Instructions of Internal Control Systems No (35/2007) Issued by the Central Bank of Jordan

1 10/1/6066 24/5/1428 H 10/6/2007 G INSTRUCTIONS OF INTERNAL CONTROL SYSTEMS NO (35/2007) ISSUED BY THE CENTRAL BANK OF JORDAN PURSUANT TO THE STIPULATIONS OF ARTICLE (45/a) OF THE CENTRAL BANK’S LAW AND ARTICLE (99/b) OF THE BANKING LAW Listed here below are the minimum control measures required to ascertain that the Bank’s Management carries out the proper control over the Bank’s activities. FIRST: The following words mentioned in these instructions shall have the following meanings:

1. The Executive Management: General Managers, their deputies, assistants, administrative and banking consultants, bankers and those of similar capacities at the Bank.
2. Quality of Information: The ultimate result of factors that provide the following conditions: a- Effectiveness: It is to provide the information related to the administrative operation and decision in a timely and required fashion where such information is accurate, coherent (consistent) and beneficial. b- Efficiency: It is the management of information by utilizing various resources through standard economic methods c- Confidentiality: It caters for protecting the information from being divulged, published, declared, and illegally used (unauthorized usage). d- Integrity: It caters for the accuracy, completeness, and validity of information. e- Availability: It is that the information is available when needed at the present time or in the future. f- Reliability: It is that the information is adequate and reliable for administration and decision making purposes. Compliance: It is that the information management is compatible and in conformity with the current laws, regulations and instructions as well as with the Bank’s strategies, policies and space systems.
3. Information resources and the related Technology: It is all the resources relating to the productivity of the human factor, data, software, hardware, in addition to the time factor.

2 SECOND: Duties of the Board of Directors In addition to what the relative legislation provided for, the Bank’s Board of Directors must ensure the existence of adequate and effective internal controls, supervision regulations and must continuously follow it up through, as a minimum, pursuing and observing the following controls:

1. Awareness of the major risks facing the bank and approve acceptable limits to such risks and to supervise the bank’s executive management to ensure taking the necessary procedures to define, measure, control and supervise such risks.
2. Approval of the organizational structure of the bank, form the committees and delegate powers and authorities.
3. Approval of the bank’s strategies, policies, annual budgets, and code of conduct and to review same periodically.
4. Ensuring that the executive management works towards realizing the effectiveness of the internal control systems.
5. Apprising the Board or the committees emanating there from of the reports of the supervising authorities, external and internal auditors and to follow-up the violations and remarks mentioned therein and to make certain that the executive management rectifies the same and takes the necessary procedures to prevent the recurrence of the violations and remarks, in addition to any other reports relating to compliance, risk management or any other relevant issues.
6. Exercising authority outside executive management’s scope.
7. Assessing the performance of the executive management, extent of its adherence with the Board’s policies, success in realizing the projected results and objectives as well as to remedy the deviations. THIRD: Duties of the Executive Management In addition to what the relative legislation provided for, the bank’s executive management must, at a minimum, adhere to the following:
8. To develop and update the policies and strategies and work towards implementing the same after gaining approval by the Board of Directors.

3 2. To prepare and develop the work procedures in a manner that ensures defining, measuring, controlling and supervising the risks that the bank encounters and to implement such procedures. 3. To prepare the financial statements and the closing accounts. 4. To prepare an organizational structure in accordance with Item (Four) and to ensure adherence to it after it is approved by the Board of Directors. 5. To prepare an annual budget to be approved by the Board of Directors and to report performance periodically to the Board of Directors illustrating the actual performance deviation from the projection. 6. To set-up adequate internal control policies and to implement them after they are approved by the Board of Directors. 7. To execute the duties according to the authorized powers. 8. To accomplish the effectiveness of the internal control systems and to report, at least annually, to the Board of Directors about the implementation and effectiveness of the systems 9. To set-up the procedures that guarantee the assessment of the capital adequacy and to report periodically to the Board of Directors in that regard. 10.To provide the external and internal control entities, such as the supervisory authorities, internal and external auditors and any other relevant entities, at the time specified by such entities, with the information and statements so required which are necessary to carry out its tasks in an optimal manner. 11.The annual report must include a statement about the executive management’s responsibility for providing internal control systems that guarantees the quality and transparency of the published information and data. 12. To articulate a bank’s Code of Conduct, get it approved by the Board of Directors and circulate it among all administrative levels at the bank. 13. To develop the skills and professional behavior of the bank’s employees up to par with the latest benchmarks and requirements

4 FOURTH: The Organizational Structure and Job Description At a minimum, the bank’s management must prepare a detailed, clear and flexible organizational structure that can be implemented and a comprehensive job description comprising of the following::

1. All organizational units and job descriptions for all grades in addition to sub￾organizational structures for such units.
2. The committees emanating from the Board of Directors and other committees formed at the bank.
3. A detailed work procedures guide to execute and supervise the operations.
4. A detailed description of the tasks and responsibilities of each job and activity for each organizational unit provided that the entire bank’s staff is acquainted with it as per their respective jobs.
5. To have at least dual supervision for each activity or transaction.
6. To separate and define duties to avoid conflict of interest and to minimize the risks.
7. To separate the activities and procedures administratively and practically among the tasks of approval, execution and recording.
8. To separate the tasks of risk management from the internal audit administration.
9. The participation of the risk management and the compliance with planning for any new products or procedures and approve the same, giving a consultative role to the internal audit units.
10. The adherence with supervisory authorities’ requirements and the bank’s internal policies. 11.Regular supervision confirming the implementation of the organizational structure, adhering therewith and follow up on its development to realize and accomplish the bank’s objectives.

5 FIFTH: Internal Audit Administration The bank must abide by creating an independent internal audit administration that reports directly to the Audit Committee (constituted in accordance with the stipulations of Article (32) of the Banking Law) (or its equivalent in respect of the foreign banks branches) to whom periodical reports shall be made. The audit administration’s tasks shall be as follows, at a minimum.

1. To set-up an Internal Audit Charter and approve it by the Board of Directors, provided it comprises the audit administration’s tasks, responsibilities, powers and work methodologies.
2. To set-up internal audit procedures consistent with the best practices and international standards.
3. To prepare an annual audit plan approved by the Audit Committee where its is contrived from the bank’s strategic plan, provided it encompasses the majority of the bank’s activities and its organizational units including the risk management according to the level of risks in such activities.
4. To prepare an annual report about the extent of adequacy of the internal controls and supervision regulations to limit the risks that the bank is subjected to and to work towards providing the proper recommendations to rectify the weaknesses.
5. To augment the internal audit administration with qualified employees of adequate technical qualifications and related practical experience to audit all activities and operations, provided such comprises qualified staff to assess the information risks and its related technology.
6. To follow-up the violations and comments mentioned in the supervisory authorities and independent auditors’ reports and to ascertain working towards its ramifications towards of appropriate controlling measures placed at the disposal of the executive administration to ensure its non-recurrence.
7. To ascertain the existence of the proper procedures to receive, remedy and maintain the customers’ complaints and the remarks relating to the accounting system, internal control and supervision, audit operations and to periodically report the same.
8. To maintain the audit reports and documents for periods consistent with the relevant stipulations of the legislation in force, in an organized and safe manner to be available for review by the supervisory authorities and the independent auditors.

6 SIXTH: Risk Management Assessment and risk management are deemed to be the responsibility of each of the bank’s units according to the unit’s positions and objectives , the bank must, as a minimum, abide by the following:

1. To set-up a risk management system compatible with the bank’s size and nature of operations, by which the system comprises of the following: a- The existence of risk policy/policies approved by the Board of Directors that covers/cover the entire bank’s operations and sets/set a clear measure and limit for every type of risk and to ascertain that all employees, at all administrative levels, are apprised and fully aware thereof and to review the same periodically, provided that such policy/policies includes/include requisite procedures to ensure the following: 1- Periodical definition of the major and sudden changes of risks reflected in the financial statements, developments in the markets, the legal environment… etc, in addition to assessing such changes and reporting same to the concerned units. 2- To ascertain that the bank adopts “Risk Mitigation”, through avoiding, transferring, reducing accepting and disclosing the risks in the financial statements. b- The existence of a specialized and independent administrative staff charged with analyzing and reviewing the risks consequent upon the bank’s operations and to develop the necessary methodologies to manage and control such risks. c- To supervise adherence to the risk control procedures and policies as well as the risks limits of all types. d- Procedures that ensure the delivery of good quality information to the decision makers about any deviations having a material effect, the necessary measures to remedy such deviation and to follow-up the implementation of such measures. e- Regular assessment of risk procedures, policies, and limits in light of the degree of the manifested problems, the bank’s strategies, and market development.
2. Adoption of the means that assist in risk management including but not limited to: a- Self-assessment of risks and setting-up risk indicators. b- Preparation of a profit/loss historical database defining its source and categorizing the same according to the type of risks.

7 3. To ascertain, before introducing any new (product/operation/system) that it is compatible with the overall policy of strategic development; that all risks involved including the operational risks have been determined; that the new controlling measures and the procedures or the amendments that it has undergone have been done in conformity with the risk limits acceptable to the bank. 4. To form an independent committee for risk management emanating from the Board of Directors whose membership may include some of the higher executive management members and shall be charged, at the least, with the following: a- To review the risk management strategy being approved by the Board of Directors and to continuously assess its effectiveness to ascertain its conformity with the variables. b- To ascertain the availability of policies, framework, programs, and the tools necessary for risk management, to review it at least annually to ascertain its effectiveness and to amend it if necessary. c- To report periodically to the Board of Directors showing the compatibility extent of the existing risks with the adopted policies and the acceptable levels of risks specified therein in a manner that enables the Board to make the proper decisions. d- To supervise the development of the database necessary for risk management. e- To discuss the risk management reports. f- To ascertain the existence of a business continuity plan and to examine it periodically. 5. The imperativeness of using modern information systems for risk management that guarantee the availability of quality information about the risks that the bank encounters. SEVENTH: The Bank’s relationship with the External Auditor. In addition to the Stipulations of the Banking Law and any other stipulations provided for under any relevant legislation, the bank must abide by the following, as a minimum:

1. To sign an “Engagement Letter” with the external auditor to audit the bank’s business where it should encompass carrying out all matters assumed by the auditor and which are in conformity with the requirements of the International Audit Standards, provided that the letter includes that the auditor shall carry out the following:

8 a- To provide the Board of Directors with a detailed report showing all weaknesses in the accounting systems, internal supervision and any other issues of a negative effect that the auditor became cognizant of during the audit process. b- To verify the accuracy and integrity of the data presented to the auditor during the audit process. c- To provide the Central Bank with copies of any reports that the external auditor presents to the bank within the audit mandate that the auditor was assigned for. 2. To obtain the prior approval of the Audit Committee before entering into an agreement with the external auditor to offer any non audit services in conformity with the Audit Profession Practice Law and the instructions issued in its pursuance provided such services are declared. EIGHTH: Financial and Accounting Systems Requirements The bank must have the following:

1. Financial and Accounting Systems that help it to present the bank’s true financial position and the availability of the requisite information to make the decisions that enable it to prepare the periodical and annual financial statements in conformity with the International Financial Reporting Standards or the equivalent in respect of Islamic Banks.
2. Written and sound financial accounting and documentary systems that ensure recording the financial transaction upon its occurrence.
3. Written procedures to ascertain the keeping of books and records in an organized and safe manner for not less than the statutory period provided for under the legislation in force that can be easily audited and inspected.
4. Periodical audit procedures, particularly for the accounting records to ascertain that it has been properly recorded.
5. A mechanism that enables the confirmation of the quality of financial information and data that is presented to the supervisory authorities.
6. Written procedures for the selection of the proper financial and accounting mechanical systems in addition to sufficient qualified staff to guarantee the effectiveness of the financial and accounting systems.
7. All the necessary technical means and backups to ensure the continuity of operations

9 8. Proper supervisory systems that encompass the entire bank’s systems to guarantee that each of the bank’s transactions has been duly carried out whereby: a- It is consistent with legislation and it is accurate. b- It is executed pursuant to the concerned unit’s work guide. c- It is executed by the authorized person. d- It is documented and kept in the proper registers in accordance with the legislation in force. NINTH: Information Management and the related Technology At a minimum, the internal control systems must guarantee the effectiveness and integrity of information management and the related technology at the bank of the following issues, at a minimum:

1. To set-up a strategic plan to cater for the information management resources and the related technology where it is compatible with the bank’s strategic plan and approved by the Board of Directors.
2. To set-up policies and procedures emanating from the bank’s strategy that guarantee the realization of its objectives, provided it is constantly reviewed by all concerned parties to ascertain its conformity with the bank’s plans and strategies..
3. The bank’s executive management must create the proper and necessary organizational structures to realize the bank’s objectives which guarantee the alignment between the management plans of information technology resources and the bank’s plans; including, but not limited to, forming a higher Steering Committee to manage the information technology resources and the security and protection of information
4. The administrative organization of the information management and the related technology must accomplish high quality information, where the team assuming management must be of competence from the aspects of knowledge and experience in addition to having specialized professional staff who carry out their tasks pursuant to a specific and documented job description approved by the Board of Directors, provided that the segregation of duties is practiced to maintain the precautionary controlling measures that prevent one person from executing a sensitive transaction in full.
5. To define the proprietary of various systems based on the proprietorship of information and the banking transaction related thereto, particularly the sensitive systems, together with determining clear responsibilities towards the proprietorship ensuring the realization of the information quality objectives.

10 6. To create the required principles and standards including the “Code of Conduct of Information Security and Protection” and to constantly engage in educating and augmenting the awareness of the bank’s staff within such framework. 7. To create the proper administrative organization and mechanism that endeavor to determine, measure, control and supervise the information risks and the related technology within the strategic planning framework and the medium and short-term planning for risks. 8. To create the proper mechanisms that enable the continuous supervision and measurement of performance of the information management and the related technology to ascertain the quality of services presented (whether presented by the internal units or by external parties) to the various bank’s units and to ascertain that such services are at the required level to realize the bank’s objectives efficiently and effectively. 9. To obtain assessment reports (risk – control) of the information and the related technology from independent supervisory entities, such as, the internal audit, external audit and the Central Bank and to be committed to remedy the points of weakness and to obtain feedbacks in that regard for the purpose of enhancing and development, including the supervisors’ authorities inspection reports in that regard. 10.To set-up the proper controls to ensure, at the least, the following: a- That developing/purchasing the application programs is done competently and effectively where such programs satisfy the objectives and work requirements of the bank’s units. b- That purchasing and operating the information technology infra-structure is competently and effectively done where it supports such structure and satisfies the objectives and work requirements of the bank’s units. c- The examination of the programs and infra-structure before operating same, to ascertain the extent of its adequacy, reliability, and integrity that leads to the required purpose thereof and which realizes the bank’s objectives. d- The integrity of the programs and infra-structure upon conducting any alteration thereon, where the alterations are accepted by its proprietary by virtue of duly documented acceptances. e- The quality of the services presented by external parties and the mechanism of presentation from the aspect of maintaining the confidentiality, accuracy, availability, and integrity conditions where such conditions are controlled through duly documented agreements. f- The security conditions of the various systems and the data related thereto from the aspect of protecting same from illegal alteration (unauthorized).

11 g- The treatment of problems and events that affect the information and the related technology negatively from the aspect of creating the mechanisms that guarantee the discovery, recording, and the making of the proper decision to overcome such events. h- The adequacy, accuracy, and validity of the entered, treated, and extracted data from the various programs and systems; to ascertain the continuity of up-dating the data; to have backup thereof; to check its reliability and maintaining the same in a manner that minimizes the risks that may negatively impact it. TENTH: Banks’ Security and Safety Requirements The bank must abide by the necessary security and safety requirements where it shall comprise, at the least, of the following:

1. The proper selection of the bank’s location and its organizational units where it has high safety standards
2. To place vaults/safes away from customer areas; to utilize dual control for access to and opening of the safes; to record the access in registers organized records for such purpose; to fortify the walls and select safes and doors that are difficult to be tampered with or broken into and to work towards augmenting the fortification means of such locations as needed.
3. To lock the bank’s subsidiary doors securely, fortify the windows of the bank’s building, and implement security and safety systems for all of the bank’s working locations.
4. Set up alarms and cameras; connect the bank’s communication network with the police communication network or the early warning stations licensed by the security authorities; impose the necessary safety precautions where and when necessary, including the automatic teller machines. Moreover, any recorded clips are to be saved for a minimum of one year.
5. To utilize the necessary protective devices in entering practices adopted by the bank’s different locations.
6. To train all staff members on the security and safety practices adopted by the bank including an emergency plan.
7. To specify limits for keeping the cash at different bank’s units; work towards adhering to such limits and to follow the necessary security procedures during the transportation of cash from and to the bank and its organizational units or to any other entity inside the Kingdom.

12 8. To insure all the bank’s assets against any risk such assets may be subjected to. ELEVENTH: The bank must provide the Central Bank with the following:

1. Any change that the bank wishes to carry out at the position of the General Manager or any of the bank’s executive management before making the decision.
2. Detailed reports regarding any lawsuits instituted between the bank and other entities that comprise the legal opinion and the rulings rendered in that regard.
3. The debts that the bank has written off where it shall comprise the customer’s name, amount of debt, collateral, the requisite reasons for writing off such debts and any other information that the bank deems necessary to list, provided that it includes the Board of Directors or the Audit Committee’s (or its equivalent in respect of foreign branches) resolution in that respect.
4. The information relating to the members of the Board of Directors, executive management and the committees that include members of the Board of Directors as members therein according to the enclosed specimens, on an annual basis or upon the occurrence of any amendments.
5. A semi annual report of the following shareholders: a- Jordanians, Arabs and Foreigners ownership and its ratio to capital as a whole. b- Members of the Board of Directors, their representatives and the executive management’s ownership where it shows the name, number of shares, percentage of ownership and nationality. c- The ten largest shareholders ownership in the bank, displaying the name, number of shares, percentage of ownership and nationality. d- Shareholders holding(10) thousand shares or more, where it shows the name, number of share, percentage of ownership and nationality. e- Banks’ participation where it shows the bank’s name, number of shares, percentage of ownership and the bank’s nationality. f- Ownership that is less than (10) thousand shares displaying the number of shareholders, amount, and percentage of ownership as a total.
6. Name of liaison officer responsible for providing all the Central Bank’s requirements for all areas and the name of an alternate officer on an annual basis or upon the occurrence of any amendments.
7. The annual budget and the assumptions upon which it was based and the goals desired to be achieved, and this should be carried out annually by the end of January at the latest.

13 8. Detailed report clarifying the circumstances of any embezzlement, forgery, theft, fraud or major shortage in the assets with an illustration of the procedures that the bank is taking to recover its rights and to guarantee the non-recurrence of such issues in the future. TWELVETH: The following instructions shall be deemed to be an integral part of these instructions:

1. E-banking Practices Instructions No (8/2001) dated 26/7/2001
2. Electronic Money Transfer Instructions No. (20/2004) dated 13/9/2004
3. E-banking Risk Management Principles issued by virtue of Circular No. (10/1/3344) dated 21/3/2005.
4. Business Continuity Plan Instructions No. (27/2006) dated 30/3/2006.
5. Money Laundering and Terrorism Financing Prevention Instructions No. (29/2006) dated 28/5/2006.
6. Compliance Supervision Instructions No. (33/2006) dated 26/12/2006.
7. Any other relevant instructions. THIRTEENTH: The stipulations of these instructions shall apply only to the licensed banks inside the Kingdom and to the foreign branches of Jordanian banks.

14 FOURTEENTH: These instructions shall be operational with effect from their respective dates and the following memoranda and circulars shall be considered as repeal. Serial No. Memorandum / Circular Date Subject 1 Memorandum (22/75) 13/2/1975 Notification about embezzlement incidents 2 Memorandum (105/79) 13/5/1979 Debts write-off 3 Memorandum (88/80) 21/6/1980 Branches Internal Auditors 4 Memorandum (30/81) 4/2/1981 Security Procedures (Night guards, Alarm Devices…) 5 Memorandum (205/82) 7/11/1982 Judicial Disputes 6 Circular (7030/7424) 26/3/1988 Internal Audit Departments and its Staff 7 Circular (7030/6591) 18/3/1989 Presenting Inspection Reports to the Board of Directors 8 Circular (7030/3293) 10/2/1991 Augmentation of Internal Controlling Means 9 Circular (7030/14883) 29/7/1991 Provision of Board of Directors Minutes of Meetings to the Central Bank 10 Circular (7100/16779) 19/8/1991 Budgets 11 Circular (7136/23890) 17/11/1991 Shareholders Data 12 Memorandum (3/92) 4/1/1992 Consultation with the Central Bank upon appointing a General Manager or Deputy General Manager 13 Circular (7030/11146) 9/5/1993 Provision of Information about employees in the Inspection / Internal Audit Department to the Central Bank 14 Circular (7136/17828) 27/7/1994 Shareholders Data 15 Circular (7030/22563) 22/9/1994 Notification about embezzlement incidents 16 Circular (7030/23287) 12/9/1995 Rectification of Violations and Comments mentioned in Inspection Reports 17 Circular (10/4/2/14151) 18/6/1996 Provision of Information about the employees of the Treasury Department to the Central Bank 18 Circular (10/12617) 20/7/1998 Security Procedures (Cameras…) 19 Circular (10/2/3/3/19906) 15/11/1999 Security Procedures (Cameras, Alarm Devices…) 20 Circular (10/1751) 7/2/2000 Budgets 21 Circular (10/2/3/3/5939) 13/4/2000 Security Procedures (Transportation of Money) 22 Circular (10/1912) 29/1/2001 Nomination of Liaison Officer

15 23 Circular (10/3940) 27/2/2001 Names of the Audit Committee 24 Circular (10/4794) 27/3/2002 Directives of Control and Supervision Systems 25 Circular (10/13556) 25/5/2002 Data about the Board of Directors and Executive Management 26 Circular (10/2/4/2935) 21/3/2006 Security Procedures (Cameras…) 27 Memorandum (36/2006) 18/4/2006 Security Procedures (Transportation of Money) 28 Circular (10/2/4/6393) 2/7/2006 Security Procedures (Cameras…) 29 Circular (10/2/4/1106) 31/1/2007 Notification about embezzlement incidents Enclosures: 3 Specimens The Governor Dr. Umayya Toukan

16 Specimen No. (1) Chairman and Members of the Board of …………………………………….. Bank on / / 200 Serial No. Chairman and Members of the Board (Name of four sections for the natural person and as per the Commercial Registration for the corporate person) Name of Representative of the Corporate Person (from four sections) No. of Shares owned by the Director in the Bank’s Capital No. of Shares owned by the Representative Date of Birth Date of Joining the Board Educational Qualifications Practical Experience Membership in Committees emanating from the Board Remarks Bank’s Seal and Signature Specimen No. (2) Corporate Persons who are members in the Board of Directors / ……….………………………… Bank on / / 200 Serial No. Name of Corporate Person Type Its Paid-up Capital Nature of Activities and Objectives Address Names of Chairman and Board Members of the Corporate Person Remarks Bank’s Seal and Signature Specimen No. (3) The Executive Management / …………………………………….. Bank on / 200 Serial No. Position: General Manager, Regional Manager, Deputy General Manager, Assistant General Manager, Administrative Consultant or Banker Name (from four sections) Date of Birth Educational Qualifications Practical Experience Date of Joining the Bank Date of Commencement of work in the current position No. of shares owned in the Bank’s Capital (if any) His Membership in Companies Boards of Directors as a representative of the Bank Remarks The Branches of Foreign Banks shall submit Specimen No(3) only Bank’s Seal and Signature