Financial Services (Risk and Governance Requirements for Banks and Bank Holding Companies) Directive, 2018

1. Citation This Directive may be cited as the Financial Services (Risk and Governance for Banks and Bank Holding Companies) Directive, 2018.

2. Interpretation In this Directive unless the context otherwise requires— “ affiliate ” means any entity, corporate or unincorporated where 5% or more of any class of its voting shares or other voting participation is directly or indirectly owned or controlled by that institution or is held by the institution with power to vote; “ associate ” has the meaning ascribed to it in the Act; “ bank ” means a person who conducts banking business in Malawi, including by accepting funds withdrawable by cheque or transferable by other means; “ bank holding company ” means a body corporate that owns or controls at least two financial institutions one of which is a bank , whether the financial institution is a subsidiary or significant minority investment or interest of the body corporate; “ Board ” means the highest body of authority in an institution , responsible for strategically guiding the institution , effectively monitoring management, and properly accounting to shareholders; “ conflict of interest ” means a situation in which a person has direct or indirect private or personal interest in a matter which is sufficient to directly or indirectly influence or has the potential to directly or indirectly influence tire objective exercise of his official or professional duties or the making of impartial judgment over the same or related matter; “ controlling party ” has the same meaning ascribed to it in the Act; “ executive director ” means a member of the Board who has management responsibilities within the institution; “ executive officer ” has the same meaning ascribed to it in the Act; “ governance ” means the set of relationships between the institution ’s management, board, shareholders and stakeholders which provide the structure through which the objectives of the institution are set, and the means of attaining those objectives and monitoring performance; “ group ” means a group consisting two or more institutions that have common controlling party and the body corporate of which any of those institutions is a controlling party ; “ independent director ” means a director that— (a) is not a significant shareholder of the institution, either directly or indirectly; (b) is not related or affiliated to a shareholder; (c) has not been employed by the institution , its subsidiary or affiliate in any executive capacity for the past two years; (d) is not a member of the immediate family of an individual who, in any of the past two years, is or has been, employed by the institution or the group in an executive capacity; (e) is not a professional advisor to the institution or the group other than in a director capacity; (f) has no significant contractual relationship with the institution or the group; or (g) is free from any business or other relationship which could be seen to materially interfere with the individual’s capacity to act in an independent manner; “ institution ” means a bank or a bank holding company ; “ internal control ” means process effected by the institution 's Board , management and other personnel designated to provide reasonable assurance regarding the achievement of objectives such as effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations; “ non-executive director ” means a member of the Board who does not have management responsibilities in the institution; “ person affiliated to a shareholder ” means— (a) an employee of the shareholder; (d) an associate of the shareholder; or [Please note: numbering as in original.] (e) any other person as the Registrar may determine; “ senior management official ” have the same meaning as ascribed in the Financial Services (Fit and Proper) Directive, 2018; “ significant contractual relationship ” means five percent of the value of the transaction conducted with the institution ; and “ significant shareholder ” means a shareholder who, directly or indirectly, owns five percent or more of the shares or voting rights of the institution .

3. Objective The objective of this Directive is to prescribe minimum risk and governance requirements for a bank and a bank holding company .

4. Obligations of shareholders A shareholder of an institution shall— (a) jointly and severally protect, preserve and actively exercise supreme authority over the institution ; (b) ensure that the Board is held accountable and responsible for the efficient and effective governance of the institution; (c) ensure that only competent and reliable persons with appropriate knowledge, skills and experience are appointed to serve on the Board ; (d) change the composition of a Board that does not perform to expectations or in accordance with the mandate of the institution; (e) appoint competent external auditors; and (f) approve director’s remuneration or fees during annual genera] meetings or extraordinary meetings.

5. Restriction on shareholders and persons affiliated to shareholders (1) A significant shareholder of an institution shall not directly or indirectly, be a a chairperson of a Board or member of a Board Audit Committee or Board Risk Committee of the institution . (2) A person affiliated to a shareholder of an institution shall not be a member of the Board Audit Committes or Board Risk Committee of the institution . [paragraph 5 substituted by section 2 of Government Notice 31 of 2024 ]

6. Shareholder loan Management shall grant a shareholder loan on non-preferential terms and on an arm’s length basis.

7. Broad charter (1) The Board shall have a formal charter which shall, at a minimum— (a) outline the Board ’s responsibility for the formulation and adoption of strategic plans; (b) provide for the monitoring of operational performance of management; (c) document the procedure for the selection, orientation and evaluation of directors; and (d) provide for the criteria for managing conflict of interest among directors of the institution. (2) The Board shall review the charter at least once every two years. [subparagraph (2) substituted by section 3 of Government Notice 31 of 2024 ]

8. Directors’ powers and responsibilities The Board shall— (a) severally and jointly be liable for the affairs of the institution ; (b) have clear, well-defined responsibilities; (c) determine appropriate policies and processes to ensure the integrity of the institution ’s risk management practices, internal controls and communications policy; (d) be responsible for monitoring of management in the implementation of the Board ’s plans and strategies, (e) provide strategic direction to the institution ; (f) approve the organizational structure of the institution ; (g) appoint and remove senior management of the institution ; (h) allocate time and resources for directors to acquire and retain a sound understanding of their responsibilities; (i) ensure the development and implementation of the organization’s succession plan; (k) ensure that the institution complies with all relevant laws, regulations and policies; [Please note: numbering as in original.] (l) have access to all the institution ’s information, records, documents and property; (m) set and approve limits of authority for management; (n) in accordance with the Schedule hereto, conduct formal annual self-assessments and submit assessments reports to the Registrar by 31st March of every year; (o) not make any public announcement about any proposed appointment of chief executive officer or director before the Registrar has granted approval to the appointment; (p) ensure that senior management implements strategic policies and procedures that are designed to promote good and acceptable ethical behaviour; (q) ensure that the institution discloses to the Registrar all complex shareholding structures of the institution ; (r) have a clear policy for setting remuneration of executives and non-executive directors at levels that are fair and reasonable' in a competitive market for the skills, knowledge, experience, nature and size of the institution ; (s) ensure that where executive directors' remuneration packages include an element that is dependent on individual performance as well as the institution ’s performance, such schemes strike a proper balance between risk and reward; (t) have a formal written conflicts-of-interest policy and an objective compliance process for implementing the policy; and (u) ensure that the governance of the institution is adequately transparent to its shareholders, depositors, other relevant stakeholders and market participants.

9. Company Secretary An institution shall have a Company Secretary who shall, among other duties, be responsible for— (a) orientation of new directors on the business and governance practices of the institution ; (b) facilitation of annual self-assessment of directors; and (c) provision of advice and guidance on ethics and governance to the Board . [paragraph 9 substituted by section 4 of Government Notice 31 of 2024 ]

10. Balance of power on the board The Board shall have an appropriate balance of power and authority, such that an individual or a group of individuals shall not dominate the Board 's decision making process.

11. Removal of broad member The chairperson shall through a Board resolution, recommend to the shareholders, the removal of a Board member who does not contribute effectively to the Board .

12. Liability of directors and senior management officials A director or a senior management official shall be held liable for false or misleading statements to the Board, the Registrar or other stakeholders.

13. Board composition The Board shall— (a) comprise a minimum of eleven directors and the majority of the directors shall be independent directors; and [subparagraph (a) substituted by section 5 of Government Notice 31 of 2024 ] (b) have appropriate balance of skills, knowledge and experience;

14. Residence of directors A majority of directors of tire Board shall be resident in Malawi.

15. Board chairperson (1) The chairperson of the institution shall be an independent and non-executive director except where the individual proposed to be the chairperson is affiliated to a shareholder of the institution. (2) Notwithstanding subparagraph (1) , the person affiliated to the shareholder shall not serve as the chairperson unless with prior written approval of the Registrar.

16. Restrictions on directors (1) A director of an institution shall not simultaneously hold the roles of Board chairperson and chief executive officer or equivalent designation for the same institution. (2) A director of the institution shall not be a member of more than six other Boards except where the six other Boards are part of the group . [ Act No. 15 of 2013 ] (3) The restriction in subparagraph (2) shall not apply to Boards of entities not registered under the Companies Act. (4) Where the director exceeds the limitation in subparagraph (2) by virtue of the Boards being part of the group , the director shall not serve on any other Board outside the group. (5) A director who contravenes subparagraphs (2) and (4) shall cease to be eligible as a director of the institution and shall be subject to such administrative penalties as the Registrar may prescribe. (6) A director of a bank or bank holding company shall not serve on the Board of another financial institution unless— (a) the director obtains prior written approval of the Registrar; or (b) the other financial institution is part of the group or is affiliated to the bank through shareholding. [subparagraph (6) substituted by section 6(a) of Government Notice 31 of 2024 ] (7) A director of a bank shall not be an executive officer or a director of a credit reference bureau or a collateral registry. (8) A person who ceases to be a director of a bank or bank holding company shall not be appointed as a director of another bank or bank holding company until after expiry of a cooling off period of six months from the date he ceases to be a director of the bank or bank holding company . [subparagraph (8) added by section 6(b) of Government Notice 31 of 2024 ]

17. Restrictions on independent directors An independent director shall not be considered independent after serving on the Board for a period of more than 10 years.

18. Board committees (1) A bank holding company shall, at a minimum, have the following Board committees in place— (a) Audit committee; and (b) Risk Management Committee. (2) Where a bank is part of a group, the Board of the holding company shall ensure that it is aware of the material risks and issues that might affect the group . (3) A bank shall, at a minimum, have the following Board committees in place— (a) Audit Committee; (b) Risk Management Committee; (c) Credit Review Committee; and (d) Nominations (Appointments) and Remuneration Committee. (4) A committee of the Board shall have a minimum of three members. [subparagraph (4) inserted by section 7(b) of Government Notice 31 of 2024 ] (5) The Board shall ensure that the proceedings of committee meetings are properly minute and made available to the Registrar upon request. [subparagraph (5) , previously subparagraph (4) , renumbered by section 7(a) of Government Notice 31 of 2024 ] (6) A chairperson of a committee of the Board shall be an independent director . [subparagraph (6) , previously subparagraph (5) , renumbered by section 7(a) and substituted by section 7(c) of Government Notice 31 of 2024 ] (7) A director shall not be a chairperson of more than one committee of the Board except with prior written approval of the Registrar. [subparagraph (7) inserted by section 7(d) of Government Notice 31 of 2024 ] (8) Where a director serves as chairperson of an additional committee of the Board as prescribed under subparagraph (7) , the director shall serve as a chairperson of the additional committee for a period not exceeding six months. [subparagraph (8) inserted by section 7(d) of Government Notice 31 of 2024 ] (9) The Board chairperson shall not be a member of any subcommittee, except with prior written approval of the Registrar. [subparagraph (9) , previously subparagraph (6) , renumbered by section 7(a) of Government Notice 31 of 2024 ] (10) A member of the Board Audit Committee shall not sit in any other Board Committee. [subparagraph (10) , previously subparagraph (7) , renumbered by section 7(a) of Government Notice 31 of 2024 ] (11) A member of the Board Risk Committee shall not sit in any risk-taking Board Committee. [subparagraph (11) , previously subparagraph (8) , renumbered by section 7(a) of Government Notice 31 of 2024 ] (12) The chief executive officer and an executive director shall not be a member of the Board Audit Committee. [subparagraph (12) , previously subparagraph (9) , renumbered by section 7(a) of Government Notice 31 of 2024 ]

19. Internal audit (1) The head of internal audit shall functionally report to the Board Audit Committee. (2) The head of internal audit shall have unrestricted access to the Board Audit Committee. (3) The internal audit function shall have full, free and unrestricted access to all functions, premises, assets, personnel, records, and other documentation and information that it considers necessary to meet its responsibilities. (4) The Board Audit Committee shall ensure that recommendations made in internal audit reports are dealt with in a timely manner and that corrective actions are taken on deficiencies noted in the audit. (5) The Board shall ensure that the internal audit function is adequately resourced and that the annual audit work plan is timely approved. (6) The Board Audit Committee shall assess the performance of the internal audit function and determine the remuneration of the head of internal audit. (7) Non-executive directors of the Board shall, in the absence of management, at least, meet annually with the institution’s external auditors, the head of internal audit and the heads of compliance and legal functions. (8) The Board Audit Committee shall approve the appointment, resignation or dismissal of the head of internal audit. (9) The Board Audit Committee shall review, at least annually, the system of internal controls to determine whether it works to expectation and to ensure it remains appropriate. (10) The Board shall ensure that operations of the internal audit function are carried out in accordance with international standards for professional practice of internal auditing as issued by the Institute of Internal Auditors in Malawi.

20. Risk management function The Board shall ensure that an institution has an effective independent risk management function, under the direction of a chief risk officer or similar designation, with sufficient authority, independence, resources and access to the Board .

21. Monetary penalties (1) The Registrar shall impose the following monetary penalties for violations of this Directive— (a) for an institution , up to K50,000,000; and (b) for natural persons who are members of the Board or senior management, up to K10,000,000. (2) With respect to banks, the Registrar shall— (a) debit the penalty in subparagraph (1)(a) from the main account of the bank maintained at the Reserve Bank of Malawi; and (b) notify the bank in writing prior to debiting the account. (3) With respect to a natural person or an institution that does not maintain an account with the Reserve Bank of Malawi, the natural person or the institution , as the case may be, shall pay the penalty through a bank certified cheque or electronic transfer payable to the Reserve Bank of Malawi within 10 working days after being notified by the Registrar.

22. Administrative penalties In addition to the monetary penalty imposed in paragraph 21(1) , the Registrar may impose directions, administrative penalties and enforcement action as provided for under the Act and the Banking Act. [Cap 44:01] Schedule (par. 8 (n)) Guidance on Board of Directors’ performance evaluation (1) The review and evaluation shall include, among other things, an assessment of the Board's— (a) composition and independence; (b) performance against its objectives at the beginning of the year; (c) performance against the Board charter; (d) effectiveness in the institution’s strategic direction; (e) response to problems and crises; (f) responsiveness to shareholders’ and stakeholders' concerns; (g) maintenance and implementation of the Board's governance principles; (h) access to and review of information from management and the quality of such information; and (i) opinion on coercion or influence from a dominant entity be it shareholder, other director or management that affects delivery on the Board. (2) The following are some of the questions that should be considered in a performance evaluation. They are however, by no means definitive or exhaustive. An institution should tailor questions to suit its own needs and circumstances. (3) The responses to these questions and others should enable boards to assess how they are performing and to identify how certain elements of their performance areas might be improved. Board Evaluation (1) Have any performance objectives been set for the Board? (2) How well has the Board performed against any performance objectives that have been set? (3) What has been the Board’s contribution to the development, determination, testing and monitoring of the institution’s strategy? (4) What has been the Board’s contribution to ensuring robust and effective risk management? (5) Is the composition of the Board and its committees appropriate, with the right mix of knowledge and skills to maximize performance in light of current and future strategy? Are inside and outside the Board relationships working effectively? (6) How has the Board responded to any problems or crises that have emerged and could or should these have been foreseen? (7) Are the matters specifically reserved for the Board the right ones? (8) How well does the Board communicate with the management team, company employees and others? How effectively does it use mechanisms such as the Annual General Meeting and the annual report? (9) Is the Board as a whole up to date with latest developments in the regulatory environment and the market? (10) Has the Board developed or ensured that the institution has a workable succession plan? (11) How effective are the Board’s committees? (Specific questions on the performance of each committee should be included such as, for example, their role, composition, attendance and interaction with the Board). (12) The processes that help underpin the Board’s effectiveness should also be evaluated e.g— (a) is appropriate, timely information of the right depth and quality provided to the Board and is management responsive to requests for clarification or amplification? Does the Board provide help fill feedback to management on its requirements? (b) are sufficient Board and committee meetings of appropriate length held to enable proper consideration of issues? Is time used effectively? (c) are Board procedures conducive to effective performance and flexible enough to deal with all the eventualities? (d) are new directors properly oriented to the institution and their roles, responsibilities and expectations? Chairman and Directors' evaluation (1) In addition, there are some specific issues relating to the chairman, which should be included as part of an evaluation of the Board’s performance e.g— (a) is the chairman demonstrating effective leadership of the Board? (b) are relationships and communication with shareholders well managed? (c) are relationships and communication with the Board constructive? (d) are the processes for setting the agenda working? Do they enable Board members to raise issues and concerns? (e) is the Company Secretary being used appropriately and to maximum value? (2) The Chairman and other members should consider the following issues and the individual concerned should also be asked to assess themselves. For each director— (a) how well prepared and informed are they for Board meetings and is their attendance satisfactory? (b) do they demonstrate willingness to devote time and effort to understand the company and its business and a readiness to participate in events outside the boardroom such as site visit? (c) what has been the quality and value of their contributions at Board meetings? (d) what has been their contribution to development of strategy and to risk management? (e) how successfully have they brought their knowledge and experience to bear in the consideration of strategy? (f) how effectively have they probed to test information and assumption? Where necessary, how resolute are they in maintaining their own views and resisting pressure from others? (g) how effectively and proactively have they followed up their areas of concern? (h) how effective and successful are their relationships with fellow Board members, the Company Secretary and Senior Management official? Does their performance and behaviour engender mutual trust and respect within Board? (i) how actively and successfully do they refresh their knowledge and skills and are they up to date with the latest developments in areas such as corporate governance framework and financial reporting? (k) the industry and market conditions? [Please note: numbering as in original.] (l) how well do they communicate with fellow Board members, senior management officials and others, for example shareholders? Are they able to present their views convincingly yet diplomatically and do they listen and take on board the views of others? (m) do they or their affiliates have obligations to the institution that may affect their objectivity? In particular, are there any advances or loans to a director less than current? (n) do they have any litigation in or outside our jurisdictions that raise issues of fitness or propriety as director?