Instructions of Internal Control Systems for Microfinance Companies No. 11/2020

1 No.: 28/2/15556 Date: 21/4/1442 Hijri Corresponding to: 6/12/2020 Instructions of internal control systems for microfinance companies No. (11/ 2020) Issued pursuant to the provisions of Article (4 / B/ 4) of the Central Bank of Jordan Law No. (23) of 1971 and its amendments and to the provisions of Article (26) of the Microfinance Companies Bylaw No. (5) of 2015 Article (1): Scope of application These instructions shall be called "Instructions of Internal Control Systems for Microfinance Companies", and they shall be applied to all microfinance companies operating in the Kingdom and shall be enforced one year after the date of their issuance. Article (2): Definitions The words and expressions mentioned in these instructions shall have the meanings indicated below, unless the context indicates otherwise: The Central Bank : The Central Bank of Jordan The Company : Microfinance company The Board : The Board of Directors of the company or its Management Committee Compliance oversight : An independent function whose aim is to ensure that the company and its internal policies comply with all laws, bylaws, instructions, orders, codes of conduct, sound standards and practices issued by local and international regulatory bodies. This function determines, evaluates, and provides advice and guidance; monitors, and reports to the Board about the extent of compliance in the company.

2 Article (3): Internal Control Systems a. The company must establish internal control systems in proportion to the size of the company and the nature of its operations, so that these systems include, as a minimum, the following:

1. The existence of an effective role for each of the committees emanating from the Board and the executive committees.
2. The existence of approved work policies and procedures.
3. The existence of financial and administrative systems to ensure the maintenance of accurate and comprehensive financial, administrative and operational records.
4. The existence of clear organizational structure and specific job descriptions.
5. Segregation of jobs and tasks.
6. The existence of clear and specific financial and administrative authorities.
7. Achieving dual oversight on all major financial and administrative operations.
8. The existence of controls over the use and handling of cash.
9. Protecting the company's assets from any penetration or use by any unauthorized person. b. The company shall review the internal control systems and ensure their effectiveness at least once a year by the company's internal audit and the external chartered accountant. c. The Board shall disclose, within the annual report, about the extent of the effectiveness and adequacy of the company's internal control systems in preparing its financial statements and reports, so that this disclosure includes the following:
10. The responsibility of the senior executive management to establish internal control systems and to ensure their adequacy.
11. The senior executive management's evaluation of the effectiveness of the internal control systems up to the date of preparing the financial statements included in the annual report.
12. Any fundamental weaknesses in the internal control systems.
13. The main features of risk management system at the company. Article (4): Duties and responsibilities of the Board In addition to what is stated in the relevant legislation, the Board has the following duties and responsibilities as a minimum: a. Ensuring the existence of adequate and effective internal control systems and monitoring their implementation

3 b. To be aware of the main risks facing the company, and to supervise the senior executive management to ensure that it is aware of these risks and works to control and monitor them. c. Apprising of, either by itself or by the committees emanating from it, the reports of the supervisory authorities and of the internal and external audit, and ensuring that the senior executive management takes the necessary procedures to follow up the violations and the notes contained therein, and works to correct and address them to ensure that they do not recur. d. Approving the organizational structure of the company, forming committees, approving financial and administrative systems, and approving the delegation of powers and authorities. e. Adopting procedures that ensure conducting a periodic and regular review of operational performance and of the compliance of all company employees with internal policies and procedures. f. Adopting a risk management system appropriate to the size of the company and its operations, so that it is implemented by the senior executive management and under its supervision, and so that:

1. The system is based on identifying and analyzing the main risks, including credit risks, market risks, operational risks and any other risks. It shall include determination of acceptable levels of risks and setting limits accordingly.
2. The system clearly defines the roles, tasks and responsibilities of the Board, the audit committee, the internal audit department, and the employees working in risk management.
3. The system defines the methodologies that will be followed in the continuous measurement, monitoring and controlling processes for each type of risk, in addition to the mechanisms for identifying and dealing with the risks associated with change.
4. The effectiveness of the company's implementation of the system is reviewed at least once annually. g. Approving strategies, annual budget, and code of conduct, and reviewing them periodically. h. Adopting an internal audit charter that includes the tasks, powers, responsibilities, and methodology of the internal audit department, so that it is circulated within the company. i. Allocating adequate resources for the senior executive management to carry out its responsibilities independently and effectively, and ensuring that all company activities are subject to internal audit, including risk management, compliance, branches, and the

4 evaluation of the company's procedures for combating money laundering and terroism financing. Article (5): Tasks and responsibilities of the senior executive management In addition to what is stated in the relevant legislations, the responsibilities of the senior executive management must include the following as a minimum: a. Preparing and developing strategies and policies and working to implement them after approval by the Board. b. Preparing, developing and implementing the work procedures manual in a way that ensures identifying, measuring, controlling and monitoring the risks facing the company. c. Preparing policies that ensure the existence of appropriate internal control systems, ensuring that they are being implemented, and providing the Board with periodic reports on the extent of application and effectiveness of these systems at least once annually. d. Ensuring compliance with the requirements of the supervisory authorities and the internal policies of the company, and providing the supervisory authorities, the internal audit and the external chartered accountant of the company with the required information and data at the specified time. e. Following up the observations and violations mentioned in the reports of the supervisory authorities, the external chartered accountant and the internal audit, and taking the necessary steps to address them and prevent their recurrence. f. Preparing an organizational structure appropriate to the size and activities of the company, and that it includes, at a minimum, the following:

1. All organizational units and activities for all job levels, in addition to sub￾organizational structures for those units, and job descriptions for each of them.
2. Committees emanating from the Board and other committees.
3. Segregation and specification of duties to avoid conflicts of interest and to reduce risks. g. Establishing all necessary steps to effectively implement the risk management system, including verifying that any new product, process or system is in line with the general strategy of the company, and that all related risks have been identified and that they are within acceptable risk limits in accordance with the company's policies. h. Submitting periodic reports to the Board on all financial and administrative matters of the company and the level of risk it operates in. i. Preparing the financial statements and final accounts of the company.

5 j. Preparing the estimated budgets in accordance with the budget preparation policies approved by the Board. k. Developing the skills and professional behavior of the company's employees to keep up with developments. Article (6): Internal Audit a. The company shall commit to establish an internal audit department, so that it is independent from the executive management and report directly to the audit committee emanating from the Board according to the following:

1. Providing the department with adequate resources and a sufficient number of qualified employees in a manner consistent with the size of the company and its operations and training them. Noting that the company should not assign to those employees any executive duties or tasks.
2. Granting the internal auditors full access to the company’s records and direct contact with all employees of the company, the board and the audit committee to enable them to perform the tasks entrusted to them. b. The department shall submit its reports directly to the audit committee on a regular and periodic basis, and concurrently provide the general manager of the company with a copy of these reports. c. The scope of the department's work must include reviewing all the company's business and activities, including the work of the risk department, the compliance oversight department and the branches. The audit department shall performs the following tasks in particular:
3. Preparing an annual audit plan to be approved by the audit committee.
4. Carrying out necessary audits of financial matters and ensuring the reliability and accessibility of relevant information.
5. Carrying out audits in a manner commensurate with risks to review accounting and administrative systems.
6. Preparing an annual report on the adequacy of the internal control systems to reduce the risks to which the company is exposed and the extent of their effectiveness in limiting the presence of conflicts of interest and any fraud or corruption operations.
7. Following- up the violations and observations contained in the reports of the supervisory authorities and the external chartered accountant, and ensuring that they are addressed and that appropriate controls are in place to prevent their recurrence.

6 6. Ensuring that appropriate procedures are in place to receive and handle customer complaints in accordance with the relevant legislations. 7. Evaluating the company's measures to combat money laundering and terrorism financing, including compliance with the requirements of the relevant legislations in force. 8. Filling audit reports and related documents in accordance with the relevant legislations in force, in an orderly and secure manner, so that they are available for review by supervisory authorities and external chartered accountants. Article (7): External Audit a. The company must sign an "Engagement Letter" with the external chartered accountant to do all the matters that fall within his responsibility in line with the requirements of international auditing standards, in addition to the following:

1. Providing the Board with a detailed report that includes weaknesses in the accounting systems, internal control systems, and any other matters of negative impact that the external chartered accountant observe during the audit process.
2. Verifying the accuracy and integrity of the data presented to him during the audit process.
3. Providing the Central Bank with copies of any reports submitted to the company while performing his duties.
4. Directly reporting to the audit committee or the Board and the Central Bank of any fraud that he detects or of suspicions of fraud or of any suspicious or illegal operations. b. The company shall adhere, at a minimum, to the following:
5. Not to appoint the same external chartered accountant for more than eight consecutive years, with a change in the partner auditor every four years.
6. Obtaining the approval of the Board upon the recommendation of the audit committee in the event that an external chartered accountant is required- during his tenure as an auditor- to offer any non- audit services such as accounting services or consulting services in a manner that does not affect the independence of the external chartered accountant. Article (8): Compliance Oversight a. The company should establish an independent compliance oversight department responsible for implementing the policies, procedures and mechanisms necessary to ensure that the company and its internal policies comply with all relevant legislations

7 in force and with the sound standards and practices issued by the supervisory authorities. The functions and authorities of the department shall be documented and disseminated across the company, so that it does not perform any executive work and undertakes the following tasks:

1. Evaluating the adequacy of the company's compliance procedures and guidelines, tracking any deficiencies that are discovered, and formulating appropriate suggestions to make the necessary corrective adjustments.
2. Identifying, documenting, and assessing the “compliance risks” related to the company's activities according to a well- studied basis.
3. Educating employees on compliance issues and preparing written guidelines in this regard.
4. Ensuring adherence to the established compliance oversight policy by conducting tests and submitting reports to the Board or the committee emanating from it- if any- and copying the general manager thereof. The reports shall include an assessment of "compliance risks" and the tests that were conducted during the reporting period and the violations and deficiencies that were detected and corrective actions taken. b. The compliance manager is the liaison officer responsible for providing all requirements of the Central Bank in various fields. Article 9: Risk Management a. The company should establish an independent risk management department that does not exercise any executive tasks and undertakes the following tasks:
5. Reviewing the risk management framework in the company before approval by the Board.
6. Implementing the risk management strategy in addition to developing policies and work procedures to manage all types of risks.
7. Developing methodologies for identifying, measuring, monitoring and controlling each type of risk.
8. Submitting reports to the Board through the risk management committee and copying the general manager. The reports shall include information on the actual risk profile for all the company's activities in comparison with the risk appetite statement. This is in addition to following- up addressing the negative deviations.
9. Studying and analyzing all types of risks that the company faces.
10. Submitting recommendations to the risk management committee about the company's exposures to risks, and recording exceptions cases from the risk management policy.

8 7. Providing the necessary information about the risks of the company, to be used for disclosure purposes. 8. To ascertain, before introducing any new (product / process / system), that it is compatible with the overall policy of strategic development, and that all risks resulting from it, including the operational risks, have been identified, and that the new controls and procedures or any amendments made to them have been implemented in a manner consistent with the risk tolerance of the company. b. The Board, before approving any expansion of the company's activities, shall study the risks involved and the capabilities and qualifications of the employees of the risk management department. c. The Board shall ensure the independence of the company's risk management department, by submitting its (the department’s) reports to the risk management committee, and granting the department the necessary powers to enable it to obtain information from the company’s other departments and cooperate with other committees to carry out its duties. d. The board shall approve a risk appetite statement for the company and supervise the senior executive management in the company to ensure that the necessary measures are taken to identify, measure, monitor, and control each type of risk. Article (10): Financial and accounting systems and information management systems requirements a. The company must have, at a minimum, the following:

1. Financial, accounting, and administrative systems that verify any financial transaction upon its occurrence and enable the company to show its true financial position.
2. Periodic audit procedures for the data and accounting records to ascertain that they have been properly recorded.
3. Written procedures to ascertain the keeping of books and records in an organized and safe manner for a period not less than the legal period stipulated in the legislations in force.
4. Internal review and audit procedures to ascertain the quality and reliability of the financial information and data that is presented to the company's management and to the supervisory authorities.
5. An information management system that uses new information technology in a manner that ensures the availability, integrity, safety, and confidentiality of information provided to the senior executive management and the Board,

9 including those related to the significant risks, risk metrics, quality of implementation of the risk management system, and corrective steps. 6. Sufficient and qualified human resources to ascertain the effectiveness of the financial and accounting systems, in addition to the necessary technical alternatives and means that ascertain the continuity of operations. b. The internal control systems must ensure the effectiveness and safety of the information management systems and its associated technology in the company, and this includes, at a minimum, the following:

1. Mechanisms for evaluating the performance of systems, and for identifying, measuring and controlling information- related risks.
2. The senior executive management should ensure that the information systems and management are adequate to enable the company to proceed according to its business plan, its regulatory requirements, and its internal control and compliance needs.
3. The senior executive management should ensure that a qualified technical cadre is appointed to deal with the information systems and its associated technology.
4. Obtaining evaluation reports of the risks and controls of information and its associated technology by independent bodies such as external audit, and working to address weaknesses for the purpose of improvement and development.
5. To create the proper mechanisms to deal with service providers to maintain a high- quality information system commensurate with the size of the company and its activities.
6. To set- up the proper controls to ascertain the adequacy, accuracy and validity of the data entered, processed, and extracted from programs and systems; to ascertain the continuity of updating the data; to have backup thereof; to check its reliability and compatibility between the company's systems, and to store it in a manner that minimizes the risks that may negatively impact it.
7. Ensuring access to reports upon request and as needed. Article (11): Security and safety requirements Every company must adopt appropriate procedures to maintain its security and safety. The Board shall have the responsibility to ensure the effectiveness of these procedures, and that shall include, at a minimum, the following: a. The selection of the proper security and protection means, and testing and maintaining them periodically, provided that this includes the following:
8. Strong safes that are difficult to manipulate, to save cash while ensuring the existence of dual control over them.

10 2. The use of protective means to control the entry and exit processes to and from the company's different locations, especially the places where cash is stored, received and delivered. 3. Tamper- resistant locks on exterior doors and windows of the company and its branches. 4. Cameras to record all businesses and activities that take place within the company's branches. b. Provide the necessary training for all company employees on the used security and safety methods. c. To place the cash safes away from the customers’ areas. d. To provide the necessary security measures to transfer cash to and from the company or any of its branches. e. To specify limits for keeping the cash at different company's branches and to work towards adhering to such limits. f. To insure all the company's assets against all risks such assets may be exposed to. Article (12): The company shall provide the Central Bank with a detailed report clarifying all the circumstances of any incident of embezzlement, forgery, theft, fraud, or major shortage in the assets as soon as it occurs, with an illustration of the procedures that the company is taking to recover its rights and guarantee the non- recurrence of such incidents in the future. Governor Dr. Ziad Fariz