Instructions to Banks Concerning Internal Control Systems

28- INSTRUCTIONS TO BANKS CONCERNING
INTERNAL CONTROL SYSTEMS
A) Instructions to provide the Central Bank of Kuwait with the “Management Letter” prepared by the external auditors. B) Instructions to local banks concerning their internal control systems. C) General guidelines manual for the bank’s internal control systems, and external auditors’ evaluation reports thereof. D) Instructions regarding establishment of a system to evaluate and manage risks which a bank might encounter in its activities. E) Circular to all local banks on basel committee’s Operating Guide Concerning Risks associated with the settlement of FX transactions, and the mechanisms proposed to the public and private sectors for containing these risks. F) Circular to Banks for refraining from assigning the assessment of the Adequacy of its internal control systems or any other technical or advisory tasks, to the audit offices that perform auditing work for the bank. G) Circular to banks for refraining from entrusting the assessment of the adequacy of its Internal Control Systems or any other technical or advisory tasks of an auditing nature, to companies that have legal or economic ties with the Audit Offices that Perform Audit Work for the Bank. H) Guiding principles issued by the based committee for good practice in the management and control of operating risks at banks. I) Circular concerning the principles of good corporate governance in financial institutions.

J) Circular concerning the need for following the guidelines of Basel Committee's Paper on Principles of e-banking risks management. K) Circular regarding .the need for following guidelines issued by Basel Committee in April 2005 on the establishment of the compliance function and its role in banks. L) Circular concerning the enhancement of the aspects of banks internal control systems, by taking the necessary actions to rectify the deficiencies revealed in the applications of some information technology systems or general controls system in some banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Jumada Al-Aula 22, 1415 H
October 27, 1994
THE GENERAL MANAGER,
Instructions to provide the Central Bank of Kuwait with the “Management Letter” to be prepared by external auditors * I would like to refer to the meeting No. (2/1994) held on July 11, 1994 between the Governor and the Chairmen of local banks, whereby the Central Bank of Kuwait asked the banks to provide it with the report prepared by the external auditors for management purposes, namely the “Management Letter”. Meanwhile, I would like to advise you that the Central Bank of Kuwait has not received the above mentioned report, although more than 3 months have passed since it was requested . Accordingly, you are kindly required to provide us with the aforesaid report within one week from the date of this letter . Best Regards, Hameed Ahmed Al-Rasheed Manager of Supervision Department

• Circulated to all local banks.
  A- Instructions to provide the Central Bank of Kuwait with the “Management Letter” prepared by the external auditors.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Thu Al-qi'da 16, 1415 H
April 16, 1995
THE GENERAL MANAGER,
Instructions to local banks concerning their internal control systems * Within the framework of the activities undertaken by the local banking and financial institutions, and given the rapid and increasing developments of operations concluded in the various money and financial markets, and the relation of such developments to the activities of the local banking and financial institutions, and due to their positive or adverse reflection on such institutions overall performance, it has become mandatory to have a written internal control system duly approved by the top management of the said units. Procedures and rules of such a system should be sufficiently clear and effective to ensure the protection of the aforesaid units against any adverse consequences from errors committed by their personnel, or from non￾compliance with or not properly understanding the developments in the banking and financial market activities. Nevertheless, a highly efficient internal control system would realize the following objectives :
(1) Assets of the banking and financial institutions should be protected against any losses resulting from misuse or disposal thereof. Disposal of the assets must be concluded in accordance with the resolutions and recommendations issued by the boards of directors of such institutions . (2) The risks involved in the banking and financial operations should be properly monitored, evaluated and followed-up .

• Circulated to all local banks.
  B- Instructions to local banks concerning their internal control systems.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
(3) The operations recorded in the books of the banking and financial institutions should be carried out in consistence with the procedures specified by such institutions’ managements, and should be entered in the records in accordance with the International Accounting Standards and any other regulating criteria determined by the Central Bank of Kuwait. Within this context, and given Central Bank’s plan to ensure the availability of efficient internal control systems at the banking and financial institutions, your bank is required to take the following procedures :
(1) Requesting your bank’s external auditor to evaluate your bank’s existing internal control systems in accordance with the commonly acceptable audit rules, and to provide us with a copy of the external auditor’s report in this connection . (2) The audited closing financial statements should include a separate detailed report prepared by your bank’s external auditor on the internal control systems of your bank commencing from the fiscal year 1995. Such a report should identify the extent of the efficiency of such systems in the light of your bank’s operations during the audited year . Best Regards, Hamad AbdulMohsen Al-Marzouq Acting Manager of Supervision Department B- Instructions to local banks concerning their internal control systems.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Rajab 3, 1417 H
November 14,1996
THE CHAIRMAN,
The general guidelines manual for the bank’s internal control systems, and external auditors’ evaluation reports thereof I would like to advise you that the Central Bank of Kuwait Board of Directors, at its meeting held on November 10, 1996, has approved “The General Guidelines Manual for the Banks’ Internal Control Systems and for External Auditors Evaluation Reports thereof”. The said Manual includes instructions regarding the general requirements which the banks’ Internal Control Systems should satisfy . We attach herewith a copy of the said Manual, where your bank shall urgently come into compliance with the requirements contained in the currently implemented internal control system by your bank. Auditors’ Reports prepared in the manner specified in the Manual shall be requested as effective from fiscal year 1997. With my best wishes, SALEM ABDUL AZIZ AL-SABAH

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
General guidelines manual for internal control systems of banks, and audited reports on the Evaluation thereof ITEM DESCRIPTION SECTION INTRODUCTION ONE ACCOUNTING RECORDS AND OTHER RECORDS TWO ∗ Introduction ∗ General requirements ∗ Information for management INTERNAL CONTROL SYSTEMS THREE ∗ Introduction ∗ General requirements ∗ Controls in Information Technology Systems ∗ Internal audit SCOPE OF AUDITED EXAMINATIONS AND REPORTS FOUR ∗ Introduction ∗ Scope review ∗ The required report FIVE ∗ FORMANT OF EXTERNAL AUDITORS’ REPORT ON ACCOUNTING, AND OTHER RECORDS AND INTERNAL CONTROL SYSTEMS

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
The general guidelines manual for the banks’ internal control systems and external auditors’ evaluation reports thereof
SECTION ONE
Introduction
1 - Under the provisions of Article "71" of Law No. (32) of year 1968 concerning Currency, the Central Bank of Kuwait and the Organization of Banking Business, the Central Bank requires that banks registered in Kuwait should maintain adequate internal control systems that commensurate with the size, nature and scope of the bank’s various activities. Banks should be committed to implement such systems to manage the risks which they face in their day-to-day business . 2 - It is the responsibility of banks’ board of directors and senior management to ensure that accounting records, other records and internal control systems are adequately maintained. 3 - The Central Bank of Kuwait requires that all Kuwaiti banks should provide it with reports on the adequacy of their internal control systems prepared by local audit firms, whether acting in the capacity of external auditors or not on an annual or other basis determined by the Central Bank of Kuwait. It is the responsibility of these “external auditors” to provide their opinions and remarks on whether the regulations and internal control systems of the bank are sufficient enough in quality and quantity to manage the risks that the bank faces in its day-to-day business. Thus, the external auditors are basically required to point out where the internal controls systems are not adequate during examination periods, and submit relevant recommendations .

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
4 - The purpose of this Manual is to provide guidance on the Central Bank’s requirements in relation to records and internal control systems that should be observed by all local banks to assist these banks to establish and implement sound internal control systems, and in particular to assist external auditors appointed by local banks to report on the adequacy of the records and systems of banks. These guidelines confirm the scope and nature of the financial information and data that should be considered in the accounting records and other records to be submitted to the bank’s management. Further, they should confirm the areas and nature of the internal control systems and the purposes for which such systems have been set by the bank management. These guidelines are prepared in such a manner to be:
(a) sufficiently comprehensive to encompass the wide range of activities undertaken by local banks, whether those related to the balance sheet items or off-balance sheet items, and whether exercised by the banks for their own account or for the account of third parties. (b) relevant to the circumstances of both commercial and specialized banks which undertake activities in varying degrees of volume and complexity . 5 - The requirements and conditions for adequate accounting records and other records, and internal control systems to be maintained, shall apply only to the banks registered in Kuwait, inclusive of the foreign branches and subsidiaries that exercise banking business. It shall be taken into account the circumstances and requirements established in compliance with the laws and regulations currently in effect in the countries where such branches and subsidiaries operate.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
SECTION TWO
Accounting records and other records
Introduction
6 - The scope and nature of the accounting records and other records which are required for the business to be conducted in a prudent manner should be commensurate with the bank’s needs and particular circumstances and should have regard to the manner in which the business is structured, organized and managed, to its size and the nature, volume and degree of complexity of its transactions and business areas. A proper method shall be adopted for maintaining such records (whether in terms of place or responsibility), in such a way to help those in charge to manage the bank’s daily operations in a prudent manner. General requirements 7 - This Manual does not aim at providing a comprehensively-detailed list of the types and forms of the accounting records and other records appropriate for each bank. Its purpose is to determine the general requirements that should be met in the aforesaid records to ensure proper and systematic progress of work. The general requirements, which should be met in the accounting records and other records, are as follows:
(a) record on a timely basis and in an orderly fashion every transaction and commitment which the bank enters into with sufficient information thereof to explain :
(1) their nature and purposes;
(2) any assets and/or liabilities, actual or contingent, which respectively arise or may arise therefrom; and (3) any income and/or expenditure, current and/or deferred, which may arise therefrom.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
(b) Provide details, as appropriate, for each transaction and commitment, showing:
(1) other participating parties whether totally or partially; (2) the amount and currency; (3) type of contract (new or renewal), value and settlement or repayment dates; (4) the contracted interest rates of an interest-rate transaction or commitment; (5) the contracted exchange rate of a foreign-exchange transaction or commitment; (6) the contracted commission or fee payable or receivable together with any other related payments or collections; (7) the nature and current estimated value of any security or collateral for a loan or other facilities; alongwith the physical location and documentary evidence of such collateral; and (8) statement of the assets provided by the bank as collateral in the case of any borrowing from a third party. (c) Book-keeping and maintaining of the financial data and business information, related to the bank’s activities in various areas, should be kept in such a manner so as to be extracted promptly to enable management to achieve the following :
(1) monitor the quality of and safeguard the bank’s assets, including those held as custodian ; (2) identify, quantify, control and manage its exposures or the overdrawn positions by related counterparties across all bank products; (3) identify, quantify, control and manage its exposures and business risks, most important of which are : credit risks, liquidity risks, interest rates risks and foreign exchange risks and other market risks across all products; (4) rationalize and monitor the performance of all aspects of its business on an up-to-date basis; and (5) make timely and informed decisions;

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
(d) Records should contain details of overdraft or exposure limits authorized by management which should be appropriate to the type, nature and volume of business undertaken (See item 10 / f). These limits should, where relevant, include the trading limits for each customer, sector, or country, the trading limits to accommodate the settlement risks, securities trading position limits as well as limits on the level of intra￾day and overnight open trading positions in foreign exchange operations, futures, options, swap agreements and future (or forward) interest rate agreements (FRAs) and limits of the maturity mismatches to encounter liqudity risks and interest rate risks, in a manner which ensures availability to necessary information on actual excesses to the said limits to be readily, accurately and regularly measured; (e) Records should contain details of the factors considered, the analysis undertaken and the authorization or rejection by management of loans, advances or other credit exposure; and (f) Provision of necessary information on details of every transaction entered into in the name of or on behalf of a third party, whether the bank is acting as an agent or trustee . Information for management 8 - Every bank should prepare all data and information for directors and management so that they can monitor, assess and control the performance of its business, its financial position and the risk to which it is exposed. Such information should be prepared on the bank as an independent or individual unit and, where appropriate, on a consolidated basis to cover all the subsidiaries. The frequency with which information is prepared, its level of detail and the amount of narrative analysis and explanation will depend upon the level of management to which it is addressed. Some types of information will be needed on a more frequent basis than others and it may be appropriate for some to be presented on a basis of breaches or deviations from agreed limits by way of exception reports, explaining such special cases.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Due regard should also be paid to the general requirements mentioned above in Item (7) concerning the provision of information to bank’s management . 9- It is the responsibility of directors and senior management to lay down a suitable information system, the quality and quantity of the required information, and to decide the management levels who should receive it. In general, appropriate management information should be provided to some or all the following recipients :
(a) The Board of Directors of the bank; (b) The executive officers who, either jointly or severally, are responsible under the immediate authority of the directors for the conduct of the business of the bank; and (c) The managers responsible for exercising supervisory functions or formaintaining accounting records and other records. 10 - This information should in particular include the following :
(a) The financial position of the bank; (b) The operational results of the business both on a cumulative basis and by discrete period, and to give a comparison with budgets and previous corresponding periods; (c) Analysis of assets and liabilities showing how they have been valued; (d) Analysis of off-balance sheet item positions, showing how they have been valued; (e) Analysis of income and expenditure, showing how they are related todifferent categories of assets and liabilities and off-balance sheet positions; and (f) Types of bank’s exposure to each risk, as compared to the relevant limits set by bank management .

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
SECTION THREE
Internal control systems
Introduction
11 - The scope and nature of effective internal control systems for proper and systematic progress of work should be consistent with the bank’s special needs and conditions, and should take into account the nature and size of the business, the diversity of operations, the volume and size of transactions and degree of complexity, the degree of risk associated with each area of operation, the amount of control exercised by senior management over day-to-day operations, the degree of centralization in work management and the extent of reliance on information technology. In this regard, attention should be paid to the extent of conformity or proportion between the efforts of implementing the procedures or applying various control systems, or maintaining thereof on one side, and the expected or attained benefits, whether financial or non-financial, on the other. The internal control systems must be designed to provide reasonable assurance of realizing the underlying objectives, as there should be necessary assurance that all bank’s revenues accrue to its benefit, all expenditure is duly authorized and properly disbursed, all assets are adequately safeguarded, all liabilities are recorded, all statutory requirements relating to the provision of accounts are complied with and all prudential reporting conditions are strictly adhered to in such a manner for providing management information. General requirements 12- It is a responsibility of directors and management to set up, review, monitor and test the bank’s systems of internal control on a regular basis in order to assure their effectiveness on a day-to-day basis and their continuing relevance to the business. In many banks an internal audit function will assist management by providing an independent review of such systems (see Items 26-30 below).

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
13- This Manual does not aim at presenting a comprehensive list of internal control procedures, which would then be applicable to any bank, nor is it possible to prepare a detailed list of particular procedures which should be undertaken, where appropriate, by all local banks. However, it aims at specifying the general requirements, which should be available in effective internal control systems to ensure the sound progress of banking business. 14- The internal control systems adopted in the banks should provide reasonable assurance that :
(a) The business is conducted in an orderly and prudent manner in adherenceto established policies and limits. (b) Transactions are entered into according to the established authority . (c) Monitoring and control systems are in place to enable the management tosafeguard the assets and control the liabilities of the business. Assurance should also be there to availability of procedures and measures to minimize the risk of loss from irregularities, fraud or error, and which ensure that the adopted systems are capable of promptly and readily identifying those losses when they occur. (d) The accounting records and other records of the local bank should provide complete, accurate and timely information (in the manner referred to under SECTION TWO of this Manual) . (e) Management is able to monitor on a regular and timely basis the financial positions’ elements (capital adequacy of the bank, its liquidity, its profitability, the quality of its assets and the associated risks) (See Item 10). (f) Systems and controls are in place which allow the bank’s management to identify and assess the risk of loss encountered by the bank in the conduct of various areas of business so that :

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
1- The risks can be monitored and controlled on a regular and timely manner . 2- Appropriate provisions can be made for bad and doubtful debts, and for any other risks, either on or off-balance sheet items. (g) Management is able to prepare all returns made to the Central Bank of Kuwait accurately, and in accordance with the Central Bank’s instructions and to submit them on a timely basis . 15 - The following are the most important control areas and issues that each bank should address in order to create an effective internal control system:
(a) organizational structure;
(b) performance monitoring and control procedures; (c) segregation of duties and responsibilities; (d) authorization and approval; (e) completeness and accuracy; (f) safeguarding assets; and (g) manpower. The following items (from No. 16 to 22) will address such elements as follows:
Organizational structure
16 - Banks should formulate and document the organizational structure appropriate to the size and nature of various banking activities. Such a structure should demonstrate the job standards and needed administrative committees and their interrelation with the Board of Directors, in addition to defining and allocating responsibilities, identifying lines of reporting for all aspects of the bank’s operations, including the key controls and giving outline job descriptions in general. Special emphasis should be laid on the managerial positions in this regard.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Performance monitoring and control procedures 17 - A bank should have procedures in place to ensure that relevant and accurate management information covering the financial position and performance of the bank and the exposures which the bank has entered into are provided to appropriate levels of management on a regular and timely basis (See Items 8-10). Procedures should also be in place to ensure compliance with the bank’s policies and practices, including any limits on delegated authority referred to in Item (16), along with statutory, and supervisory requirements . Segregation of duties and responsibilities 18 - A prime means of internal control is the separation of those responsibilities or duties which would be applied in such a manner that prohibits a single individual from recording and processing a complete transaction. Segregation of the duties reduces the risk of intentional manipulation or error and increases effectiveness of the element of auditing functions and control process. The functions and tasks which need to be segregated so that each of them would be carried out by a different staff shall be listed as follows:
(a) authorization or approval of transactions (b) execution (processing & inputting) (c) settlement of payments (d) valuation (e) reconciliation, or settlement of suspense transactions (f) possession of assets (g) recording

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Where appropriate (for example, loans or treasury transactions) the above functions should be separated both physically and organizationally. Access to computerized accounting or monitoring/recording systems by bank staff should be selective (eg. a marketing officer may not input customer’s limits or transactions for dealing with or be allowed to record details of deals). Also, in the case of computer-based systems, systems development and daily operations (such as transactions processing or payments) should be separated. Authorization and approval 19 - All transactions should require authorization or approval by an appropriate person based on assigned authorities and responsibilities. It shall be observed that the authorities entrusted are proportionate with the responsibilities of various staff levels, taking into consideration the nature, size and degree of complexity of the bank’s operations. Completeness and accuracy 20 - Banks should set up controls to ensure that all transactions to be recorded and processed have been authorized, are correctly recorded, and are accurately processed in compliance with the established procedures. Such regulations and controls should basically include checking the accounting and arithmetical accuracy of the amounts of entries against the document records; checking valuation processes, settlement of suspense transactions or reconciliations (including not just internally between various registers and accounts, but also externally with counterparties), control accounts and trial balances.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Safeguarding assets
21 -A bank should set up controls to ensure that access (whether directly or indirectly) to assets or information is limited to authorized personnel. These controls are of particular importance in the case of valuable, and portable assets, which can be exchanged or disbursed, and assets held by the bank as custodian. Manpower 22 - The bank must adopt relevant policies and procedures to ensure that personnel have capabilities commensurate with their responsibilities. The proper functioning of any system depends on the competence and integrity of those operating it. The qualifications, recruitment and training policies as well as the innate personal characteristics of the personnel involved are important features to be considered in setting up any control system. Due regard in this context should be paid to the requirements of Article (68) of Law No. (32) of year 1968 (as amended under Amiri Decree Law No. (36) of year 1992) concerning Board Directors, head of executive staff, and his deputies and assistants. Controls in an information technology environment 23- The information held in electronic form within a bank’s information technology systems is a valuable asset that needs to be protected against unauthorized persons for the purpose of accessing to records and disclosing of information. Such a protection is required to avoid risks of irresponsible or unauthorized usage of banks’ information. The internal control elements described above apply equally to operations undertaken in the both manual and electronic environments although there are additional risks associated with electronic environments, which shall be addressed in the following paragraph.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
It is the responsibility of management to understand the extent to which a bank relies upon electronic information to assess the value of such information and to establish an appropriate system of controls. The Central Bank of Kuwait recognizes that proper control will usually be achieved by a combination of manual and automated regulations, the balance of which will vary between banks, reflecting the need for each bank to study the proper regulations and their cost so as to achieve the control objectives effectively. 24 - The type of risk most often associated with the use of information technology in banking and financial systems may be classified as follows :
(a) Fraud and theft :-Access to information and systems can create opportunities for the manipulation of data in order to create or conceal significant financial losses. Additionally, information can be stolen, even without its physical removal or awareness of the fact, which may lead to loss of competitive advantage. Such unauthorized acts can be committed by persons with or without legitimate access rights to the records and information . (b) Errors :-Although errors most frequently occur during the manual entry or inputting of data and the development or amendment of software, errors can be introduced at every stages in the life cycle of an information system. Therefore, adequate attention should be paid to the review and checking procedures . (c) Interruption and failure :-The components of electronic systems are vulnerable to interruption or failure; without adequate contingency arrangements, this can lead to serious operational difficulty and/or drastic financial loss . (d) Misinformation :-Problems may emerge in systems that have been poorly specified or inaccurately developed. These problems might become immediately evident, but can also pass undetected for a period during which they could undermine the veracity of supposedly sound information. This is a particular risk in systems where audit trails are poor and the processing of individual transactions are difficult to follow .

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Information security
25 - Banks management should be aware of their responsibility to establish and maintain a climate of security awareness and vigilance as to the importance of security measures throughout the bank. In particular, it should give consideration to :
(a) Adopt a security information policy, comprising standards, procedures and responsibilities, designed to ensure that arrangements are adequate and appropriate; and (b) Provide security education and training, designed to make all relevant staff aware of the need for, and their role in supporting, good security practice for such information and the importance of protecting bank’s assets. Internal audit 26 - Internal audit represents an integral part of the systems of internal control whose rules are established and maintained by the bank’s management and may provide independent assurance over the integrity and effectiveness of such systems . 27 - The existence of an independent Internal Audit Function for local banks is mandatory, which the local banks should meet so as to provide an independent evaluation of the efficiency and accuracy of the adopted controls and systems. The scope and objectives of internal audit are dependent upon the judgment of management as to its own needs and duties, in the light of the size and structure of the bank and the risks inherent in its business. Important considerations in assessing the effectiveness of internal audit include several factors, most importantly: the extent of independence from the executive management, adequacy of scope and frequency of the audit, adequacy of audit procedures, its reporting systems and the quality of its audit staff (see paragraphs 29 and 30 below).

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
28 - The most important internal audit functions within the internal control arena are as follows:
(a) review of accounting records and other records and the internal control environment; (b) review of the appropriateness, scope, efficiency and effectiveness of the adopted internal control systems; (c) detailed testing of transactions and balances to ensure that specific control objectives have been met; (d) review of the implementation of management policies; and limits established at the bank; and (e) special investigation for the bank’s management . 29 - The bank’s management should ensure that the internal audit function is appropriately structured and resourced, where the information necessary for performing such functions are available so as to enable it to provide the independent appraisal of internal control regulations. There should be clearly defined terms of reference in respect of internal audit functions (audit by-laws, audit manual, etc). Internal audit independence should be assured by determining the audit reporting line and thereafter the parties to which the audit reports should be submitted, namely an obligation to report regularly to the bank’s board of directors or the bank’s audit committee (formed by the bank’s board) the internal audit may also report directly to the chairman of the board, taking into consideration that in the cases where the internal audit reports to the audit committee, it shall advise the board of directors, at least twice a year, on the audit’s major findings and on the actions taken in their respect. Nevertheless, in cases where the internal audit reports are submitted to the chairman of the board, the chairman shall present the audit report (or a summary thereof comprising the most important audit findings) to the board of directors at its next meeting. Once agreed, audit reports should be circulated more widely to the appropriate department heads. Generally, management or bank departments must be given a sufficient time period to respond in a report to the audit comments.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Generally, internal audit should not have authority or responsibility for the activities it audits (i.e. internal audit should not administer internal controls but only check on their adequacy and efficiency of such systems). 30 - Appropriate arrangements should be made to enable the Internal Audit to have unrestricted access to all bank’s activities, records, property and personnel to the extent necessary for the effective completion of its work. The internal audit function should be staffed with individuals who are appropriately qualified or the function either by holding professional qualifications or by having the requisite practical experience.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
SECTION FOUR
Scope of examination and auditors’ reports Introduction 31 - The examination of accounting records, systems and controls will normally cover a twelve-month period. The first step will arise from an annual letter of instruction from the Central Bank of Kuwait to the concerned bank requiring it to furnish the Central Bank with the subject report, and defining therein the scope of examination and any other relevant instructions. In compliance with such a notification, the concerned bank shall send an assignment letter to the external auditor to carry out the tasks required and prepare the requested report. A copy of this letter shall be sent to the Central Bank of Kuwait. 32 - The external auditors appointed by a bank and approved by the Central Bank will be required to form their opinion on whether the bank’s accounting records and other records and internal control systems have been maintained by management during the period examined in accordance with the Central Bank’s requirements stipulated in this Manual in respect of adequacy of the accounting records, other records and internal control systems . In forming this opinion, they will be expected to have regard to the nature, scope and scale of the business undertaken by the bank . 33 - Where during the course of their work, the external auditors find out that one of the Manual requirements is not, or has not been fulfilled, by the concerned bank and believe that the matter is likely to be of material significance for the exercise of the Central Bank’s supervisory functions, the matter should be reported by the external auditors to the concerned bank, which in turn should pass the information to the Central Bank of Kuwait without undue delay. Where the external auditors believe that a serious matter should be reported as a matter of urgency, they should request the concerned bank to report the matter immediately to the Central Bank of Kuwait to this effect.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
34 - The circumstances giving rise to an opinion qualified by exceptions or cases of reservation include those where :
(a) certain records and systems do not exist and the external auditors consider that they should exist in order to assist management to conduct the business of the bank in a prudent manner on a day-to-day basis; (b) there is, or has been, a significant weakness in, or failure of, certain records or systems during the period examined; or (c) the external auditors are unable to form an opinion on a particular aspect of the records and systems and therefore wish for the matter to be discussed jointly at a tripartite meeting with the Central Bank of Kuwait . 35 - The Central Bank of Kuwait does not require external auditors to report all omissions, weaknesses and failures however minor in the existence, nature, scope and effectiveness of records and systems. Rather, it requires them to report those, which individually or collectively in their opinion do not enable them to give reasonable assurance that the requirements set out in this Manual are satisfied. The Central Bank of Kuwait expects the external auditors to indicate in their reports any form of repeated deficiencies detected in their previous examinations. Scope review 36 - When the Central Bank of Kuwait commissions a full scope review, it expects the external auditors to consider the adequacy of the accounting records and other records and internal control systems, including the internal audit function, throughout the bank. In addition, the external auditors should consider whether the bank’s procedures are adequate to prevent and detect any money-laundering cases, and submit reports on suspicions related thereto. (See also recommendations applicable related to combating money laundering issued in February 1994) .

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
37- The banks may, in consulation with its external auditors and with the agreement of the Central Bank of Kuwait, commision the external auditors to carry out a limited scope examination of the records and internal control systems in one year on one or more of the bank’s areas of activities and confine their reports to such area(s), as part of a rolling audit programme of examinations spread over a number of years as an alternative to a comprehensive or “full scope” examination which covers all the areas and activities of the bank each year. 38- The Central Bank of Kuwait does not expect the external auditors to examine or evaluate the bank management’s resolutions and projections relevant to banking affairs. The required report 39 - The external auditors should submit their reports to the board of directors in the case of a Kuwaiti bank or to the General Manager in the case of a Kuwait branch of an overseas-incorporated bank and should take the form of the proforma report set out in SECTION FIVE of this Manual. The Central Bank requires the examining auditors to give an overall assessment of the control environment for each business area which they have been asked to examine. The external auditors, unless exempted in the scope assignment letter, should give limited background information on the examined business area including an organizational structure, nature and approximate volume of transactions (where appropriate), in addition to the key risks faced by the bank and the key controls in operation. 40- Where the external auditors’ report is qualified by exceptions, the report should clearly set out the risks which the bank runs by not correcting the existing weakness, with an indication of the severity of the weakness and its adverse impacts should it not be corrected. The actual time frame for complying with each recommendation is a matter to be decided between the bank concerned and the Central Bank of Kuwait, although this should be discussed at a trilateral meeting.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
41- The report should be completed, with such remarks and comments as the bank’s management see fit to make, and submitted to the Central Bank of Kuwait by the bank within the time scale laid down by the Central Bank of Kuwait, but not later than four months after end of the period examined. The comments of the bank’s managements should be sent to the external auditors at the same time as these comments are submitted to the Central Bank of Kuwait. If the external auditors conclude, after discussing the matter with the bank, that they will give a qualified opinion, the bank must immediately inform the Central Bank of Kuwait in writing requesting a tripartite meeting therefore. The bank should also send the external auditors a copy of the same letter. If the bank, for whatever reasons, is unable to submit a report to the Central Bank of Kuwait within the required period, it should inform the Central Bank in writing of the reasons for the delay, as soon as the bank becomes aware the deadline will not be met. 42- The required report format to be submitted to the bank’s board of directors (see the format contained in SECTION FIVE) has been designed on the basis that it will be prepared by a Kuwaiti audit firm. If exceptionally, a report from the home country’s external auditors or home country’s supervisors is accepted by the Central Bank of Kuwait, the said report would be made on the same basis and terms as the required report.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
SECTION FIVE
Format of the external auditors report on Accounting records and other records and internal control systems to be submitted to bank board of directors To: The Board of Directors of Bank ........ K.S.C. In accordance with your letter of assignment dated / /199, we have examined the accounting records and other records and internal control systems of your Bank, which were in existence during the year/period ended / /199, as related to (please mention the activities and locations which have been examined) . Our examination has been carried out with regards to the Central Bank of Kuwait’s General Guidelines Manual dated / /199 and in accordance with International Auditing Standards. We would like to indicate that you as Directors of ...... Bank K.S.C. are responsible for establishing and maintaining adequate accounting systems, other records and internal control systems for your bank, taking into account that the related cost of such systems should commensurate with the benefits expected from implementation thereof. It shall be observed that the objective of this report is to provide reasonable, (but not absolute), assurance that assets are safeguarded against loss from unauthorized use or disposition, that banking risks are properly monitored and evaluated, that transactions are executed in accordance with established authorization procedures and are recorded properly, and to enable you to conduct the business in a prudent manner, with care and caution. Because of inherent limitations in any accounting and internal control system, errors or irregularities may nevertheless occur and not be detected or traced. Also projection of any evaluation of the systems to future periods is subject to the risk that management information and control procedures may become inadequate because of changes in conditions or that the degree of compliance with those procedures may deteriorate. In our opinion, having regard to the nature and scale of the business, during the year/ period ended ………..

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Either
The accounting records and other records and internal control systems examined by us were established and maintained in accordance with the requirements of the General Guideline Manual issued by the Central Bank of Kuwait on / /199 (with the exception of the matters set out in the Appendix attached to this report) . Or :
The accounting records and other records and internal control systems examined by us were not established and maintained in accordance with the requirements of the General Guidelines Manual issued by the Central Bank of Kuwait on / /199 for thereasons set out in the Appendix attached to this report . Kuwait on: / /199 Name : ………… Auditors’ License No.: ……… Category : ………. Member of : ………… Signature : …………

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Safar 21, 1418 H
June 26, 1997
THE CHAIRMAN,
Circular to all local banks(1)
No. (2/BS/37/1997)
I would like to refer to issues raised in the meeting held on 12/5/1997 with the Chairmen of the local banks regarding each bank’s situation in respect of “Risk Management” and assessment of “Asset Risk Management” that might be encountered by the banks. In addition, the meeting has discussed the Central Bank’s requirements regarding banks’ internal control systems, particularly those related to the systems of risk assessment and management, contained in the “General Guidelines Manual for the Banks’ Internal Control Systems, and Auditors’ Evaluation Reports thereof” sent to your bank attached with the letter dated 14/11/1996, requesting full compliance as early as possible with the essential conditions therein. Due to the importance of this issue, the Central Bank of Kuwait asserts that due and sufficient care should be paid for establishing a system to be based on professional and practical principles for assessing and managing the risks which might be encountered by your bank throughout its various activities. It would be adequately convenient to consider the concept of establishing a specialized unit for this purpose, where competent staff with the necessary capabilities and facilities should be maintained for proper performance thereof. Correspondingly, the Risk Assessment and Management System to be applied by your bank should encompass the rules and regulations that secure realization of the following:
(1) Circular dated 13/10/2003 was issued concerning guiding principles Committee for good practice in the management and control of operating risks at banks. D- Instructions regarding establishment of a system to evaluate and manage risks which a bank might encounter in its activities.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
1- Identify and specify types and volume of risks to be encountered by the bank in its various activities, most important of which are the risks related to: credit, liquidity, interest rates, foreign exchange and market risks. In this connection, banks shall follow the formats and methods of evaluating the risks matching with the bank’s volume and nature of activities, and level of diversification and complication of its operations. 2- To secure for the bank’s senior management all data and information required to identify and evaluate loss risks to be encountered by the bank in its various fields of activities in such a manner so as to assist in managing and monitoring the risks in a regular way, and in the suitable time; and to specify the provisions appropriate to problem debts and to any other risks, whether related to balance items and off-balance items. Preparation of such data shall be concluded at level of bank as an independent unit, and at consolidated level containing the bank’s subsidiaries, when required. 3- The system’s outputs should include volume and types of exposures that might be encounted by the bank throughout its activities. Finally, your bank shall comply with the above requirements as early as possible, not later than end of 1997, and furnish the Central Bank of Kuwait with all measures implemented in this concern. With my best wishes, SALEM ABDUL AZIZ AL-SABAH D- Instructions regarding establishment of a system to evaluate and manage risks which a bank might encounter in its activities.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Safar 2, 1421 H
May 24, 2000
THE CHAIRMAN,
Circular To All Local Banks
The Settlement and Payments Systems Sub-committee of Basle Committee passed an operating guide in January, 2000, on “FX Transactions Settlement Risks Control”, which addressed the risks associated with the arrangements adopted in the banks in respect of settlement of the FX transactions, and the proposed work mechanisms for the both public and private sectors, in order to contain such risks, through various guidance papers specially prepared for this purpose. Within this context, it is worth mentioning that the Central Bank of Kuwait support the attention given to this issue by the Basle Committee and all other central banks within the (G10) group. Central Bank of Kuwait also urges your bank to ascertain the adequacy and efficiency of its FX transactions settlement arrangements, in a manner that achieves integrity and strength of your bank’s financial position, the adequacy of its liquidity ratios and financial solvency in general. We would also like to confirm the contents of our circular No. (2/BS/37/1997) dated 26/6/1997, requiring the local banks to develop advanced systems to measure and manage the risks which they would be exposed to in the areas of their various activities, through establishing specialized units comprising the necessary expertise and personnel to perform the function in the desired manner. In addition to the aforesaid, your bank’s efforts must focus on containing the risks associated with the said transactions through adopting work mechanisms which would help your bank ascertain adequacy of the systems adopted to manage risks of the FX transactions settlements, properly measure the risks of the FX operations settlements, and check the adequacy of the control and follow-up systems of the obligations resulting from the FX trading transactions. 28- INSTRUCTIONS TO BANKS REGARDING INTERNAL CONTROL SYSTEMS. E- Circular to all local banks on Basel Committee’s Operating Guide Concerning Risks associated with the Settlement of FX Transactions, and the Mechanisms Proposed to the Public and Private Sectors for Containing these Risks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
In order to advise your bank of the practical applications currently available for management and measurement of the FX transactions settlements risks, enclosed please find a diskette containing the following informative papers:

1. Description of practical steps that bank and other trading institutions can
   take.
2. Joint industry providers of bilateral netting services.
3. Guidelines for foreign exchange settlement netting (NYFEC).
4. IFEMA agreement and accompanying documentation (IFEMA).
5. Settlement Risk in Foreign Exchange Transactions; CPSS; March, 1996.
6. Reducing Foreign Exchange Settlement Risks: Progress Report; CPSS;
   July 1998.
   In case your bank desires to obtain further information on this issue, please visit the internet site of the subject committee. www.bis.org/publ/index.htm With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTIONS TO BANKS REGARDING INTERNAL CONTROL SYSTEMS. E- Circular to all local banks on Basel Committee’s Operating Guide Concerning Risks associated with the settlement of FX transactions, and the mechanisms proposed to the public and private sectors for containing these risks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Jumada Al-Akhir 6, 1423 H
August 14, 2002
THE CHAIRMAN,
Circular to All local Banks
I wish to point out that according to the “General Guidelines Manual on Local Banks Internal Control Systems and External Auditors Reports on the Assessment of these Systems” – endorsed by the Central Bank of Kuwait Board of Directors in its meeting on 10/11/1996 and sent to you on 14/11/1996 - it is mandatory to obtain the Central Bank of Kuwait approval of the auditors entrusted with both the assessment of your bank’s internal control systems as per the manual requirements, and the preparation of the requested relevant report. To enhance the independence of the auditing function entrusted by the bank’s General Assembly to auditors, and in order to achieve the highest possible shareholders’ confidence in the auditors reports on the bank financial data, your bank shall not assign the assessment of its internal control systems to audit offices that perform audit work or any other technical or advisory tasks for the bank. It is noted that in order to obtain the Central Bank of Kuwait approval of an auditor for carrying out the audit function or assessment of the bank’s internal control systems, that auditor shall be part of an international audit office. With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTION TO BANKS REGARDING INTERNAL CONTROL SYSTEMS. F- Circular to banks for refraining from assigning the assessment of the adequacy of its internal control systems or any other technical or advisory tasks, to the audit offices that perform auditing work for the bank.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Sha'aban 10, 1423 H
October 16, 2002
THE CHAIRMAN,
" Circular to All local Banks "
Further to the Central Bank of Kuwait circular dated 14/8/2002 to banks prohibiting them from assigning the assessment of their internal control systems or any other technical or advisory tasks, to audit offices that perform audit work for the bank. And, pursuant to the provisions of Article (20) of the Decree law No. (5) for year 1981 regarding the exercise of the auditing profession, which prohibits auditors from exercising any other occupation conflicting with that of auditing, particularly the occupations distinctly mentioned in that article. We wish to clarify that your bank shall refrain from assigning the assessment of the adequacy of its internal control systems or any other technical or advisory tasks, to the audit offices that perform audit work for the bank, whilst also not assigning other technical or advisory tasks of auditing nature (such as designing accountancy records, providing advice on alternative accountancy treatments) to companies that have legal or economic ties with these offices, whether such ties are through joint ownership or joint management. Therefore, your bank may entrust these companies with only other technical or advisory tasks of no auditing nature (such as the preparation of feasibility studies, action plan review, developing the salaries and wages structure, and the provision of advise on personnel recruitment) With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTION TO BANKS REGARDING INTERNAL CONTROL SYSTEMS G- Circular to banks for refraining from entrusting the assessment of the adequacy of its internal control systems or any other technical or advisory tasks of an auditing nature, to companies that have legal or economic ties with the audit offices that perform audit work for the bank.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Sha'aban 17, 1424H
October 13, 2003
THE CHAIRMAN,
" Circular to All Local Banks"
Guiding principles for sound practices for the management and supervision of operational risk at banks Basel Committee for Banking Supervision issued a set of Principles for Sound Practices for the Management and supervision of Operational Risk in banks. The main areas covered by these principles are as follows:
(1) Stressing the importance of defining operational risk as belonging to a distinct category of risks alongside credit, market and interest rate risks. The Committee is adopting that approach, in keeping with the main development trends in the operational risk issue. (2) Determining the principles underlying sound practice in the management and supervision of operational risk in banks, and the role of the Board of Directors and Senior Management in setting up, endorsing and applying adequate framework in this regard, including policies and procedures,. (3) That each bank – independently of the size of its business – lays down policies and procedures (framework), to determine, evaluate and supervise operational risk, as part of the overall risk management system, in line with the Basel Committee’s directives. (4) That banks adequately disclose information to allow market participants to evaluate banks’ approach to managing operational risk. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
In keeping with the policy adopted by Central Bank of Kuwait for the alignment of Kuwaiti banking business with international practices in that field, we have attached hereto a copy of the mentioned guiding principles, for your observance of the requirements provided therein, at the earliest possible convenience. In this context, we wish to stress the content of Central Bank of Kuwait instructions provided in the general guidelines manual on internal control, issued on 14/11/1996, along with the instructions issued on 26/6/1997, in regard to establishing a specialized unit and setting up a system for the assessment and management of risks, in fulfillment of the needed supervisory regulations for managing risks at banks in general. With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Guiding principles for sound practices for the management and supervision of operational risk General principles and definitions 1 - Over the last few years, the banking business witnessed incessant quantitative and qualitative changes in regard to products and services. These developments were accompanied with the application of advanced and complex technologies in the electronic processing of data and information, and paralleled by an increase in operating risks at banks, whereby these risks developed into a distinct category alongside the categories of credit, market and interest rate risks. Within the context of subjecting these developments to the international rules and standards applied in banking business, the Basel Committee issued guidelines to banks, encompassing principles of sound practice for the management and supervision of operational risk. Such guidelines are based on those principles. 2 - Operational risk has been defined as the “ risk of loss resulting from inadequate or failed internal processes people and systems or from external events “. Examples of these risks include risks deriving from the electronic processing of data, and those deriving from over-extended usage of electronic banking, along with risks concerning system security, breach of confidentiality, fraudulent operations perpetrated from inside or outside the institution, misuse of clients’ information, as well as risks associated with banks’ mergers, shift in systems’ usage, money￾laundering, practices of illicit activities, and damage to physical assets or property due to deliberate acts of violence or natural disasters, in addition to risks resulting from vendor disputes, risks concerning salaries and compensation claims, and legal risks. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
3 - Though the term ‘Operational Risk’ may have a variety of meanings within the banking industry, and though the policies required for managing these risks may vary among banks in light of the divergence in size and nature of business, as well as the difference in levels of relatedness among the components of each bank’s business, there are still several elements common to them all, which constitute the structure of operational risk management, regardless of the differential in business size among banks. This requires each bank to determine the operational risk which constitute the main reasons of operating losses, along with laying down the policies and procedures that are appropriate for the management and supervision of these risks, and in tune with the size and nature of each bank’s business, within the context of managing all types of risks which the bank is exposed to. 4 - Though it is noted that the issue of operational risk is not new to banks, an important current trend in that regard is represented in the efforts of international financial standards to set up systems and instruments for managing theses risks as belonging to a distinct category, at an equal level with the management of other risk categories. *Principles of Sound Practice for the Management and Supervision of operational risk Considering the general principles and definitions, banks have the following obligations:
First : Laying down policies and procedures for the management of operating risks, including the principles of how operational risk is to be identified, assessed, monitored and controlled. These policies shall be regularly endorsed and reviewed by the Board of Directors. Second: Subjecting the policies and procedures for the management of operating risks to effective and comprehensive internal audit by qualified auditors. The Board of Directors shall ensure that the scope and periodicity of audit are commensurate with the level of bank’s exposure to operating risks, and that the audit reports indicate the extent of effectiveness of these policies. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Third : Applying policies and procedures for the management of operational risk, as a consistent effort between the organization units at the bank, along with informing all staff members and officials of all aspects involved into the management of these risks; The bank’s senior management is considered responsible for laying down and applying these policies, along with their development to fit the management of operational risk associated with the bank’s products and activities. The Senior Management shall ensure that individuals in charge of managing operational risk are in constant contact with those in charge of managing credit and market risks, within a coordinated framework that serves the objectives of managing the bank’s overall risks. Fourth: Identify and assess the operational risk inherent in all material products, activities, processes and systems. An adequate assessment procedures should be taken before introducing new products. Within that context, the bank shall be aware of the internal factors influencing operational risk, such as the bank’s structure, the nature of its activities, and its human resources, along with identifying and evaluating the relevant external factors, such as changes in banking work and developments in information technology. When assessing operational risk, the bank shall identify the areas of weakness and strength in its operating procedures and regulations. In order to enhance the efficiency of risk measurement, each bank may develop its particular working methods, so as to transform qualitative operating risks into quantitative measurement risks. Fifth : Applying appropriate measures to monitor the various aspects of operational risk likely to entail high losses, and providing senior management and the Board of Directors with regular reporting of pertinent information. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Within this context, the bank may use indicators that provide early warning of any increase in risk levels, with a view to confronting and containing these risks. The level of monitoring shall be commensurate with the risks involved and the frequency, and the nature of the change in the operating environment. Feedback from oversight of risks, shall be in the form of reports submitted to the Board of Directors by the Unit in charge of Risks Management and Internal Auditing. These reports shall comprehensively highlight all risks’ aspects and the prompt measures necessitated in remedying them. Sixth: Carrying out a periodic review of the risk limitation, and the control strategies, along with adjusting these strategies in light of the development in overall risks at the bank. Within this context, the bank shall determine the risks to be subjected to control, develop documented policies for the system applied in their management, identify those activities whose risks can be handled through insurance, and firmly establish the concepts underlying an integrated internal control system for the bank’s activities. Additionally, the bank shall grant particular significance to internal control whenever operating risks become more prominent, such as when the bank starts up new activities, or develops or launches products which are not part of its core activities, or channels these products to non-conventional markets. Seventh: Laying down contingency and business continuity plans, so as to guarantee the continuity of bank’s business at minimum loss, in case of disruption in activity. Within this context, banks should have in place emergency plans, encompassing potential risk scenarios, in the event of failure of instruments, equipment and communication networks. These plans shall also be periodically reviewed to allow for their amendment, as required by developments in the bank’s business or in the banking environment. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Eighth: Banks shall persevere in their efforts for developing and using better applications in the management of operational risk, so as to ensure a level of supervision that maintains the safety and security of banks at all times. Ninth: Banks shall publicly disclose sufficient information to allow market participants to evaluate the bank’s approach in managing operational risk. The level of disclosure shall be commensurate with the size of the bank’s operations, their nature and the types of risks associated thereto. Tenth: Banks shall submit reports on the evaluation of their policies and procedures in regard to managing operational risk. These reports shall be prepared by the auditors in charge of evaluating internal control systems, based on the instructions of the Central Bank of Kuwait issued on 14/11/1996, and subsequent instructions in this regard. 13/10/2003 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Rabi Al-Awal 14, 1425 H
May 3, 2004
THE CHAIRMAN,
Circular to all local banks and investment companies subject to the Central Bank of Kuwait (CBK) supervision Principles of Good Corporate Governance in Financial Institutions Corporate Governance rose to the forefront of issues handled by the economic administrations of countries worldwide over the last few years, following the financial crises which befell major shareholding corporations and affected confidence in the soundness of their management and the reliability of their published financial results, along with bringing about other negative consequences. Interest in that issue also increased, with the separation of management from ownership becoming more dominant in modern corporations, and leading to potential conflicts of interests between management and shareholders. Banks and investment companies in the State of Kuwait operate in a supervisory and regulatory environment that provides a legislative framework propitious to the sound management of these institutions, particularly as supervisory regulations and instructions issued by Central Bank of Kuwait address the various aspects of banking and financial activities of these institutions’. However, as substantial risks ascribed to unsound corporate management practices materialize every now and them worldwide, the issue of good corporate governance has been gaining further prominence. Consequently, Central Bank of Kuwait considered it important to issue directives to banks and investment companies that are directly related to the issue of good corporate governance in financial institutions, so as to back up the controls mentioned in its previous instructions with regard to good governance principles, and complement these instructions with an additional set of principles of good corporate governance in banks and investment companies. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Attached is a copy of these directives, noting that the application thereof should clearly reflect in the management structure, as well as the policies and practices, of banks and investment companies. We hope that these directives will provide an incentive for financial institutions in the State of Kuwait to apply the best practices of corporate governance. With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Directives to banks and investment companies regarding principles of good governance in financial institutions Directives and general principles

1. Over the last three decades, the world witnessed significant
   transformation in the private sector’s role in economic development and job creation. Meanwhile, more countries adopted the market system as a guide for their economic policy. These developments coincided with an increased awareness of the role of corporations in economic life and individuals’ welfare. There has also been an increase in awareness in the importance given to the issue of good corporate governance, especially as separation of ownership and management in modern corporations became more widespread, thus entailing potential conflicts of interest between the management and shareholders. In the last few years, this issue ranked first on the agenda of the economic administrations in various countries, as a result of the financial crises which befell major shareholding corporations and affected confidence in the soundness of management in these corporations, the reliability of their published financial results, and consequently the true value of their shares in the securities markets, in addition to other negative consequences. Consequently, the current trends in the good governance of listed corporations stresses that these corporations are part of an integrated economic system which influences and is influenced by the domestic, regional and international environments, thus necessitating the performance of control and auditing tasks. This has further confirmed the significance of internal and external auditing functions, and the Board’s responsibilities in the formation of auditing committees to efficiently monitor corporation’s operations and to enhance the efficiency and effectiveness of the Board’s participation in operations control. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
2. According to the OECD’s Ministerial Council’s definition of
‘Corporate Governance’ – which is also one approved by the Basel Committee for Banking Supervision, Corporate Governance involves “a set of relationships between a company’s management, its board, its shareholders, and other Stakeholders. Within that definition, theses principles mentioned that corporate governance shall also provide the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined. Good corporate governance should provide proper incentives for the board and management to pursue objectives that are in the interests of the company and shareholders and should facilitate effective monitoring, thereby encouraging firms to use resources more efficiently.” Thereby, corporate governance is based on striking a balance between the powers vested in the corporation’s management and the protection of shareholders and stakeholders’ rights. Good governance and transparency are among the core foundation of corporate management.
3. Review of the set of principles mentioned in the OECD’s paper on
corporate governance, and the principles and directives issued by the Institute of International Finance on corporate governance and transparency in emerging markets, and the principles and directives mentioned in the Basel Committee paper on enhancing corporate governance for banking organizations, good corporate governance cover the following main areas. Protecting shareholders’ right and the equitable treatment of shareholders, respecting and protecting stakeholders’ rights, defining the responsibilities of the Board and Executive Departments, in addition to disclosure, transparency and good practice, along with stressing the importance of the role of Internal and External auditing and auditing committees.
4. Within the areas covered by the good governance principles, the
legislative and regulatory framework applied in the State of Kuwait - particularly Law No. (32) of Year 1968 concerning Currency, the Central bank of Kuwait and the Organization of Banking Business, and the set of regulations and instructions issued by the Central bank of Kuwait (CBK) regarding the various activities of financial institutions￾covers many important aspects pertaining to good governance in 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
financial institutions. Furthermore, the Commercial Companies Law No. (15) for year 1960, and the laws issued in regard to regulating the Kuwait Stock Exchange (KSE) and the decisions issued by KSE’s management, also encompass several controls and provisions connected to the main areas underpinning the principles of good corporate governance in the State of Kuwait.
5. As the issue of corporate governance is commanding increasing
attention internationally, due to the graveness of risks occurring in international markets from time to time, as a result of unsound practices, Central Bank of Kuwait considered it important to issue directives to banks and investment companies in regard to good corporate governance in financial institutions, in order to stress the principles encompassed in its previous relevant instructions, and to complement these instructions by additional principles that Central Bank of Kuwait deemed appropriate in the matter of good practice at banks or investment companies. Following are the main areas underlying the good corporate governance principles to be applied by banks and investment companies, noting that the above mentioned general directives and principles provide the basis for encouraging financial institutions in the State of Kuwait to imply the best practices connected thereto. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
First: protecting shareholders rights and equitable treatment of shareholders The financial institutions’ framework, policies and practices, shall conform with the controls and procedures provided for in the laws, regulations and instructions issued by the various supervisory authorities, in regard to protecting shareholders rights and the equitable treatment of shareholders, as follows:

1. Protecting basic shareholders’ rights in regard to ownership registration,
   conveyance or transfer of shares; participation and vote in general shareholder meetings; sharing in the profits of the corporation; and, obtaining information on the corporation on a timely and regular basis.
2. Confirming shareholders’ right to be sufficiently informed of and to
   participate in decisions concerning changes in the company’s Memorandum of Agreement and Articles of Association including amendments to the company’s capital, by issuing new shares to shareholders or issuing shares under the employee share options or through the repurchase of shares, in addition to decisions concerning extraordinary transactions that affect the destiny of the company or the conduct of its business, such as mergers, sale of a tangible portion of the company’s assets, or giving up the company’s subsidiary.
3. Confirming and ensuring that shareholders participate effectively in
   general shareholder meetings and are informed of the voting rules and procedures, including furnishing shareholders with information concerning the date and agenda of general meetings, before a reasonable time of the meeting taking place, so as to enable them to prepare for the requirements of the representation system (proxy voting). The date and venue of the meeting shall be published publicly, according to the laws, regulations and instructions issued in this regard.
4. Capital structures and arrangements that enable certain shareholders to
   obtain a degree of control disproportionate to their equity ownership should be disclosed.
5. The corporate governance framework should ensure that all
   shareholders, including minority and foreign shareholders are treated equitably, and allowed to question the Board’s decisions and to obtain redress for violation of their rights. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Second: the role of stakeholders
Stakeholders are those individuals, institutions and bodies connected to the financial institution (such as depositors, borrowers, creditors, investors, employees, and the society as a whole). In this area, enhancing good corporate governance requires the following:

1. The institution framework, its policies and practices should
   recognize the rights of stakeholders as established by the laws, regulations and instructions issued in this regard, and encourage co￾operation between corporations and stakeholders in supporting development, creating jobs for the national manpower, and the fostering of the financial soundness of these corporations. Financial institutions shall realize that an important aspect of good governance is to ensure funds’ inflows. Therefore, final success is the fruit of a joint effort by several parties, namely depositors, borrowers, employees, investors and others who have working relationships with these institutions. Banks and financial institutions shall realize that their interest lies in the long term into supporting wealth creation through joint cooperation and all stakeholders’ participation. Worth mentioning is that Law No. (32) of Year 1968 concerning Currency, the Central bank of Kuwait and the Organization of Banking Business, and the set of regulations and instructions issued by the Central bank of Kuwait (CBK) regarding the exercise of the activities of financial institutions, encompass controls and principles that provide necessary protection to stakeholders’ rights, particularly the rights of depositors, borrowers and shareholders, so as to guarantee the safeguard of the financial positions of these institutions and to activate these institutions’ role in serving the society and the economic development process. Therefore, these institutions’ abidance by controls provided for in the regulations and instructions issued by the Central Bank of Kuwait in regard to the exercise of their activities, constitute the general framework for the main areas underlying good corporate governance in financial institutions. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
2. The institution framework, its policies and practices should ensure the
rights of stakeholders to obtain effective redress for violation of their rights, as provided for by the relevant laws.
3. Where stakeholders participate in the corporate governance process, they
should have access to relevant information, according to the nature of their participation. Third: disclosure and transparency A strong disclosure regime is a pivotal feature of market-based monitoring of companies and is central to shareholders’ ability to exercise their voting rights. Disclosure is considered a powerful tool for influencing the behavior of companies and for protecting investors. The stronger a disclosure regime, the more effective it will be in contributing to the enhancement of confidence in the capital markets. Shareholders and potential investors require access to accurate and material information in sufficient detail for them to assess the management of companies, and make appropriate investment decisions. Material information can be defined as information affecting the price of the company’s shares or information whose omission or misstatement could influence the economic decisions taken by users of information. Within this context, the enhancement of good corporate governance in financial institutions requires that the corporate framework should encompass an adequate mechanism which ensures that timely and accurate disclosure is made on all material matters regarding the corporation, including the corporation’s financial situation, performance, results of activities, changes in ownership, and management of the company. Additionally, disclosure encompasses any other matters required by the laws and instructions issued in this regard, particularly the disclosure requirements mentioned in Central Bank of Kuwait instructions in regard to the exercise of financial institutions’ various activities, and the instructions issued in regard to the Kuwait stock Exchange. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
These principles support the timely disclosure of all material developments that arise between regular reports. They also support simultaneous reporting of information to all shareholders in order to ensure their equitable treatment. Disclosure should include as a minimum all information and data required by the laws and instructions issued in this regard, such as:

1. The financial and operating results of the company, represented in the
   balance sheet, the profit and loss statement, the cash flow statement and notes to the financial statements, noting that the goals of that disclosure are to provide the essential information and data on the basis of which shares are valued, and to enable appropriate monitoring of the institutions’ performance.
2. Ownership structure by major shareholders and others that control the
   institution. Disclosure of such information is One of the basic rights of investors.
3. Members of the Board and key executives, and their remuneration,
   including benefits extended to them by virtue of the share option schemes. Such information is necessary for investors to evaluate the experience and qualifications of the members of the Board and key executives, and assess any potential conflicts of interest that might affect their judgment.
4. Material issues regarding employees and other stakeholders that may
   materially affect the performance of the institution.
5. Nature and size of dealings with stakeholders who have influence or
   control over the institution, including management employees in senior positions.
6. Disclosure of the institution’s structures and policies, regarding the
   application of corporate decisions and policies, and the division of authority between shareholders, management and board members. Such disclosure is important for the assessment of a company’s management. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
7. Company objectives and policies relating to business ethics, and its
commitments towards the environment and the public. Disclosure of such information may be important to better evaluate the relationship between companies and the communities in which they operate.
8. Systems and mechanisms applied by the institution in managing and
controlling the various risks associated with banking and financial business. Disclosure of these systems is a requirement for evaluating the institution’ management in regard to controlling those risks, and for assessing the extent and size of risks the institution may be exposed to in light of the size and nature of its activities.
9. Financial statements shall be prepared and disclosed in accordance with
the International accounting Standards, or any approved relevant standards, according to the various supervisory authorities’ decisions, particularly according to the Central Bank of Kuwait instructions regarding the external auditor’s reports.
10. The institution shall ensure that channels for disseminating information
provide for users’ access thereto, in a timely manner and at a fair cost. Fourth: responsibilities of the board and executive management Responsibilities of the board The institution framework should ensure the strategic guidance of the company, the effective monitoring of management by the Board, and the Board’s accountability to the company and the shareholders. The main requirement of good governance is exemplified in a Board which delivers its responsibilities in line with the institutions’ objective, and in furtherance of its significant activities. Within this context, the application of good corporate governance in financial institutions requires from the Board to exercise its functions in the fulfillment of the following responsibilities:
28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Core responsibilities

1. The Board should exercise its functions, through joint and independent
   action. Board members should devote sufficient time to their responsibilities, and act in good faith, with due diligence and care, and in the best interest of the company and the shareholders.
2. Where Board decisions concern shareholders’ affairs, the Board should
   treat all shareholders fairly.
3. The Board should ensure compliance that the interests of stakeholders
   are taken into account in the performance institutions’ activities, in compliance with the law and instructions issued to that effect.
4. Board members should base their decisions on relevant, accurate and
   timely information.
   Strategy and planning
5. Board members should select executive staff on the merit of
   educational qualifications and the possession of the required experience in the area of banking and finance, while observing the provisions on qualifications controls according the law and instructions issued by the various supervisory authorities in this regard.
6. The Board shall lay down the institution’s corporate strategy, annual
   plans of action, performance objectives, in addition to the policies for managing and monitoring various risks, by drawing on the executive management staff, or on external experts and advisors if need be.
7. Reviewing and directing the institution’s strategy, work plan, and
   annual planning, along with monitoring the execution and application of plans, and assessing actual against targeted performance. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Organizational structure and internal control
8. The Board shall endorse an organizational structure which fits the
nature of the institution’s business and activities, and provides the needed organizational controls for the execution of the strategy endorsed by the Board, by means of defining each organizational unit’s objectives, functions, responsibilities, in addition to setting the lines of communications for administrators at various levels, so as to achieve dual control and separation of duties; thereby avoiding conflict between functions and operating risks. This necessitates making available user manuals, policies and procedures for the execution and monitoring of operations, along with setting job descriptions for all position levels, and defining the required qualifications and experience for holders of these positions.
9. the Board shall periodically make sure that the internal control systems
have the required adequacy and effectiveness for safeguarding the institution’s property and assets, and shall ensure the accuracy of the institution’s financial statements and the efficiency of its operations from the administrative, financial and accounting perspectives, along with ascertaining that such controls provide the needed protection against any illicit interference from inside or outside the institution.
10. The Board shall ascertain that the internal audit function is independent
and internal auditors are competent, and that the scope, procedures and periodicity of audit are commensurate with the level of risks associated with the institution’s various activities. The Board shall appoint the head and staff of the internal audit, and define their privileges to ensure the principles of audit independence and competency. For better effectiveness the Board shall benefit from the audit notes, and require from the external auditor to assess the efficiency of internal control. The Board shall consider both the internal and external auditing important supervisory instruments and avail of the audit reports as an independent review of the information submitted to the Board by the Executive Management. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Oversight of executive management
11. The Board shall evaluate the Executive Management’s performance and
determine its ability with regard to executing the internal control policies and procedures, evaluating achievements against targeted results, and making necessary amendments accordingly.
12. The Board shall oversee the major capital expenditures, review key
executive and Board members remuneration, and ensure a transparent remuneration process.
13. The Board shall draw on the Executive Management’s expertise in the
execution of the Board’s decisions, without however interfering with the Executive Management’s responsibilities. Contribution of a Board member to the execution of the Board’s decisions shall be by virtue of a proxy issued by the Board and subject to the latter’s perusal of what has been achieved in this regard.
14. The Board shall ascertain the Executive management’s compliance with
the laws and instructions issued by the various supervisory bodies, as well as with the Boards’ decisions, regarding the institution’s various activities, so as to protect it from non-compliance risk. Professional practices and management of conflicts of interests
15. The Board shall manage and monitor potential conflicts of interest of
management, Board members and shareholders, including misuse of corporate resources and abuse in related party transactions.
16. The Board shall observe the confidentiality of customers’ information
and data, according to the provisions of the laws and instructions issued by supervisory bodies in this regard.
17. Board members shall not make use information that becomes available
to them about the situation of the institution, for achieving personal interests or the interests of other connected parties. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Responsibilities of the board towards shareholders and supervisory bodies
18. The Board is responsible towards shareholders, and other concerned
parties and bodies, for the integrity of the institutions financial statements and the results of its activities. These data shall be transparent and objective, and disclose all transactions with connected parties, according to the laws, decisions and instructions issued in this regard.
19. The Board is responsible towards the supervisory authority of the
soundness of the institution’s financial position, and the protection of shareholders and depositors’ rights. The Board is responsible of the integrity and transparency of financial data and information submitted to CBK, and shall ascertain the institutions’ abidance by the laws, decisions and instructions issued by CBK in this regard. Compensation of board members
20. The Board members’ financial compensation package (remuneration,
allowances, etc.) shall be commensurate with the importance and burdens of their charges, and constitute for them an incentive to exercise their functions as may best serve the interest of the institution and its shareholders., and abide by their responsibilities in this regard; nonetheless, such compensation package shall not be overstated. Role and responsibilities of the executive management The institution’s Executive Management encompasses the Chief Executive Officer –which is the General Manager- and its assistants for the various operations, along with the administrative and technical committees formed according to written and authorized decisions. Within the context of the exercise of good governance in financial institutions, the responsibilities of the executive management are as follows:
1- Propose work strategies, plans and policies for the institution’s banking and financial operations, subject to Board’s approval. Such policies shall be based on adequate experience in that area. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
2- Executing the Board’s approved policies in regard to the institution’s various activities and operations, and laying down appropriate mechanisms to ascertain abidance by the responsibility of applying these policies. 3- Any important Board’s decision shall be taken in participation with one or more, key individual from the Executive Management. 4- Providing the Board with regular financial and administrative reports on the application of the Board’s approved policies, the progress of the institution’s activities and the result of its operations, along with comparing actual with targeted performance rates, determining deviations and causes thereof, and presenting any suggestions for the modification and activation of these policies, as needed. The Executive Management shall abide by the transparency and objectivity principle in the reports it submits on the institution’s operations. 5- The Executive Management shall be responsible for ensuring compliance with the laws, regulations and circulars issued by the Central Bank of Kuwait and other supervisory bodies regarding the activities and operations carried out by the institution, so as to avoid its exposure to non- compliance risks, such as penalties, financial losses, and reputation risks. The Executive Management shall lay down the needed policies for ascertaining such compliance. 6- The Executive Management shall operate according to professional ethics’ standards, and lay down the needed instruction for the application of these standards by all staff members. Additionally, the Executive Management shall, whenever needed, include in its policies, the controls for the abidance by professional ethics’ standards. 7- The Executive Management shall prepare the institution’s financial statements according to the International Accounting Standards, or any approved or issued standards in this regard. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Fifth: auditing committee and the committees issued from the board The effective oversight of the institutions operations requires from the Board to form sub-committees as needed for enhancing the efficiency and effectiveness of participation in operations’ oversight. The formation of Auditing Committees in banks and financial institutions are considered a requirement of good governance, and are a top priority in these corporations’ policies. According to good governance practices and relevant international directions, the formation of these Committees and the determination of the functions thereof, shall be undertaken within the following framework:
1- The Committee shall be formed by Board’s decision, and encompass three members (chairman and two members) elected by the Board among those of its non-executive members with adequate expertise in the analysis of financial statements. The Committee will remain operational through the Board’s tenure. The Board shall also set the remuneration of the Committee members’ as it deems appropriate. 2- The Auditing Committee shall operate under the Board’s oversight, and shall provide the Board with reports and recommendations based on its findings in the exercise of its functions. 3- The core functions of the Auditing Committee shall encompass:

• Overseeing the external auditing of the institution’s activities,
  reviewing audits’ comprehensiveness and verifying the occurrence of cooperation between external auditors in case of more than one external auditor.
• Overseeing internal auditing; reviewing and approving audits’
  comprehensiveness and periodicity of.
• Receiving audit reports and ensuring that proper measures are taken to
  redress any reported deficiency in supervision.
  28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls

• Ascertaining the institution’s compliance with policies, laws and
  instructions.
• Reviewing the adequacy of the institution’s internal auditing
  regulations, including the policies and procedures relevant to sound practice in the management and control of various types of risks.
• Reviewing the bank’s financial statements before their submission to
  the Board, to ensure that CBK’s instructions are abided by.
• Providing the Board with periodic reports on internal and external
  auditing matters.
  4- The Auditing Committee shall meet at least once every three months, or as need arises, or at the request of its other two members; whereby the meeting will be legal if attended by at least two members. The head of the Internal Auditing shall participate in the regular meetings of the Auditing Committee. The Auditing Committee may invite any individual from within the institution, to avail of his opinion when discussing a certain matter. 5- The Board’s Secretary will be the Auditing Committee’s secretary and take minutes of its meetings. These minutes, along with the minutes of the Board meetings, shall be part of the institution’s records. Formation of other committees It is appropriate for a financial institution to consider – according to the size and nature of its activities- the need for forming other committees issued from the Board, to contribute to more effective control by the Board over the important operations at the institution, e.g. the formation of a hiring committee with the duty of selecting a managerial staff whose qualities and qualifications are appropriate for the institution’s activity, and a compensation committee which will set remunerations and compensations in line with the interest of the institution and its shareholders. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS I- Circular concerning the principles of good corporate governance in financial institutions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Thu Al-qi'da 1, 1422 H
January 14, 2002
THE GENERAL MANAGER,
" Circular to all Local banks "
It has been noticed during the past few years that some local banks compete on extending electronic banking services (E-banking) through the Internet. Despite the advantages the Internet provides for both banks and customers, yet e-banking involves multiple risks that do not considerably differ from those of other typical traditional banking services, but the respective bank should be fully aware of such risks and should develop appropriate means to manage them and to take precautionary actions in relation thereto. Within this context , the Basle Committee passed in May 2001 a paper entitled “Principles of e-Banking Risks Management”. This paper comprised 14 principles which constitute a directory model to be used for ascertaining the integrity of e-banking at the respective bank. The principles of managing e-banking risks are classified into three general and interrelated categories:
a- Supervision and control of board of directors and top management. b- Monitoring controls c- Management of legal risks and reputation risks. Since your bank has launched the e-banking services, such services must be guided by the principles addressed in Basle Committee paper, noting that those principles do not represent the minimum nor the best available application. Accordingly your bank has to initiate all procedures and systems that ensure proper management of those operations. Additionally, your internal control systems should cover and be consistent with the types of such operations. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS J- Circular concerning the need for following the guidelines of Basel Committee's Paper on Principles of e-banking risks management.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
You may have a copy of the Principles of e-banking Risks Management from the website of International Bank for Settlements on the Internet:
www.bis.org
Best Regards,
Ibrahim Ali Al-Qadhi
Manager of Supervision Department
28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS J- Circular concerning the need for following the guidelines of Basel Committee's Paper on Principles of e-banking risks management.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
DEPUTY GOVERNOR
Jumada Al-Akhir 4, 1426 H
July 10, 2005
THE CHAIRMAN,
“Circular to all local banks”
Guidelines on the Establishment of the Compliance Function and its Role in Banks The Basel Committee on Banking Supervision issued in April 2005 a paper comprising a set of principles entitled “Compliance and the Compliance Function in Banks”. In order for the Central Bank of Kuwait to ensure further organization of the banking business and its direction in the manner conducive to the soundness and integrity of the financial position of banking system’s units, and in order to ensure that such units shall not be exposed to any crises that may arise from non-compliance with the banking rules and regulations in conducting their business, and since the mentioned guidelines on the establishment of a compliance unit, as presented by the Basel Committee, are complementary to the Central Bank of Kuwait’s methodology of ensuring the compliance of the banking business in Kuwait with the best international practices in this regard, we recommend that you visit the website of the Bank for International Settlements - Basel Committee on Banking Supervision :
www.bis.org/publ/bcbs113.htm to review the mentioned paper and to seek the guidance of those principles. With my best regards, DR. NABEEL AHMED AL MANNA’E 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS K- Circular regarding .the need for following guidelines issued by Basel Committee in April 2005 on the establishment of the compliance function and its role in banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
GOVERNOR
Ramadhan 4, 1427 H
September 26, 2006
THE CHAIRMAN,
" Circular to All Local Banks "
Despite the tangible progress local banks have achieved in technological applications and the positive reflections of these applications on the level of customer service, yet the inspection carried out on local banks has revealed a number of gaps in some aspects of the internal control systems in some local banks. These gaps relate to the applications of some IT systems or the general control systems. This requires the respective banks to take the necessary actions for bridging such gaps, while taking the following regulatory controls into consideration, given the risks involved:

1. Some banks have not got the ratification of their boards of directors for
   the Disaster Recovery and Business Continuity Plans. These plans are also not updated to reflect the latest activities and products of the bank that should be incorporated into such plans. Furthermore, it was also observed that some banks have not tested the subject plans to ensure their efficiency.
2. It was noticed in some cases that the powers delegated to the users of a
   banking system of some banks give the employees a set of delegation levels to enter, execute and amend the data - a case which is in conflict with the principle of segregation of duties. This is the result of giving such employees new delegated powers without canceling the previous delegations that are in conflict with the new ones and with the principle of dual control. Moreover, it was also noticed that there are active delegated authorities for some systems users whose service with some bank branches has ended. This situation requires banks to review the powers delegated to the systems users, so as to take the necessary corrective actions. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS L- Circular concerning the enhancement of the aspects of banks internal control systems, by taking the necessary actions to rectify the deficiencies revealed in the applications of some information technology systems or general controls system in some banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
3) The inspection revealed, in some cases, that there are control gaps in
the credit cards issuance system. It was noticed that these cards are delivered to customers in an “Active” status. The cards are also kept for certain period in non-sealed envelopes pending delivery to customers. This situation requires the local banks to observe various relevant regulatory controls, such as activating such cards by customers only after the date of receipt, as well as in relation to providing dual control and cards delivery procedures.
4) It was also noticed that the funds recovered to the favor of customers
after the settlement of disputes on some customers card transactions, are transferred to the respective customers accounts only after a long period from the date of posting such amounts into the bank accounts. Such a period may extend to more than six months. Therefore, banks must refund these amounts to customers without any delay and during a period not exceeding one month from the date of recovering the amounts.
5) In the area of checking the data of the report on suspicious
transactions, it was noticed that the statement of financial transactions report electronically transmitted to the Central Bank of Kuwait on a daily basis (and which include the FCT file and the LCT file for amounts equivalent to or exceeding KD 3,000, or the equivalent in foreign currency), does not include in some cases all the transactions carried out in the bank. This situation requires the local banks to ensure regular consistency of the report.
6) The Central Bank of Kuwait noticed that the internal audit plans of
some banks do not include sufficient coverage of certain important areas of the IT systems. This situation requires banks to give due attention to internal audit of IT systems. 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS L- Circular concerning the enhancement of the aspects of banks internal control systems, by taking the necessary actions to rectify the deficiencies revealed in the applications of some information technology systems or general controls system in some banks.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls
Although most of the above mentioned observations relate to the Internal Control Systems in regard of which the Central Bank of Kuwait issued its instructions to local banks, particularly the guidelines on internal control systems, and the circulars issued with respect to corporate governance and management and control of operational risks, yet given the special nature and significance of the subject observations, the respective banks must enhance the controls applied in this respect. With my best wishes, SALEM ABDUL AZIZ AL-SABAH 28- INSTRUCTION TO BANKS CONCERNING INTERNAL CONTROL SYSTEMS L- Circular concerning the enhancement of the aspects of banks internal control systems, by taking the necessary actions to rectify the deficiencies revealed in the applications of some information technology systems or general controls system in some banks.