PACRA Financial Institutions Rating Methodology

Analyst Contacts Momin Farooque momin.farooque@pacra.com October 2024 The Pakistan Credit Rating Agency Financial Institutions Rating Methodology Table of Contents Introduction........................................................2 Profile .................................................................3 Qualitative Factors .............................................3 Business Risk .....................................................6 Financial Risk ...................................................11 Credit Enhancement ........................................16 PACRA’s methodology documents lay out the umbrella framework guiding its credit ratings. This document provides an overview of PACRA’s approach to assigning credit ratings to commercial banks (conventional, Islamic, and digital) and Development Finance Institutions (DFIs) in Pakistan. PACRA’s opinions are based on a mix of qualitative and quantitative assessment factors, including: Profile, Ownership, Governance, Management, Business Risk, and Financial Risk. While standalone credit quality is addressed, PACRA incorporates the relative positioning of a financial institution to arrive at the final rating. Analyst Contacts: Muhammad Hamza Tahir hamza.tahir@pacra.com +92 42 3586 9504 The Pakistan Credit Rating Agency: Head Office FB 1 Awami Complex Usman Block, New Garden Town Lahore Phone: +92 42 3586 9504 Karachi Office PNSC Building, 3rd Floor M.T. Khan Road, Lalazar Karachi Phone: +92 21 3563 2601 Disclaimer: PACRA has used due care in preparation of this document. Our information has been obtained from sources we consider to be reliable but its accuracy or completeness is not guaranteed. PACRA shall owe no liability whatsoever to any loss or damage caused by or resulting from any error in such information. Contents of PACRA documents may be used, with due care and in the right context, with credit to PACRA. Our reports and ratings constitute opinions, not recommendations to buy or to sell.

Page | 2 October 2025 Financial Institutions Rating Criteria Methodology Introduction Scope This methodology applies to financial institutions (FIs) regulated by the State Bank of Pakistan (SBP), the central bank. The scope of this methodology covers all commercial banks (conventional, Islamic, and digital) and Development Financial Institutions (DFIs). These institutions are mainly licensed to mobilize deposits and provide credit among other financial services. The regulatory framework consists of the laws and regulations designed by SBP to ensure a sound financial system Rating Framework PACRA’s framework for assessing the credit quality of financial institutions employs a mix of qualitative and quantitative analyses. The quantitative factors help in achieving objectivity in the rating assessment while the qualitative factors help establish the sustainability of the rating in the foreseeable future. Neither can all factors be quantified, nor can quantitative metrics portray the complete picture. PACRA seeks to employ an optimal combination of both and applies it consistently to ensure comparability between ratings over time. The assessment is categorized into six key areas: Profile, Ownership, Governance, Management, Business Risk, and Financial Risk. These factors are further scrutinized in light of new regulations and a changing financial landscape. PACRA also achieves a clear perspective on the relative position of a financial institution in its peer group. In addition, a sensitivity analysis is performed through several “what if” scenarios to assess its capacity to cope with changes in the operating environment. PACRA’s analysis typically involves at least three years of operating history and financial data as well as FI and rating agency forecasts of future performance. The assessment culminates in the assignment of a long-term and short-term credit rating to a financial institution. More information on the distinction between the long-term and short-term ratings and the relationship between them may be found in PACRA’s Criteria document titled “Correlation between Long-term and Short-term Rating Scales”. Rating Approach Qualitative Factors Ownership Governance Management Quantitative Factors Standalone Entity Profile Peer Comparison Credit Enhancement Business Risk Financial Risk

Page | 3 October 2025 Financial Institutions Rating Criteria Methodology Profile Background PACRA reviews the background of the financial institution to understand its evolution, from where it started to where it currently stands. While the majority of banks aim to cater to the banking and financial services needs of the general population, some financial institutions are established to cater to a niche market or with a predefined purpose. This is often the case with DFIs, which may be established by sovereigns to focus on a particular set of economic activities. In all cases, the underlying objective and vision of the institution is understood to gauge its progress in realizing that vision and strategy. We analyze how and through what means the institution has achieved its desired expansion. The significant factor here for PACRA is to assess whether the institution has achieved the desired expansion through organic growth or acquisitions. Meanwhile, the source of funding for desired growth is also critical. Operations The assessment of operations of a financial institution depends on the exposure of business segments and the stage the business it is in. Here, PACRA reviews the diversity in terms of advances and deposits, geographic spread of operations, product offering in terms of the types of accounts, range of loans, and services offered by the financial institution, asset mix, borrower profile, size of the franchise/portfolio and track record of operations. Size can be an important factor if it confers major advantages in terms of operating efficiency and competitive position. Qualitative Factors Qualitative assessment helps establish the sustainability of the rating in the foreseeable future. Qualitative considerations here refer to rating factors, which do not pertain to an FI’s business or financial risk. Rather, they focus more on internal processes, people, and systems, and thus are essential for a forward-looking perspective while forming a rating opinion. This section is meant to provide a brief overview of how PACRA generally factors qualitative considerations into its assessment, insofar, as they can impact an issuer’s ability to meet financial obligations. PACRA’s detailed approach undertaken to conduct this analysis is documented in its methodology titled “Qualitative Rating Considerations1 ”. Incorporating the potential impact of qualitative considerations into the rating opinion can be challenging because it is generally inferred or estimated based on information, which may not be standardized and is difficult to quantify. This often requires some degree of subjectivity and analytical judgment, supplemented by PACRA’s own experience and the experience of the underlying financial institution (FI)or other FIs with similar risks. Three factors underlying PACRA’s qualitative analysis at an entity level include: Ownership, Governance, and Management. The scope of analysis for each is briefly described below: Ownership This section provides an overview of the risks pertaining to the structure and stability of the FI’s ownership structure, owners’ experience and prowess in the FI’s industry, and willingness and ability to extend extraordinary financial 1 Methodology: Qualitative Rating Considerations

Page | 4 October 2025 Financial Institutions Rating Criteria Methodology support in distressful circumstances. The ability of the financial institution to raise capital from key shareholders, as and when required, is an important credit driver. Ratings of financial institutions established or supported by sovereigns/sub-sovereigns may benefit if existing support or likelihood of support from sovereign/s can be established with certainty. Support factors, inter-alia, include percentage of ownership, control over governance framework, provision or arrangement of concessionary funding and promise to support given certain contingencies. In case of newly established or small financial institutions where capitalization requirements are yet to be met, PACRA critically analyses the willingness and ability of the sponsors to support the institution to comply with the applicable regulatory requirements within required timeframes. Furthermore, the institution's importance in the domestic financial system also has a bearing on the possibility of sovereign support in times of financial distress. In case of digital banks, regulatory requirements and owner’s experience in this domain is looked at to ascertain their ability to provide strategic guidance. Any synergies that may exist between owner’s other ventures and the digital bank and their eventual impact is also considered. Governance This section provides an overview of the risks pertaining to the Board of Directors’ role in establishing a robust oversight and control framework that ensures appropriate oversight, aligned management and shareholder objectives, transparent reporting and disclosure standards, and establishment of strong systems to ensure compliance with all regulatory requirements set by the SBP. Environmental, Social, and Governance PACRA does not capture ESG as a separate rating driver. However, it considers ESG as a subfactor in Governance with growing importance, which subsequently can affect other factors used for assessing credit risk. This entails that, wherever relevant, PACRA would consider the impact of ESG factors on its current rating drivers. Governance-related risks have already been addressed in the qualitative assessment. Therefore, PACRA mostly factors in E and S risks for each of the sub-factors separately. Although financial institutions do not face a direct threat from climate change, these are indirectly affected by the impact on their lending portfolio. In case, a financial institution is heavily invested in a sector, such as agriculture which is expected to suffer adversely from climate change, the financial institution may also suffer in the form of growing NPLs due to the inability of lenders to make timely payments. Factors such as these and the overall approach towards green financing are evaluated to ensure greater sustainability. Similarly, financial institutions focus towards green banking and steps taken in this regard are considered. Management This section provides an overview of the risks pertaining to the management team’s proficiency in executing strategy, maintaining strong information systems and utilizing the same for efficient decision making, and ensuring adherence to the FI’s ethical and quality standards. A growing area of focus is use of technology for operational efficiency and control. Risk Management Framework/Control Environment This includes an analysis of the financial institution’s appetite for risk and the systems in place to manage these risks. PACRA examines the independence and effectiveness of the risk management function, the procedures and limits that have been implemented, limits setting authority and the degree to which these procedures are adhered to. In

Page | 5 October 2025 Financial Institutions Rating Criteria Methodology recent years, there has been a noticeable upgradation in the risk management systems of financial institutions, in the face of increasing guidance and supervision from the SBP. In case of bank, SBP efforts to implement Basel III further improves it. Technology Infrastructure With the increase in alternate delivery channel usage and emergence of digital banks, examining the efficacy and reliability of the bank’s technology infrastructure has become critical. This is even more important for digital banks where PACRA looks at the core banking software deployed, front-end and back-end applications, user interface and channels used by the customers, agreements with vendors or in-house development capabilities, system back-up plans and measures taken for data security by the digital bank. Similarly, risk management mechanism and controls established are examined. Credit Risk •Asset quality Indicators are primary tool to assess the level of risk being taken. •These are viewed in the context of returns achieved. •Credit risk management is assessed to determine the levels of risk and return through the business cycle. Market and Interest Rate Risk •Asset and Liability Managment Strategy is reviewed •Board and management exposure limits, are evaluated along with reports from management systems. •Risk appetite along with risk mitigants are evaluated collectively Operational Risk •Financial institution’s definition of such risk •The quality of its organizational structure •Operational risk culture •Approach towards the identification and assessment of key risks •Data collection efforts •The ability to retain critical staff and ensure an effective disbursal of the workload is also critically evaluated • In case of digital banks, the technology infrastructure agreements with vendors, digital security, system back-up and other factors gain greater importance Reputational and Other Risks •May emanate from operational problems or failure in any risk management systems •Results in withdrawal of deposits in case of strain on reputation. • Difficult to evaluate but could adversely affect a FI's rating when significant. •Regulatory non-compliance may lead to potential legal ramifications as well.

Page | 6 October 2025 Financial Institutions Rating Criteria Methodology Business Risk Industry Dynamics The process for anchoring credit rating of a financial institution builds on PACRA’s understanding of the industry dynamics. This understanding, following an in-depth research approach, is documented as a sector study. The analysis captures the placement of the local industry in the international context to see points of identity and distinction. In points of identity, the risks and challenges identified for the international industry are re-evaluated for the local industry players, with a view to see whether the local players have established effective mitigant’s against those risks and taken due measures to meet the challenges. At the same time, we identify the risks and challenges specific to the local context of the industry. While conducting the analysis, PACRA takes a view on the industry alone, independent of the market players. PACRA explores the possible risks and opportunities resulting from social, demographic, regulatory and technological changes. It considers the effects of geographical diversification and trends in industry expansion or consolidation required to maintain a competitive position. The analysis includes the role of the regulator, its supervision of regulated entities, reporting requirements and regulations relating to specific type of financial institutions and to specific financial products. Economic Risk PACRA analyzes basic economic indicators of the country including size and composition of economy, performance of important sectors, nominal and real gross domestic product (GDP) growth, inflation, saving and investment trends, exchange rate volatility and potential credit demand. An important part of economic analysis is positioning of industry and impact assessment of economic risk factors on the industry including foreign currency controls or trade restrictions imposed by the government. These factors can impact a FI’s asset quality, fee and commission income and other earning avenues as intermediaries. Regulatory Environment A well-regulated and supervised system is pivotal for credibility and stability of financial institutions even when the operating environment may become unfavorable. PACRA’s evaluation of the regulatory system involves evaluation of criteria related to capital and other countercyclical measures to absorb risk and the extent of regulatory supervision and changes in response to the macro environment. This includes looking at key norms such as Non-Performing Loan (NPL) recognition, provisioning, capital adequacy, liquidity, benchmark lending rate and prospective regulatory changes. For digital banks, PACRA reviews the business plan of the bank comprehensively. We assess the viability of the plan and various regulatory and management milestones identified for each phase. As part of its surveillance, PACRA follows implementation/achievement of phase-wise milestones and how any delay impacts the digital bank. In case of material delays or regulatory breaches, a rating action may be taken, if these are not cured in a timely manner.

Page | 7 October 2025 Financial Institutions Rating Criteria Methodology Relative Position Relative position reflects the standing of the financial institution in the related industry. The stronger this standing is, the stronger is the financial institution’s ability to sustain pressures on its business prospects and profitability. This “standing” takes support from three major factors; i) market share, ii) growth trend, and iii) franchise/brand value. Market Share Market share represents the financial institution’s penetration in the chosen market. There is a positive correlation between a financial institution’s absolute and relative size and its market position and brand value. Key factors that are evaluated to assess the market share of a financial institution include its share in the sector’s total advances, total deposits and franchise presence. In a dynamic industry, which is not characterized by concentration, PACRA believes that relative size rather than absolute size would better capture the strength of the financial institution’s standing. PACRA also analyzes how market share translates into advantage for a FI in terms of lower cost of funds, higher asset yield and optimal operating expense. Growth Trend While evaluating the financial institution, PACRA looks at the rate of growth. Growth is important as it shows that the financial institution continues to demonstrate the ability to meet industry benchmarks. As the industry grows, it uplifts the scale of its operational context which, if capitalized, would permit financial institutions to grow and diversify their advances and deposit base either organically or through the acquiring incremental business. PACRA monitors higher￾than-industry growth to understand the quality of the incremental business including impact on key business segments and if it has resulted in higher concentration due to added business. High growth at the expense of declining portfolio quality is perceived negatively. PACRA monitors growth sustainability by evaluating the growth in non￾performing advances against the growth in total advances and industry trends in this regard. Franchise/Brand Value The strength of a franchise determines its capacity to grow while maintaining a reasonable cost to income ratio and profitability, thus providing resilience to earnings. PACRA evaluates the franchise’s strength in terms of scale, benchmarked comparisons, key segment complexity, and diversification across various performance metrics (number of branches, advances, liabilities, other operating income etc.). Access to government support and/or privileges relative to other financial institutions constitute part of brand value. The same holds true for market positioning whether evaluated through perception maps or a banking service quality index schematic comprising reliability, responsiveness, tangibility, empathy, and assurance. A strong franchise is expected to result in a granular asset and liability base. PACRA also considers the brand recognition and life of the institution for its franchise strength analysis. Revenues In measuring revenue quality of a financial institution, diversification and stability are very important factors. A financial institution with a diverse product slate with more than one revenue stream is considered better than a financial institution with a concentrated earning profile. Composition of revenue from core business activities i.e., advances and investments, is considered critical. The analysis of target markets, which a financial institution serves, forms a

Page | 8 October 2025 Financial Institutions Rating Criteria Methodology part of the assessment. Stability is measured through historical trend analysis of variance and is considered in the analysis. Steady growth in revenues is viewed positively instead of a volatile pattern. Financial institutions that rely more on generating income from risky business lines like trading activities will typically display more volatile revenue trends. Diversification Diversification is desirable since it enhances the FI’s ability to meet challenges, both present and upcoming. Lack of diversification gives rise to concentration risk, reflecting the vulnerability of the financial institution to a few elements. At the same time, it enhances the risk of disruption if the area of concentration is impacted by economic changes. This does not entail that a FI specializing in a certain product/segment would always be at a disadvantage. The disadvantage would only arise if the institution’s business gives rise to concentration risk. For instance, majority lending to a single industry gives rise to concentration risk. Similarly, diversification into riskier segments may not improve resilience, and, therefore, may not translate into superior rating assessments. In assessing diversification, some common factors consist of, portfolio granularity in terms of reliance on a handful of advances, sectoral mix, share of domestic and overseas exposure, and borrower profile. Meanwhile, a diverse geographical presence bolsters competitive position as it could offset the credit risks arising from unfavorable regional developments. Investment Income Investment income is an alternative revenue stream. It supplements a financial institution's profitability. Profits derived from investments can include interest, dividends, and capital gains. Since this profit functions as “other operating income”, it has the potential to offset core shortcomings. It also provides a safe avenue for allocating tangible common equity-based resources without degradation of value. However, since investment income is intended to supplement, it must not adversely contribute to the market and credit risk already inherent in the core earning assets of an FI. Assets invested should cater to the differing liquidity needs of an institution based on its funding structure, and there ought to be well-established risk management and allocation policies behind investment decisions. The quality of investments, generally, as previously hinted, is gauged through an evaluation of the following risks; credit, market and liquidity. One approach utilized by PACRA is the evaluation of concentration within particular asset classes and the risks inherently associated with these assets. Financial institutions invest a significant portion of their investment portfolio into government securities that notably diminishes credit risk. However, these are subject to mark risk due to changes in interest rates. Any potential impact of these changes is carefully analyzed at investment portfolio level in terms of maturity and composition of the portfolio. Low rated investments and/or highly volatile and illiquid investments are considered risky. The quality of the investment book is analyzed to assess the degree of concentration in high-risk avenues. Non-Mark-Up Income For most financial institutions, income from advances and investments makes up much of revenue. However, non￾interest income from fees, service charges, commissions, foreign exchange, etc. is often an important source of revenue. PACRA views earning profiles comprised primarily of interest income favorably given the relative stability of this income stream. Nevertheless, PACRA also assesses the financial institution’s ability to complement its core income with fee income from services constituting unfunded exposure s, fees, commissions and others.

Page | 9 October 2025 Financial Institutions Rating Criteria Methodology Cost Structure This structural aspect of an institute is studied to discern any operational leeway or advantage afforded to an institution by virtue of its technological or operational infrastructure, especially when the industry, as a whole, is strained. The goal of this assessment, firstly, is to judge whether or not the institute generates enough gross margins, and secondly, to inspect the coverage afforded by the margins against fixed costs or operational expenses, including the necessary impairment provisions. Entities that operate efficiently, in the sense that their average cost has been minimized, gain a competitive advantage because the threat of competitors or the bargaining power of customers and suppliers of credit is comparatively diminished. The implication is that such institutions can generate enough financial profit to maintain their cashflows such that their debt repayment capacity is not entirely dependent upon liquid reserves. With that in mind, there are a handful of metrics studied to ensure that the cost structure is not exorbitantly disadvantageous to increased leverage. Those metrics include "Non-Mark-Up Expenses/Total Income" and forays into compensation, infrastructure, and other operating expenses. This list, though, is not exhaustive and other elements factored into the evaluation include a contrast between the overall income and non-markup expenses to determine the earning asset base. Similarly, PACRA takes it a step further by contrasting non-markup and operating expenses against the borrower pool of an FI to discern and benchmark efficiency. Digital banks are expected to have better cost structure and efficiency matrix due to nature of their operations. This is carefully analyzed and benchmarked against operations of similar institutions or digital subsidiaries of banks. Margins The future profitability of a financial institution is evaluated by analyzing its interest spread (asset yields minus cost of funds). This is completed by standardized approaches to calculating net interest and minimum lending rate margins. Where possible, PACRA also analyses earnings for each of the financial institution’s business lines. In this context, it looks at the trends in: i. Net Interest Revenue including evolution of interest spreads in each business lines, trends in lending volumes and evolution in funding cost. ii. Non-Interest Income, including more stable revenues in the form of fee and commissions, on inherently more volatile trading revenues. iii. Exceptional income and expenditure items, as well as developments in taxation incidence. There are instances in which an institution could thrive despite negative margins, such as when an FI has diversified into a plethora of non-lending products and services. Then they would be able to lend on the lower spectrum of the interest rate associable with a risk profile. However, it may just be that they are constrained in their ability to generate appropriate yields due to the presence of larger competitors, whereas others might be stymied by slow growth in their contribution margin per borrower. Alternatively, differing sources of markup income, advances versus investments, impact the analytical exercise differently. Wherever necessary, in its rating analysis, PACRA makes adjustments to a financial institution’s reported income statement figures, so that financial performance indicators are as comparable as possible from one financial institution to another.

Page | 10 October 2025 Financial Institutions Rating Criteria Methodology Sustainability PACRA analyzes the assumptions underlying a particular strategic path, including its logical coherence. Strategic plans, as they are presented by the management of FIs, are benchmarked against trends within the industry, wherever applicable, and are contrasted against the management’s track record for reliability and the ability to achieve prior strategic goals. For instance, earning prospects are closely examined based on budgets and forecasts provided by a financial institution, as well as any medium-term plan it may have. External factors, which may influence future earnings trends, are taken into consideration. Event Risk Incorporating the risk of unforeseen events into a financial institution’s rating opinion is challenging, given the unpredictable nature and magnitude of impact yielding from the underlying event. These events may be external (M&A’s, regulatory changes, litigations, or natural disasters) or may be internally driven (unrelated diversification, system breakdown leading to significant operational risk or strategic restructuring) and can lead to substantial rating changes. PACRA applies its analytical judgment in assessing the likelihood of such occurrences and potential impact, insofar as may be possible, and assesses the financial institution’s track record, expertise of management team and level of financial discipline to incorporate the same into its ratings. Lastly, note that PACRA gives due regard to any precautionary measures undertaken by a financial institution as part of its analytical exercise. Information Required on Business Risk  Financial statements of the financial institution for the last three years and latest four quarters  Projections of two years, with details of underlying assumptions  Break-up of fee, commission and brokerage income  Spread calculation  Details of investment book  Key Figures; Deposit Attributes (amount, volume, and number), Number of Transactions, and Portfolio Concentration Statistics  Industry and Entity Information including additional data as may be necessary pertaining to the loan portfolio, depositors, and number of borrowers.  Top 20 Advances and Deposits

Page | 11 October 2025 Financial Institutions Rating Criteria Methodology Financial Risk Credit Risk The risk that an institute’s borrowers fail to meet their obligations is credit risk. PACRA evaluates this risk by assessing asset quality, which is more or less the key to judge the stability of a financial institution. Failure to recover the lending portfolio carries the implication that the FI has to make up for the shortfall via remnant returns, its investment portfolio, or its loss absorbing equity. That entails exhausting any liquid reserves to simply remain operational, which is effectively disastrous from the perspective of lenders (e.g. depositors) to an FI. Furthermore, credit risk arising from elsewhere, even if through on-balance sheet activities (investments, inter-financial institution deposits and placements) or off-balance sheet transactions (letter of credit, guarantees, et cetera) are accounted for. In this context, a breakdown of lending by type of loan, size, maturity, currency, et cetera is part of the essential evaluation criteria. PACRA gives due importance to the implementation of IFRS 9, which is intended to enhance risk management and present a more comprehensive view of the overall risk associated with investments and advances. The IFRS 9 expected credit losses takes a more proactive approach then IAS 39. Under IAS 39 losses were recognized once there is objective information about impairment based on current events. IFRS 9 ECL takes into consideration future events which may trigger reduced credit quality in the future. IFRS 9 ECL also takes a more conservative approach by recognizing life time losses for assets which undergo a significant increase in credit risk. Consequently, TIER 1 equity Business Risk – Key Ratios •Number of branches •Total Deposits/Sector's Total Deposits (%) •Total Advances/Sector's Total Advances (%) Relative Position •Advance Yield (%) •Deposits Cost (%) •Core Spread (%) •Net Interest Margin (%) •Net Mark Up Income/Total Income (%) •Non Mark Up Income/Total Income (%) •Other Comprehensive Income/Total Income(%) Revenues •Return on Average Equity (%) •Return on Average Assets (%) •Asset Yield (%) and Cost of Funds (%) •Intermediate Efficiency (Spreads) % •Non-Mark Up Expenses/Total Income (%) •Compensation Expense/Total Income (%) Cost Structure •Growth In NPLs/Growth in Performing Aadvances •Growth in Investments Sustainability

Page | 12 October 2025 Financial Institutions Rating Criteria Methodology might be reduced which may restrict the size of the overall lending portfolio by reducing CAR. The following table presents details pertaining to asset classification under IFRS 9 ECL. Asset Classification Description Stage I Associated credit risk of a portfolio has not altered considerably since the initial transaction. FIs, however, are obliged to provision for potential twelve-month losses associated with this asset class. Stage II The portfolio has experienced a significant increase in credit risk. It is not non-performing in the sense that the inflow of markup revenue has ceased. At this stage, lifetime expected credit losses would now have to be accounted for Stage III The portfolio has experienced both an increase in credit risk and a ceasing of markup revenue. Interest income associated with these assets shall now be recognized net of the associated credit loss for the period. Asset Quality PACRA analyses loans considered to be “problem” loans, whether they are “sensitive”, “watchlist”, “underperforming” (i.e., still performing), non-performing or restructured loans. In assessing the underlying risk of problematic loans, the adequacy of any security and reserve coverage is taken into account. As far as loan loss reserves are concerned, the evaluation consists of different types of risk reserves or provisions in place for them (specific or general), trends within the financial institution's provisioning, write-offs and recoveries. The trend evaluation, particularly, is inclusive of trends depicting movements in financing asset “stages” in lieu of IFRS 9. Naturally, an advances portfolio with an increasing tendency of transference towards Stage II loans foreshadows an increase in Stage III or non-performing loans. Moving on, asset quality is also assessed through both absolute and relative criteria, and where possible, PACRA compares ratio results with those of equivalent financial institutions. All in all, credit risk or asset quality in general is accounted for by a handful of metrics, including but not limited to the Impaired Loan Ratio, Write Off Ratio, the Provision Coverage Ratio, Top 20 Advances as a percentage of Advances, Off-Balance Sheet Exposure against Equity, etc. With reference to the quality of other assets, we analyze the fixed income securities’ portfolio in terms of its qualitative characteristics, its maturity, any undue concentration or particularly large individual exposures and the valuation of these securities. Likewise, an analysis of a financial institution’s inter-financial institution deposit and loan book takes into consideration the creditworthiness of the counter parties. Financial institutions’ off-balance sheet commitments are important to PACRA’s evaluation. Such commitments include guarantees and letters of credit (LCs) as well as derivatives and other products. Proceeding with derivative instruments, PACRA looks at the gross notional and net fair values of a financial institution’s derivative portfolio. It also considers the types of derivative instruments the financial institution uses and the purpose for which it uses them. Insofar as credit risk is concerned, it examines the systems used by financial institutions for measuring credit exposure, their valuation policies and the quality of counter parties. Apart from credit risk, derivative instruments also give rise to market, legal and operational risks, which have to be taken into consideration separately.

Page | 13 October 2025 Financial Institutions Rating Criteria Methodology Market Risk This risk may be defined as one arising as a result of fluctuations in the returns or values underlying financial and equity securities. Unsystematic Risk would not technically constitute market risk, but given that institutes may not have sufficiently diversified, residual traces of it shall remain in the risk as accounted for by this sub-factor. Additionally, PACRA’s analysis of market risk encompasses all structural and trading risks experienced by a financial institution. Insofar as structural risks are concerned, the examination includes the asset and liability management strategy, and the role of hedging and position taking. Accordingly, elements interplaying within the dimension of structural risks, such as interest rate levels, foreign exchange rates and other off-balance sheet items are inspected and contrasted against risk management policies and prudential circumstantial practices. The evaluation of the trading portfolio, as aforementioned, pertains to the approach and optimization of trading activities. For instance; does the institute happen to be a significant position taker or are its trading activities mainly related to client business or hedging transactions? Inquiries such as this are intended to clarify ambiguities such that it can be reasonably ascertained that an institution’s core operations are not subverted by other aspects of its business model. Liquidity and Funding The primary factor to analyze in this section is the structure and diversification of a financial institution’s funding base. This includes identifying any marked concentration in deposit base and borrowings, as well as identifying significant trends in funding sources. The composition of the deposit base is analyzed in regard to the following comparative categorizations; retail versus institutional, current versus savings/fixed term, and by germination classifiers (financial institutions, corporates, etc.). The yardstick to gauge concentration is usually the proportion of top 20 deposits as a percentage of total customer deposits. The greater the fractional proportion of the top twenty deposits the more important it is for an FI to be able to refinance itself without destabilizing its lending portfolio. As such, it is now evident that one risk for an FI’s funding liabilities is an inability to renew or replace maturing liabilities, either at all or at a reasonable cost. A well-diversified and stable funding base coupled with a variety of suppliers; depositors, perhaps, within each source type, can limit this risk. Hence, the need to breakdown borrowing and/or deposit composition by size, maturity, geographical source, and currency. In case of digital banks, deposit mobilization is linked with capitalization of the bank. Digital banks are expected to rely more on capital in the initial years considering various caps on deposit limits and other requirements. In regards to liquidity, the evaluation encompasses an institution’s internal (marketable securities, maturing loans, et cetera) and external sources (access to money markets, stand-by lines from other financial institutions and rediscount facilities at the central bank). As a contingency to a liquidity crunch, most financial institutions hold a portfolio of marketable securities and other assets, which can be sold quickly for cash in case of need. It is, however, important to assess how marketable a financial institution’s securities’ portfolio truly is, and whether or not its marketability suffices the deadlines imposed by an urgent outflow schedule. Lastly, financial institutions should build an elaborate contingency plan per chance of a liquidity crisis. The plan should ideally specify the function and individuals responsible for monitoring reserve amounts intended to be utilized in case of fluctuations in the burn rate or withdrawal of funding. Adding to that, its specifications should include differing courses of action and the point or stage at which they are to be acted upon. This is to be accompanied by covenants held with lenders of last resort.

Page | 14 October 2025 Financial Institutions Rating Criteria Methodology Capital Structure A financial institution’s capital provides a cushion to absorb unreserved losses, or, in case of insolvency, absorbing losses which would otherwise have to be borne by depositors. Both the absolute size of a financial institution’s equity capital and its capital adequacy (i.e., the size of its capital in relation to its risks) are thus fundamental considerations when analyzing its creditworthiness. With reference to the quality of other assets, we analyze the fixed income securities’ portfolio in terms of its qualitative characteristics, its maturity, any undue concentration or particularly large individual exposures and the valuation of these securities. Likewise, an analysis of a financial institution’s inter-financial institution deposit and loan book takes into consideration the creditworthiness of the counter parties. Meanwhile, the framework for domestic systemically important banks (D-SIBs) is considered to have a material impact on the capital adequacy of D-SIBs. Here, PACRA reviews the compliance status of the financial institution and forms a forward-looking opinion on any materially adverse effect that could have subsequent repercussions on the Capital Adequacy Ratio (CAR). SBP has introduced phase-wise capital requirements for digital banks. These, along with the digital bank’s funding plan for short, medium and long-term are looked at to assess its viability. The impact of regulatory changes and the managerial response intended to ensure an adequate level of funding for current and future alterations to the asset composition is an essential part of this assessment. Apart from the regulatory capitalization requirements, PACRA uses its own standard quantitative techniques to measure capitalization. These are applied to financial institutions across the board, the principal one being pure common equity as a percentage of total assets. PACRA also examines the quality of capital; what percentage of the capital base is pure common equity relative to that in the form of subordinated debt, perpetual debt, and other forms of quasi-equity (revaluation reserves, unrealized gains, insufficiently provisioned non-performing loans, and overvalued assets). The management’s policies with regard to minimum capital ratio, share buyback programs and dividend disbursements are likewise, taken into account. The same goes for a financial institution’s ability to raise new capital, which is inclusive of its ability to generate capital internally. PACRA inspects the trends within the regulatory capital ratios, both in absolute terms and in relation to those of its peers. Moreover, PACRA analyses the capital formation rate to assess a financial institution’s ability to meet its growth requirements and restraints through its internal business model. This can be determined by isolating growth through other sources of funding and computing the required formation rate in line with the rate of change in assets. That, subject to some adjustment, can be contrasted against the true formation rate, which itself is computed based on retained profits and net of dividends.

Page | 15 October 2025 Financial Institutions Rating Criteria Methodology Credit Enhancement A financial institution that possesses third party commitments to make good an amount obligated to the lenders may provide additional support to its financial risk profile. In this case, when determining the impact on the rating, some key factors to incorporate into the assessment are the financial profile of the third party and the extent of coverage, quantum and duration, provided by it. Financial Risk – Key Ratios •Top 20 Advances / Advances (%) •Stage I and Stage II Advances / Gross Advances (%) •Impaired Loan Ratio | [Stage III | Advances (NPLs) / Gross Advances] •Non-Performing Finances / Gross Finances (%) •Risk Weighted Assets / Total Assets (%) •Loan Loss Provisions / Non-Performing Advances (%) Credit Risk •Government Securities / Investments (%) •Risk Weighted Assets / (Investments + Debt Instruments) (%) •(Investments + Debt Instruments) / Total Assets (%) Market Risk •Liquid Assets / Deposits and Borrowings (%) •Advances / Deposits (%) •Finances / Deposits and Borrowings (%) •Top 20 Deposits / Deposits (%) •Government and PSE Deposits / Deposits (%) -not in model Liquidity and Funding •Equity / Total Assets (%) •Tier-I Capital / Risk Weighted Assets (%) •Tier-II Capital / Risk Weighted Assets (%) •Capital Formation Rate (%) Capitalization Information Required on Financial Risk  Top performing private group exposures  Statement of credit exposures by type of security  Breakdown of advances in each stage as per IFRS 9 ECL  Latest Internal Risk Rating of facilities’ obligors  Party wise break-up of classified loan portfolio  Latest statement of marginal/watchlist accounts  Category wise break-up of FSV benefit availed by the bank  Details of top 20 group-wise deposits and sponsor deposits separately  Breakup of deposit base  Capital Adequacy Ratio Statement

Page | 16 October 2025 Financial Institutions Rating Criteria Methodology Credit Enhancement PACRA also takes into account any external support available to financial institution by any shareholder(s) or government while rating the institution. Availability of external support improves the ability of financial institution to fulfill its financial commitments. This results in improved creditworthiness of that financial institution specially when it is backed up by strong third party. At the same time, financial strength of supporting party is also evaluated in order to evaluate riskiness. If support mechanism is strong, it results in improved rating of that FI.

Analyst Contacts Momin Farooque momin.farooque@pacra.com October 2024 Financial Institutions Rating Criteria Scale Credit Rating Credit rating reflects forward-looking opinion on credit worthiness of underlying entity or instrument; more specifically it covers relative ability to honor financial obligations. The primary factor being captured on the rating scale is relative likelihood of default. Scale Long-Term Rating AAA Highest credit quality. Lowest expectation of credit risk. Indicate exceptionally strong capacity for timely payment of financial commitments. AA+ AA AA￾Very high credit quality. Very low expectation of credit risk. Indicate very strong capacity for timely payment of financial commitments. This capacity is not significantly vulnerable to foreseeable events. A+ A A￾High credit quality. Low expectation of credit risk. The capacity for timely payment of financial commitments is considered strong. This capacity may, nevertheless, be vulnerable to changes in circumstances or in economic conditions. BBB+ BBB BBB￾Good credit quality. Currently a low expectation of credit risk. The capacity for timely payment of financial commitments is considered adequate, but adverse changes in circumstances and in economic conditions are more likely to impair this capacity. BB+ BB BB￾Moderate risk. Possibility of credit risk developing. There is a possibility of credit risk developing, particularly as a result of adverse economic or business changes over time; however, business or financial alternatives may be available to allow financial commitments to be met. B+ B B￾High credit risk. A limited margin of safety remains against credit risk. Financial commitments are currently being met; however, capacity for continued payment is contingent upon a sustained, favorable business and economic environment. CCC CC C Very high credit risk. Substantial credit risk “CCC” Default is a real possibility. Capacity for meeting financial commitments is solely reliant upon sustained, favorable business or economic developments. “CC” Rating indicates that default of some kind appears probable. “C” Ratings signal imminent default. D Obligations are currently in default. Scale Short-Term Rating A1+ The highest capacity for timely repayment. A1 A strong capacity for timely repayment. A2 A satisfactory capacity for timely repayment. This may be susceptible to adverse changes in business, economic, or financial conditions. A3 An adequate capacity for timely repayment. Such capacity is susceptible to adverse changes in business, economic, or financial conditions. A4 The capacity for timely repayment is more susceptible to adverse changes in business, economic, or financial conditions. Liquidity may not be sufficient. Rating Modifiers | Rating Actions Outlook (Stable, Positive, Negative, Developing) Indicates the potential and direction of a rating over the intermediate term in response to trends in economic and/or fundamental business / financial conditions. It is not necessarily a precursor to a rating change. ‘Stable’ outlook means a rating is not likely to change. ‘Positive’ means it may be raised. ‘Negative’ means it may be lowered. Where the trends have conflicting elements, the outlook may be described as ‘Developing’. Rating Watch Alerts to the possibility of a rating change subsequent to, or, in anticipation of some material identifiable event with indeterminable rating implications. But it does not mean that a rating change is inevitable. A watch should be resolved within foreseeable future, but may continue if underlying circumstances are not settled. Rating watch may accompany rating outlook of the respective opinion. Suspension It is not possible to update an opinion due to lack of requisite information. Opinion should be resumed in foreseeable future. However, if this does not happen within six (6) months, the rating should be considered withdrawn. Withdrawn A rating is withdrawn on a) termination of rating mandate, b) the debt instrument is redeemed, c) the rating remains suspended for six months, d) the entity/issuer defaults., or/and e) PACRA finds it impractical to surveil the opinion due to lack of requisite information. Harmonization A change in rating due to revision in applicable methodology or underlying scale. Surveillance. Surveillance on a publicly disseminated rating opinion is carried out on an ongoing basis till it is formally suspended or withdrawn. A comprehensive surveillance of rating opinion is carried out at least once every six months. However, a rating opinion may be reviewed in the intervening period if it is necessitated by any material happening. Rating actions may include "maintain", "upgrade", or "downgrade". Note: This scale is applicable to the following methodology(s): a) Broker Entity Rating b) Corporate Rating c) Debt Instrument Rating d) Financial Institution Rating e) Holding Company Rating f) Independent Power Producer Rating g) Microfinance Institution Rating h) Non-Banking Finance Company Disclaimer: PACRA has used due care in preparation of this document. Our information has been obtained from sources we consider to be reliable but its accuracy or completeness is not guaranteed. PACRA shall owe no liability whatsoever to any loss or damage caused by or resulting from any error in such information. Contents of PACRA documents may be used, with due care and in the right context, with credit to PACRA. Our reports and ratings constitute opinions, not recommendations to buy or to sell.