Instructions to Finance Companies Regarding Internal Control Systems

A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. 9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. THE GOVERNOR Shawwal 27, 1434 H September 3, 2013 THE CHAIRMAN, Circular No. (2/FS, IFS/312/2013) to All Financing Companies subject to the Supervision of the Central Bank of Kuwait In the context of keeping up with the developments in corporate governance standards, especially in light of what was revealed by the global financial crisis that weak governance and the failure to implement sound practices were among the group of factors that contributed to the outbreak of that crisis, and in accordance with the requirements of Article (217) of Law No. 97 of the year 2013 to amend some articles of Decree-Law No. (25) of the year 2012 issuing the Companies Law, which stipulates that “the relevant regulatory authorities shall set the rules of governance for the companies under their supervision, in order to achieve the best protection and balance between the interests of the company's management, its shareholders, and other stakeholders related to it, as well as providing the conditions that must be met by independent members of the board of directors”. The Central Bank of Kuwait’s Board of Directors approved, in its session held on 3/9/2013, the issuance of the attached instructions regarding “Rules and Regulations of Governance for Finance Companies Under the Central Bank of Kuwait’s Supervision”, to implement these instructions as of its date. These instructions include a set of basic pillars for corporate governance standards, starting with the importance of the role assigned to boards of directors, as the instructions emphasized the need for the board of directors to assume all its responsibilities towards the company, including setting strategic goals, developing corporate governance standards on an ongoing basis, actively participating in the organization of the company and bearing all responsibilities related to the soundness of its financial position, safeguarding the interests of shareholders, depositors and stakeholders’ parties, focusing on risk management and its governance, and strengthening internal control systems, as well as internal and external auditing. These instructions also include an emphasis on consolidating the principle of the independence of the board of directors in terms of the commitment of each member of the board to carry out his role towards the company and towards all its shareholders without being under the influence of any factor that may limit his ability to consider the company’s matters and discuss them impartially and objectively. Furthermore, these instructions emphasize the importance of board members having the necessary expertise in the field of financial business, with the need to develop their expertise to keeping up with the financial developments on an ongoing basis.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Introduction The issue of corporate governance has occupied the forefront of economic administrations in different countries as a result of the financial crises that hit large joint-stock companies and led to mistrust in the soundness of management in the companies and the validity of their declared financial results and the reality of the prices of companies’ shares in the stock market which has various negative repercussions. The recent financial crisis, which worsened during the last quarter of 2008, came to reaffirm the importance of the issue of governance, in light of what this crisis revealed that weak governance standards and failures in applying sound practices, whether in banking, financial or other corporate business, was among the group of factors that contributed to the outbreak of the global financial and economic crisis. The issue of governance, especially in financial institutions, takes on special importance due to the enormity of the risks and repercussions resulting from improper practices in the financial business in light of the nature of the role these institutions play in the economic conditions. As well as in the nature and importance of the products and services that these institutions provide to the national economy. Therefore, sound governance practices are important for these institutions and the financial system, which makes effective governance one of the important pillars of financial stability. The Central Bank of Kuwait (CBK) has given the issue of governance a special importance, as it has issued, since the nineties, many instructions and controls related to the issue of governance. In May 2004, the Central Bank issued instructions related to governance (principles of sound management of banks and financial institutions), guided by the principles of corporate governance issued by the Organization for Economic Cooperation and Development (OECD) in April 2004, and by the principles issued at that time by the Institute of International Finance (IIF) concerning best practices in banking. In the context of keeping pace with the developments of international supervisory standards aimed at strengthening governance standards in banks and other financial institutions, CBK issues these instructions concerning “rules and regulations of governance for finance companies under its supervision”, to replace the instructions issued in April 2004. These instructions include the development of the aforementioned corporate governance standards, taking into account the lessons learned from the recent global financial crisis and the new governance standards issued in this regard, particularly the paper issued by the Basel Committee on banking supervision, in October 2010, concerning “The Principles for Strengthening Corporate Governance”, and the
principles issued from the Financial Stability Board regarding remuneration systems, and the recommendations that came in the World Bank Working Group’s report regarding the evaluation of governance standards in Kuwaiti banks issued in late 2010,

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. in addition to what standards are applied in some countries in the region. The new standards also took into consideration the structure of the Kuwaiti financial sector, the basic features of the economy and the degree of its integration with the global economy, and other factors that would emphasize the importance of the issue of governance in financial institutions. These instructions included a set of basic pillars for the standards of governance, starting with the importance of the role assigned to boards of directors, as the instructions emphasized the need for the board of directors to assume all its responsibilities towards the company, including setting strategic objectives, governance standards, and effective participation in organizing the company and bearing all responsibilities related to its financial integrity, as well as maintaining the interests of shareholders, creditors and other stakeholders, focusing on risk management and governance, strengthening internal control systems, and internal and external auditing. The instructions include the emphasis on consolidating the principle of the board of directors’ independence in terms of the compliance of each member of the board to carry out his role towards the company and all its shareholders without being under the influence of any factor that may limit his ability to consider the company's matters and discuss them impartially and objectively, taking into consideration the protection of the minority’s rights. These instructions emphasize the need for members of the board of directors to undertake their role in developing the public trust in the company’s management so that the board of directors takes into account, in terms of enhancing the company's profits, the impact of risks on the interests of creditors and other stakeholders and on the financial stability. The instructions emphasize the importance of board members having the necessary expertise in the field of financial business, with the need to continuously develop their expertise in keeping pace with financial developments. Moreover, with regards to the importance of activating the supervisory role of the board of directors and the effective supervision of the executive management, the instructions included the formation of a group of committees emanating from the board of directors with the aim of enhancing the effectiveness of the board’s control over the important operations in the company, including the governance committee, nominations committee, remuneration committee, risk committee and audit committee. In line with the development of governance standards at a global level, these instructions included updating and developing some important pillars related to remuneration systems and policy and linking them to the company’s performance
and risks not only in the short term but also in the long term, in addition to strengthening disclosure standards, and the transparency of the legal and organizational structures of these companies and their groups, which allows for risk management with ease, as well as emphasizing the importance of behavioral values as one of the important pillars of governance standards, particularly in identifying professional standards that enhance the integrity of the company,

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision.
Chapter Two: Sound Practices and Compliance with Implementing
the Instructions
First: Sound Corporate Governance Practices:
As stated in the introduction of these instructions, the practice of effective governance by financial institutions is considered one of the basic factors to strengthen trust in the financial system, and it is necessary for the proper functioning of this sector and the performance of the overall economy. The weak standards of governance may result in stumbling in these companies’ business, which may constitute high costs on the country and have consequences and repercussions that have wide implications on the economy, especially in the event of a systemic crisis that negatively affects the payment and settlement systems. Good corporate governance practices involve the distribution of powers and responsibilities, which is the way in which the company’s business affairs are organized by the board of directors and the executive management, including how to:
 Establish the company’s strategy and objectives.
 Determine the company's "Tolerance / Risk Appetite".
 Operate the company’s business on a day-to-day basis.
 Protect the interests of creditors, fulfil the obligations towards shareholders, and take into consideration the interests of other stakeholders.  Implement and execute activities in a safe, secure, and impartial manner, while adhering to applicable laws and instructions.  Manage the company, while taking into consideration not to expose the financial sector to any systemic crisis. Sound governance standards are considered an essential element in the company’s safe and sound business, as well as contribute to enhancing the efficiency and effectiveness of the control system, and protecting the interests of creditors, while the company may face high risks in the event that governance standards are not effectively implemented in which negative effects might occur on the financial sector. Companies must take into account the challenges they face in the area of governance, represented by the complex ownership structures that lack transparency and as mentioned in these instructions. Therefore, companies must ensure that their ownership structures do not impede proper governance. In all cases, sound corporate governance must ensure that many basic functions are performed appropriately, and the organizational structure of companies must include important forms of control that include appropriate regulations and balances represented by the presence of supervision from the board of directors, supervision from the executive management, direct supervision on the company's activities, and independent risk management, in addition to audit and compliance verification functions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Second:The Companies’ Compliance with Implementing these Instructions:
Within the framework of the efforts made by CBK to enhance the standards and practices of governance in the units under its supervision, and to achieve the objectives of the governance of financial institutions, it is necessary for each company within the framework of these instructions, to carry out the following:
a. Prepare a governance manual to be approved by the board of directors and publish it on the company's website, provided that the manual includes the rules and regulations contained in these instructions as a minimum, and that it is updated annually, and whenever needed. b. The company shall, within its annual report, prepare a Governance Report on the extent of the company’s compliance with the provisions of the governance manual, while explaining the application of these instructions, as well as stating the reasons for non-compliance with any clause that has not been applied in the specified cases in which the company may face, when applying some of these instructions hereof, practical difficulties, as per the principle of “Comply or Justify”.
c. These instructions, compared to the instructions issued in May 2004, has dealt
with additional issues regarding governance standards, including the expansion of the number of committees emanating from boards of directors, as contained in these instructions, the matter requires companies to make the necessary amendments in their articles of association that are in line with the implementation of the instructions, especially with regard to increasing the number of council members to meet the requirements of forming additional committees, as well as other decisions that may be required by the general assemblies regarding the implementation of these instructions. d. The independent external auditor for each company must include, in the annual report submitted to CBK, the evaluation of the internal control systems, particularly about the company’s compliance to implement these instructions. e. These instructions apply to conventional finance companies and finance companies that operate in accordance with the provisions of Islamic Sharia, and are registered in the Finance Companies Registry at CBK. In the context of implementing these instructions, companies operating in accordance with the provisions of Islamic Sharia must notice any other regulatory or supervisory controls related to their activities. f. In the framework of implementing these instructions, finance companies must notice the provisions of prevailing laws concerning the application of the instructions and standards mentioned in these instructions in this field.

General Responsibilities of the Board of Directors:
The board of directors bears the overall responsibility of the company, including setting strategic goals for the company, risk strategy, and governance standards, as well as the responsibility for implementing these goals and standards and overseeing the safety of their implementation, in addition to the responsibility for supervising the executive management. In this context, the board of directors shall:
a. Carry out all responsibilities related to the company’s operations and financial integrity, ensure that the requirements of CBK are met, safeguard the interests of shareholders, creditors, employees, and other stakeholders, and ensure that the company’s management is executed in a prudent manner and within the framework of applicable laws, instructions and internal policies of the company. b. Draw up the strategic objectives of the company in addition to supervising its executive management, which is responsible for day-to-day operations. The board shall also approve the internal control and supervisory systems, ensure their effectiveness, and the extent of the company’s compliance with the strategic plan, policies and procedures approved or required under the issued laws and instructions, as well as ensure that all company risks are properly managed.
c. Develop the concept of public trust in the management of the company by
taking into consideration the impact of risks on the interests of creditors and the financial system, and this includes emphasizing that the role of corporate boards of directors should not be limited to the concept of profitability, but also takes into account the impact of risks on the interests of creditors and on financial stability. d. Establish the principle of the board of directors’ independence and emphasize the importance of the compliance of each member of the board to carry out his role towards the company and all its shareholders without being under the influence of any factor that may limit his ability to consider, discuss and decide on company matters with impartiality and objectivity, taking into account the protection of rights of shareholders. In cases where the controlling shareholders have the power to appoint members of the board of directors, then the members of the board must exercise their responsibilities towards the company regardless of the entity that appointed them.

Monitor that executive management’s actions are consistent with the strategy
and policies approved by the board, including the risk tolerance/appetite.
Meet regularly with executive management to discuss various company’s
business.
Question and review critically explanations and information provided by
executive management.
Set formal performance standards for executive management consistent with
the long-term objectives, strategy and financial soundness of the company, and monitor executive management’s performance against these standards.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision.
5. Ensure that the members of the executive management have the educational
qualifications and professional experience as required for the nature of the company’s business and aspects of risks.
c. Ensure that the company’s organizational structure possesses the transparency
and clarity needed to facilitate effective decision making and good governance. This should include setting and enforcing lines of responsibility and accountability throughout the organization, which define clearly the key responsibilities and authorities of the board itself, as well as of executive management and the control functions. d. Ensure segregation between the posts of the Chairman and the CEO, and that there are no familial or any other relation between them which might affect the independence of the decision of each. The segregation of responsibilities shall be by means of written instructions approved by the Board and reviewed on a need basis. e. Regularly review with executive management the policies, processes and controls and/or internal control functions (including internal audit, risk management and compliance) in order to determine areas needing improvement, as well as to identify and address significant risks and issues. The board shall also ensure that the control functions are properly positioned, staffed and resourced, and that they are carrying out their responsibilities independently and effectively. f. Set out succession plans for the replacement of members of the executive management in cases of vacancy. These succession plans shall include the qualifications and requirements that must be met by the occupants of such positions.
3) Composition of the Board:
a. The board shall have an adequate number and appropriate composition of board members allowing the formation of adequate number of board committees within the framework of the requirements of sound governance standards. b.The Board shall comprise of members who have diverse knowledge and skills contributing to the independence of their decisions.
4) The Chairman of the Board (Chairman):
As the chairman of the board plays a crucial role in the proper functioning of the board and the maintenance of mutual trust among members, he shall carry out the following:
a. Ensure that the board decisions are taken on a sound and well-informed basis. He should encourage and promote critical discussion and ensure that dissenting views can be expressed and discussed within the decision-making process.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision.
i. The Board of Directors shall appoint a Board Secretary who has the
appropriate qualifications and experience, and define his duties in line with the responsibilities assigned to him, and these tasks include:
 Ensure the execution of the procedures approved by the Board in terms of exchanging information among board members, committees and the executive management.  Arrange the agenda and write down the minutes.  Write down all the Board’s discussions and directors’ suggestions, and the results of voting taking place during the meetings.  Record, coordinate and keep all board meeting minutes, records, and reports submitted to the board. The meeting minutes shall be signed by him and all the members present. The Board shall determine the Board Secretary’s functions in an official and written manner in line with the level of responsibilities referred to above. Any decision related to the appointment or discharge of the Board Secretary should be made by the Board.
6) Board Members’ Qualifications:
Board members should be and remain qualified, through training for their positions. They should have a clear understanding of their role in corporate governance and be able to exercise sound and objective judgment about the affairs of the company. In this context:
a. The board members should possess appropriate experience, personal integrity and competencies. They should also abide with good business practices and work on toning their experience through proper training. b.The board collectively should have adequate knowledge and experience relevant to key financial activities, corporate governance and effective supervision, finance, accounting, lending, financial operations, payment systems, strategic planning, governance, risk management, internal control, company’s regulations and instructions. The Board should further collectively have adequate knowledge in local, regional, international economic development as well as the organizational and supervisory environment.
c. This principle applies to a board member in his capacity as a member of the
full board and as a member of any board committee. d.The Board members should remain fully updated about the situation within the company as well as local and international financial sectors. The bank shall provide the board members with an adequate briefing of the company’s business upon appointment and during their membership term or upon request.

Rules and regulations organizing third party transactions.
Rules shall contain a clause which confirms that the same conditions
applicable to customers shall apply to the granting of credit to board members and related parties without any preferential terms. This shall also be in accordance with any CBK instructions issued in this regard.
The board member shall not be allowed to participate in the discussion of
any items on the agenda pertaining to that board member, directly or indirectly, during the meeting where such items are being discussed in addition to related transactions, dealings, or voting.
The company shall ensure the adequacy of the internal control systems in
connection to related parties, and that all transactions have been processed as per the approved policy.
The company shall ensure the adequacy of the internal control systems in
connection to related parties, and that all transactions have been processed as per the approved policy.
Each company shall set out appropriate mechanism to deal with customers’
complaints based on CBK instructions in this regard, in order to achieve the necessary protection for the customers.

A member of the board of directors should avoid activities that may lead to
a conflict of interest.
Obtaining the approval of the Board of Directors on any activity carried out
by a member of the Board that may result in a conflict of interest, and verifying that such activity will not create a conflict of interest.
The member should disclose any matter that may result, or has already
resulted, in a conflict of interest.
The member should abstain from voting on any matter where the member
may have a conflict of interest or where it may effect on the objectivity of voting.
Adequate procedures for transactions with related parties should be made on
an equal basis, and provide the way in which the board will deal with any non-compliance of the policy.
The conflict of interest policy shall include examples of cases in which a
conflict arises for a member of the board of directors.
Third: Related Parties:
a. The company shall have a formal written related party policy. This policy should contain the rules and procedures organizing transactions with these parties, whether between the company and its employees, or between the company and its board members or subsidiaries or related parties, including transactions such as lending and mutual trading with the company. b. The company shall keep records of related parties’ transactions and ensure these transactions are adequately audited.
c. The company shall disclose all its related parties based on the definition of
related parties under the International Accounting Standards. The companies shall also keep lists and monitor all transactions with existing or new related parties while taking into account the company’s approved policies.

The board members shall be committed to preserve the confidentiality of the
data and information of the company and its customers, as well as data and information of other customers, which have come to the knowledge of the company’s employees in the course of performing their duties.
No disclosure of any data or information pertaining to company and its
customers unless by authorized parties and as permitted by instructions and bylaws.
Information security of the company and its customers shall be preserved.
Supervisory controls shall be set to prevent unauthorized access thereto. The company’s board shall be responsible for setting the supervisory controls to restrict unauthorized access to such data and information, and to ensure that the supervisory controls at the company impede any leak of information that might compromise or prejudice the confidentiality.
The company’s board and the executive management should be aware of their
responsibilities in developing security awareness at the company to enhance and preserve secrecy.
No board member or employee at the company may use the information
available for him on the state of affairs of the institution for the sake of achieving self-interests or interests for other related parties.
The policies should contain that the company’s audit shall monitor its
implementation.

Establish a governance structure which contributes to the effective
supervision over the subsidiaries and which takes into account the nature, scale and complexity of the different risks to which the group and its subsidiaries are exposed to.
Assess the corporate governance structure periodically to ensure it remains
consistent with revenue growth, and increase complexity and geographic expansion.
Approve a corporate governance policy at the group level for its subsidiaries,
which includes the commitment to meet all applicable governance requirements.
Understand the roles and relationships among correspondent companies and
between them and the parent company.
Ensure that enough resources are available for each subsidiary to meet both
group standards and local governance standards of local supervisory authorities.
Provide appropriate means and instruments to ensure that each subsidiary
complies with all applicable governance requirements.
Sixth: Committees Emanating from the Board:
The board shall set up other board committees that would contribute to enhancing the effectiveness of the board’s supervision of important operations. Such committees shall submit periodic reports to the board depending on the nature of the tasks of each committee. The presence of such committees shall not exempt the board from assuming direct responsibility for all matters related to the company. In this context, the board shall carry out the following:

Prepare the governance manual and approving it by the board, so that this
manual is consistent with the instructions issued by CBK, and what is stipulated in any other laws or instructions in the field of governance.
Prepare the corporate governance report that is published in the company's
annual report concerning the company's compliance with the provisions of the governance manual.
Follow up on the application of the rules and regulations of corporate
governance by the company, and provide the board with an annual report on the correct application of these rules and other observations in this regard.
Coordinate with the audit committee in the framework of verifying the proper
implementation of these instructions.
Hold periodic meetings, with no less than two meetings per year, with the
minutes of the meetings written.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Pillar Three: Executive Management The Executive Management shall, under the supervision of the board, ensure that the company’s activities are in line with the corporate strategy, risk appetite, and the policies approved by the board. a. The executive management comprises a group of people appointed by the board to carry out their role in the company operation management such as the CEO, his deputies and assistants. These individuals are supposed to have the academic qualifications, required experience, and personal integrity to run the company’s business. The executive management is accountable for its oversight of the company’s management. b. The executive management shall primarily contribute to the sound corporate governance of the company through personal conduct (for example by assisting in setting the initiative approach side by side with the board) through adequate control over activities run, and ensuring that the company’s activities are in line with the corporate strategy, risk appetite, and the policies approved by the board.
c. The executive management is responsible for assigning tasks to the employees
and promoting a structure which encourages accountability and transparency. The executive management should remain aware for its oversight responsibility of such assignment and its responsibility for the company’s performance before the board. d. The executive management shall execute (in agreement with the board’s orientation) the appropriate risk management systems (financial or nonfinancial) risks faced by the company, and shall place effective internal control systems, and ensure that the company’s activities are in line with its corporate strategy, risk appetite, and the policies approved by the board. It shall further contribute to the proposals related to the company’s strategy and annual budget. e. The executive management shall be responsible for oversight and supervision of the company business, and in particular, ensuring compliance function, risks supervision, autonomy and task segregation; in which it is not affecting the independence contained in these instructions. f. The executive management shall provide the board of directors, at least every two months, with financial and administrative reports wherein the executive management has also to comply with the principles of transparency and objectivity. The board shall rely on the executive management’s expertise in the execution of the board’s resolutions without any intervention in its jurisdiction. In case any board member wishes to participate in the execution of the board resolutions, such participation shall be based on an authorization issued by the board, and the board shall be notified accordingly.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Pillar Four: Risk Management and Internal Controls The company shall maintain effective internal controls and systems for risk management function whereby there is autonomy for these functions, including a risk management head with independence and easy access to the board and the chairman of the risk committee without impediments. First: Internal Controls:
a. The board shall approve an organizational structure aligned with the nature of the company’s business and activities to ensure organizational controls needed to execute the strategy approved by the board by identifying objectives for each business unit, setting out tasks and responsibilities, and identifying authorities and communication lines for the administrative officers at all levels to achieve dual control and segregation of responsibilities, and to avoid task conflict and operational risks. The board shall also maintain policy and procedure manuals for processing and supervising operations, along with job descriptions for the different job titles whereby qualifications and experiences are identified. b. The board shall ensure periodically (at least once a year) the adequacy and effectiveness of the internal control systems as needed to protect the company’s properties, assets, soundness of its financial statements, efficiency of its operations at the administrative, financial, and accounting levels, compliance with these different supervisory controls, and to ensure at the same time that such controls provide the company with the required protection against any unauthorized access inside or outside the company.
c. The board shall ensure that the internal audit staff possess independence and
qualifications, and that the scope, procedures, and frequency of audit are consistent with the different risk grades the company is exposed to. The board shall appoint and assign the head and staff of internal audit and determine their privileges to stress independence and competency of the audit. d. Effective board performance requires the board to make use of the observations of the internal and external audit as well as the internal control assessment reports. The board shall also recognize the internal and external audit as crucial supervision tools and make use of the audit reports recognizing them as independent review of the information submitted from the executive management to the board. e. The company shall ensure that the internal control system assessment process and the other technical and consultation tasks shall not be assigned to the company audit offices. Furthermore, it shall ensure that the other technical and consultation tasks of accounting nature (assessment of accounting records, guidance on accountancy solutions…etc.) to companies that are economically or legally connected to these firms, whether such connection is by way of joint ownership or joint management.

The company should set up, and develop, strong and comprehensive systems
and procedures for risk management, whereby it is able to identify the nature of all effective risks which the company is exposed to.
The company should consider the risks it may face as a result of adopting new
products, or as a result of change in the size of activity, changes in the operating environment or the type of portfolio/economic environment, taking these variables into consideration when measuring risks. The company should adopt the qualitative, as well as quantitative measurements when measuring such risks.
The company should appoint a head of risk management, with qualifications
and expertise suitable to the nature and tasks of this function. Such head shall be authorized to directly communicate with the chairman of board and the chairman of the risk management, emanating from the board, and shall submit his reports to both. In this context:

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. a. Head of risk management shall be independent, and shall not be assigned with any financial tasks. b. Head of risk management should hold meetings with the non-executive board members and members of the risk committee, without the attendance of the executive management.
c. Head of risk management should have the ability to influence the company’s
decisions relating to exposure to risks. This requires vesting in the head of risk management the authority to discuss with the executive management to obtain their opinion on such decisions.
4. Dismissal or exclusion of the head of risk management, for any reason
whatsoever, shall not take place without obtaining prior approval of the board of directors. The company shall discuss such reasons with CBK prior to his dismissal.
5. Risk management shall be responsible for identifying, measuring, supervising,
and mitigating the risks, as well as preparing reports on the company’s exposures to risks. In this context, overlap between the various types of risks shall be considered, such as overlap between market and credit risk, and between credit and operating risk.
6. The board of directors should provide adequate support to the function of risk
management, providing this department with the confidence and importance of its functions.
7. Risk management function should be sufficiently independent from the
departments and units of which the exposures are reviewed by the risk management department, taking into consideration that such independence would allow the risk managers access to the local and foreign activities that requires understanding, or request certain information regarding such activities, in order to properly assess their exposures.
8. Risk management function should be given access to all lines of financial
activity with probable generation of high risk on the company, in addition to the authority to report directly to the chairman of risk committee and executive management.
9. Adequate resources should be provided for the risk management, including
providing it with qualified personnel.
10. Irrespective of any liability to the risk management regarding performing its
roles, the final responsibility should be shouldered by the board of directors.
11. The company’s annual report shall include adequate information on risk
management, in terms of structure, independence, nature of operations, and developments during the year.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Risk Committee:
a. A committee for risk management shall be formed from the board of directors, including three non-executive members, including the chairman of the committee. Such committee shall be responsible for providing the board with consultancy on the company’s current and future risk strategy and appetite, as well as oversight of the executive management’s application of such strategy. The board of directors may outsource risk management by hiring external consulting firms with expertise in risk management in order to support the efforts of the risk committee at the company, and enhance effectiveness of the committee's role. b. Risk Committee shall review the company’s risk management policies and strategies prior to board approval. The company’s executive management shall be responsible for implementing such strategies, in addition to developing policies and procedures regarding the management of the various types of risks.
c. The company’s executive management shall propose the structure, roles,
responsibilities, and development approaches of the risk department. The structure and roles of such department shall be reviewed by the risk committee, in prelusion for approval by the board of directors. d. Risk committee shall cope with the rapid developments and increasing complexities that occur in the company’s risk management, together with providing the board of directors with periodic reports on such developments. e. The head of risk management department shall submit reports directly to the chairman of the risk committee. Third: Internal and External Audit The board of directors and executive management should effectively capitalize on the internal audit business, external auditors, as well as the reports issued on the assessment of the internal control systems. Internal Audit:
a. The company shall provide the internal audit department with adequate number of qualified human resources, whom should be trained and rewarded adequately. Internal audit department shall have the right to obtain any information, or contact any employee within the company. It shall be given all powers, enabling it to perform the assigned tasks to the required level. The board of directors shall approve the audit code or program and circulate it within the company. b. The board of directors’ approval shall be obtained upon appointing a new head of internal audit. Internal auditors shall be appointed upon the approval of the head of internal audit.

Verifying and assessing the adequacy and effectiveness of internal control
systems, and verifying comprehensiveness of the internal control systems relating to financial and administrative matters, which shall be supervised and reviewed in due course.
Verifying compliance with the company’s internal policies, and the relevant
laws, policies, regulations and instructions.
Conducting examination of the specific activities and operations relating to
the company’s financial position, internal control systems, risk management, etc. g. The board of directors shall regularly enhance the internal audit function in the company, in which the company should abstain from outsourcing any of the major roles of audit. In the events where the bank considers outsourcing certain activities, CBK’s approval should be obtained, however, for specific purpose and for a limited timeframe. External Audit a. External auditors should provide the audit committee, emanating from the board of directors, with copy of the audit report. External auditors shall meet with the audit committee to discuss such reports, and any other observations that may arise regarding the bank's matters. Such meetings shall be attended by the executive management. Audit committee shall meet with the external auditors without the attendance of the executive management, at least once a year. b. Audit committee shall set up adequate standards to ensure that external auditing is carried out in the manner that achieves the dual audit principle, which rests on the independent work of each external auditor, and to achieve the purpose of appointing two external auditors. Audit committee shall provide the board of directors with reports that support such purpose.

Scope, findings, and adequacy of the company’s internal and external audit.
Accounting issues of material impact on the financial statements.
The company’s internal control systems, and ensure sufficiency of all
resources provided for supervisory functions.
Reviewing the company’s financial statements prior to presentation to the
board of directors, as well as ensuring adequate provisions.
Ensuring the company’s compliance with the relevant laws, policies,
regulations and instructions. d. Audit committee shall annually appraise the performance of the head of internal audit and determine his remuneration. e. Audit committee shall draw its recommendations to the board regarding the appointment, termination, and remuneration of the external auditors, any other contractual terms relating to the external auditors, in addition to assessing their objectivity.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. Pillar Five: Remuneration Granting Systems and Policy Malpractices in allocating remuneration were among the factors that contributed to the recent global financial crisis. Numerous banks, financial institutions and other companies in many countries failed to take the risks into account in their practices, which encouraged them to intensively take long-term risks in order to boost their short-term profit to obtain high remuneration in light of applying remuneration systems that rely on the volume of profit. This resulted in depletion of assets and resources of such institutions, undermining their financial capabilities to confront the losses they sustained later. It is now obvious that the existence of formal regulations and procedures to address such gaps in the remuneration systems is an integral part of the financial reform programs that occurred during the global financial crisis, while ensuring that controlling the remuneration systems and policy is one of the significant pillars of corporate governance standards. Within the framework of such reforms, the financial stability board developed a set of principles and standards relating to the proper remuneration practices. Basel Committee on Banking Supervision adopted such principles and standards, and recommended their application in developing remuneration systems and policy, which must be correlated to risk levels and soundness of the long-term conditions of the financial institutions, while increasing the participation and effectiveness of the boards of directors of such institutions in setting policies for remuneration in line with the risk strategy of such institutions, as well as emphasizing that remuneration for risk-related and supervisory functions must be specified by parties with activity independent from those functions (i.e. assessment should not be made by people related to the areas of business supervised by those working in such supervisory functions). Principles and standards, included in these instructions issued by CBK, aim at setting a minimum requirement for such standards, providing CBK and finance companies with a supervisory manual to prepare, assess the policies and procedures of granting financial remuneration, and encouraging an effective risk management. Hence, the objective of such rules and regulations is to address the risks arising from the remuneration granting policies, rather than to specify the maximum amount of financial remuneration, which will continue to be specified by the companies themselves according to their remuneration granting policy.

General Controls:
a. The company that has licensed financial subsidiaries operating in the State of Kuwait should set up a policy and practices to grant remuneration at the

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision. group level that is in line with such rules, or should ensure that the remuneration granting policy at such subsidiaries are in line with such rules. b. The company that has licensed subsidiaries operating outside the State of Kuwait, or has a branch carrying out business in a foreign country, should ensure that the financial remuneration granting policy and practices of such subsidiary or branch are in line with such rules, and that there is no in conflict with the legal and regulatory requirements in the host country.
2. Remuneration Granting Governance – The Role of the Board of Directors:
The board of directors should effectively supervise the remuneration systems and operations, and control and review remuneration systems to ensure they operate in the required manner. In this context:
a. The board of directors shall be responsible for the preparation and supervision of the financial remuneration granting policy. Accordingly, the board may not assign the executive management with such responsibility. b. Despite the establishment of the "Remuneration Committee", the entire board shall eventually be fully responsible for enhancing the formulation of an effective governance and sound practices for granting financial remuneration.
c. The board of directors shall review the recommendations of the remuneration
committee regarding the consequent modification or update of the remuneration granting policy, and shall ensure that such modifications shall not be applied unless approved by the board. d. The board of directors shall review the recommendations of the remuneration committee with regard to the level of remuneration proposed to be granted to key personnel, and shall not operate such recommendations unless approved by the board. e. The board of directors shall ensure that the company’s executive management has set effective systems, precise procedures and supervision mechanism to ensure compliance with application of such rules and standards.
3. Remuneration Granting Policy:
a. Every company should have a written remuneration policy approved by its board of directors, which reflects the objectives of the company, taking into consideration the company’s sound operations and financial position. b. Such policy should cover all aspects and components of granting financial remuneration, within the framework of enhancing the effectiveness and

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision.
4. Performance Measurement:
Financial remuneration granting system should include adequate performance measurements. In this context, each company should:
a. Have a system for objectively measuring and appraising the performance of its employees at the various levels. b. Have a clear written and documented performance appraisal and measurement procedures and processes. Such procedures and processes should provide for avoiding conflict of interest cases, and must be transparent and circulated to all concerned staff.
c. Have top management members performance measurement based on
the company’s long-term performance. Accordingly, the element of granting their remuneration should not be based only on the performance of the current year. d. Upon appraising the performance and identifying the remuneration of employees in supervisory functions, such as risk management, internal audit department and compliance, ensure that such appraisal is made objectively and in light of the independence of such functions. Thus, such appraisal should not be made by people related to the areas of business controlled by those working in such supervisory functions.
5. Linking Remuneration with the Company’s Performance and Risk
Timeframe:
In this context, the company shall consider the following:
a. Remuneration granting policy should be consistent with prudent provision. b. Link the financial remuneration with the company’s performance in the long term, as well as the performance in the short term, and take into consideration the change in the components of granting financial remuneration in line with the long term risk (risk timeframe).
c. Review of the financial remuneration granting policy to assess its
consistence and effectiveness as a constitute part of the work frame of the company’s risk management.
6. Disclosure Requirements:
The company should disclose, in its annual report, the main characteristics of its financial remuneration granting policy, as well as the formation and scope of authority of the remuneration committee. Such disclosure should cover information on the overall design of the remuneration granting policy, the relationship of remuneration granting with the actual performance, and the realization of the objectives of financial remuneration granting policy.

Preparing the remuneration policy and submitting it to the board of
directors for approval and supervision of its application.
Conducting a periodic review of the remuneration granting policy, or
when recommended by the board of directors, and providing recommendations to the board on amending/updating such policy.
Conducting a periodic assessment of the adequacy and effectiveness of
remuneration granting policy to ensure achieving its announced objectives.
Assessing the practices by which the remuneration is granted against
future income of uncertain timing and potential.
Drawing recommendations to the board regarding the level and
components of the remuneration of the CEO and his assistants, as well as those at the level of such functions, including the company’s executives.
Determining the remuneration granting system in consistence with the
principles of sound practices of granting remuneration.
Completing any other tasks related to the regulatory requirements.
c. Members of the remuneration committee should have knowledge, skills and
expertise necessary to make independent and objective decisions regarding the remuneration granting policies and practices. d. Remuneration committee should work closely with the company’s risk committee and/or the head in-charge of risk, when evaluating the incentives proposed by the remuneration granting system. e. Remuneration committee should review its policy on an annual basis at least to ensure achieving its prescribed objectives. For this purpose, the committee should request the management to present for them the information concerning the business course of remuneration granting system.

Each company should have a policy for disclosure and transparency, which
should be approved by its board of directors. Such policy, and its amendments, should be set to serve the purposes of the company, stakeholders and related parties, and to upgrade the level of application of corporate governance, within the framework of sound practices of the financial business.
Disclosure and transparency policies should include all information that should
be disclosed in a timely manner and in the method identified by CBK’s laws, legislation, resolutions, and instructions.

CHAPTER TWO: The Law, Supervisory & Regulatory Instructions & Controls on Financing Companies
9- INSTRUCTIONS TO FINANCE COMPANIES REGARDING INTERNAL CONTROL SYSTEMS. A) Rules and regulations of Governance for financing companies under the Central Bank of Kuwait’s supervision.
3. The board of directors of each company shall set up the rules and procedures
to be followed for compliance with the disclosure and transparency requirements contained in these instructions, and to ensure good application and compliance with such instructions.
4. Companies’ disclosure policies should determine the mechanisms under which
they classify the disclosed information in terms of nature (such as financial information and other information), or in terms of disclosure frequency (monthly, quarterly or annually), in addition to the instantly disclosed information.
5. Disclosure and transparency policy should cover the company’s objectives and
policies regarding the professional ethics and the company’s obligations towards the society.
6. The board of directors shall be responsible for ensuring the availability of
systems and procedures needed for disclosure compliance in a timely manner, periodically or instantly, to avoid, as a result of delay or failure to disclose, the company from violating the instructions.
7. Each company should disclose in accordance with International Financial
Reporting Standards (IFRS) and CBK instructions, as well as the applicable laws and regulations in this respect. In addition, the company should be aware of the changes that occur in the international practices regarding the issue of transparency and disclosure required from the financial institutions. The company’s board of directors shall be responsible for ensuring adherence to full application of all amendments to IFRS. The company’s executive management shall report to the board of directors of such developments, in addition to recommending on the methods of enhancing the company’s practices in the area of disclosure, in consistence with the international best practices.
8. The company’s board of directors shall be responsible for ensuring correctness,
accuracy, and integrity of the disclosed information, as well as ensuring compliance with the company’s approved policy in this respect, and providing the mechanisms that enable sound application thereof.
9. The company’s disclosure and transparency policy should cover the principles
and rules approved by the company when dealing with customers, whether borrowers, creditors or customers of products and services provided by company in general, particularly with regard to the terms of agreements, costs, and obligations related to each.
10. Each company should take into consideration that the quality of disclosed
information is a vital matter that the company should thrive to achieve.

Each company should at least advertise in two daily newspapers and annually,
the following annual financial statements (as a minimum):
 Balance sheet.
 Income statement.
 Statement of cash flow.
 Statement of changes in shareholders’ equity.
 Board of directors’ report on the operating results for the period for which the statements are prepared.  Audit report by the company’s auditors.
The company’s annual report should include a disclosure statement by the
executive management on the company’s performance and future plans (Management Discussion and Analysis – MD&A), allowing the investors to understand the results of current operations, projections, and financial position of the company. The company should confirm that the clarifications to such disclosure are approved by the board of directors, are complete and are based on the company’s published financial statements and the management’s vision.
Accurate and timely disclosure, by any of the appropriate means of
disclosure, of all important issues and information related to the company, including the financial situation, performance and business results, any changes in ownership or in the management of the company, and any other matters required by the laws and instructions issued in this regard. Taking into account informing and providing CBK – instantly - with the method of disclosure and the used medium.

Board member remuneration package (as a group).
Five senior executives who received highest remuneration from the
company, in addition to the CEO, CFO, head of internal audit, and head of risk, if not included (as a group). h. Disclosure of the nature and size of the company’s transactions with related parties, who have influence or control over the company, including key management members of those parties.
i. Disclosure of the framework through which the financial statements are
prepared, their consistence with IFRS, laws, resolutions and instructions issued in this respect, especially CBK instructions.

Each company shall maintain a disclosure record of the board members, and
executive management, including their information as required by the disclosure and transparency policy and any relevant instructions, resolutions or laws. Such information should be updated instantly with the changes that may occur thereon, such as the remuneration package, salaries, financial benefits, conflict of interests, etc.
Each company should have a section or unit responsible for disclosure, of
which the roles and responsibilities shall be specified by the board.
Each company should provide the information stated in the company’s annual
report, its quarterly reports, or the lectures presented by the executive management, on the company’s website in an updated manner, and in both Arabic and English. Fourth: Control over the Company’s Disclosure Process a. The company’s disclosure and transparency policy should determine the following:
The mechanisms of audit and control over the accuracy and soundness of the
disclosed information prior to dissemination.
Mechanisms for addressing the internal information, to ensure nonexploitation of such information before dissemination to the public.
Mechanisms for preparation of reports on compliance with such policy, the
area assigned to prepare such report, and the procedures to be followed in case of non-compliance with the contents of such reports. b. The board of directors of each company should conduct periodic review to reconsider and evaluate the disclosure and transparency policy in light of the surrounding developments and changes.

The board of directors and executive management should know the company’s
operational structure and the risks arising from such structure.
The board of directors and executive management should know the structure
and organization of the group in terms of the objectives of each unit or entity, and the formal and informal relations between the units and parent company.
Sound and effective measurements and systems should be in place to obtain
and exchange information between the group’s entities, so as to manage and effectively control the risks of the group as a whole.
The board of directors and executive management should ensure that all
products and their risks are assessed by each entity within the group, and on the basis of the group’s entities as a whole.
The board of directors and executive management should recognize the nature
of risks that the company may face through branches and subsidiaries operating in regions that do not satisfy the international control standards. Second: The board of directors should approve clear policies and strategies to establish new structures. The board of directors and executive management should consider the following:
Avoiding building unnecessary complex structures.
The existence of central procedures for approval and control over the
establishment of new legal entities upon specific standards, covering the ability to supervise and satisfy the requirements for the continuity of each unit.
Obtaining the ability to extract information on the company’s structure,
including the type, code, ownership structure and activity of each legal entity.

Protecting basic shareholders rights in relation to securing methods of
ownership registration and transfer, participating and voting at general shareholder meetings, sharing in the profits and obtaining regular information on the company.
Ensuring the shareholders rights to be sufficiently informed or to participate in
making decisions concerning amendments to the company’s memorandum and articles of association, including the amendments to capital increase through additional shares issue, or the launch of shares under staff share option scheme, re-purchase share, as well as the decisions related to extraordinary transactions influencing the destiny of the company or the course of its business, such as merger or sale of a significant portion of its assets or divestiture of subsidiaries.
Encouraging effective shareholders participation and familiarizing them with
the voting rules, and notify them about general shareholders meetings and the agenda well before the meeting. The venue and date of the meeting should be publicly announced in accordance with the relevant laws, rules and instructions.
Stressing the importance of disclosure of capital structures or any arrangements
that enable certain shareholders to obtain a degree of control.
All shareholders should be equitably treated, including small investors and
foreign investors. All shareholders should have the right to question the acts of the board of directors and to rectify any prejudice to their rights.
The company should provide the information to the shareholders on a timely
basis, allowing them to practice their rights in a perfect manner. Such information should be comprehensive and accurate, without discrimination between shareholders in regards to providing such information.
Shareholders must be empowered to have access to the minutes of the general
assembly meetings.
The company should prepare a statement of the penalties (financial and nonfinancial) that are imposed thereon during the financial year, in accordance with
the provisions of Article 85 of Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait, and the Organization of the Banking Business, and its amendments. This statement shall be read by the chairman of the board during the annual general meeting, as specified by CBK’s instructions in this respect.

The company’s work systems, policies and practices should stress respect of
stakeholders rights, as specified by the laws, regulations and instructions issued in this respect, and should stress the stakeholders rights to rectify any prejudice to their rights in accordance with the provisions relevant laws.
Companies should consider that stakeholders rights represent one of the
significant aspect of good governance. The company’s eventual success is the result of a joint work by several parties: creditors, borrowers, employees, investors, etc., who have transactional relations with such companies. It should be mentioned that Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait, and the Organization of the Banking Business, as well as the set of rules and instructions issued to finance companies regarding their practice of the various activities, include controls and fundamentals that provide necessary protection for stakeholders, particularly creditors, borrowers, and shareholders, to ensure protection of the financial positions of such companies, and to activate their role in the service of society and economic development process. Therefore, the companies’ compliance with the provisions of the aforementioned law, and CBK instructions, covering controls regarding companies’ practice of their activities, constitute the general framework of the major pillars of corporate governance. 18/8/2013

Instructions to Finance Companies Regarding Internal Control Systems

Lineage: In force