REGULATION ON RISK MANAGEMENT IN COMMERCIAL

BANKS

Chapter I
Introduction
General Provisions for Application of Risk Management

Article 1. Concept of Risk and Essence of its Application

1. The banking system has undergone rapid changes in its external environment and internal
situation, followed by increasing complexity of the risk of banking operations. Risk
undertaking itself is not a negative step and it may be related with receipt of additional
profit.
2. As a result, increase in complex risks related with bank operations determined a growing
need for good corporate governance that encompasses active oversight of Bank
management, policies, procedures and establishment of risk limits, identification,
measurement, and monitoring processes, implementation of information systems, risk
control, and internal control systems.
3. Application of risk management will benefit both the banking system and the bank
supervising authorities. Through effective governance of risks commercial bank
(hereinafter-bank) management can improve asset value, obtain picture of likelihood of
future Bank losses, improve the methods and processes for systematic decision making
based on availability of information, use a more accurate basis for measuring Bank
performance, assess inherent risk in relatively complex instruments or business activities of
the Bank, and create a robust risk management infrastructure that will strengthen the
competitiveness of the Bank.
4. For the bank supervisory authority, application of risk management will expedite
assessment of the likelihood of Bank losses that may affect Bank capital and provide one
basis for assessment in adoption of strategy and focus in bank supervision.
5. The essence of application of risk management is adequacy of procedures and methodology
for risk management to ensure that Bank operations are manageable within acceptable
limits and are profitable for the Bank. Nevertheless, in view of differences in market
conditions and structures, the size and complexity of Bank operations, and the absence of
any single universal risk management system for all Banks, each Bank shall develop a risk
management structure and risk management system appropriate to the Bank.
6. Risk within the context of banking is a potential event, whether anticipated or
unanticipated, that may negatively impact the revenues and capital of the Bank. To put
 risk management process into place, a Bank shall first undertake an accurate identification
of risks by recognizing and understanding all inherent risks and risks that may arise from a
new business conducted by the Bank, including any risks from connected companies and
other affiliates.
7. Following the accurate identification of risk, the Bank will then have to proceed with
measurement, monitoring, and control of risks in that order. Measurement of risk is
intended to enable a Bank to calculate the inherent risk exposure in its business activities
so that the Bank is able to estimate the impact of the risk on the capital that should be
maintained to support these business activities. Alongside this, as part of its risk
monitoring, the Bank shall evaluate its risk exposure and especially any that are material
and/or may impact Bank capital.
8. The results of the monitoring, including timely, accurate, and informative evaluation of
these risk exposures, will be used by the decision makers in a Bank and in any follow up
that may be needed. Furthermore, based on these findings, the Bank will take measures to
control risks, among others by adding capital, taking out hedging, and other risk mitigation
techniques.

Article 2. Powers and Responsibilities of Bank Management with Respect to Risk Management

1. The Bank is required to analyze and design adequate control measures against those threats
which may create obstacles for the Bank in achievement of specific goals. Effective risk
management necessarily implies management of all risks. This can be achieved if close
cooperation and open communication are established among supervisory board,
directorate, internal audit, compliance functions, external audit and internal units of risk
management. Thus the bank has to define clear powers and liabilities for each job level
pertaining to application of risk management.
2. The powers and responsibilities of the Supervisory Board shall cover at least the following:
a) Approval and evaluation of risk management policy at least once each year or at a
higher frequency in the event of any change in factors significantly affecting the
business activities of the Bank;
b) Evaluating the report provided by the Board of Directors on implementation of the
above-mentioned risk management policy, at least on a quarterly basis;
c) Evaluation of decisions exceeding the decision-making powers of the Board of
Directors, and thus requiring approval from the Supervisory Board.
3. The powers and responsibilities of the Board of Directors shall cover at least the following:
a) Preparation of a comprehensive, written risk management policy and strategy,
including the establishment and approval of overall risk limits, limits on specific types
of risk, and limits per business line of the Bank, as well as powers of collective bodies
accountable to the Directorate defining risks and / or separate persons.
 b) The risk management policy and strategy shall be revised at least once each year or at a
higher frequency in the event of any changes in factors significantly affecting the
business activities of the Bank;
c) Responsibility for implementation of the risk management policy and overall risk
exposures taken on by the Bank, including evaluation and provision of guidance for the
risk management strategy based on reports submitted by the Risk Management Unit
and submission of the quarterly reports to the Supervisory Board;
d) Evaluate and decide on transactions exceeding the authority of subordinated structural
units or transactions requiring approval by Board of Directors under the applicable
internal policies and procedures;
e) Develop a risk management culture at all levels of the organization, with scope
including adequate communications to all levels of the organization on the importance
of effective internal control;
f) Ensure the development of the competency of employees concerned with application of
risk management, including but not limited to ways of conducting ongoing education
and training programs, especially those concerned with risk management processes and
systems;
g) Ensure that the risk management function is applied on an independent basis, reflected
among others by segregation of functions between the Risk Management Unit (which
conducts the identification, measurement, monitoring, and control of risks) and units
that conduct and settle banking operations;
h) Conduct regular reviews at a frequency determined according to the needs of the Bank
to obtain assurance of:
h.a) accuracy of the risk assessment methodology;
h.b) adequate functioning of the risk management information system; and
h.c) propriety of policies, procedures, and establishment of risk limits.

Article 3. Human Resources (HR)

1. The Bank shall establish clear qualification requirements at each job level of the Bank risk
management unit;
2. To ensure that risk management processes are implemented on the basis of prudential
principles, the Bank shall strengthen the competency and integrity of its officers and
particularly of the head of operational units and the Risk Management Unit. This should
take into account such factors as knowledge, track record, skills, and adequate education in
risk management;
3. The Bank shall develop adequate systems for employee recruitment, development and
training, and remuneration to ensure adequate numbers of employees competent in risk
management;
4. The Bank shall deploy competent officers and staff in the Risk Management Unit in
accordance with the nature, size, and complexity of the business operations of the Bank;
5. The officers and staff deployed in the Risk Management Unit shall possess the following
skills:
a) Understanding of the inherent risk in each product/business line of the Bank;
b) Understanding of the relevant risk factors and market conditions affecting the
products/business lines of the Bank, and the ability to estimate the impacts of any
changes in these factors on the survival of the Bank;
c) Experience and ability to understand and communicate the implications of the Bank’s
risk exposures to the Board of Directors and the risk management committee on a timely
basis.

Article 4. Organization and Functions of Risk Management

1. The organizational structure of a Bank shall be designed to ensure that any unit conducting
a particular transaction (risk-taking unit) is independent of the unit performing the
internal control function (internal audit unit and compliance functions) and also
independent of the Risk Management Unit.
2. For the purpose of effective application of risk management, each Bank shall prepare an
organizational structure appropriate to the objectives and business policies, size,
complexity, and capability of the Bank. This unit shall necessarily cover risk management
committee and structural unit (risk management unit, internal audit and compliance
functions).
3. Risk Management Committee may have permanent and non-permanent members and shall
consist of at least a majority of the Board of Directors and relevant Executive Officers.
a) If the Bank has 3 (three) members of the Board of Directors, risk management committee
may be staffed with General Director and line management Director (Credit &
Marketing, Operations, or other similar Director) and the Compliance Director;
b) The Bank is required to appoint the Compliance Director as a permanent member of the
Risk Management Committee;
c) The recommendations issued by the Risk Management Committee shall reflect an
agreement reached among the Committee members.
d) Relevant executive officers are officers at one level below those members of the Board
of Directors who are in charge of an operational unit and Risk Management.
 e) Membership of executive officers in the Risk Management Committee shall be
appropriate to the issues discussed in the Risk Management Committee, such as
Treasury and Investment, Credit, and Operations and etc.
4. The powers and responsibility of the Risk Management Committee are to provide
recommendations to the General Director within a scope covering at least the following:
a) Formulation of the Risk Management policy and any amendments thereto, including
the risk management strategy and contingency plan in the event of any abnormal
external conditions. This formulation shall be conducted jointly by the heads of
operating units and the head of the Risk Management Unit;
b) Improvements or advancements in application of Risk Management on a regular basis as
a result of any change in the external and internal condition of the Bank affecting its
capital adequacy and risk profile and the outcome of evaluation of the effectiveness of
this application;
c) Justification of matters pertaining to business decisions made in departure from normal
procedure (irregularities), such as decisions for significant business expansion beyond
the previously established business plan of the Bank or taking of positions/risk
exposures in excess of established limits. These justifications shall be conveyed in the
form of recommendations on the basis of business considerations and analysis related to
the specific transactions or business operations of the Bank that require a departure
from the procedures established by the Bank.
5. The organizational structure of the Risk Management Unit shall be appropriate to the size
and complexity of Bank operations and the inherent risks of the Bank. This means that
each Bank may determine the appropriate organizational structure according to its own
condition, including financial condition and human resources.
6. For a relatively large bank in terms of total assets with highly complex business operations,
the organizational structure of the Risk Management Unit shall reflect the business
characteristics of the Bank. For a relatively small bank in terms of total assets with less
complex business operations, the Bank may appoint a group of officers in a unit/group to
perform the function of the Risk Management Unit.
7. Depending on the size and complexity of Bank operations, the position of the officer in
charge of the Risk Management Unit may be equivalent to or not equivalent to that of a
head of an operational unit (risk taking unit). In addition, head of risk management unit
shall be directly responsible to the General Director or respective Director.
8. The Risk Management Unit shall be independent of risk-taking units, such as treasury and
investment, credit, funding, accounting, and the internal audit unit.
9. The powers and responsibilities of the Risk Management Unit shall cover the following:
a) Monitoring of implementation of the risk management strategy recommended by
the Risk Management Committee and approved by the Board of Directors;
 b) Monitoring of positions/risk exposures on an overall basis, by type of risk, and by
business line;
c) Application of stress testing to ascertain the impact of implementation of risk
management policy and strategy on the performance of each risk - taking unit;
d) Study of proposal for any new activity and/or product submitted or developed by a
specific unit within the Bank. The study shall focus mainly on the ability of the
Bank to implement the new activity and/or product, including the system and
procedures used and the resultant impact on the overall risk profile of the Bank;
e) Preparation and submission of the risk profile report to the General Director and
Risk Management Committee on a regular basis or at least quarterly. In the event of
any sudden changes in market conditions, the report shall be made at more frequent
intervals. For relatively slow risk exposures, such as credit risk, the reporting
frequency shall be at least every quarter.
10. Risk – taking units are required to provide information on the inherent risk exposure
within their own units to the Risk Management Unit on a regular basis.

Article 5. Policy, Procedures, and Establishment of Limits

1. The Risk Management Policy is a written guide for the application of risk management and
shall be consistent with the vision, mission, and strategic plan of the Bank and focused
more on the risks relevant to the business lines of the Bank.
2. Risk Management Policy shall be established, among others, by putting together a Risk
Management Strategy that ensures that:
a) The Bank maintains risk limit consistent with the policies and internal procedures of the
Bank, laws and respective normative acts;
b) The Bank is managed by human resources possessing knowledge, experience, and
expertise in risk management, as appropriate to the complexity and business
opportunities of the Bank;
c) Determination of risks related to banking products and transactions on the basis of the
Bank’s analysis of inherent risk in each banking product and transaction that has and
will be made in accordance with the nature and complexity of the Bank’s business
operations;
d) Establishment of use of a risk measurement method and risk management information
system for precise calculation of risk exposure for each banking product and transaction
and the business lines of the Bank, in addition to establishment of reporting of data and
information pertaining to risk exposures for use as input in making profitable business
decisions;
 e) Setting of limits and establishment of risk tolerances representing limits of potential risk
that can be absorbed by the capital of the Bank and development of a tool for
monitoring developments in the risk exposure of the Bank;
f) Establishment of the internal control system for application of risk management in order
to ensure compliance with external and internal legal provisions (compliance risks),
availability of management and financial information, effectiveness and efficiency of
operations, and effectiveness of the risk culture at each level of the Bank organizational
structure;
g) Evaluation of risk rating as the ground for implementing corrective actions of some
aspects of banking products and operations and risk management policy and
procedures;
h) Preparation of a contingency plan for worst-case scenarios (external and internal
factors) to ensure the survival of the Bank.
3. Adoption of the risk management strategy shall also take into account the financial
condition of the Bank, the Bank organization structure, and risks arising from changes in
external factors and internal factors.
4. In formulating procedures and setting risk limits, the Bank shall take into account risk
appetite based on its experience in managing Risks. Procedures and establishment of risk
limits shall cover at least the following:
a) Accountability and clear scale of delegation of authority;
b) Adequate documentation of procedures and establishment of limits to facilitate review
and the audit trail;
c) Regular review of procedures and limits at least once each year or at a higher
frequency, commensurate to the type of risk and the needs and development of the
Bank.
d) Establishment of limits on the basis of overall limit, limit by type of risk, and limit by
specific business line involving risk exposure.

Article 6. Processes for Application of Risk Management

1. Risk management process includes: identification of risks, risk measurement, monitoring
and limits, risk management information systems, risk control, asset and liability
management and use of stress testing for risk measurement models.
2. The purpose of risk identification is to identify all types of inherent risk in each business line
that may potentially incur losses for the Bank. Points to be taken into account in the
application of risk identification include, the following:
a) be proactive (anticipative), not reactive;
b) cover all business lines (operations);
 c) consolidate and analyze risk information from all available sources of information;
d) analyze risk probability and the consequences of these risks.
3. The risk measurement approach is used to measure the risk profile of the Bank in order to
obtain a picture of the effectiveness of application of risk management. The approach shall
be capable of measuring:
a) sensitivity of the product/activity to changes in factors that affect it under both
normal conditions and abnormal conditions;
b) trend of changes in these factors, based on fluctuations and changes in the past, and
correlations;
c) risk factors on an individual basis;
d) aggregate risk exposure, taking account of risk correlation;
e) all risks inherent in all banking transactions and products and that may be integrated
into the management information system of the Bank.
4. Measurement of risk may use a quantitative or qualitative method. Generally, the simplest
approach for measurement of risk is the standard method recommended by the Bank for
International Settlements, while the approaches used by practitioners are referred to as
alternative models. Application of an alternative model necessitates that various
quantitative and qualitative requirements are met to ensure the accuracy of the model
used;
5. A Bank with large operations and a high degree of complexity may develop and use an
internal model. However, the use of the internal model shall be only for internal purposes
commensurate to the needs of the Bank and in anticipation of future banking policy.
6. The method used in measurement of risk shall be commensurate to the type, scale, and
complexity of business operations, the capacity of the data gathering system, and the ability
of the Board of Directors and relevant executive officers to understand the limitations of
the end results of the risk measurement system used.
7. The method of risk measurement shall be clearly understood by employees concerned with
risk control, including but not limited to the treasury manager, Risk Management
Committee, Risk Management Unit, and Directors in charge of relevant line management.
8. As part of the application of risk monitoring, risk limits shall be established at least as
follows:
a) take into account the ability of Bank capital to absorb risk exposures or losses
that may arise, and the extent of the Bank’s risk exposures;
b) take into consideration past experience of losses and capacity of human
resources;
 c) ensure that any positions exceeding the established limits are brought to the
attention of the Risk Management Unit, the risk management committee,
and the Board of Directors.
9. Setting of limits shall encompass the following:
a) transaction/product limit;
b) currency limit;
c) turnover limit;
d) open position limit;
e) loss limit;
f) intraday limit;
g) individual borrower and counterparty limit;
h) related parties limit;
i) industry/economic sector and geographic limit.
10. Limits shall be set by the Risk Management Unit or other collective body (asset – liability
management committee, credit committee, Board of Directors) according to their respective
powers.
11. Establishment of limits shall take account of applicable laws and normative acts of Georgia,
including but not limited to regulations on the Minimum Capital Requirement, Lending
Limit, and Net Open Position and etc.
12. In the event of any exceeding of limits, the Bank shall make immediate adjustments and
anticipate these exceeding of limits to ensure that they do not affect the previously
determined total allocation of capital for the risk.
13. Any exceeding of a limit shall be immediately identified and followed up by the Board of
Directors, and actions in excess of limits may only proceed upon authorization by the Board
of Directors or an authorized officer in accordance with the internal rules and procedures of
the Bank.
14. The Bank shall put into place a backup system and effective procedures to prevent disruption
to risk monitoring processes and perform regular checks and reviews of the backup system.
15. The risk management information system constitutes part of the management information
system that shall be in place and developed in accordance with the needs of the Bank for
effective application of risk management. As part of the risk management process, the Bank
shall have a risk management information system capable of ensuring:
a) that risk exposures are measured accurately, with proper information and on a timely
basis, both for aggregate/composite risk exposure and risk exposure by type of inherent
risk in the business activities of the Bank, as well as for risk exposure by business line of
the Bank;
 b) compliance with application of risk management in respect of policy, procedures, and
establishment of Risk limits;
c) results (progress) in application of risk management compared to targets set by the Bank
in accordance with the policy and strategy for application of risk management.
16. The risk exposure report, comprising one of the outputs of the risk management information
system, shall be prepared on a regular basis by the Risk Management Unit or a group of
authorized officers independent of any unit involved in operations. Frequency of
reporting to the relevant members of the Board of Directors and Risk Management
Committee shall be increased in the event of any sudden changes in market conditions.
17. Reports to management levels outside the relevant Board members and the Risk
Management may be submitted less often, but shall nevertheless provide adequate
information for these parties to enable them to assess changes in the risk profile of the
Bank.
18. The risk management information system shall be capable of translating risks measured in
a quantitative technical format into a qualitative format easily understood by the Board of
Directors and Bank officers.
19. In developing any new information system technology and software, the Bank shall ensure
that the application of the new information system and technology will not create any
disruptions.
20. If a Bank decides to outsource the development of software and upgrading of its system,
the Bank shall ensure that the decision to appoint the third party is made on an objective
and independent basis. The outsourcing agreement/contract shall state the terms and
conditions of maintenance and upgrade, and anticipatory measures to prevent any
disruptions that may occur during operation.
21. Before applying a new management information system, the Bank shall conduct testing
to ensure that the processes and output have followed effective and accurate processes of
development, testing, and review. The Bank shall also ensure that historical data for
accounting and management can be properly accessed by the new system/software.
22. If the Bank develops a new system/software, the functioning and design of the system
shall be such that it can automatically and effectively meet the reporting requirements
stipulated by the competent authorities.
23. The Bank shall administer and update its system documentation, covering hardware,
software, databases, parameters, process stages, assumptions used, data sources, and
outputs to facilitate built-in controls and the audit trail.
 24. Risk control processes shall be instituted by the Bank to manage certain risks, and most
importantly any risks that may endanger the survival of the Bank.
25. The Bank may control risks through measures that include hedging and other risk
mitigation methods such as issuance of guarantees, securitization of assets and credit
derivatives, and reinforcing of Bank capital to absorb potential losses.
26. In implementing the control functions for interest rate risk, foreign exchange risk, and
liquidity risk, the Bank shall at the minimum apply asset – liability management (ALMA).
To support the effective implementation of ALMA, the Bank shall establish an Assets and
Liabilities Committee (ALCO), with the size of the committee adjusted to the volume and
complexity of banking transactions pertaining to the implementation of ALMA.
27. The Bank shall prepare and document the policies, procedures, and setting of limits that
affect the ALMA performance of the Bank. The ALMA policy shall clearly present the
responsibilities and powers in:
a) identification of interest rate risk arising from Bank transactions and products;
b) adoption of a system for measurement of interest rate risk;
c) authorizations and mechanism for exceptions to policy.
28. The scope of ALCO policy shall cover the following:
a) description of responsibilities, frequency of ALCO meetings, and membership of
ALCO;
b) description of the reporting lines between ALCO and the Board of Directors;
c) description of the fund placements strategy;
d) hedging strategy;
e) funding strategy;
f) pricing strategy;
g) interest rate risk management, namely establishment of limits on specific exposures;
measurement of risks using gap analysis, duration analysis, or simulation model.
29. The scope of responsibilities of ALCO includes the following:
a) development, review, and modification of ALMA strategy;
b) evaluation of the interest rate risk position of the Bank and ALMA strategy to ensure
that the outcome of the Bank’s risk taking position is consistent with the objectives of
interest rate risk management;
c) review of the assets and liabilities pricing strategy to ensure that pricing achieves
optimum results in fund placements, minimizes cost of funds, and maintains the
balance sheet structure of the Bank in accordance with the Bank’s ALMA strategy;
 d) review of deviations between actual results and the budget projections and business
plan of the Bank; and
e) inform the Board of Directors of any developments in relevant legal provisions and
regulations affecting ALMA strategy and policy.
30. ALCO meetings may be convened monthly or quarterly, as appropriate to changes in the
economy, condition of the Bank, and the interest rate risk and liquidity risk profiles.
31. The ALCO regular meetings shall review:
a) decisions for (short-term) placements, pricing, and other funding decisions, trends
in funds and actual outcomes against budget plan. If necessary, the ALMA strategy
shall be adjusted to the latest developments. ALCO shall also develop a hedging
strategy without neglecting flexibility in the day-to-day ALMA decisions by officers
and staff.
b) implications of interest rate risk on the assets and liabilities of the Bank.
c) The results of the ALCO meetings shall then be documented and submitted as
recommendations to the Board of Directors.
32. The quarterly ALCO meetings shall at least conduct a full review of interest rate risk,
liquidity risk and foreign exchange risk analysis, make adjustments to the strategy for
management of interest rate risk, adopt changes in strategy, and establish the policy
direction for ALCO concerning fund placements.
33. All reports presented to the Board of Directors shall be focused and adequately documented
to enable easy assessment by the Board of compliance with the set limits. The scope of
ALCO reports includes but is not limited to:
a) ALCO minutes, including minutes from the previous period concerning discussed
issues;
b) profit/loss statement, presenting data in comparison with the previous year;
c) balance sheet, presenting data in comparison to the previous period;
d) budget projection;
e) new credit report;
f) margin analysis report;
g) list of securities portfolios accompanied by transactions conducted during the latest
month or quarter;
h) liquidity analysis report, in particular analysis of sources and use of funds;
i) pricing data report, reflecting the prices or costs of a product;
j) model simulation (if the Bank uses a model) or gap report for presenting the interest
rate risk profile;
 k) hedging report, if the Bank employs a hedging strategy.
34. The system, plans, and underlying assumptions in ALCO policy and decisions shall be
subject to regular review, particularly in regard to external changes such as applicable legal
provisions, market conditions, and consumer behavior.
35. The models used by the Bank for measurement of major Bank risks, such as credit risk,
market risk, and operational risk, shall be adjusted to the needs of the Bank, the size and
complexity of Bank operations, and the benefits obtained by the Bank.
36. If the Bank conducts back-testing of internal models, such as Credit Scoring Tools, Value at
Risk (VAR), and stress testing for exposures carrying certain risks, the Bank shall use
historical data/parameter series and assumptions prepared by the Bank itself and/or
assumptions as requested by the National Bank of Georgia (NBG).
37. In the event that the model is put into application, the relevant data requirements shall also
be adjusted to the data reporting system required by the National Bank of Georgia
(hereinafter – National Bank).
38. Banks using internal models for measurement of risk shall take into consideration at least
the following:
a) accurate statistical results complying with standards;
b) management information system in place that allows the system to retrieve
appropriate and accurate data and information on a timely basis;
c) create system to capture risk data (particularly for market risk) for all positions of
the Bank;
d) documentation of data sources used to support risk measurement processes;
e) the database and data storage processes shall constitute part of the system design to
prevent any disruption of statistical data series.
39. To overcome any weaknesses that may arise from the use of certain risk measurement
models, the Bank shall validate the model. Validation process shall be conducted by an
internal or external party independent of the unit applying the model. If necessary, the
validation shall be conducted or supplemented by review by an external party possessing
technical competence and expertise in development of risk measurement models.
40. Model validation is a process of:
a) evaluation of the internal logic of a particular model by verification of mathematical
accuracy;
b) comparison of model predictions with subsequent events;
c) comparison of one model with another existing model, whether internal or external, if
available.
41. Validation shall also be conducted for new models, whether developed in-house or
purchased from a vendor. Models developed in-house shall undergo more intensive
evaluation, particularly if there are significant changes in market conditions.
42. The risk measurement process shall clearly set out the validation process, frequency of
validation, data and information documentation requirements, and requirements for
evaluation of assumptions used, before a model is put into application by the Bank.
43. Stress Testing is designed to complement the application of risk measurement by estimating
the potential economic loss to the Bank under abnormal market conditions in order to
ascertain the sensitivity of Bank performance to changes in risk factors and to identify
influencing factors that significantly impact the Bank’s portfolios.
44. In conducting Stress Testing, the risk measurement system shall be sufficiently flexible to
facilitate the operation of various kinds of scenarios. The assumptions used in the Stress
Testing shall be carefully developed to test trends in the condition of the Bank’s portfolios.
The Bank needs to conduct Stress Testing on the basis of the highest loss recorded in past
experience (large historical market moves).
45. The Stress Testing analysis shall be capable of quantifying potential for loss and thus enable
the Bank to assess the worst impact that may arise from various changes in Bank revenues
and capital. The Stress Testing results, including use of assumptions by the Risk
Management Unit, shall be communicated to the Board of Directors on a regular basis.
46. As part of this Stress Testing, qualitative analysis shall also be made of the actions and
decisions taken by the Board of Directors or relevant officers in anticipation of the worst-
case scenario.

Article 7. Internal Control in the Application of Risk Management

1. The scope of the internal control system in the application of risk management shall cover at
least the following:
a) appropriateness of the internal control system to the type and level of inherent risk in
the business operations of the Bank;
b) establishment of powers and responsibilities for monitoring of compliance with policy,
procedures, and limits;
c) establishment of reporting lines and clear segregation of functions between operating
units and units performing control functions;
d) organizational structure that clearly depicts the business activities of the Bank;
e) adequacy of procedures to ensure the compliance of the Bank with prevailing laws and
normative acts;
 f) effective, independent, and objective review of the procedures for assessment of Bank
operations;
g) adequate testing and review of the management information system;
h) complete and adequate documentation of the scope, operating procedures, audit
findings, and response of Bank management on the basis of audit results;
i) regular and ongoing verification and review of the handling of material weaknesses in
the Bank and actions of the Bank management in correcting any irregularities that may
occur.
2. Review of application of risk management shall encompass at least the following:
a) application of risk management shall be subject to regular review and evaluation at least
once each year by the Risk Manager or officers in the Risk Management Unit,
Compliance officers and Internal Auditors in the internal audit unit;
b) the review and evaluation may be intensified in frequency and extended in scope
according to developments in Bank risk exposures, market changes, and the method for
measurement and management of risk;
c) review shall also be conducted by an external auditor or other qualified party
understanding the techniques of risk management;
d) review and evaluation of risk measurement in particular shall cover at least the following:
d.a) the methods, assumptions, and variables used to measure risk and determine risk
exposure limits;
d.b) comparison between the results obtained from risk measurement methods using
simulations or forward projections against actual outcomes;
d.c) comparison between the assumptions used in the method and actual conditions;
d.d) comparison between established limits and actual exposures;
d.e) determination of the suitability of risk measurement and exposure limits in relation
to past performance and current position of Bank.

Article 8. Risk Management for New Products and Activities

1. In order to manage inherent risks in a new product and activity, the Bank shall have a
written policy and procedures.
2. The policy and procedures for risk management for a new product and activity shall state at
least the following:
a) standard operating procedure and powers in management of the new product and
activity;
b) identification of all risks inherent in the new product and activity;
 c) trial period for the methods of measuring and monitoring inherent risks in the new
product and activity to ensure that the method is tested from the aspect of prudential
banking and other aspects;
d) the accounting information system for the new product and activity, presenting at least
the risk profile and level of profit or loss in regard to the new product and activity;
e) legal analysis of the new product and activity, covering the possibility of legal risks that
may arise and a compliance analysis of the new product and activity in regard to
prevailing laws and regulations;
3. If the Bank is a member of a business group, and especially a financial group with
centralized risk management processes, the Bank shall ensure that the techniques for
measurement and exposure of risk can be accurately consolidated. The processes for
consolidated monitoring and measurement of risks shall establish clear limits that are met
at each level of consolidation.
4. In the event of inter-unit transfers (among business lines) and inter-branch operations that
give rise to certain risk positions, the Bank shall:
a) clearly identify the internal transactions;
b) reconcile internal deals in an accounting process aimed at putting together
the consolidated financial statement;
c) ensure that risk positions arising from internal transactions can be
measured, monitored, and controlled by the Risk Management Unit;
d) ensure that limits are established on a consistent basis;
5. The Bank shall reconcile on a regular basis, at least each month, the variances arising
between the profit and loss statement and internal transactions due to differences in the
accounting standards used and immediately examine and correct these variances.
6. In the event that inter-company transactions are conducted within a business group, the
Bank shall also ensure that the transactions are properly recorded so that business group
accounts are accurately portrayed in the financial statement of the Bank.

Article 9. The Role of Supervisors in Evaluation of Bank’s Risk Management Processes

1. In the course of implementing the supervisory policy, the National Bank of

Georgia shall focus special attention on adequacy of risk management in
commercial banks, so that these systems give the opportunity for prudential
management and timely identification, adequate assessment, effective
monitoring and control of risks.
2. Use of Risk Management for bank supervision purposes will expedite evaluation
of Bank’s potential losses, which may negatively influence its capital. In this
regard Banks shall be required to assess risk management on a quarterly basis
 and submit the respective report, along with financial statements on risk profile,
to the National Bank of Georgia.
3. This report shall encompass comparison with the previous quarter. It shall also
reflect level and dynamics for all respective risks in correspondence with the
complexity of the Bank’s business activities. Report on risk profile, submitted to
the National Bank shall be identical to the one submitted to Director and Risk
Management Committee.
4. Commercial Bank shall also be required to submit report to the NBG on a new
product or activity within 7 (seven) working days following their
implementation.
5. Bank shall be required to submit other reports to the National Bank if the bank’s
position may cause significant financial losses, or due to other reasons, which are
deemed significant by the National Bank. In this regard, such condition of the
Bank may be the following:
a) Bank is under intense or special supervision of the National Bank;
b) Bank is facing the largest market and liquidity risks;
c) External (market) condition is fluctuating and goes beyond the Bank’s
control.
6. Frequency and format of submitting reports defined under this Article shall be
determined on the basis of consultations between the Bank and the National
Bank, as they are based on the Bank’s current position and those risks that may
arise in front of the Bank.
7. In the course of CAMEL or limited scope examination of Banks special attention
shall be focused on fulfillment of requirements stipulated in this regulation.
Respectively, examination program of supervisors for each bank among other
issues shall cover:

a) how management and quality of all nine risks recognized at international level
are ascertained in the course of work;
b) What tangible (capital, liquidity) and intangible (management quality and
control systems) resources are in the Bank’s possession to manage the given
risk;
c) Whether the volume of revealed resources is sufficient to balance risk.

8. Inspectors shall determine whether the Bank’s approach towards risk

management, including its subsidiaries, is sufficient for conducting their
activities and they implemented risk management discipline for risks inherent in
their activities.
9. Inspectors shall request that banks have right effective system to Identify,
measure, manage and control risks faced by the Bank. They shall carry out
independent assessment of Bank’s strategies, policies, procedures and practice
related with extension of credits and portfolio management, implementation of
 foreign exchange operations, liquidity management and etc. Given the fact that
currently banking activities are determined by credit and foreign exchange
operations, in the course of on-site inspections special attention shall be focused
on management of risks related with such activities.
10. Inspectors shall evaluate individual banks on-site for the purpose of
identification, measurement, management and control of credit risk. This shall
include evaluation of any measurement instrument used by the Bank (such as
internal ratings for risks and credit risk models). In addition, they have to
determine whether Board of Directors effectively manages credit risk and risk
positions and examine compliance with respective policies. For the purpose of
assessing credit risk systems quality, the supervisors shall use series of analytical
methods. Major element of such assessment is determination by supervisors that
the bank uses sound asset evaluation procedures.
11. Inspectors shall ascertain whether the Bank’s management recognizes problem
loans at early stage and takes respective measures. They have to perform
monitoring of those trends which are presented within the loan portfolio and
judge about deterioration of market conditions along with executive
management. Supervisors shall assess Bank’s capital along with security and
reserves, whether it is adequate compared to credit risk level identified and
inherent to bank’s activities.
12. When reviewing adequacy of credit risk management process examiners shall
determine whether this process is effective:
a) Only at individual business line or legal entities;
b) For a wide range of activities and branches and consolidated bank.

13. After evaluating credit risk management process examiners, in concert with
managers, shall direct their efforts for elimination of any weakness, grown
concentrations in the system and problem loans as well as for setting additional
reserves.

14. Supervisors shall take into account set prudential limits (e.g. limits for large
exposure) concerning all banks regardless their credit risk management quality.
Such limits shall contain limited bank risks for separate borrowers or group of
partners related with them. Special attention shall be focused on payment of credits
of those partners who are “related” with the banks or each other.
15. If examination finds the Bank’s risk management to be inadequate or efficient for
special risk profile of the Bank, the National Bank of Georgia shall exercise intensive
or special supervision over such bank.
 Chapter II.
Credit Risk
Article 10. Concept of Credit Risk, Responsibilities of the Supervisory Board and Board of
Directors for Implementation of Credit Risk Strategy and Policy
1. Credit risk is the risk of default by counterparty. Credit risk may arise from various business
lines of the Bank with its clients (below referred to as debtors) such as provision of funds,
treasury and investment, and trade financing and etc.
2. The Supervisory Board shall be responsible for approvals and regular review, at least
annually, of the credit risk strategy and policy of the Bank. The strategy and policy shall:
a) reflect the Bank’s tolerance of risk and probability of sustained earning of expected
revenues, taking into account economic cycles and changes in economic conditions.
b) take account of domestic and international economic cycles and changes that may
affect the composition and quality of all credit portfolios.
c) be designed to meet long-term needs with adjustments as may be necessary.
3. The Board of Directors shall be responsible for implementing the credit risk strategy and
policy and developing procedures for identification, measurement, monitoring, and control
of credit risk. The policy and procedures, properly developed and implemented, shall be
capable of supporting sound lending standards, monitoring and control of credit risk and
identifying and dealing with problem loans.
4. The Bank shall identify and manage the inherent credit risk in all new products and
activities and ensure that the risks from new products and activities have passed through a
proper risk control process before introduction or operation. Approval from the Board of
Directors or recommendation from the Risk Management Committee shall be obtained in
advance.

Article 11. Policies, Procedures, and Establishment of Limits

1. The Bank shall have sufficient information to assist it in the comprehensive assessment of
debtor risk profiles. Factors that shall be taken into account include but are not limited to:
a) purpose of loan and source of repayment;
b) up to date risk profile of the debtor and collateral, and sensitivity to changes in
economic and market conditions;
c) analysis of repayment ability, both historical and future based on financial history and
cash flow projection under a variety of scenarios;
d) capacity and stability of the debtor’s business and condition of the economic sector/
business of the borrower and the position of the borrower within a specific industry;
 e) terms and conditions of the credit applied for, including any agreement designed to
limit changes in the debtor’s future risk exposure.
2. Selection of credit transactions in taking on risk exposures shall take into account the level
of profitability, which shall be performed at least by ensuring that the analysis of expenses
and revenues has been made on a comprehensive basis, covering operating expenses, cost of
funds, costs pertaining to estimated default by debtors until receipt of payment in full, and
calculation of the capital requirement.
3. Pricing of credit facilities shall be consistent with the calculation of the risk level of the
transaction concerned, particularly the overall condition of the debtor and the quality and
marketability of collateral pledged as guarantee.
4. At least every quarter, the Board of Directors shall obtain the profitability analysis of
lending transactions. If necessary, the pricing of credit transactions shall be corrected and
all necessary corrective actions shall be taken to prevent any worsening of the financial
condition of the Bank.
5. Decision making procedures for loans and/or commitments, particularly when operating
through delegation of authority, shall be clearly formalized in keeping with the
characteristics of the Bank (size, organization, type of activities, and complexity of
transactions) and supported by the systems in place at the Bank.
6. In the working framework or mechanism for compliance with delegation procedures in
decision making on extension of credit and/or commitments, the Bank shall ensure
segregation of functions between those involved in approval, analysis, and administration
of credit.
7. The review process shall be conducted at least each quarter and cover classification of
credit risk exposures, assessment of marketability of collateral, and setting of fees. The
results of the review shall constitute an integral part of the credit file.
8. In developing the credit administration system, the Bank shall ensure:
a) efficiency and effectiveness of credit administration, including monitoring of
documentation, contractual terms and conditions, loan agreements (legal aspects),
and binding of collateral;
b) accuracy and timeliness of information provided for the management information
system;
c) proper segregation of duties;
d) viability of control of all back office procedures; and
e) compliance with internal written policy and procedures and applicable legal
provisions.
9. The Bank shall administer and document all quantitative and qualitative information and
material evidence in a credit file used for assessment and review.
10. The Bank shall ensure the completeness of records in the credit file at least every quarter
for debtors in arrears or classified loans and also debtors exposing the credit portfolio of the
Bank to high risks (large exposures and loan concentration).
11. In its procedures for establishing limits on credit risk, the Bank shall among others present
the factors that may affect the setting of credit risk limits and the processes for decision
making/establishment of credit risk limits.
12. The Bank shall establish limits for all customers or counterparties before entering into
transactions with those customers.
13. Limits for credit risk shall be for the purpose of mitigating risks from concentrated lending.
The limits established shall cover at least the following:
a) exposure to customers or counterparties;
b) exposure to connected parties;
c) exposure to certain economic sectors or geographical areas.
14. A limit for a single customer or counterparty may be based on analysis of quantitative data
obtained from information in financial statements and analysis of qualitative information
that may be obtained from interviewing the customer.
15. Establishment of credit risk limits shall be fully documented in writing to facilitate the
audit trail for the purposes of internal and external auditors.
16. In addition to requirements set by the National Bank of Georgia, the Bank shall observe
internal policy, procedures and set limits.

Article 12. Identification, Measurement, and Monitoring Processes and the Management
Information System for Credit Risk

1. The Bank shall identify the credit risk inherent in all of its products and activities. This
identification of credit risk comprises the result of study of the characteristics of credit risk
inherent in specific business lines, such as credit (provision of funds), treasury and
investment, and trade financing.
2. For credit operations and trade financing services, assessment of credit risk shall take into
account the financial condition of the debtor and particularly prompt repayment ability, in
addition to the collateral or guarantee that is provided. For debtor risk, the assessment
shall include analysis of the debtor environment, characteristics of partners in business
dealings, quality of shareholders and management, condition of the latest financial
statement, cash flow projection, quality of business plan, and other documents that may be
useful in supporting a comprehensive analysis of the condition and credibility of a debtor.
3. For treasury and investment activities, assessment of credit risk shall take into account the
financial condition of the counterparty, rating, characteristics of instruments, types of
transactions made, market liquidity, and other factors that may affect credit risk.
4. The Bank shall have written procedures for conducting risk measurement that enable:
a) centralization of on balance sheet and off balance sheet exposures carrying credit risk
from each debtor or by special group of debtors and/or counterparties;
b) assessment of differences in categories of credit risk ratings using a combination of
qualitative aspects and quantitative data and selection of specific criteria;
c) distribution of complete information on the results of risk measurement for
monitoring by relevant units.
5. The system for measurement of credit risk shall take into account at least the following:
a) the characteristics of each type of transaction involving credit risk, the financial
condition of the debtor/counterparty, and the terms and conditions of the loan
agreement, such as term and interest rate and etc.
b) gap profile in regard to potential changes in the market;
c) collateral and/or guarantee;
d) potential for default;
e) ability of the Bank to absorb potential default.
6. Banks using risk measurement techniques through the internal risk rating approach shall
verify data on a regular basis.
7. Parameters used in measuring credit risk shall include but not be limited to the following:
a) non performing loans (NPLs);
b) concentration of lending by borrower and economic sector;
c) adequacy of collateral;
d) lending growth;
e) non-performing treasury and investment (non-credit) portfolios;
f) composition of treasury and investment portfolios (inter-bank securities, and equity
participation);
g) adequacy of reserves;
 h) trade financing transactions in default;
i) concentration in provision of trade financing facilities.

8. The Bank may use a system and statistical/probability methodology to measure risk
pertaining to certain types of credit risk transactions, such as credit scoring tools.
9. In using this system, the Bank shall:
a) conduct regular review of the accuracy of the model and assumptions used for
projection of defaults;
b) adjust assumptions in keeping with changes in internal and external conditions.
10. In the event of large risk exposures or relatively complex transactions, the decision making
process for credit risk transactions shall be based not only on this system, and shall
therefore be supported by other credit risk measurement tools.
11. The Bank shall document such credit information as assumptions, data, and information
used in the system, including any changes thereto, and this documentation shall be
subsequently updated on a regular basis. In application, the system shall:
a) support decision making processes and ensure compliance with provisions concerning
delegation of authority;
b) be independent of any possibility of engineering of score-outputs, through use of
appropriate and effective security procedures;
c) be reviewed by a unit or party independent of the unit applying the system.
12. For the purpose of monitoring of credit risk:
a) The Bank shall develop and apply an information system and procedures to monitor the
condition of each debtor or counterparty in all credit portfolios of the Bank.
b) The credit risk monitoring system shall state at least measurements for the purpose of:
b.a) ensuring that the Bank is informed of the latest financial condition the debtor or
counterparty;
b.b) monitoring compliance with the terms and conditions of the loan agreement or
contract for the credit risk transaction;
b.c) assessing the adequacy of collateral relative to the liabilities of the debtor or
counterparty;
b.d) identify any delay in payments and classify problem loans on a timely basis;
b.e) take quick action to deal with problem loans.
c) The Bank shall also monitor credit risk exposures in comparison with the established limits
on credit risk, including the ability to repay the loan or internal risk rating.
d) Monitoring of these credit risk exposures shall be conducted on a regular and ongoing basis
by the Risk Management Unit by comparing actual credit risk against the established credit
risk limits.
e) For the purpose of monitoring credit risk exposures, the Risk Management Unit shall
prepare regular reports on developments in credit risk, including underlying factors, for the
Risk Management Committee and Board of Directors.
13. The key principles for use of internal risk rating are as follows:
a) The procedure for use of the internal risk rating system shall be formalized and
documented.
b) The system shall be capable of early identification of any changes in risk profile brought
about by potential or actual reduction in credit risk.
c) The internal risk rating system shall be regularly evaluated by a party independent of the
unit applying the internal risk rating;
14. The reports generated by internal risk rating, such as reports on the condition of the credit
portfolio, shall be submitted to the Board of Directors on a regular basis.
15. To improve the effectiveness of credit risk measurement processes, the Bank shall have a
management information system that provides accurate, timely reports and data to support
decision making by the Board of Directors and other officers.
16. The management information system shall:
a) Generate reports or information for monitoring of actual exposures against established
limits and any exceeding of risk exposure limits that needs to be brought to the
attention of the Board of Directors.
b) Provide accurate and timely data on total credit exposure of individual borrowers and
counterparties, the credit portfolio, and a report on exceptions to limits of credit risk.
c) Enable the Board of Directors to identify any risk concentrations in its credit portfolio.

Article 13. Control of Credit Risk

1. The Bank shall establish a system for independent and ongoing internal credit reviews in
regard to the effectiveness of application of the credit risk management process. The
review shall include at least evaluation of the credit administration process, assessment of
the accuracy of application of internal risk rating or use of other monitoring tools, and
working effectiveness of the unit or officers monitoring the quality of individual credit.
2. The review shall be conducted by a unit or officer independent of units conducting credit
risk transactions. The results of the review shall then be reported directly in full to the
 Internal Audit Unit, Compliance Director, other relevant members of the Board of
Directors, and the Revision Commission.
3. The Bank shall ensure that the units in charge of credit and other credit risk transactions are
adequately managed and that credit risk exposures are consistently held within the set
limits and comply with prudential standards.
4. The Bank shall establish and apply internal control to ensure that any exceptions to policy,
procedures, and limits are report on a timely basis to the Board of Directors or a relevant
officer for corrective action.
5. When conducting internal audit, the Internal Audit Unit shall test the effectiveness of
internal control to ensure that the internal control system is effective, secure, and in
compliance with applicable legal provisions and the policy, guidelines, and internal
procedures of the Bank. Any incidence of ineffectiveness or inaccuracy or any important
findings in the system shall be immediately reported and brought to the attention of the
Board of Directors and the Risk Management Unit for immediate corrective action.
6. The Bank shall have procedures for management of problem loans, including a written
system for detection of problem loans, and apply these procedures on an effective basis. If
the Bank has a significant level of problem loans, the Bank shall segregate the problem loan
resolution function from the function responsible for lending decisions. Each strategy and
effective outcome for resolution of problem loans shall be administered in documentation
of data that will thereafter be used as input for the purposes of units with the functions of
disbursing or restructuring credit.

Chapter III
Market and Interest Rate Risks
Article 14. Concepts of Market and Interest Rate Risks
1. Market Risk is the risk arising from change in market price by Bank’s balance sheet and off-
balance sheet positions.
2. Market risk consists of interest rate, fund, foreign exchange and commodity position risks.
The present document will cover only such components of market risk as interest rate risk
and foreign exchange risk.
3. Market risk may arise in business lines such as investment in securities and money market,
equity participation in other financial institutions, provision of funds (loans and similar
forms), funding and issuance of debt instruments, and trade financing and etc.
4. Interest rate risk is the potential loss incurred from change in market interest rates.
5. Foreign exchange risk is the risk of devaluation of Bank’s assets formed in foreign currency
determined by fluctuations in foreign exchange rate.
Article 15. Responsibilities of Supervisory Board and Board of Directors over Interest Rate Risk
Strategy and Policy Implementation
1. The Supervisory Board of a Bank shall have adequate understanding of the types and levels
of interest rate risk exposures.
2. In the course of approving this policy and strategy, the Supervisory Board of the Bank shall
link this approval to the overall objectives of the business conducted by the Bank.
3. The Supervisory Board of the Bank shall approve the policy and strategy pertaining to
management of interest rate risk and ensure that the Board of Directors of the Bank take
the necessary measures for monitoring and control of this risk.
4. The Supervisory Board of the Bank shall be informed regularly by the Board of Directors on
interest rate risk exposures as part of conducting this monitoring and control.
5. The Board of Directors of the Bank shall be responsible to ensure that the Bank has adequate
policy and procedures for management of interest rate risk, most importantly the daily
operating procedures.
6. The Board of Directors of the Bank shall also be responsible for maintenance of:
a) interest rate risk limits;
b) standards and systems for measurement of interest rate risk;
c) standards for assessment of position and measurement of outcome from interest rate
risk exposures;
d) reporting of interest rate risk and review process for management of interest rate risk;
e) internal control for application of interest rate risk management.

Article 15. Policy, Procedures, and Establishment of Limits

1. The Bank shall have a comprehensive, written policy and procedures for management of
interest rate risk.
2. The policy and procedures shall establish and describe the lines of responsibility and
accountability beyond decisions in management of interest rate risk and shall clearly cover
the authorized instruments, hedging strategy, and opportunities for taking positions.
3. The interest rate risk policy shall also set out quantitative parameters obtained from the use
of methods for measurement of interest rate risk, such as interest rate sensitivity, Earnings
at Risk, and Economic Value of Equity, in order to present the tolerable level of interest
rate risk for the Bank.
4. All policy and procedures for interest rate risk shall be reviewed on a regular basis and
revised if necessary by the Risk Management Unit, the internal audit unit, or an external
auditor competent in the application of interest rate risk management.
Article 17. Identification, Measurement, and Monitoring Processes, and the Management
Information System for Interest Rate Risk
1. The Bank is required to make precise identification of interest rate risk in assets, derivative
transactions, and other financial instruments, both in specific business lines and in the
activities of the Bank as a whole.
2. Assets, liabilities, and off-balance sheet accounts to be marked to market shall be grouped in
the trading book, while transactions and positions not marked to market shall be grouped
in the banking book. As a general rule, these banking book positions, such as securities or
bonds in the investment portfolio, are not intended for short-term gain, but will be held to
maturity.
3. The marked to market process represents one technique that reflects the value of assets,
derivative transactions, and other financial instruments, while also serving as a suitable
method for measuring the risk position of these assets and financial instruments.
4. The adequacy and accuracy of the marked to market process shall be verified by a party
independent of the operational unit and possessing the relevant competence, such as the
Risk Management Unit.
5. Banks developing internal models for internal purposes may use Value at Risk (VAR) to
measure the maximum estimated loss from a particular position or portfolio from any
change in market interest rate indicators (reference interest rate) at a set interval.
Measurement using the VAR method may be made using various statistical methods such
as variance/covariance, historical simulation, and the Monte Carlo simulation.
6. In order to prevent irregularities in statistical results and treatment of interest rates, the
Bank shall use its own data sources, figures, and criteria developed on its own, not based on
data sources obtained from other parties.
7. In assessing inherent interest rate risk exposures in a number of business lines, the Bank
shall at least be capable of measuring a number of parameters including the following:
a) potential loss due to interest rate fluctuations;
b) interest rate volatility by maturity.
8. If necessary, the Bank may make corrections or improvements to the pricing criteria and
pricing process with the aim of precise assessment of credit risk (banking book) by
adjusting the applied interest rate spread to the reference (market) interest rate.
9. The Bank shall at least evaluate and perform comprehensive calculations for each
transaction to ensure that overall interest rate exposure can be monitored in real time.
10. The Bank shall monitor compliance with limits on a daily basis and any exceeding of limits
and follow up actions for resolution of these excesses shall be reported to the Board of
Directors or the relevant officers in accordance with internally assigned authorities on a
daily basis.
11. The information system shall be capable of monitoring daily changes in interest rates and
the influence of these changes on Bank revenues and capital.
12. A Bank active in derivative transactions and trading of other financial instruments shall
have a system capable of monitoring interest rate exposures (trading book) and interest rate
movements on a daily basis and develop that system to the extent that these changes can be
monitored on a real time basis.
13. The Risk Management Unit shall be responsible for formulating and distributing accurate,
timely reports on:
a) gains and losses on assessment of marked to market, classified by product,
transaction, or type of exposure;
b) sensitivity of exposures to losses from impact of changes of market interest rates;
c) potential loss that may arise from changes in market interest rates.
14. The Risk Management Unit shall regularly study trends in interest rate movements or
possibilities for emergence of market pressures. The results shall thereafter be
communicated to the Risk Management Unit and the Board of Directors as material for
evaluation for review of existing interest rate exposures and established limits.

Article 18. Control of Interest Rate Risk

1. Risk control and operational management responsibility for positions managed until
maturity (balance sheet items) shall be stipulated in the Bank organization. These
responsibilities include but are not limited to:
a) reconciliation of positions managed and recorded in the management information
system;
b) control of accuracy of profit and loss and compliance with applicable legal provisions
and accounting standards, particularly in regard to recognition of discounts, booking of
premiums, and etc;
c) classification and formation of appropriate provisioning according to applicable legal
provisions.
2. For securities and bonds listed or traded on the Capital Market, the Bank shall apply an
internal control process aimed at monitoring the credit spread of these securities and bonds
by comparing the yield of these portfolio positions with Government Bonds.
3. Disregarding the legal criteria for provisioning if the Bank deems that the credit spread is
widening, the Bank shall conduct an analysis of the condition and prospects of issues of the
securities and bonds. If the conclusion from the analysis and market sentiment points to
increased likelihood of default, the Bank shall take immediate action to establish loan loss
provisioning.
4. If increased likelihood of default is ascertained, the Bank shall strictly monitor securities
and bonds and take necessary steps for reduction of losses.
5. For securities and bonds not listed or traded on the market, the Bank shall conduct a regular
review of the condition, credibility, and repayment ability of the issuers. The review shall
be conducted by collecting and analyzing financial statements, cash flow projections, and
all relevant documents concerning the issuers. This regular review of securities and bonds
shall be documented and conducted at least every 6 (six) months.
6. If the Bank engages in derivatives contracts such as interest rate swaps, the Bank shall
ensure as part of hedging and application of the ALMA strategy that the accounting
standards used comply with the applicable legal provisions and international accounting
standards.
7. If the transactions are conducted for hedging purposes, the Bank shall establish clear
responsibilities and internal control for the purpose of:
a) ensuring that the accounting standards used do not give rise to irregularities in
recognition of revenue;
b) check that the transactions have been effectively conducted according to the
instructions or recommendations of the assets and liabilities committee (ALCO) and
that the transactions reduce overall interest rate exposure;
c) assess regularly whether hedging is effective, particularly in the calculation of the
hedging ratio and comparison of this ratio over time;
d) ensure that the transaction contracts are managed until maturity and will not be
transferred to a trading position;
e) check that the contractual terms and conditions of internal deals within the Bank
organization have been fulfilled;
f) reassess the credibility of counterparts and prevent concentration of placements for the
reason that in the event of default, the hedging strategy would be rendered ineffective.

Article 19. Control of Foreign Exchange Risk by the Supervisory Board and Board of Directors
The Board of Directors of the Bank shall ensure that Bank operating units engaged in trading
of products and transactions carrying foreign exchange risk are staffed with personnel who
understand:
a. the risk-taking philosophy in market transactions;
b. factors affecting foreign exchange risk;
c. other risks incurred as a result of conducting market transactions.

Article 209. Policy, Procedures, and Establishment of Limits for Managing the Foreign
Exchange Risk

1. The Bank shall have a comprehensive, written policy and procedures for management of
foreign exchange risk.
2. The policy and procedures shall stipulate and describe the lines of responsibility and
accountability that extend beyond decisions on foreign exchange risk management and
shall clearly cover the authorized instruments, hedging strategy, and opportunities for
taking positions.
3. The foreign exchange risk policy shall also identify the quantitative parameters that
represent the risk tolerance of the Bank.
4. All policies and procedures for foreign exchange risk shall be subject to regular review and
revision if necessary, whether by the Risk Management Unit or the internal audit unit, or
by a competent external party for application of interest rate risk management, in respect
of any possibility of increased activity driven by overall market conditions, and especially
in the event of any prohibition by the supervisory authority on conducting transactions in
a specific currency.
5. The procedures applied by the Bank shall be adequate for consolidating open positions on
both net and gross basis for each position held, and enable accurate calculation of the open
position on daily basis.
6. The Bank shall establish consistent internal limits on the Net Open Position (NOP) in order
to prevent any exceeding of limits established in the applicable legal provisions,
particularly in the event that all internal established limits have been used.
7. The limits established in the course of FX currency transactions and FX currency
denominated instruments shall be consistent with the overall risk management policy,
shall enable consolidation and cover all units of the Bank holding risk positions in FX
currencies.

Article 21. Identification, Measurement, and Monitoring Processes, and the Management
Information System for Foreign Exchange Risk
1. The Bank shall conduct precise identification of assets, derivative transactions, and other
financial instruments containing foreign exchange risk, both in specific business lines and
in the overall activities of the Bank.
2. In assessing the inherent foreign exchange risk exposure across several business lines, the
Bank shall at least be able to measure a number of parameters including but not limited to:
a) coverage potential loss due to exchange rate fluctuations on the funds placements side,
including off balance sheet transactions;
 b) potential loss due to exchange rate fluctuations on the funds mobilization side,
including commitments in off balance sheet transactions.
3. In addition to the above parameters, the Bank when measuring foreign exchange risk shall
also take account of the following structural and strategic factors:
a) Structural Factors, cover the following:
a.a) level of Bank capital, taking account of foreign exchange risk as required under
applicable legal provisions;
a.b) potential volatility in Bank capital ratios based on calculation of exchange rates
against accounts/positions denominated in foreign currencies;
a.c) foreign exchange risk exposure, such as: volume and stability of portfolios carrying
foreign exchange risk; revenue and expense accounts denominated in foreign
currencies; mismatching between assets and liabilities in foreign currencies.
b) Strategic Factors
b.a) effectiveness of hedging in controlling foreign exchange risk, such as matching of cash
flow, hedging of projected revenues, and use of financial contracts such as futures and
options;
b.b) volume and maturity of positions denominated in foreign currencies;
b.c) volume and maturity of cross currency mismatches;
b.d) impact of changes in the business strategy of the Bank.
c) External Factors, such as impact of economic conditions, regulatory changes, and market
competition and etc.
4. The Bank shall at least conduct a thorough evaluation and calculation of each transaction to
ensure that the overall foreign exchange risk exposure can be monitored at all times.
5. The bank shall monitor compliance with limits on a daily basis, any exceeding of limits,
and follow up for resolution of these exceeding of limits, with the exceeding of limits and
follow up actions reported on a daily basis to the Board of Director or relevant officials in
accordance with internally stipulated powers.
6. The information system shall be capable of daily monitoring of exchange rate movements
and the impact of these movements on Bank revenues and capital.
7. Any Bank active in derivative transactions and trading in other financial instruments
denominated in foreign currencies shall at the minimum have a system capable of daily
monitoring of foreign exchange risk exposure and movements in exchange rates, and
develop the system to enable monitoring on a real time basis.
8. The Risk Management Unit shall be responsible for preparation and distribution of accurate
and timely reports on:
a) gain and loss from foreign exchange risk exposures;
 b) sensitivity of exposures to losses resulting from changes in market foreign exchange
rates;
c) potential loss that may arise from changes in market foreign exchange rates.
9. The Risk Management Unit shall conduct a regular review of trends in exchange rate
movements or possibility of market pressures. The results of this review shall thereafter be
conveyed to the Risk Management Committee and Board of Directors as material for
evaluation in order to review existing foreign exchange risk exposures and established
limits.

Article 22. Control of Foreign Exchange Risk

1. The Bank shall institute control of foreign exchange risk for the purpose of:
a) hedging FX-denominated gains and/or FX-denominated expenses and losses against
adverse movement in FX currency rates;
b) taking account of prudential principles and selection of appropriate hedging strategy
for provision of funds and transactions involving credit risk exposure in FX
currencies;
c) provisioning in FX currencies equivalent to amounts in the domestic currency.
2. Business lines or Bank units without limits in FX currency positions shall not be permitted
to conduct transactions involving FX currency risk, enabling any unauthorized positions to
be immediately identified and the problem resolved.
3. Appropriate control of foreign exchange risk shall be instituted and effectively applied for
the purpose of compliance with limits and requirements stipulated in applicable legal
provisions.

Chapter IV
Liquidity Risk
Article 23. Definition of Liquidity Risk
1. Liquidity risk is risk caused among others by the inability of the Bank to settle liabilities at
due date. Liquidity risk can be categorized as follows:
a) Market Liquidity Risk, namely risk arising from the inability of the Bank to offset
certain positions at market prices due to poor conditions of market liquidity or
market disruptions;
b) Funding Liquidity Risk, namely risk arising from the inability of the Bank to
convert assets to cash or obtain funding from other sources of funds.
2. Liquidity Risk may be inherent in the business lines of credit, (provision of funds), treasury
and investment, funding activities, and debt instruments.
3. Liquidity management is extremely important, given that any liquidity shortage may be
disruptive not only to the Bank itself, but also the banking system as a whole.

Article 24. Oversight of Liquidity Risk by the Supervisory Board and Board of Directors
1. The Supervisory Board and Board of Directors of the Bank shall understand liquidity risk
and work actively to approve and evaluate policy and strategy for liquidity risk on a regular
basis.
2. The liquidity risk policy and strategy shall consider risk tolerance and its impact on capital,
taking into account external and external changes.
3. The Board of Directors shall elaborate and communicate the policy and strategy for liquidity
risk to all relevant units and evaluate the application of this policy and strategy.
4. The Board of Directors shall ensure the deployment of human resources and development of
their competency, with particular focus on the treasury and investment business line.
5. The Board of Directors shall actively measure the liquidity position of the Bank not only on
the basis of current adequacy but also evaluate the application of the funding strategy
particularly under adverse market conditions.

Article 25. Policy, Procedures, and Establishment of Limits for Liquidity Risk Management
1. The liquidity risk management policy shall be formulated in accordance with the mission,
business strategy, capital adequacy, human resources, and the risk appetite of the Bank.
2. The liquidity risk management policy shall be periodically evaluated and updated in keeping
with changes in liquidity condition, mission, business strategy, and overall capital strength.
The Bank shall also have clear policies on the responsibilities for funding, reporting, and
liquidity pricing.
3. The liquidity and funding strategy shall assign and provide powers to a specific unit for
determining markets, instruments, and transactions with eligible counterparties. This
policy shall also cover the handling of problems with concentration of liquidity risk and
prevention of Bank dependency on any one or a number of instruments, counterparties, or
a particular market segment.
4. The liquidity management policy and procedures approved by the Board of Directors shall
be communicated to and duly implemented by units in charge of business lines carrying
liquidity risk exposure.
5. The policy and management of Bank liquidity and funding shall establish limits that are
implemented on a consistent basis to prevent liquidity shortages, gap concentrations, and
dependence on any specific counterparty, instrument, or market segment.
6. The limits established shall be consistent and appropriate to the contingency funding plan
to ensure that the contingency funding plan can be applied effectively. The Bank shall
specifically establish short term funding limits, particularly in regard to overnight
borrowings raised on the market.
7. Establishment of limits shall at least take account of the following:
a) regular funding needs or surplus liquidity;
b) consistency with positions taken on interest rate risk;
c) overall liquidity on the inter-bank money market and potential for liquidity shortages
based on past experience;
d) movement in market interest rates and availability of liquidity.
e) The established limits shall be reviewed and adjusted in the event of any significant
change in overall market conditions.
8. The policy, procedures, and processes for establishments of liquidity risk limits shall be fully
documented in writing to facilitate the audit trail.

Article 26. Identification, Measurement, and Monitoring Processes and the Management
Information System for Liquidity Risk

1. The Bank shall accurately identify and analyze the banking products and transactions and
business lines that carry liquidity risk.
2. The Bank shall analyze the possibility of any impact from the application of various different
scenarios on the liquidity position, for the reason that the liquidity condition of the Bank
depends on cash flow under varied conditions.
3. The Bank may employ various scenarios that are used to assess:
a) cash flow and liquidity position of the Bank under normal conditions;
b) individual Bank scenario under crisis, among others reflected in inability to extend
most of the liabilities of the Bank; and
c) scenario of banking system in crisis, among others reflected in most or all of the
banking system facing liquidity problems.
d) In applying these scenarios, the Bank shall prepare assumptions on future liquidity
needs, both short term and long term, and the ability of the Bank to raise liquidity on
the money market.
4. The scope of measurement of liquidity risk includes:
a) funding structure, namely assessment of the deposit structure by type, maturity,
currency, interest rate, owners of funds, and concentration of fund ownership;
 b) expected cash flow, namely assessment of all incoming and outgoing cash flow including
funding needs to meet commitments in off-balance sheet items in order to identify any
possibility of future funding shortage;
c) market access, namely assessment of the ability of the Bank to raise liquidity on the
market under both normal and abnormal conditions;
d) asset marketability, namely assessment of liquid assets that may be converted into cash,
particularly under abnormal conditions (crisis), when the Bank is unable to meet all
liabilities from its own positive cash flow and borrowings on the money market.
5. Liquidity may be calculated by putting together a maturity ladder for each scenario, by
preparing cash flow on the basis of maturity or estimates using assumptions based on the
past experience of the Bank.
6. If the cash flow forecast is prepared on the basis of estimated statistical data, the accuracy of
the estimation shall be subject to regular review. In addition, the assumptions and
variables used in the forecast shall be reviewed in the light of changes in market
conditions, inter-bank competition, and changes in customer behavior.
7. For Monitoring of Liquidity Risk the Bank shall assess the stability and trends in depositor
funds and prepare a worst-case scenario based on observations of trends in the highest rate
of withdrawals during the observation period, especially if the Bank has experienced a rush
to withdraw funds in the past.
8. The Bank shall collect data and monitor the liquidity position on a regular basis (daily,
weekly, monthly, and other intervals), and the potential for losses resulting from liquidity
risk, among others by managing the gap of liquidity positions.
9. The Bank shall conduct a regular review of the factors responsible for liquidity risks and
their linkage to losses that could be incurred.
10. For the purpose of monitoring liquidity risk exposure, the Risk Management Unit shall
prepare reports on losses caused by liquidity risk factors for the Risk Management
Committee and Board of Directors.
11. The management information system for liquidity risk shall be capable of providing
accurate, timely information and reports on the condition of liquidity, maturity profile, and
projected cash flow. The information system shall be designed and developed in
accordance with significant changes in internal and external conditions. The risk
management information system shall be capable of meeting the reporting requirements of
the NBG, including the obligation of the Bank to provide special reports.
12. The Risk Management Unit shall analyze the reports produced and thereafter communicate
the findings of this analysis to the Board of Directors, risk management committee, internal
audit unit, and treasury unit on a regular basis according to the needs of the Bank. The
frequency of reporting may be increased if the analysis shows that the Bank has potential
for experiencing significant liquidity difficulties.
13. The Bank shall take immediate action to resolve weaknesses in an automatic capturing
process by means of an adequate and timely process of internal communication with the
treasury unit, particularly in order to be informed of large-scale, unexpected flows of funds.
14. Reports generated by the information system shall undergo regular testing for effectiveness
and reliability according to the latest liquidity gap position, whether long or short.

Article 27. Control of Liquidity Risk

1. The Bank shall have a contingency funding plan to avoid any possible shortfall in liquidity
that could cause the Bank to default on its obligations to other parties.
2. The contingency funding plan shall include assumptions and accurate estimates on:
a) establishment of stability in deposit funds and outgoing cash flow based on statistical
estimates;
b) reasonable price levels for securities, in the event that the securities are sold;
c) liquidity reserves and assets that can be used as collateral in the event that the Bank
raises borrowings, such as repo transactions and currency swaps;
d) possibility of default by debtors or borrowers (other parties) in meeting obligations on a
timely basis;
e) possibility of outflow of funds against off balance sheet transactions.
3. The Bank shall conduct regular testing of the contingency funding plan to establish the
amount of funds that may be raised from regular borrowers (or parties) or the market,
under a scenario of no guarantee, without overnight facilities, and without reducing the
Bank credit spread on the market.
4) The Bank shall conduct a review of its customer relations strategy, diversification of
deposits, and ability of the Bank to sell liquid assets, and shall know the amount of funds
that will be received from the market under normal conditions or otherwise.
 Chapter V
Legal Risk

Article 28. Definition of Legal Risk

Legal risk is the risk arising from legal weaknesses, among others resulting from legal actions,
absence of supporting provisions in laws and regulations, or weakness of legally binding
provisions, such as failure to comply with legal requirements for contracts and etc.
Article 29. Active Oversight of Legal Risks by the Supervisory Board and Board of Directors

1. The Supervisory Board and Board of Directors shall understand the inherent legal risks in
business lines that may affect the financial condition of the Bank, and work actively to
issue approvals and conduct policy evaluation for control of legal risk.
2. The Board of Directors shall identify and control legal risks inherent in any new products
and activities and ensure that the risk of the new product and activity has passed a risk
management process prior to introduction to customers.
3. The Board of Directors shall ensure that the Bank has a policy for calculating the impact of
legal risk on Bank capital.
4. The Board of Directors shall continually instill a culture of compliance and concern over
legal risk among all employees at every level of the organization.
5. The Board of Directors shall involve the officers and employees of the Bank in
communicating issues of legal risk to the legal department or relevant unit to ensure that
legal risk can be immediately prevented and controlled.

Article 30. Policy and Procedures for Controlling Legal Risk

1. The Bank shall have a written policy and procedures for control of legal risk, adjusted to
the business strategy of the Bank.
2. The procedures for control of legal risk shall be approved by the Board of Directors and
communicated to all levels of the organization to enable the procedures to be effectively
applied.
3. The Bank shall have in place and implement procedures for analysis of legal risk of new
products and activities.
4. The Bank shall have a unit or group of officers functioning as “legal watch” for those
providing legal analysis/advice to all employees at every level of the organization.
5. The legal unit/department, Risk Management Unit, and risk-taking units shall jointly assess
 the impact of changes in certain legal provisions or regulations on legal risk exposure.
6. The Bank shall have a code of ethics applied to all employees at every level of the
organization to improve compliance with internal and external regulations.
7. The Bank shall impose sanctions on a consistent basis on officers and employees proven to
have committed irregularities and offences against external and internal regulations and
the internal code of ethics of the Bank.
8. The Bank shall conduct regular evaluation and update its policy and procedures for control
of legal risk in accordance with external and internal developments, such as changes in the
provisions of applicable laws and regulations.

Article 31. Identification, Measurement, Monitoring and Management Information System for
Legal Risk
1. The Bank shall identify the inherent legal risk in the various business lines, such as credit
(provision of funds), treasury and investment, operations and services, trade financing
services, information technology and MIS, and human resources management.
2. The Bank shall record and administer all events pertaining to legal risk, including the total
potential loss resulting from these events, in a data administration system. The recording
and administration of this data shall be put together in the form of statistical data that can
be used to project potential loss over a period and for specific business lines.
3. In the process of measuring legal risk, the Bank may use a combination of qualitative and
quantitative approaches.
4. The Bank shall monitor legal risk on a regular basis in accordance with past experience with
losses arising from legal risk.
5. The management information system shall be capable of providing complete, accurate
reports on legal risk exposure on a timely basis to support the decision-making processes of
the Board of Directors.

Article 32. Control of Legal Risk

1. The legal department shall conduct a regular review of contracts and agreements between
the Bank and other parties, including but not limited to a review of the effectiveness of
enforceability processes, in order to check the validity of rights in such contracts and
agreements.
2. In the event that the Bank issues guarantees such as netting agreement, collateral pledges,
these guarantees shall be supported by the effectiveness and enforceability of legal
documents.
3. The Bank shall improve its control of legal risk to ensure:
a) compliance of operations, organization, and internal control with applicable legal
provisions, code of ethics, and business strategy;
b) compliance with internal procedures;
c) quality of financial statements;
d) effectiveness and efficiency of the risk management information system; and
e) effective application of communications pertaining to the impact of legal risk on all
employees at every level of the organization.

Chapter VI
Reputation Risk
Article 33. Definition of Reputation Risk and its Oversight by Supervisory Board and Board of
Directors
1. Reputation risk is risk brought about among others by negative publicity concerning the
operations of the Bank or negative perceptions of the Bank.
2. The Supervisory Board and Board of Directors shall understand the inherent reputation
risks in specific activities of the Bank, particularly those that may significantly affect the
financial condition of the Bank. Management shall work actively to approve and evaluate
the policy for control of reputation risk.
3. The Board of Directors shall ensure that the Bank has a policy for calculating the impact of
reputation risk on Bank capital.
4. The Bank shall have a unit with powers and responsibility for providing comprehensive
information to customers and other Bank stakeholders as part of the control of reputation
risk.

Article 34. Policy, Procedure, and Establishment of Limits for Reputation Risk
1. The Bank shall have a written policy and procedures complying with the principles of
transparency and improvement of service quality to customers and other stakeholders for
control of reputation risk. The policy shall also be consistent with the applicable laws and
regulations on consumer protection.
2. The Bank shall have and implement an appropriate communications policy for dealing
with negative media reporting/publicity or prevention of information with
counterproductive tendencies, including but not limited to ways of applying effective
media strategies for countering negative media reporting.
3. The Bank shall implement procedures for control of reputation risk pertaining to
experience with reputation risk that has materially affected the financial condition of the
Bank.
4. The Bank shall communicate its policy and procedures for control of reputation risk to all
employees at every level of the organization.

Article 35. Identification, Measurement, Monitoring and Management Information System for
Reputation Risk
1. The Bank shall identify the inherent reputation risk in specific business lines such as credit
(provision of funds), treasury and investment, operations and services, trade financing (if
any), information technology and MIS, and human resources management.
2. The Bank shall record and administer all events pertaining to reputation risk, including the
total potential loss incurred by these events, in a data administration system. The
recording and administration of this data shall be put together in the form of statistical data
that can be used to project potential loss over a period and for a specific business line.
3. In the process of measuring reputation risk, the Bank may use a combination of qualitative
and quantitative approaches.
4. The Bank shall monitor reputation risk on a regular basis in accordance with past experience
with losses caused by reputation risk.
5. The management information system shall be capable of providing complete, accurate, and
timely reports on reputation risk exposures to support the decision-making processes of the
Board of Directors.

Article 36. Control of Reputation Risk

1. The Bank shall improve compliance with applicable laws and normative acts as part of the
control of reputation risk.
2. The Bank shall take immediate action to resolve any customer complaints and legal actions
that may increase its exposure to reputation risk, including but not limited to continuous
communication with the customer or counterparty and holding bilateral negotiations with
the customer to avoid litigation and legal claims.
3. The Bank may cooperate with third parties, to control reputation risk.
 Chapter VII
Strategic Risk
Article 37. Definition of Strategic Risk and its Oversight by the Supervisory Board and Board
of Directors
1. Strategic risk is risk among others brought about by poor setting and implementation of the
Bank strategy, poor business decision-making, or lack of responsiveness of the Bank to
external changes.
2. The Supervisory Board and Board of Directors shall understand the inherent strategic risk in
certain activities of the Bank, particularly those that may significantly affect the financial
condition of the Bank, and work actively to approve and evaluate the policy for control of
strategic risk.
3. The Supervisory Board and Board of Directors shall put together and approve a corporate
plan and business plan covering matters as stipulated in the applicable legal provisions.
4. The Board of Directors shall monitor the internal condition (strengths and weaknesses of the
Bank) and developments in external factors/conditions that directly or indirectly affect the
established business strategy of the Bank.
1. The Board of Directors shall ensure that strategy adopted for achievement of the
business objectives of the Bank has taken account of the impact of strategic risk on Bank
capital.
2. The Bank shall have a unit possessing powers and responsibilities that support the
formulation of strategy and monitoring of implementation, including the corporate plan
and business plan.
Article 38. Strategic Risk Policy and Procedures
1. The Bank shall establish a written corporate plan and business plan with a time frame of no
less than 3 (three) years and implement this policy.
2. The corporate plan and business plan shall be adopted by the Board of Directors and
approved by the Supervisory Board, and communicated to Bank officers and/or employees
at every level of the organization.
3. The corporate plan and business plan shall have alternative assumptions for the event of
any deviation from set targets as a result of significant external and internal changes.
4. The Bank shall have procedures in place to track progress against budget outcome and
performance against schedule.
Article 39. Identification, Measurement, Monitoring and the Management Information System
for Strategic Risk
1. The Bank shall identify the inherent strategic risks in specific major business lines, such as
credit (provision of funds), treasury and investment, operations, and services.
2. The Bank shall record and administer changes in performance resulting from failed or
ineffective implementation of the adopted corporate plan and business plan, particularly
those changes having significant influence on Bank capital.
3. In the process of measuring strategic risk, the Bank may use a combination of qualitative and
quantitative approaches.
4. The Bank shall monitor strategic risk on a regular basis according to past experience with
losses caused by strategic risk.
5. The management information system shall be capable of providing complete, accurate, and
timely reports on strategic risk exposure to support the decision-making processes of the
Board of Directors.
Article 40. Control of Strategic Risk
1. The Bank shall institute financial control processes aimed at monitoring progress against
targets and ensuring that the risks taken remain within tolerable limits.
2. The Bank shall have a unit that is assigned powers and responsibilities for analysis of
actual vs. target reports concerning the business plan and regular communication of this
analysis to the Board of Directors.
3. The Bank shall conduct regular testing and review of the management information
system for strategic risk.

Chapter VIII
Compliance Risk
Article 41. Definition of Compliance Risk and Major Requirements Related with Managing
Such Risk
1. Compliance Risk is the risk arising from failure of the Bank to comply with or implement
laws, regulations, and other applicable legal provisions. In practice, compliance risk is
inherent in Bank risks pertaining to applicable laws, regulations, and other legal provisions,
such as credit risk pertaining to the Minimum Capital Requirement (CAR), Earning Assets
Quality, Formation of Allowance for Earning Assets Losses, and the Legal Lending Limit
(LLL), market risk pertaining to the Net Open Position (NOP), strategic risk pertaining to
the provisions of the Annual Work Plan and Budget of the Bank, and other risks concerned
with specific provisions.
2. The Bank shall identify and analyze factors that may increase exposure to compliance risk
and quantitatively affect the profit and loss and capital of the Bank, such as:
a) business activities of the Bank, namely the type and complexity of Bank operations,
including new products and activities;
b) non-compliance of the Bank, namely volume and materiality of Bank non-compliance
with internal policies and procedures, applicable laws and regulations, and sound
business practices and ethical standards; and
c) litigation, namely the amount and materiality of litigation claims and customer
complaints.
3. The Bank shall ensure the effective application of compliance risk management, with use of
adequate policy and respective procedures, as well as of qualified human resources and
good controlling system, covering:
a) With respect to policy
a.a) appropriate setting of the established risk limits;
a.b) consistency of risk management policy with the direction and business strategy of the
Bank;
a.c) application of compliance and regulation of responsibilities and accountability at all
levels of the organization;
a.d) policy for waivers in case of irregularities;
a.e) application of policy for regular, procedural checks on compliance.
b) With respect to procedures
b.a) timeliness in communication of policy to all employees at every level of the
organization;
b.b) adequacy of control for development of new products;
b.c) adequacy of reports and data systems;
b.d) adequacy of oversight by the Supervisory Board and Board of Directors of the Bank;
b.e) adequacy of the internal control of the Bank, including segregation of functions and
dual control;
b.f) timely operation and appropriate level of sophistication of the management
information system;
b.g) effectiveness of control in regard to accuracy, completeness, and integrity of data;
b.h) adequacy of processes for interpreting applicable laws and regulations;
b.i) commitment of the Bank to ensure proper allocation of Bank resources for employee
training and promotion of a culture of compliance;
 b.j) timely identification and corrective actions in regard to any effect of irregularities and
non-compliance with applicable laws and regulations;
b.k) adequacy of integration of compliance into each stage of the Bank’s corporate
planning.
c) with respect to human resources
c.a) appropriateness of the compensation program and performance management for Bank
employees and officers;
c.b) turnover rate (rotation) of Bank employees and officers holding strategic positions in
the Bank (high risk-taking units);
c.c) adequacy of the training program;
c.d) adequacy of competence for the Supervisory Board and Board of Directors of the Bank;
c.e) level of understanding and alignment of the business strategy to risk tolerance.
d) with respect to control system
d.a) effectiveness and independence of the audit function, quality assurance unit (if any), and
Risk Management Unit;
d.b) accuracy, completeness, and integrity of reports and management information system;
d.c) system in place for monitoring irregularities, capable of identifying and measuring any
increase in frequency and size of risk exposures;
d.d) responsiveness of the Bank to irregularities in regard to the internal policy and procedures
of the Bank;
d.e) responsiveness of the Bank to any irregularities within the Bank internal control system.
Article 42. Obligation of bank in terms of compliance risk
For the purposes of Article 41 of this regulation each bank shall be obliged to establish
compliance function, and ensure and protect its independent functioning.

Chapter IX
Preparation and Reporting of Application of Risk Management
Article 43. Efficiency of Risk Management
1. Risk Management for Commercial Banks shall be implemented according to the schedule set
forth in the action plan. In this regard, following the issuance of these regulations and
guidelines, the Bank shall take immediate steps to prepare for application of Risk
Management, including but not limited to diagnosis and identification of the internal
condition of the Bank, the results of which may be used as material for preparation of the
action plan for application of Risk Management as required under those provisions. The
Bank shall manage risks in stages or without them.
2. National Bank of Georgia may request that the Bank make adjustments to its Action Plan if
the Action Plan is deemed not to comply fully with the minimum requirements stipulated
in the NBG Regulation and in these guidelines.
3. The Bank shall submit report on its risk management to the NBG, within not later than 10
calendar days following completion of each stage.
4. During the period from issuance of the present Regulation by the National Bank of Georgia
to its application for risk management the Bank may observe the following guidelines:
a) conduct a comprehensive diagnosis and analysis of risk management policies,
procedures, organization, systems, and processes at the Bank;
b) assess, examine, and compare these with reference to these Guidelines,
c) identify existing weaknesses and ineffective risk management requiring immediate
resolution to ensure that the Bank is able to meet the deadline for effective
implementation of risk management.
5. Assign a staff member or officer or a project team responsible for the process of formulating
the Action Plan. The Bank shall inform the NBG of name of the staff, officer, and project
manager designated as contact person.
6. Familiarize all (relevant) employees with the minimum standards for application of Risk
Management to ensure that the employees have sufficient understanding of risk
management practices.
7. Report, on progress of implementing the Action Plan as referred to above , shall be reported
to the Board of Directors of the Bank for decision and approval. The Board of Directors
shall bear full responsibility for achievement of the targets set out in the Action Plan
during the transition period.
8. Ensure that the Internal Audit Unit is involved in the diagnostic process and in the
formulation and monitoring of the Action Plan. Thereafter the Internal Audit Unit shall
adapt its audit planning process to the results of the evaluation of the Action plan and
progress achieved.
9. The Board of Directors shall be provided with regular reports from the project manager on
the progress achieved by the project team towards the realization and effective
implementation of the Action Plan and shall also be provided with information on the
steps necessary to meet the target for effective implementation during the transitional
period.
10. The diagnostic report, Action Plan, and progress report shall be made available to the
Internal Audit Unit and/or the NBG for the purpose of evaluating preparatory measures
during the transitional period.
Article 44. Risk Profile Report
1. The Bank shall submit a risk profile report to the NBG on a quarterly basis for the positions
of March, June, September, and December, no later than 10 (ten) calendar days after the
end of the reporting month. This report shall be presented in comparison with the
previous quarter. The Risk Profile report shall present the level and trend of all relevant
Risk exposures, according to the complexity of the business of the Bank.
2. The risk profile report submitted by the Risk Management Unit shall contain the same
substance as the risk profile report submitted by the Risk Management Unit to the Director
and the Risk Management Committee.

Article 45. New Product and Activity Report

1. Upon the launching of each new product and activity, the Bank shall be required to deliver
a new product and activity report to the NBG no later than 7 (seven) working days after
the new product and activity is effectively implemented. For the first time, the new
product and activity report shall be delivered after the Bank has completed the Action Plan
described above.
2. The scope of the new product and activity report shall cover at least data, information, and
explanations on:
a) standard operating procedures (SOP) for the new product and activity;
b) organization and powers for implementing the new product and activity;
c) results of the Bank’s identification of the inherent risk in the new product and
activity;
d) results of testing the method for measurement and monitoring inherent risk in
the new product and activity;
e) accounting information system for the new product and activity, including
explanation of the relationship between this accounting information system
and the overall accounting information system for the Bank;
f) legal analysis for the new product and activity.
3. The Bank shall be required to deliver other reports to the NBG in the event that the
condition of the Bank may potentially lead to significant financial losses or for other
reasons deemed important by the NBG. In this regard, such condition of the Bank may be
understood as:
a) the Bank is placed by the NBG under the status of Intensive or Special
Supervision;
b) the Bank has highly significant market risk and liquidity risk exposures; and
 c) external (market) conditions undergoing sharp fluctuation largely beyond the
control of the Bank.

Chapter X
Operational Risk

Article 46. Definition of Operational Risk

1. Operational risk is the risk of loss caused by inadequacy of internal processes, human error,
system failure, or external problems.
2. Operational risk may be defined as the risk of incurring losses, determined by inadequate or
unsuccessful internal processes, personnel and systems or external factors.
3. Operational risk may bring about direct and indirect financial losses and potential loss of
opportunity to earn profits.
4. Operational risk may be inherent in any business line of the Bank, such as lending
(provision of funds), treasury and investment, operations and services, trade financing,
funding and debt instruments, information technology and the management information
system, and human resources management.

Article 47. Active Oversight of Operational Risk by the Supervisory Board and Board of
Directors
1. The Board of Commissioners and Board of Directors of the Bank shall understand
operational risk and work actively to approve and evaluate the policy and strategy for
operational risk on a regular basis. The policy and strategy for operational risk shall take
account of its impact on capital, while keeping watch on external and internal changes.
2. The Board of Directors shall elaborate and communicate the policy and strategy for
operational risk to all relevant units and evaluate the implementation of this policy and
strategy.
3. The Board of Directors shall be able to identify and manage operational risk inherent in a
new product and activity and ensure that the risk of any new product and activity has
passed through an adequate internal control process before launching or operation.
4. The Board of Directors shall ensure adequate deployment and development of competency
and integrity of human resources for all business lines of the Bank.

Article 48. Policy, Procedures, and Establishment of Limits

1. The Bank shall have an operational risk management policy appropriate to its mission,
business strategy, capital adequacy, and adequacy of human resources.
2. The Bank shall establish and apply procedures for assessment of operational risk and conduct
regular monitoring of operational risk exposure in a number of major business lines.
3. The Bank shall evaluate and update its policies and procedures for operational risk
management in accordance with the operational risk exposure, risk profile, and risk culture
of the Bank.
4. The Bank shall establish operational risk limits (reserves) taking account of risk exposures
and experience with past losses brought about by operational risk. The established limits
shall be reviewed and adjusted in the event of any significant change in operational risk
exposure.
5. The policy, procedures, and process for establishment of operational risk limits shall be fully
documented in writing to facilitate the audit trail.
6. The Bank shall have procedures to measure settlement risk exposure, particularly if the risk
originates from foreign exchange transactions and trade financing activities.
7. The Bank shall conduct an assessment of the stages in the transaction settlement process,
particularly concerning the deadline for payment orders, deadline for receipt, and time for
recording payment of funds.
8. The Bank shall have a procedure for monitoring the settlement of new transactions or cases
of transactions not settled for payment.
9. The Bank shall have in place a procedure for settlement of transactions brought on by
deteriorating liquidity conditions at the Bank.
10. The Bank shall promptly confirm transactions according to established procedures and
monitor these transactions on a consistent basis.
11. The Bank shall ensure that the use of accounting methods complies with prevailing
accounting standards with attention to the following:
a) conduct a regular review to ensure the suitability of the method used to assess
transactions;
b) conduct a regular review of the suitability of the accounting method used in
regard to applicable financial accounting standards.
c) conduct regular reconciliation of transaction data;
d) identify and analyze any anomaly in transactions;
e) maintain all documents and files pertaining to accounts, sub-ledgers, general
ledgers, administration of asset classification, and documentation of loan loss
provisioning in order to facilitate the audit trail.
12. The Bank shall maintain accounting data and details of third party assets placed in the
 custodianship.
13. The Bank shall obtain adequate information on the authenticity of asset
safekeeping/custodianship to ensure that the assets placed in safekeeping are not
encumbered by any legal problems.
14. The Bank shall conduct regular checking of the data of assets in safekeeping against the
agreements/contracts for these assets.
15. The Bank shall apply Know Your Customer Principles (KYC) on a consistent basis
appropriate to its exposure to operational risk. KYC shall be supported by an effective
internal control system, and particularly by the Bank’s preventive measures against internal
fraud.
16. In applying KYC, the Bank shall comply with all requirements and guidelines stipulated in
the applicable legal provisions concerning Know Your Customer Principles (KYC).
17. The Bank shall have and apply a policy on the responsibilities, powers, and access of
officers/employees to certain information systems. This policy shall be supported by
procedures for access to the management information system, accounting information
system, risk management system, security in the dealing room, and data processing room.

Article 49. Identification, Measurement, and Monitoring Processes, and the Management
Information System for Operational Risk
1. The Bank shall identify and analyze factors that give rise to operational risk inherent in all
business lines, products, processes, and the information system, whether caused by internal
or external factors that negatively impact the achievement of the objectives of the Bank.
2. The Bank shall have an adequate system for assessment of operational risk inherent in new
products and activities, including the process and system for this assessment.
3. The results from the identification shall then be used by the Bank to develop a database on
loss events caused by operational risks.
4. Methods that may be used by a Bank to identify operational risk include:
a) self risk assessment in the form of checklists to identify strengths and weaknesses in the
Bank’s operational risk environment, such as the role of the Supervisory Board and Board
of Directors, organizational structure, human resources, and information and
communications flows in the Bank;
b) risk mapping by type of risk in respect of business lines, organizational structure, and
transaction process flows;
c) key risk indicators in the form of statistics or a matrix providing data on the operational
risk position of the Bank, such as total canceled transactions, employee turnover, and
frequency of errors and etc;
d) scorecards that provide a method for translating assessments/ qualitative criteria into a
 quantitative matrix that may be used for allocating the capital requirement for each
business line.
5. After the Bank has identified the operational risks inherent in certain business lines, it shall
assess the parameters that affect operational risk exposure, including the number and
frequency of:
a) system failure and errors;
b) administration system;
c) failed customer relations;
d) accounting errors;
e) delays and errors in payment settlements;
f) fraud;
g) falsified accounting;
h) strategic failure.
6. In the application of operational risk management, the primary source is validated and
verified historical data on Bank losses caused by operational risk.
7. Data on losses from operational risk consists of routine events of high frequency events but
low impact and of low frequency but high impact on the profit and loss position of the
Bank. This data on losses is:
a) expected, such as events of high frequency but low impact; or
b) unexpected, such as events of low frequency but high impact.
8. The Bank shall have an appropriate methodology for measurement of operational risk,
competent human resources, and adequate system infrastructure for identification and
collection of data on operational risk.
9. The Bank shall record and administer all events, including amounts of potential loss arising
from these events, in a data administration system. The recording and administration of
the data shall be put together in the form of statistical data that may be used to project
potential losses over a period and activity in a specific business line.
10. The Bank shall conduct ongoing monitoring of operational risk in regard to all operational
risk exposures and loss events that may arise from major business lines, including but not
limited to ways of applying internal control system and providing regular reports on losses
caused by operational risk.
11. The Bank shall conduct a regular review of factors causing operational risk and the impact
of losses from these risks.
12. The Risk Management Unit shall prepare reports on losses from operational risk and the
results of review of internal audit compliance and convey these reports to the Risk
Management Committee and Board of Directors.
13. The Bank shall have an adequate information system and technology appropriate to the
nature and volume of transactions.
14. The management information system shall be capable of:
a) generating complete and accurate reports that are used in risk monitoring for the
purpose of timely detection and correction of irregularities in order to minimize
potential for loss events.
b) providing complete, accurate reports on operational risk exposures on a timely basis to
support the decision-making processes of the Board of Directors.
15. The Bank shall have a policy, procedures, and processes in place for control or
mitigation of operational risk, commensurate to the complexity of Bank operations.
16. In the application of operational risk control, the Bank may develop programs for
mitigation of operational risk, including security of information technology processes,
insurance, and retrieval of data on some bank operations from the system.
17. In the event that the Bank develops security for information technology processes, the
Bank shall ensure the level of security of electronic data processing.
18. Control of the information system shall ensure:
a) regular assessment of information system security, accompanied by corrective measures
if necessary;
b) availability of a back up procedure to ensure the continuity of Bank operations and
prevent any significant disruption;
c) availability of a back up procedure and contingency plan tested on a regular basis;
d) regular provision of information to the Board of Directors on the issues referred to in
letters a) through c);
e) availability of storage of information and documents pertaining to analysis,
programming, and implementation of data processing.
19. The Bank shall have support systems that cover at least the following:
a) early identification of errors;
b) efficient, accurate, and timely processing and settlement of all transactions;
c) confidentiality, integrity, and security of transactions.
20. The Bank shall follow up internal and external audit findings and thereafter proceed with a
series of corrective measures.
21. The Internal Audit Unit shall inform the Board of Directors of any audit findings not
followed up or only partially corrected. If these findings are significant, the Board of
Directors shall set a deadline for corrective measures and assign the Internal Audit Unit to
monitor the effectiveness of the corrective measures taken.
22. The Bank shall conduct a regular review of procedures, documentation, data processing
system, contingency plan, and other operational practices to minimize the possibility of
human error leading to operational risk.