so that it is convinced that it has taken into account important aspects that require adjustments to the assessment process, such as changes in business lines and risk structure. Senior Executive Management is responsible for: Full understanding of the Internal Capital Adequacy Assessment Process, and understanding the nature and level of risks the bank may face, their measurement methodologies, and how to link these risks to capital levels. Ensuring continuous alignment of the Internal Capital Adequacy Assessment Process with all the bank's activities, as well as its consistency with the circumstances in which the bank operates. Ensuring the development of an appropriate risk management framework in light of the bank's risk profile and strategic plan, and that the strategic plan indicates the bank's capital needs, capital expenditures, appropriate capital level, and its sources. Ensuring the development of appropriate policies and procedures for the Internal Capital Adequacy Assessment Process [to primarily ensure the identification of all material risks, their measurement, assessment of their levels, trends, and impacts on capital levels and quality, assessment of whether the bank holds sufficient capital levels, and regular reporting on the Internal Capital Adequacy Assessment Process to the Board of Directors and relevant committees, and that the capital adequacy assessment process is conducted at least annually and updated when needed]. Reviewing the key elements related to the Internal Capital Adequacy Assessment Process annually – such as the process governance framework, internal documentation framework for the process, bank presences included in the process, scope of inputs, risk identification and measurement methodologies, methodology used for capital adequacy assessment, stress testing framework, and data quality – and submitting them to the Board of Directors for approval. Verifying that staff involved in the Internal Capital Adequacy Assessment Process have the necessary skills and providing them with the necessary training. The Internal Capital Adequacy Assessment Process must be developed and prepared by entities independent of the business sectors/risk owners in the bank. The Risk Management Department must play a key role in the design of the Internal Capital Adequacy Assessment Process and related decisions, as well as in the independent periodic review of the process, and in preparing the document. The Internal Capital Adequacy Assessment Process as an Integral Part of the Comprehensive Management Framework The bank must have a comprehensive framework for internal capital adequacy assessment and management, including approved policies and documented procedures for risk identification, assessment, and measurement, employing quantitative methods for estimating capital needs to face risks, and assessing qualitative factors related to governance, strategic planning, risk management, and internal systems and controls. The bank must also consider the link between its capital and the effectiveness of its governance and risk management systems and procedures, and adequately document this. The Internal Capital Adequacy Assessment Process must integrate with the risk management process and decision-making culture and be an essential part of them. This process is used in strategic planning and when discussing strategic matters, enabling decision-makers in the bank (Board of Directors, Senior Executive Management, and relevant committees) to continuously assess material risks associated with the bank's activities, determine the necessary capital to face them, and assist in making important decisions. It is also used in monitoring capital adequacy and capital allocation at the banking group level, ensuring the bank maintains adequate capital. Accordingly, decision-makers in the bank must consider this process and its results during discussions when making important decisions in the bank. The Internal Capital Adequacy Assessment Process must be taken into account when developing the bank's internal policies and procedures, as well as when determining remuneration and distributing dividends, and when discussing matters related to the bank's assets and liabilities within the work of relevant committees (such as ALCO and the Risk Management Committee). The Internal Capital Adequacy Assessment Process must be consistent with other strategic risk management frameworks (especially with the Risk Appetite Framework (RAF), the Internal Liquidity Adequacy Assessment Process (ILAAP), stress testing, and recovery plans). The ICAAP document must include the general structure of this process, its key elements, and how these elements interact with other strategic risk management processes. Furthermore, the Risk Appetite Framework aims to cover all aspects of risk appetite (definition, monitoring, reporting, etc.). The risk appetite document includes risk limits and an outline of the roles and responsibilities of the bodies supervising its implementation and monitoring. The Internal Capital Adequacy Assessment Process and the Risk Appetite Framework must be closely linked, such that the ICAAP enhances the implementation and monitoring of the bank's strategies and acceptable risk limits. The bank must consider the results of the ICAAP when reviewing its risk appetite framework. The Internal Capital Adequacy Assessment Process and recovery plans must be part of the same risk management chain, relying on similar indicators and within an integrated governance framework. Updates between the Internal Capital Adequacy Assessment Process and the recovery plan must be reflected in a timely manner, given their integrated roles. The ICAAP aims to maintain the bank's continuity within its strategy and business model, while the recovery plan aims to identify actions the bank must take in the event of a significant decline to restore its financial position. Material actions taken within the ICAAP framework must also lead to a rapid re-evaluation of recovery options included in the recovery plan. The Internal Capital Adequacy Assessment Process must be consistent across the banking group's presences (branches and subsidiaries) so that the bank can assess and maintain capital adequacy across all its presences. Strategies, risk management processes, decision-making, as well as assumptions and methodologies relied upon in the internal ICAAP must also be consistent across all presences. Furthermore, if this process differs for specific presences in a way that requires its implementation in those presences using methodologies different from those applied to the rest of the banking group, the bank must document this difference and reflect any material impacts resulting from its application on the ICAAP prepared at the banking group level. The bank must assess any potential limitations hindering capital transfer within the banking group and take these limitations into account in the Internal Capital Adequacy Assessment Process. The results of the Internal Capital Adequacy Assessment Process must be updated and related reports submitted to the various relevant management levels in the bank periodically, with reporting frequency at least quarterly, and submitted to Senior Executive Management and the Board of Directors or its relevant committees. The reports must include at least levels and trends of material risks, sensitivity analysis of results to key assumptions, and expected changes in risk structure and their impacts on capital adequacy. The bank may need to update the process more frequently depending on its size, complexity of operations, business model, and types of risks, including any new risks that may relate to one of its activities, and in the event of material changes with a significant impact on the assumptions and methodologies used in this process. Identifying All Material Risks and Considering Them in the Internal Capital Adequacy Assessment Process The bank must have procedures for identifying material risks it is exposed to or may be exposed to at least annually, and more frequently when needed (e.g., when launching a new product or expanding business), based on its Internal Definition of Materiality, and the risk identification process must lead to the creation of a Risk Inventory. The likelihood and impact of losses must be taken into account when determining materiality. Risks and their degree of materiality must be identified without considering the effect of risk mitigants (Gross Risks), including hedging tools, for the purpose of assessing the effectiveness of risk mitigants. Risk identification must include all significant presences of the bank within the banking group, in addition to outsourced processes, and risks arising from the bank's adopted strategies or changes in its operating environment. The following are the risks that must be covered within the Internal Capital Adequacy Assessment Process: Pillar 1 Risks, which include credit, market, and operational risks, the definition of which falls within the Central Bank's effective instructions regarding minimum regulatory capital adequacy requirements. Pillar 2 Risks, which include risks not fully covered in Pillar 1 and risks not taken into consideration in Pillar 1, and risks that may arise from external factors. Appendix No. (1) outlines the minimum risks that banks must measure for the purposes of the Internal Capital Adequacy Assessment Process – noting that these risks do not cover all types of risks, and it is left to the bank to diagnose the risks associated with its business, taking into account its specific nature of work and based on its self-assessment. Regarding material risks, the internal criteria for determining materiality must be documented and justified by the Risk Management Department and approved by the bank's Board of Directors and its Risk Management Committee. For risks identified as material, the bank must either allocate capital to cover those risks or provide justifications for not holding capital against them, either by demonstrating risk mitigation through other measures (such as Hedging) or by showing that the risk cannot be covered by capital but is managed and monitored appropriately, and this must be adequately documented. Risk Measurement Methodologies for the Purpose of the Internal Capital Adequacy Assessment Process The bank must prepare and develop methodologies for measuring the risks it is exposed to or may be exposed to, in line with its risk profile and risk appetite, and suitable for its business model, size, and complexity of operations. Locally Systemically Important Banks (D-SIBs) are expected to use more advanced methodologies for risk measurement. Measurement methodologies must be comprehensive of all quantitative and qualitative aspects, including those that are difficult to measure (e.g., due to lack of available data), and appropriate methodologies based on professional judgment must be developed, taking into account the bank's ability to control, monitor, and mitigate risks. Each type of risk must be measured consistently within the banking group, including assumptions, measurement methodologies, and capital definition. When measuring risks, risk diversification should not be taken into account, and efforts should be made to assess the cumulative effects of individual risks. The bank must – within the framework of the Internal Capital Adequacy Assessment Process – measure Pillar 1 risks using its internal methodologies based on its risk assessment. The bank must be able to demonstrate the suitability of measurement methodologies for its specific circumstances, risk profile, and the size and complexity of its operations, even if methodologies prepared by external service providers are used. The bank must consider that the greater the uncertainty in the results of the measurement process, the greater the need for more conservatism. The bank must provide a data quality framework that includes all risk-related data and quality criteria (such as accuracy, integrity, comprehensiveness, timely availability), consistent with the principles for effective risk data aggregation and risk reporting (BCBS 239) issued by the Basel Committee on Banking Supervision, as the accuracy of the risk measurement process fundamentally depends on data quality. All measurement methodologies must be regularly subject to independent validation by an independent internal party, taking into account the importance of risks and the complexity of measurement methodologies, and comparing estimated risk levels with actual ones, and the results of the validation process must be documented. The validation entity must be organizationally and operationally independent of the unit developing the measurement methodologies, consistent with the bank's size and complexity of operations. This validation process must be separated from internal audit to ensure full segregation between the second and third lines of defense in the bank's internal control system. The results of the independent validation must be presented to Senior Executive Management and the Risk Management Committee emanating from the Board of Directors, and used when reviewing methodologies and taken into account in capital adequacy assessment. Measurement methodologies (quantitative and qualitative) must be comprehensively documented, including at a minimum the following: A detailed description of the data used (time period, presences included in the assessment process, any subsequent data adjustments, etc.). A presentation of all assumptions and measurement methodologies and their justifications, including risks classified as “difficult to measure”. A historical summary of the validation results for these methodologies. Capital Adequacy Assessment The bank must measure and disclose the amount of capital required based on the levels of risks it is exposed to or may be exposed to. The bank must manage capital adequacy