Rule for Statutory Audit of Consolidated Financial Statements of Commercial Banks and Information Disclosure

Order No. 284/04 of the President of the National Bank of Georgia December 26, 2018 Tbilisi On the Approval of the Rule for the Statutory Audit of the Consolidated Financial Statements of Commercial Banks and for Information Disclosure in the Explanatory Notes Based on sub-paragraph 'g' of the first paragraph of Article 15 of the Organic Law of Georgia "on the National Bank of Georgia", Articles 26 and 27 of the Law of Georgia "on Commercial Bank Activities", and sub-paragraph 'b' of the first paragraph of Article 25 of the Law of Georgia "on Normative Acts", I hereby order:
Article 1
The Rule for the Statutory Audit of the Consolidated Financial Statements of Commercial Banks and for Information Disclosure in the Explanatory Notes shall be approved with the attached version.
Article 2
Upon the entry into force of this order, the Order No. 134/01 of the President of the National Bank of Georgia of October 22, 2010, "On the Approval of the Rule for Conducting External Audits of Commercial Banks" Shall be declared null and void.
Article 3
Commercial banks are obliged, for the reporting periods beginning on January 1, 2019, to carry out the statutory audit of the consolidated financial statements, non-audit services, and the disclosure of information in the explanatory notes in accordance with the requirements established by this Rule. If a bank does not have a subsidiary undertaking, the requirements of this Rule shall apply to the bank's individual financial statements.
Article 4
This order shall enter into force on January 1, 2019.
Vice President of the National Bank of Georgia (Acting) Archil Mestvirishvili

Rule for the Statutory Audit of the Consolidated Financial Statements of Commercial Banks and for Information Disclosure in the Explanatory Notes
Article 1. General Provisions
This Rule regulates the main issues related to the statutory audit of the consolidated financial statements of a commercial bank, including a branch of a foreign bank (hereinafter – the Bank); the relationship between the National Bank of Georgia (hereinafter – the National Bank), the external audit firms of banks (hereinafter – the Audit Firm), and the Banks; as well as issues related to the information to be disclosed in the explanatory notes of the audited consolidated financial statements.
Article 2. Definition of Terms
For the purposes of this Rule, the terms used herein have the following meanings:
a) Engagement Partner – an auditor as defined in accordance with sub-paragraph 'I' of the first paragraph of Article 2 of the Law of Georgia "on Accounting, Reporting and Auditing", who is authorized to carry out an audit of the financial statements of a public interest entity in accordance with the legislation of Georgia; b) Audit Firm – an audit firm as defined by sub-paragraph 'h' of the first paragraph of Article 2 of the Law of Georgia "on Accounting, Reporting and Auditing", which is authorized to carry out an audit of the financial statements of a public interest entity in accordance with the legislation of Georgia; c) Financial Statements – shall be interpreted in accordance with paragraph 'd' of the first paragraph of Article 2 of the Law of Georgia "on Accounting, Reporting and Auditing"; d) Applicable Financial Reporting Framework – shall be interpreted in accordance with paragraph 'n' of the first paragraph of Article 2 of the Law of Georgia "on Accounting, Reporting and Auditing"; e) Material Misstatement – a material misstatement as defined by IFRS; f) Materiality Threshold – the materiality threshold defined by the Audit Firm within the scope of the statutory audit in accordance with International Standard on Auditing (ISA) 320; g) Management Letter – a communication received from the Audit Firm in accordance with International Standards on Auditing (ISA) 265 and 260; h) Preliminary Financial Statements – unaudited consolidated financial statements prepared in accordance with IFRS standards, which at a minimum include: the statements of financial position, profit and loss and other comprehensive income for the period, equity for the period, and cash flows for the period, as well as the accounting policies and the majority of other explanatory notes; i) Bank Holding Company – a legal entity as defined in accordance with paragraph 'z7 2 ' of Article 2 of the Organic Law of Georgia "on the National Bank of Georgia"; j) Consolidated Financial Statements - the financial statements of a Bank prepared in accordance with IFRS 10; k) Portal – the portal as defined by sub-paragraph 'b' of Article 2 of the Rule approved by Order No. 89/04 of the President of the National Bank of Georgia of July 22, 2022, "On the Approval of the Rule for Using the Supervisory Reporting System".

Order of the President of the National Bank of Georgia No. 100/04 of April 18, 2024 - website, 18.04.2024.
Article 3. Obligations of the Bank

1. The Bank is obliged to:
   a) Independently of the Audit Firm, prepare the Preliminary Financial Statements and submit them to the Audit Firm for audit purposes. Within 5 working days of submitting the Preliminary Financial Statements to the Audit Firm, and no later than the first of March of the year following the reporting period, submit the Preliminary Financial Statements to the National Bank; b) Ensure that the annual statutory audit of the consolidated financial statements is conducted by an Audit Firm that has professional experience or adequate resources appropriate to the complexity, scope, and risk profile of the Bank's activities. The Audit Firm and the Engagement Partner selected by the Bank to conduct the statutory audit must comply with the requirements established by sub-paragraphs 'a' and 'b' of Article 2 of this Rule and meet at least the following criteria:
   b.a) The Audit Firm or any foreign or Georgian firm, branch, or representative office within the Audit Firm's network must have at least 15 years of work experience in the audit field; b.b) The Audit Firm and the Engagement Partner must have at least 5 years of experience in auditing financial institutions; c) No later than October 31 of each reporting period, submit to the National Bank a copy of the audit engagement letter concluded with the auditor for the audit of the consolidated financial statements, in accordance with the requirements established by this Rule; d) To notify the National Bank of the refusal by the appointed Audit Firm to perform the obligations stipulated by the engagement, or of any changes made thereto, within 10 working days of the change being made; e) To submit to the National Bank electronic copies of the audited Consolidated Financial Statements and the Management Letter via the Portal within 10 working days of their receipt, but no later than May 15 of the year following the reporting period. Furthermore, the Bank is obliged, upon request, to also submit documentary copies of the audited Consolidated Financial Statements and the Management Letter; f) To submit the audited Consolidated Financial Statements in accordance with sub-paragraph 'e' of this paragraph in both Georgian and English, with one language being the original. If the original is prepared in another language, it must be submitted in addition to the Georgian and English versions. The audited reports in both languages must be accompanied by an auditor's opinion, and in at least one language, by the signature of the Engagement Partner or an authorized representative of the Audit Firm, indicating the date of the opinion's issuance. It is permissible to submit a notarized translation of the auditor's opinion and the audited Consolidated Financial Statements. The statements must be submitted in a format where each word can be found in automatic mode without converting the statements to another format. It is permissible to submit the documents listed in sub-paragraph 'i' of this paragraph in English; g) If the Bank does not receive a Management Letter from the Audit Firm in written form, to submit to the National Bank within the timeframe specified in sub-paragraph 'e' of this paragraph, a statement signed by an authorized person on behalf of the Audit Firm, confirming that no significant deficiencies were found during the statutory audit;

h) To publish the audited Consolidated Financial Statements in English and Georgian on its own website no later than the deadline specified in sub-paragraph 'e' of this paragraph and to ensure their availability for 10 years from the date of publication. The Bank must publish the Consolidated Financial Statements in the same form and content on which the auditor expressed an opinion, and they must be accompanied by the Audit Firm's opinion; i) To submit to the National Bank in documentary or electronic form the annual audited financial statements of the parent company and the Bank Holding Company immediately upon their publication in the country of registration, as well as the interim audited/reviewed financial statements, if the latter are publicly available; j) To pay the costs related to the statutory audit of the previous reporting period no later than October 31 of the following reporting year. The audit fee for the reporting year must only include the costs related to the statutory audit of the Bank required by this Rule and the Law on Accounting, Reporting and Auditing; k) The audited Consolidated Financial Statements must include the audited information disclosed in accordance with Article 5 of this Rule; l) For the part of the Consolidated Financial Statements that is not prepared in accordance with IFRS, if any, to indicate the basis of preparation according to which the information is presented; m) To indicate the part of the audited Consolidated Financial Statements that has not been audited, if any; n) The Bank's audit committee is obliged, in agreement with the Audit Firm, to share with the National Bank the Materiality Threshold determined by the Audit Firm during the process of conducting the statutory audit; o) In the event of a change of the Engagement Partner, to immediately notify the National Bank in writing of the Engagement Partner's name, surname, and contact information; p) To immediately provide the National Bank with the information received in accordance with paragraph 5 of Article 4 of this Rule. If the sum of the fees for the reporting period's audit and non-audit services amounts to 20% or more of the previous year's revenue of the Audit Firm conducting the statutory audit, the Bank's audit committee is obliged to submit an analysis of the auditor's independence assessment to the National Bank within 10 working days of receiving the information from the Audit Firm.
2. To ensure compliance with the relevant requirements of this Rule, the Bank is obliged to reflect
the requirements of this Rule in the audit engagement letter concluded with the Audit Firm, either by reference to this Rule or expressly stated in the text
3. The audit engagement letter must state that, for the purposes of this Rule, the provision of
additional information on the consolidated financial statements held by the external Audit Firm to the National Bank, upon informing the commercial bank, shall not be considered a breach of confidentiality.
4. In accordance with paragraph 5 of Article 4 of this Rule, the sum of the fees for the Bank's
statutory audit and non-audit services is permitted to amount to 20% or more of the previous year's revenue of the Audit Firm registered in Georgia conducting the statutory audit for 5 consecutive years, provided that the Bank's audit committee submits an assessment report of the external auditor's independence to the National Bank each year, in accordance with sub-paragraph 'p' of the

first paragraph of Article 3 of this Rule, no later than the deadline specified in sub-paragraph 'c' of the first paragraph of the same Article. Order of the President of the National Bank of Georgia No. 100/04 of April 18, 2024 - website, 18.04.2024.
Article 4. Requirements for the Bank Audit

1. In the bank audit process, compliance with the following requirements is statutory:
   a) The Audit Firm must refuse to provide any service that violates the independence and ethics requirements stipulated by the Law of Georgia "on Accounting, Reporting and Auditing"; b) If the circumstances specified in this sub-paragraph are discovered during the performance of the statutory audit, the Engagement Partner/Audit Firm shall provide information to the National Bank no later than 5 working days from the discovery of the fact:
   b.a) Regarding the non-fulfillment of any of the banking license requirements in accordance with the Law of Georgia "on Commercial Bank Activities"; b.b) Regarding a conflict with the administrators of the Bank as defined by the Law of Georgia "on Commercial Bank Activities"; b.c) Regarding a material breach of legislation or the Bank's charter; b.d) Regarding any material adverse change in the risks related to the Bank's activities or possible future risks that may affect the Bank's going concern;
2. If, based on written information provided by the Bank, the Audit Firm is satisfied that the
   National Bank is aware of the circumstances established by sub-paragraph 'b' of the first paragraph of this Article, it shall be released from the obligation to provide the information established by the same sub-paragraph.
3. The Audit Firm is obliged to share the Materiality Threshold determined during the audit
   process with the Bank's audit committee.
4. The Audit Firm, upon informing the Bank, must, at the request of the National Bank, disclose
   additional information about the material misstatement(s) that led to the issuance of a modified opinion.
5. The Audit Firm is obliged, before signing the assurance engagement letter, to provide written
   information to the Bank's audit committee as to whether the sum of the fees for the reporting period's statutory audit and non-audit services amounts to 20% or more of the previous year's revenue of the Audit Firm registered in Georgia.
   Article 5. Information to be Disclosed in the Explanatory Notes to the Audited Consolidated
   Financial Statements
6. The Bank is obliged to disclose:
   a) Information on assets that are used to secure its own or a third party's liabilities (including contingent liabilities). The information must be sufficiently detailed to show the total amount of assets used as collateral for each class of liabilities, class of third-party liabilities, and class of contingent liabilities;

b) With respect to a subordinated liability that exceeds 10% of the total subordinated liabilities, to disclose the following information:
b.a) The amount of the liability assumed, the currency in which it is denominated, the interest rate, the maturity, or the fact that the liability is perpetual; b.b) The circumstances under which the liability must be fulfilled before its maturity; it is permissible for the circumstances to include a qualitative, non-exhaustive list; b.c) The subordination conditions and the agreement (if any) according to which the subordinated liability is converted into capital or another type of liability, and the terms of such an agreement; for the purposes of this paragraph, the amount of liabilities converted into capital during the reporting period is also subject to disclosure. c) The average annual number of employees, by category, in accordance with Order No. N-7 of the Head of the Service for Accounting, Reporting and Auditing Supervision of June 28, 2017, "On the Approval of the Rule and Practical Examples for Determining the Average Number of Employees for a Reporting Period". The categories must be divided according to senior management, middle management, and other employees, as well as by temporary and permanent employment contracts; d) The name and legal address of the undertaking in which the Bank directly or indirectly holds a share of 10% or more. The share of capital held and the monetary amount of the capital held must be disclosed; e) The name, legal address, and legal form of each Undertaking to which the Bank is a partner with unlimited liability.
2. The Bank is obliged to disclose the information stipulated by this Article regardless of
materiality.
Article 6. Restrictions Related to the Bank's Audit Services

1. The Bank is obliged, for at least 1 year after the issuance of the auditor's opinion, not to
   employ the key audit partner of the Audit Firm involved in the Bank's statutory audit at the Bank or a subsidiary Undertakings. The Bank is obliged, for at least 2 years, not to employ the audit manager and the Engagement Partner of the Audit Firm involved in the Bank's statutory audit at the Bank or the Bank's subsidiary Undertakings. For the purposes of this paragraph of this Article, the restriction applies to the following positions:
   a) Member of a management body; b) Member of the audit committee or a body with a similar function; c) Member of the supervisory board; d) Positions related to the preparation of financial statements and bookkeeping.
2. The Bank is prohibited from making the remuneration for audit services contingent on any
   variable, such as the Bank's profit, revenue, or other financial indicator of the Bank.
3. The Bank is prohibited from receiving the following non-audit services from its own external
   Audit Firm or from a firm belonging to the network of which the Audit Firm is a member, from the beginning of the reporting period until the issuance of the auditor's opinion:

a) Tax services related to:
a.a) Preparation of tax returns; a.b) Income tax; a.c) Customs duties; a.d) Activities related to the identification of state subsidies and tax reliefs, unless required by law; a.e) Supporting a tax inspection conducted by a tax authority, unless required by law; a.f) Calculation of direct, indirect, and deferred taxes; a.g) Provision of tax advice. b) Services that involve participating in the Bank's management or decision-making process; c) Accounting, bookkeeping and preparation of financial statements; d) Services related to the remuneration of the Bank's employees; e) Designing and implementing internal controls and risk management procedures related to the preparation and/or control of financial information or designing and implementing financial information technology systems; f) Valuation services, including the valuation of the financial effect of a dispute initiated against the Bank and actuarial services; g) Legal services:
g.a) General legal advice; g.b) Conducting negotiations on behalf of the Bank; g.c) Acting in an advocacy role for the Bank in the resolution of litigation; h) Services related to the Bank's internal audit function; i) Promoting, dealing in, or underwriting shares of the Bank; j) Services related to human resources:
j.a) Control of human resources-related expenses; j.b) Participating in the search for employees who would be designated for the Bank's bookkeeping or preparation of financial statements; k) Services related to determining the Bank's financing, capital structure, and investment strategies, except for services related to assurance services for financial statements, such as issuing an opinion in connection with a prospectus of the audited undertaking.

4. In addition to the services listed in paragraph 3 of this Article, the restriction on receiving
   non-audit services according to paragraph 3 of this Article also applies to such non-audit services that the Bank considers to pose a threat to the auditor's independence.
5. The restriction in paragraph 3 of this Article may not apply to the services listed in
   sub-paragraphs 'a.a', 'a.d - a.g', and 'f' of paragraph 3 of the same Article, if the following conditions are met:
   a) The services do not have a material effect, individually or in aggregate, on the audited consolidated financial statements; b) An analysis of the effect of providing these services on the audited financial statements is shared in writing with the Bank's audit committee.
6. After receiving continuous 5-year statutory audit services from the same Audit Firm, the Bank
   is obliged to hold a tender defined by the Bank's internal policies and procedures for the purpose of selecting an Audit Firm to conduct the statutory audit. Taking into account the results of the tender, the Bank's audit committee shall send a corresponding written recommendation to the supervisory board for the purpose of selecting an Audit Firm. The written recommendation must include a proposal of at least two candidate Audit Firms and information on the advantages of each Audit Firm. Receiving statutory audit services from the same Audit Firm is permissible for no more than 10 continuous years.
7. After the expiration of the 10-year period defined in paragraph 6 of this Article, before receiving
   statutory audit services from the same Audit Firm again, the Bank must observe a cooling-off period of at least 4 years, which shall be calculated from the moment of the expiration of the 10-year period.
8. The Engagement Partner and other key audit personnel conducting the statutory audit of the
   commercial bank must be rotated after every continuous 5-year period. The conduct of the statutory audit process by the same Engagement Partner and other key audit personnel is permissible after a period of at least 3 years has passed, which shall be calculated from the moment of the expiration of the continuous 5-year period defined by this paragraph.
9. In the event that a representative of the financial sector obtains a banking license in
   accordance with the legislation of Georgia, the relevant periods related to the statutory audit services provided to said financial sector representative before obtaining the banking license shall be counted towards the time limits established by paragraphs 6-8 of this Article for the Audit Firm or the Engagement Partner/other key audit personnel. Decree No. 41/04 of the President of the National Bank of Georgia of March 12, 2020 - website, 12.03.2020. Order No. 100/04 of the President of the National Bank of Georgia of April 18, 2024 - website, 18.04.2024.
   Article 7. Powers of the National Bank
10. The National Bank is authorized to:
    a) At any time after the issuance of the opinion by the Audit Firm, request in written form additional information from the Audit Firm and/or the Bank regarding the audited consolidated financial statements; b) Request from the Bank and/or the Audit Firm information about all services provided by the Audit Firm to the Bank, for the purpose of assessing the independence and impartiality of the Audit Firm; c) Require the Bank to select another Audit Firm if, after cooperating with the Service for Accounting, Reporting and Auditing Supervision, it determines that the audit has not been conducted in

accordance with International Standards on Auditing, or if the independence/competence of the Audit Firm is called into question, and/or the Audit Firm violates the requirements of this Rule. In the event that the National Bank exercises this power, it must notify the Audit Firm, the Service for Accounting, Reporting and Auditing Supervision, and the Bank of this in writing within 5 working days of making the decision.
2. The National Bank is not authorized to determine the scope and forms of work necessary for
conducting the audit.
Article 8. Supervisory Measures and Sanctions (Monetary Fine)
In case of non-fulfillment of the requirements established by this Rule, the National Bank is authorized to apply against the banks the supervisory measures and/or sanctions (monetary fine) established by legislation. Order No. 94/04 of the President of the National Bank of Georgia of April 27, 2020 - website, 28.04.2020.