12 May 2008 RRRRuuuulllleeee oooonnnn OOOOppppeeeerrrraaaattttiiiioooonnnnaaaallll RRRRiiiisssskkkk MMMMaaaannnnaaaaggggeeeemmmmeeeennnntttt

12 May 2008 RRRRuuuulllleeee oooonnnn OOOOppppeeeerrrraaaattttiiiioooonnnnaaaallll RRRRiiiisssskkkk MMMMaaaannnnaaaaggggeeeemmmmeeeennnntttt ffffoooorrrr BBBBaaaannnnkkkkssss 1111.... SSSSTTTTAAAATTTTEEEEMMMMEEEENNNNTTTT OOOOFFFF OOOOBBBBJJJJEEEECCCCTTTTIIIIVVVVEEEESSSS To set out the Cayman Islands Monetary Authority (“Authority’s”) rule on Operational Risk Management for banks, (each of the sub-paragraphs of section 4 below referred to as a “Rule,” and collectively, the “Rules”), pursuant to the Monetary Authority Law (2004 Revision) (“MAL”). 2222.... IIIINNNNTTTTRRRROOOODDDDUUUUCCCCTTTTIIIIOOOONNNN 2.1. Section 34 of the MAL provides that the Authority may issue rules: 33334444.... (1) After private sector consultation and with the approval of the Governor, the Authority may – (a) issue or amend rules or statements of principle or guidance concerning the conduct of licensees and their officers and employees; … 2.2. This document establishes the Rule on Operational Risk Management for banks and should be read in conjunction with the Statement of Guidance on Operational Risk Management for banks. Page 1 of 2 12 May 2008 3333.... SSSSCCCCOOOOPPPPEEEE OOOOFFFF AAAAPPPPPPPPLLLLIIIICCCCAAAATTTTIIIIOOOONNNN This rule applies to all banks regulated by the Authority under the Banks and Trust Companies Law (2007 Revision). 4444.... RRRRUUUULLLLEEEESSSS 4.1. A bank must establish, implement, and maintain strategies, policies, and processes to identify, assess, monitor, and mitigate operational risk that are appropriate for the size, complexity, and nature of the bank’s activities. 4.2. A bank’s Board of directors must: a) approve such strategies, policies, and processes; b) oversee the management of these policies and processes to ensure they are implemented effectively; and c) periodically review these strategies, polices and processes. 5555.... EEEENNNNFFFFOOOORRRRCCCCEEEEMMMMEEEENNNNTTTT Whenever there has been a breach of the Rules, the Authority’s policies and procedures as contained in its Enforcement Manual will apply, in addition to any other powers provided in the Banks and Trust Companies Law (2007 Revision) and the Monetary Authority Law (2004 Revision). Page 2 of 2