Attachment 4Baseline Security Standard for Information Security ManagementAssurance Level 1Version 1.0


PART I: IntroductionForewordDriven by business objectives, such as increasing revenue and customer base, many organisations are embracing ICT-enabled solutions to provide richer online services to their client base. These very services have driven many banks and other organisations to interconnect via common communications and information processing infrastructure.In terms of security posture, organisations in Sri Lanka represent a spectrum of capabilities. However, just as the strength of a chain lies with its weakest link, so does the strength of information security in the financial services sector lie with its weakest member, which in turn poses a threat to all other members, which may potentially lead to financial fraud.The Centra] Bank of Sri Lanka (CBSL), the Sri Lanka Computer Emergency Readiness Team | Co-ordination Center (Sri Lanka CERT|CC) and the Sri Lanka Banks' Association (SLBA) worked towards the establishment of the Baseline Security Standard for Information Security Management (BSS), based on the globally recognized ISO 27000 series of international Standards for information security. The implementation of the Standard will be supervised by CBSL and the subsequent revisions to the Standard will be proposed by Bank Computer Security Incident Response Team (Bank CSIRT) to CBSL for consideration.1. Fundamentals1.1. Information Security ManagementThe preservation of the Confidentiality, Integrity and Availability of information by the appropriate and systematic application of security controls to manage the risk of exposure to a threat, which arises due to the existence of vulnerabilities in information assets.1.2. Information Security Risk ManagementInformation security risk management is the systematic approach to ascertaining the impact and likelihood of an information asset being exposed to a threat.


This Standard assumes the application of ISO 27005, to assign risk ratings to information assets which fall within the scope of the Information Security Management System of the Organization concerned.1.3. Security ConsiderationsAll organisations are required to derive their security requirements to conform to the laws in Sri Lanka including the regulatory requirements set by the respective regulators and the international best practices adopted globally. Additionally, security requirements are also governed by the business objectives set by the board of directors and the senior management of the organization. The BSS is developed taking into consideration the requirements set in these Standards, with a view towards increasing the level of conformance with such requirements. Significant changes to these requirements will be reflected in the revised versions of the BSS.1.3.1. Legal RequirementsAll organisations are liable to comply with the laws applicable in this regard including the Computer Crimes Act No. 24 of 2007, the Electronic Transactions Act No. 19 of 2006, Payment Devices Frauds Act No. 30 of 2006, and Intellectual Property Act No. 36 of 2003 of which any violations amounts to an offence.1.3.2. Regulatory RequirementsLocal industry regulations/directives set forth by the CBSL and other regulatory bodies must be complied with.1.3.3. International StandardsIn order to be recognized as competent online/e-banking service providers, organizations need to comply with internationally recognized industry specific security standards, such as PCI-DSS.1.3.4. Information Security ObjectivesInformation Security objectives must be identified supporting fulfillment of key business objectives within the framework of the information security policies, statutory requirements, other requirements and business processes.2


2. Terms and DefinitionsThe following terms and definitions are applicable throughout this document.2.1. AssetAnything that has value to the organization./ISO/ZEC 13335-1:2004]2.2. BSSBaseline Security Standard on Information Security Management.2.3. ControlMeans managing risk through policies, procedures, guidelines, practices or organizational structures, which can be of an administrative, technical, management or legal nature.2.4. FraudWrongful or criminal deception intended to result in financial or personal gain.2.5. GuidelineA description that clarifies what shall be done and how to achieve the objectives set out in policies./ZSCMEC 13335-1:2004]2.6. IECInternational Electrotechnical Commission.2.7. ISOInternational Organization for Standardization.2.8. Information SystemAny information processing system, service or infrastructure, or the physical locations housing them.3


2.9. Information SecurityPreservation of confidentiality, integrity and availability of information. Other attributes such as authenticity, accountability, non-repudiation and reliability can also be involved.2.10. Information Security EventAn identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant.[ISO/IEC Technical Report 18044:2004]2.11. Information Security IncidentA single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security.[ISO/IEC Technical Report 18044:2004]2.12. Malicious CodesPrograms that cause undesirable effects to the Information Systems. Examples of malicious codes include computer viruses, network worms, Trojan horses, logic bombs, spyware etc.2.13. OrganizationsFinancial institutions who are members of Bank CSIRT.2.14. OutsourcingAn agreement between a licensed bank and a third party ‘service provider’, whereby the service provider performs an activity, function or process connected with the operations of a licensed bank.[Banking Act Directions No. 2 of 2012]2.15. PolicyOverall intention and direction as formally expressed by the Board/Senior management.4


2.16. PCI-DSSPayment Card Industry - Data Security Standard.2.17. RiskA combination of the likelihood of an event and its impact.[ISO/IEC Guide 73:2002]2.18. Risk analysisSystematic use of information to identify sources of risk and to estimate the level of risk.[ISO/IEC Guide 73:2002]2.19. Risk assessmentOverall process of risk analysis and risk evaluation.[ISO/IEC Guide 73:2002]2.20. Risk EvaluationProcess of comparing the estimated risk against given risk criteria to determine the significance of the risk.[ISO/IEC Guide 73:2002]2.21. Risk ManagementCoordinated activities to direct and control an organization with regard to risk.[ISO/IEC Guide 73:2002]222. Risk TreatmentProcess of selection and implementation of measures to modify risk.[ISO/IEC Guide 73:2002]5


2.23. Service Provider‘Includes the Head Office, parent institution, another branch or related company of a Licensed Commercial Bank or Licensed Specialised Bank, or an unrelated institution, whether located in Sri Lanka or elsewhere.[Banking Act Directions No. 2 of 2012]2.24. Third PartyA person or body corporate that is recognized as being independent of the parties involved, as concerns the issue in question.[ISO/IEC Guide 2:1996]2.25. ThreatA potential cause of an unwanted incident, which may result in harm, damage to a system or an organization.[ISO/IEC 13335-1:2004]2.26. VulnerabilityA weakness of an asset or a group of assets that can be exploited by one or more threats.[ISO/IEC 13335-1:2004]3. Applicability of BSSThis section defines the applicability and preservation of this document.3.1. ScopeThis Standard is applicable to all Information Security Management Systems used within organisations who are members of the Bank CSIRT, as well as personnel handling such information and information systems, both internal and third party.3.2. StructurePart I of the Standard addresses the ownership and management of this document, its structure, scope of applicability and recommended risk management methodologies.6


Part II of the Standard introduces fourteen (14) main security domains to be considered within the current version of this Standard.33. MaintenanceThis document is to be reviewed in six (6) months from the time of introduction, and the result is to be published as Version 2 in case if changes are made, otherwise revision status remains unchanged with the date of reviewed. Bank CSIRT shall take responsibility for this task in consultation with the CBSL. Adoption of each subsequent version will provide improved information security management3.4. ImplementationExpected implementation period for Version 1 is 12 months from the time of introduction of the standard.4. Risk ManagementRisk management is a fundamental component of any cost effective information security management system.4.1. Risk as a basis for Information Security ManagementAssets contain vulnerabilities due to weak design, production, implementation, handling, management and a host of other activities. These vulnerabilities may be exploited to give rise to threats. The combination of the likelihood of a threat being realized and the impact of that exposure is called risk, and is an important measure of the relative urgency and need to impose control measures to mitigate that risk.4.2. Risk Treatment and Security ControlsAdoption of BSS and its successive revisions, will introduce security controls which would mitigate identified risks.4.3. Guidelines for Risk ManagementRisk Management shall be done in accordance with ISO 27005:2011.7


4.4. Associated Documents and ActivitiesThe establishment of Guidelines, policies, procedural manuals, schemes and templates by the respective organisations will aid the implementation of the BSS.PART II: Security Domains1. Organization of Information Security ManagementObjective: To introduce a structured approach to managing information security by defining security roles and assigning responsibilities and making available the necessary resources and authority to perform activities to enhance the Information Security Management System of the organization.Scope: Applicable to all personnel handling information and information assets within the Information Security Management System of the organization.1.1. Management Commitment to Information Security1.2. Management shall establish a clear information security policy direction across the organization on par with its business strategies and objectives. Such policies shall be approved by the Board of Directors or senior management of the organization or the head/Regional Office, as the case may be. These management activities include regular review and amendments depending on the evolving ICT, security, legal, regulatory and audit environments. The management shall provide adequate resources and assign security roles and responsibilities to achieve the above.1.3. Information Security Risk AssessmentRisk assessments shall identify, quantify and prioritize risks against criteria for risk acceptance and objectives relevant to the organization. Results of risk assessment should guide and determine the appropriate management action and priorities for managing information security risk and for implementing controls selected to protect against these risks. The information security risk assessments shall have a clearly defined scope and should be performed periodically to address changes in the security requirements.8


1.4. Information Security Risk TreatmentRisk treatment decision shall be made after following the risk assessment.1.5. Information Security CoordinationInformation Security shall be coordinated by authorized representatives with required technical skills from different parts of the organization with relevant roles and responsibilities assigned to them. This function shall be executed in compliance with information security policy of the organization.1.6. Allocation of Information Security (IS) ResponsibilitiesAllocation of IS responsibilities shall be clearly defined in accordance with the information security policy. These responsibilities shall adequately address the ways and means for identification of IS assets and delegation of responsibilities, level of protection required and necessary documentation.Confidentiality or non-disclosure agreements shall reflect the institutional needs for information security and protection from unauthorized access using legally enforceable terms. Such agreements shall be included in employment and outsourcing arrangements.1.7. Communication with AuthoritiesOrganizations shall have procedures in place that define who and how to communicate with external authorities in reporting IS incidents and related events.1.8. Communication with Special Interest GroupsAppropriate contacts with special interest groups, IS forums and professional bodies shall be maintained.1.9. Independent Review of Information SecurityRespective IS policies, procedures and control objectives shall be reviewed at planned intervals and as and when significant change of ICT infrastructure occurs within the organization.9


2. Information Security (IS) PolicyObjective:To provide management direction and support for information security in accordance with business, legal and regulatory requirements. IS Policy Document.The IS policy document shall state the management commitment and set out the approach for managing information security defining overall objectives, scope and the importance of security and commitment to comply with legal and regulatory requirements.2.2. Review of the IS Policy DocumentIS policy document shall be reviewed in planned regular intervals and when significant ICT infrastructure changes occur within the organization. All reviews shall be properly documented and retained.2.3. Administration and implementation of the IS Policy DocumentPolicy administration shall be assigned to an appropriate division or department of the organization, with an appointment of an Information Security Officer to be responsible for the implementation with identified procedures and methodologies.3. Third PartiesObjective: To maintain the security of the organization’s information, information processing facilities and information assets that are accessed, processed, communicated to or managed by third parties.3.1. Identification of Risk Related to Third PartiesRisk to organization’s information, information systems and assets from business processes involving third parties shall be identified and appropriate controls shall be implemented before granting access to such third parties.3.2. Addressing Security when Dealing with CustomersAll identified security requirements shall be addressed before giving customers access to the organization’s information and information assets.10


3.3. Addressing Security in Third Party AgreementsRespective agreements with third parties shall cover all relevant information security requirements and shall ensure that there is no misunderstanding between the respective third party and the organization.3.4. Service DeliveryIntended service delivery by third parties shall be covered with a Service Level Agreement (SLA) that includes and clearly describes the measures taken to ensure information security, the service to be provided, expected level of service, performance criteria, escalation procedures for problem resolution, respective liabilities of the third party and involvement of sub contractors by third parties and conditions for termination.3.5. Monitoring and Review of Third Party ServicesServices rendered by the third party in accordance with the SLA shall be monitored closely and shall be reviewed in planned intervals by the appropriate internal division or department of the organisation. Third parties are required to adhere to the information security requirements of the organizations even after the expiry of their service contracts.4. Information Asset ManagementObjective: To achieve and maintain appropriate level of protection of organization’s information assets.4.1. Inventory of Information AssetsAll information assets shall be clearly identified and an inventory of all such information assets shall be recorded and maintained. This asset inventory shall include all information required for recovery from a disaster.4.2. Information Asset ClassificationInformation classification guidelines of the organization shall be published in the information security policy document to support the asset owner who shall classify the information to indicate the need, priorities, and expected level of protection when handling the information. Appropriate set of procedures for labeling information shall be developed 11


and implemented in accordance with the classification guidelines of the organization (Refer Section 77 of the Banking Act, No 30. of 1988, as amended)4.3. Acceptable use of Information AssetsRules for acceptable use of information and assets shall be identified, documented, implemented and reviewed periodically. These rules shall be followed by employees, contractors and third parties for the acceptable use.5, Human Resource SecurityObjective: To ensure that employees, contractors, service providers and third party users understand their roles and responsibilities to reduce the risk of theft, fraud and unauthorized use of facilities.5.1. Definition of Roles and ResponsibilitiesOrganization’s information security policy shall clearly define the roles and responsibilities of every user or user group.5.2. Security ScreeningBackground screening checks for all candidates especially for sensitive job holders for employment, contractors, service providers and third party users shall be carried out.5.3. Terms and Conditions of EmploymentAs part of employment or service contract, all employees, contractors, service providers and third parties (users) shall agree and sign the terms and conditions of the employment contract. All contractual documents shall include reference and acceptance to the Information Security Policy.5.4. Management ResponsibilitiesManagement shall require all users to apply security in accordance with established policies and procedures of the organization. They shall be properly briefed on their roles and responsibilities prior to granting access to information systems.12


5.5. Information Security Awareness, Education and TrainingRegular updates to this policy and changes to ICT infrastructure shall be communicated to all users. Appropriate technical and user training to carry out their duties shall be provided to respective officers on regular basis.5.6. Breach of Security and PenaltiesThere shall be formal and defined disciplinary procedure/s for investigation of information security incidents or breaches.5.7. Termination FormalitiesResponsibilities for performing employment termination or change of employment, including changes to user access rights shall be clearly defined and assigned. Such responsibilities and duties still valid after termination of employment shall be included into respective agreements.5.8. Return of I nformation AssetsAll users shall return/declare organization’s information assets including logical access information in their possession upon termination of their employment, contract or agreement.5.9. Revocation of Access RightsUpon termination or changes of the employment status or third party contract, access to information, information systems and information processing facilities shall be removed or changed with immediate effect.6. Operations SecurityObjective: To protect from unauthorized access, damage and interference to organization’s premises, information and operations.6.1. Information Processing SitesAppropriate security perimeters shall be implemented and maintained in good order to protect areas, equipment, both on-site and off-site and network cabling that contain information and information processing facilities from natural or manmade disasters.13


6.2. Equipment MaintenanceEquipment shall be maintained in good working order to ensure its continued availability and integrity. Those deployed for critical operations shall be covered with annual maintenance and support agreements with the vendor.6.3. Documented Operating ProceduresOperating procedures shall be documented, maintained and made available for all users on need to know basis. If there is a significant change to the ICT infrastructure and systems, relevant documents must be updated to reflect such changes/ modifications.6.4. Segregation of DutiesDuties and areas of responsibility shall be segregated to reduce unauthorized access, modification and misuse of organization’s information and systems giving due consideration to specific job functions.6.5. Change ManagementChanges to information systems and information processing facilities shall be attended in a controlled manner adhering to industry accepted good practices. Duties and areas of responsibility shall be segregated to reduce instances for unauthorized access, modifications and misuse of organization’s information system assets.6.6. Separation of Development, Test and Operational FacilitiesDevelopment, test and production operations shall be separated to reduce the unauthorized access, misuse and changes to the operational systems6.7. Capacity ManagementUse of resources shall be monitored, tuned and projected to capture future growth and capacity requirements to ensure the required level of performance is maintained for continuity of operations.14


6.8. System AcceptanceAcceptance criteria for the implementation of in-house developed applications, acquisition of application software or major upgrades shall be in place and appropriate system tests shall be carried before moving for live operations.6.9. Controls Against Malicious CodesDetection, prevention and recovery controls to protect against malicious codes shall be in place along with appropriate user awareness programmes.6.10. Information BackupAppropriate backup policy shall be implemented to ensure the availability of critical, sensitive and other required information to be used in a contingency situation. These backup copies of information systems and procedures shall be tested regularly.6.11. Information Handling ProceduresProper procedures shall be in place to prevent unauthorized disclosure, modification and removal/disposal of media used to store information of the organization.6.12. Security of System DocumentationSystem documentation shall be stored securely to protect against unauthorized access.6.13. Information Exchange Policies and ProceduresProper procedures shall be designed and in place to protect information from interception, copying, modification, misuse, and destruction. Policies and procedures shall be designed and in place to protect information associated with the interconnection of business information systems giving due consideration to address known vulnerabilities in managing information sharing.6.14. Audit LoggingAudit logs that record user activities, exceptions and information security events shall be maintained with proper care for designated periods as per the audit and legal requirements.15


6.15. Monitoring System Use and Protection of Log InformationSystems shall be monitored to review administrator, operator and fault logs and information security events (if any) shall be recorded. These logs shall be used to ensure that information system problems are identified and addressed.6.16. Clock SynchronizationThe system time stamps of all information systems shall be synchronized with an agreed, standard time source.7. Communications SecurityObjective: Prevention of unauthorized interception from accessing telecommunication networks in an intelligible form, while delivering content to the intended recipients. This shall cover crypto security, transmission security, emission security and physical security of information and its processing facilities and transmission mechanisms implemented in the organization.7.1. Oversight of Critical Infrastructure by the Board or Delegated AuthorityRegular reviews of development and continued maintenance of security control infrastructure for the safeguard of electronic banking systems shall be conducted. This shall include the establishment of authorization privileges, logical and physical access controls to maintain appropriate boundaries and restrictions on both internal and external user activities.7.2. Network Security ManagementTo ensure the protection of information in networks and the protection of the supporting infrastructure.7.3. Network ControlsCapability of users connecting to the organization’s local area or wide area network shall be restricted in accordance with the access control policy of the organization. Groups of network services, users and information systems shall be separately maintained in the 16


network to access those resources in accordance with the information security policy of the organisation.7.4. Mobile Computing and CommunicationsThe information security policy shall cover the appropriate security measures to protect against the risks of using mobile computing and communication facilities.7.5. User Authentication for External ConnectionsAppropriate authentication methods shall be used to control access by remote users. Physical and logical access to diagnostic and configuration ports shall be controlled.7.6. Equipment Identification in NetworksAutomatic equipment creation and identification shall be considered as a means to authenticate connections from specific locations and equipment.7.7. Network Connection ControlFor shared networks that extend the boundaries of the organization, the capability of users to connect to the network shall be controlled in accordance with the access control policy of the organization.7.8. Network Routing ProtocolRouting controls shall be in place for networks to ensure that network connections and information flows do not breach the access control policy of the organization.8. Physical and Environmental SecurityObjective: To prevent unauthorized physical access, damage, and interference to the organization’s premises, information and information system assets.8.1. Physical Security PerimeterAppropriate security perimeters (barriers such as walls, card controlled entry points, manned information processing facilities) shall be implemented to protect areas that contain information systems and information processing facilities.17


8.2. Physical Entry ControlsOnly authorized personnel are allowed to enter into information processing facilities with proper access control mechanisms. A register shall be maintained to record access by visitors entering such areas and they shall be accompanied always by an authorized officer.8.3. Securing Offices, Rooms and FacilitiesPhysical security for offices, sites, rooms and facilities shall be properly designed and implemented.8.4. Protection from External and Environmental ThreatsPhysical protection against damage from natural or manmade disaster shall be designed and implemented.8.5. Working in Secured AreasPhysical protection and guidelines for working in secured areas shall be designed, implemented and made available to respective officers on a regular basis.8.6. Public Access, Delivery and Loading AreasAccess points such as delivery and loading bays where unauthorized personnel may enter the facilities shall be controlled and isolated from the information processing facilities where possible.8.7. UtilitiesAll equipment shall be protected from failure of power and air conditioning, fire and other disruptions caused by failures in supporting utilities.8.8. Cabling SecurityPower and telecommunication cables carrying data and information services shall be protected from interception or damage.18


9. Access ControlObjective: Access to information, information systems, facilities and business processes shall be on the basis of organisation’s business and security requirements.9.1. Access Control PolicyAn access control policy shall be established, documented, and reviewed based on the business and security requirements.9.2. User Access ManagementFormal procedures shall be in place to provide access to authorized officers while denying access to unauthorized officers. Management shall review the user access rights in regular intervals using a formal procedure.9.3. User Identification and AuthenticationThere shall be a formal user creation and deactivation procedure in place when granting and revoking access to information systems.9.4. Password Management SystemsAllocation of passwords and password governing rules shall be established in the security policies of the organization. Users are required to follow good security practices in selection and use of passwords.9.5. Session Timeout/Limitation of Connection TimeTermination of active sessions is required when the respective work is completed. Users shall ensure that unattended equipment has appropriate protection from unauthorized access.10. Internet and E-mail SecurityObjective: A secure and well structured framework shall be established to ensure the effective use of email and internet facilities.10.1. Electronic Messaging and Internet19


The corporate email and Internet connections are primarily for official use only. Procedures shall be in place to authenticate the identity and authorization of customers providing facilities for Internet banking.10.2. OnlineTransactionsProcedures shall be in place to ensure the implementation of adequate segregation of duties within the organization for systems and databases that shall use transaction authentication methods to ensure non-repudiation and shall establish accountability for internet banking transactions. Organizations shall maintain comprehensive audit trails and logs and shall employ appropriate cryptographic techniques, specific protocols or other security controls to ensure the confidentiality of customer internet banking data.10.3. Publicly Available InformationOrganization shall ensure that they provide correct and appropriate level of information to its customers through different media, electronically as well as in printed form.11. Information Systems Acceptable UseObjective: Formal procedures shall be established to prevent unauthorized user access and compromise or theft of information, and information processing facilities.11.1. Authorization Process for Information SystemsAllocation and revocation of access rights, to information systems and information services shall be handled using controlled and secure mechanisms. Management shall review user access rights in regular intervals using a formal procedure.11.2. Media HandlingA secure framework has to be established by the management to ensure that electronic and printed media are used, managed and disposed by authorized officers as per the agreed policies of the organization.11.3. Use of System UtilitiesUse of system utilities shall be restricted to authorized officers and controlled to ensure that the intended service is delivered.20


11.4. Clear Desk and Clear Screen PolicyA clear desk policy for printed and removable storage media and a clear screen policy for information processing facilities shall be adopted in accordance with the information classification guidelines of the organization.12. Information Security Incident ManagementObjective: Formal incident reporting and escalation procedures shall be in place. These procedures shall be made available to all relevant stake holders.12.1. Reporting Information Security IncidentsInformation security events shall be reported through appropriate management channels as quickly as possible. A formal reporting procedure shall be implemented together with an incident response and escalation procedure setting the action to be taken.12.2. Reporting Security WeaknessesAll employees, contractors or third party users of information systems and services are required to note and report observed or suspected security weaknesses in the systems or service delivery.12.3. Responsibilities and ProceduresManagement responsibilities and procedures shall be established to ensure quick, effective and orderly response to information security incidents. These procedures shall cover analysis and identification of the incident, contents, planning and implementation of corrective measures to avoid future recurrence.12.4. Learning from Information Security IncidentsThere shall be mechanisms in place to enable types, volumes and costs of information security incidents to be quantified and monitored.12.5. Collection of EvidenceWhere a follow-up action against a person or organization after an information security incident involves legal action (either civil or criminal), evidence shall be collected, retained, 21


and presented to conform to the requirements on evidence as set out in the relevant jurisdiction(s).13. Acquisition, Development and Maintenance of Information SystemsObjective: To ensure that information security management is an integral part of information systems.13.1. Information Security Requirements Analysis and Specification for Software and HardwareInformation security requirements shall be identified, justified, agreed and documented as part of the implementation and overall business case for an information system.13.2. Correct Processing in ApplicationsTo prevent errors, losses, unauthorized modifications or misuses of information, appropriate controls shall be implemented at data input, processing and output stages.13.3. Message IntegrityRequirements for ensuring authenticity and protecting message integrity in applications shall be identified and implemented.13.4. Control of Operational SoftwareFormal procedures for controlling operational software in production environments shall be in place to minimize the risk of corruptions. Use of pirated software shall be prohibited and compliance to the acts and laws pertaining to intellectual property in Sri Lanka must be maintained.13.5. Protection of System Test DataSystem testing shall be carried out in a separate test environment to avoid unauthorized access to production databases and these test results and test scripts shall be retained for control /audit purposes.22


13.6. Access Control to Program Source CodeAccess to source code shall be restricted. Source code of purchased software packages that are deployed for critical operations should be kept with an escrow agent based on the policy adopted by respective organisation.13.7. Change Control ProceduresFormal change control procedures shall be in place to control the implementation of changes to information systems.13.8. Technical Review of Applications After Operating System ChangesReview of application controls and integrity checks shall be conducted to ensure that the changed computing environment has not compromised the internal controls.13.9. Restrictions on Changes to Software PackagesModifications to software packages must be discouraged and shall be used without modification. If modifications are required, the risk of in-built controls and integrity processes shall be evaluated with the vendor’s technical support.13.10. Information LeakagePossibilities for information leakages shall be prevented at all times.13.11. Outsourced Software DevelopmentWhen software development is outsourced, licensing arrangements shall be established respecting the intellectual property rights. Outsourced software development shall be monitored and supervised by the organization.13.12. Technical Vulnerability ManagementTimely information about technical vulnerabilities of information systems being used shall be obtained. The organization's exposure to such vulnerabilities evaluated, and appropriate measures taken to address the associated risk.23


13.13. Control ofTechnical VulnerabilitiesTechnical vulnerability controls shall be implemented through effective and systematic measurements to ensure the hardware and software are functioning as intended.14. Business Continuity ManagementObjective: To counteract with the interruption to business and to protect critical business processes from the effects of major failures of information systems and facilities or disasters and to ensure their timely resumption within tolerable time frames.14.1. Preparation and Approval for Business Continuity Plans (BCP)A single framework of enterprise wide business continuity plan shall be maintained to ensure all plans are consistent, addressing information security requirements and identifying priorities for testing and maintenance. BCP shall be prepared on the basis of business impact analysis that is conducted giving due considerations to business operations of the organization. BCP shall be approved by the Board of Directors or Senior management of the organization or the Head/Regional office as the case may be.14.2. Business Continuity and Risk AssessmentEvents that can cause interruptions to business processes and facilities shall be identified, along with the probability and impact of such interruptions and their consequences for information security.14.3. Including Information Security in the Business Continuity Management ProcessA managed process shall be in place for business continuity throughout the organization that addresses the information security requirements needed for the entire organization’s business continuity.14.4. Developing and Implementing BCP including Information SecurityPlans shall be developed, documented, maintained and reviewed regularly to ensure the restoration of business operations.24


14.5. Testing, Maintenance and Revision of BCPBusiness continuity plan shall be tested and updated regularly to ensure that they are up to date and effective. These tests should ensure that all members of the recovery, operational and other relevant teams are aware of the plan, their role for business continuity and information security.End of BSS Version 1
25


ffiF,ffiiilir"l*n
Oco4 q6re5'r oqerboo@dQO eunirdl GLo$unrieoou$ pileoour6eenLb Bank Supervision Department
Ref. : 02117 1500/0540/001 O\ December 2013
To: Chief Executive Officers of Licensed Commercial Banks
Dear Sir/Madam
Definition of Liquid Assets under Section 86 of the Banking Act, No. 30 of 1988
Interms of Item (g) of the definition of "liquid assets" under section 86 of the BankingAct,
No. 30 of 1988, as amended, the Monetary Board has determined that investments in International
Sovereign Bonds issued by the Government of Sri Lanka shall be treated as liquid assets.
2. Licensed commercial banks shall:(, take into account the daily market value of their investment in the Intemational
Sovereign Bonds in computing their liquid assets ratio for the purpose of complying
with the provisions of section 21 of the Banking Act; and(ii) repofi the eligible value of the investments in International Sovereign Bonds under:(a) code number 4.I.2.4.0.0 of the monthly web based return on Statutory Liquid
Assets Ratio for Domestic Banking Unit (BSD-MF-04-LD); and(b) code number 4.2.2.4.0.0 of the monthly web based return on Statutory Liquid
Assets Ratio for Off-shore Banking Unit (BSD-MF-04-LF),
as the case may be.
Yours faithfully
(Mrs.)TMJYPFemando
Director of Bank Supervision
6 O(D @(,g, qoro 30, d{rlAcaS @)OeD,
o.. @E).59O, @loleo Ol, @ goo:O
I ga'n zqnfiorcsg V sa r6 €|gLb ong, @eu. :O uor$u$ ormgiog Getr(grbq 1
p. Gu. @a1.590, Gsnlgrirq Ol. O6)rdlos
11 K banksup@cbsl,lkkvd 6, N0.30, Janadhlpathl Mawatha, Colombo 1
P.0. Box.590, Colombo 01, Sri Lanka.
www.cbsl.(ov.lk


0 flohr gdrnrC0, ol0d0,{ elndeloC fiaf er000
The Gazette of theDemocrffifffiiuli,tRepublic of srilanka
EXTRAORDINARY
q"a 1843/8 - 2Ot3 oqesl@Ob @ee 3O O1E esgqc _ 2OI3.LZ.3O
No. 1843/8 -MONDAY DECEMBER 30, 2013
(Published by Authority)
PART I : SECTION (I) - GENBRAL
Central Bank of Sri Lanka Notices
TIIE MONETARYLA\ilACT
REGULATIONS made by the Monetary Board under Section 32E of the Monetary Law Act, (Chapter 422-).
Nrvano Anru Lpsrm CaSRAAL,
Chairmarq
Monetary Board.
::ffif,*ofSriLanka'
?.3'dDe*ember,2013.
sriLanka Depositlnsurance and Liquidity support scheme Regulations
Amendment to the Sri Lanka Deposit Insurance Scheme Regulations, No. I of 2010
I . I These Regulations shall be cited as Sri Lanka Deposit Insurance and Liquidity Support Scheme
Regulations, No. 1 of20l3.
2.1 Sri Lanka Deposit Insurance Scheme Regulations, No. I of 2010 published.in Gazette
Extraordinary No. 167311 I of28th September, 2010 is hereby amended as follows :_
2.2 rn regtlation 3.1 thereof, by the substitution for the words "This scheme shall be titled sri
Lanka Deposit Insurance Scheme" of the words "This Scheme shall be titled Sri Lanka Deposit Insurance
and Liquidity Support Scheme (hereinafter referred to as "the Scheme,,),,.
. 2.3In regulation 7. I thereof, by the substitution for the words "The Scheme shall have a fund titled';Deposit Lesurance Fund" " of the words "The Scheme shall have a fund titled ,,Sri Lanka Deposit Insurance
and Liquidify Support Fund"',.l. Citation
2. Amendments
to the principal
regulation
This Gazette Extraordinary can be downloaded from www.documents.gov.lkIA


2A I oacOes ' (I) odqq: - 6 e.ro, gefcorcaJ$a es@ce5OcQ eSarde5ooi qB Sooeo ct16o <,:goo - 2013.12.30
Penr I : Src. (l) - GAZETTE EXTRAORDINARY OF THE DEMOCRATIC SOCIALIST REPUBLIC OF SRI LANKA - 30.12.2013
r 2.4 In regulation 9.7 thereof, by the substitution for the words "Deposit Insurance Fund", and
wherever those words oceur in these regulations, of the words "Sri Lanka Deposit Insurance and Liquidity
Support Fund".
2.5 In regulation 10.5 thereof, by the substitution for the words "Sri Lanka Deposit Insurance
Scheme", and wherever thoie words occur in these regulations, of the words "Sri Lanka Deposit Insurance
iquidity Support Schsme".
3. Effective' dat e 3. 1 These amendments shall come into effect from 22nd November, 201 3 .
01 -4t7
PRINTEDATTHE DEPARTMENT OF GOVERNMENT PRINTING SRI LANKA.


ffieF,ffiiil[*];*
Oooq qdrre6r oqerboo@do2O ounirdl GLogrunrteoor$ pleoour6oor6 Bank Supervision Department
Ref. :021171500105401001
To: Chief Executive Officers of Licensed Commercial Banks
6 OeD @t'e, qclo 30, crerlaeS @lorD,
tDa. oc, . 59O, @!'l€@ Ol, 6 ecrDto6 e5Lb onq, go. 30 eonplupfl Dtrilfi@E oanqgLbq I
p. Gu. @m.500, GsrT@6tl 01, O6oritosoft December 2013
kvel 6, No.30, Janadhipathi Mawatha, Colombo 1
P.0. Box' 590, Colombo 01, Sri Lanka.Dear Sir/Madam
Permitting licensed commercial banks to invest in
International Sovereign Bonds issued by the Government of Sri Lanka
In tetms of section 25 of the Banking Ac| No. 30 of 1988, as amended, the Monetary Board
with the concufl'ence of the Minister of Finance and Planning has authorised off-shore banking
units of licensed commercial banks to invest in International Sovereign Bonds issued by the
Government of Sri Lanka, in the secondary market.
Yours faithfully
(Mrs.)TMJYPFernando
Director of Bank Supervision
I sd't't zan'toorcss lJ sa fi 2477711 banksup@cbsl;lk
ilflIiilfitilliililililfl ililfiflililil flilfiltilililliilflililfl ilflllllillfl


Directions, Determinations, and Circulars
issued to
Licensed Commercial Banks

(Inclusive of Amendments made up to 30 November 2013)
Bank Supervision Department
Central Bank of Sri Lanka


DISCLAIMER
This updated edition contains of Directions, Determinations
and Circulars issued by Central Bank of Sri Lanka to
Licensed Commercial Banks up to 30th November 2013.
Please note that this edition is issued only for the purpose
of convenience, and although every effort has been made to
ensure the accuracy of the text, the Central Bank of Sri Lanka
does not hold itself responsible for any errors, omissions or
inadvertent alterations, in any manner.
Printed at Central Bank Printing Press, 58, Sri Jayawardenepura Mw., Rajagiriya, Sri Lanka.
Published by Bank Supervision Department
Central Bank of Sri Lanka, 30, Janadhipathi Mawatha, Colombo 01, Sri Lanka.


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  iii
Governor’s Statement
Sri Lankan economy has now entered into an accelerated growth path of achieving Rs. 100
billion economy with USD 4,000 per capita income by 2016. In this scenario, Sri Lankan banking sector
which holds more than 55% of the financial sector assets of the country is destined to play a pivotal role
in supporting the growth momentum of the economy. Improved resilience to face external and internal
shocks, innovative and futuristic banking products, expanded access to finance and consumer protection
are some of the key drivers to promote a strong and dynamic banking sector through business excellence.
Despite the global financial crisis, Sri Lanka’s banking sector has remained resilient with the
existing prudential regulatory initiatives and reforms that have ensured the financial system stability.
A strong regulatory framework that promotes risk management of banks is a key component of the safety
net to ensure systemic stability. Thus, the earlier regulatory initiatives on improving risk management,
corporate governance and capital requirements have continued with reforms in 2013 too. Compliance
with these new regulatory reforms has enabled the Banks to improve their governance structure, risk
management framework and capital requirements. It is expected that the consolidation between banks
and the financial institutions would further strengthen the resilience in the financial sector .
At the same time, the Directors of Banks are expected to play a major role in setting strategic
directions to ensure a sound and resilient banking sector in the country by adopting prudent policies in line
with new financial reforms. In that context, the Central Bank expects all Directors, Senior Management
and Other Staff of the banks to be fully conversant with the Directions, Determinations, and Circulars


issued time to time by the Central Bank, thereby ensure compliance. In order to facilitate such task, this
volume containing “Directions, Determinations, and Circulars issued to Licensed Commercial Banks”,
incorporating the changes and amendments up to 30 November 2013, is being issued.
It is hoped that this new volume will create greater awareness of and compliance therewith,
so that more effective inputs will contribute to ensure improved risk management, corporate governance,
efficiency and resilience in the Banking Sector.
Ajith Nivard Cabraal
Governor
Central Bank of Sri Lanka
02 December 2013


iv Directions, Determinations, and Circulars issued to Licensed Commercial Banks


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  v
Contents
Page No.
1. Licensing of Banks
 Determinations
 1.1 Determination No.1 of 201 1 – Annual Licence Fee  1
 Circulars
 1.2 Establishment of Bank Branches  2
 1.3 Classification of Banking Outlets  3
2. Capital Adequacy
 2.1 The Adoption of Basel II Capital Adequacy Framework Beginning 2008  4
 Directions
 2.2 Direction No. 09 of 2007 – Maintenance of Capital Adequacy Ratio  6
 2.3 Direction No. 05 of 2013 – Supervisory Review Process
  (Pillar 2 of Basel II) for Licensed Commercial Banks and Licensed Specialised Banks  74
 2.4 Direction No. 09 of 201 1 – Amendments to Directions on Maintenance of
Capital Adequacy Ratio  88
 2.5 Direction No. 01 of 2009 – Amendment to Directions on Ownership of
  Issued Capital Carrying V oting Rights  89
 2.6 Direction No. 01 of 2007 – Ownership of Issued Capital Carrying V oting Rights  90
 Determinations
 2.7 Foreign Participation in the Share Capital of a Licensed Commercial Bank
  Incorporated or Established in Sri Lanka  93
 Circulars
 2.8 ICRA  Lanka Limited – Recognition as an External Credit Assessment Institution  94
 2.9 Criteria for Selection of Valuers Undertaking the Revaluation of Fixed Assets
  for the Computation of the Capital Adequacy Ratio  96
 2.10 Interpretation of Capital Funds  98
 2.1 1  Enhancement of Minimum Capital Requirement of Banks  99
 2.12 Request to Maintain Capital of Banks in Foreign Currency  103
 2.13 Shipping Guarantees Issued by Banks  105
3. Cr edit Risk Management
 Directions
 3.1 Direction No. 07 of 2007 – Maximum Amount of Accommodation  106
 3.2 Direction No. 03 of 2010 – Amendments to Directions on Classification of Loans and
  Advances, Income Recognition and Provisioning  112
 3.3 Direction No. 03 of 2008 – Classification of Loans and Advances, Income Recognition and
Provisioning  113


vi Directions, Determinations, and Circulars issued to Licensed Commercial Banks
 3.4 Direction No. 01 of 2013 – Exposure to Stock Market by
Licensed Commercial Banks and Licensed Specialised Banks  126
 Determinations
 3.5 Shares in Companies Held by Licensed Commercial Banks  129
 3.6 Accommodation Granted to a Director / a Close Relation of such Director /
  any Concern in which Director has a Substantial Interest  130
 3.7 Determination No. 3 of 2009 – Lease-Backed Trust Certificates / Lease Receivables
  as Approved Security for Accommodation to any Director  133
 Circulars
 3.8 Accounting for Properties Acquired by Foreclosure of Collateral / Part Settlement of
  Debt  134
 3.9 Establishment of a Revolving Fund to grant Loans to Acquire Property to
  the State Sector Employees  135
 3.10 Financial Accommodation to Finance Companies  136
 3.1 1  Prepayment of Import Bills  137
 3.12 Recovery of Accommodation to Exporters  140
 3.13 Concessions Granted to Tourism Industry  148
 3.14 Relief Package for the Tea Sector  149
 3.15 Granting Credit Facilities to Private Sector  150
 Orders
 3.16 Monetary Law Act Order No. 01 of 2012 – Ceiling on Credit Growth of Licensed Banks  151
 Guidelines
 3.17 Guidelines on the Grant of Facilities for the Issue of Commercial Paper and
  other Forms of Promissory Notes  152
4. Liquidity Risk Management
 Circulars
 4.1 Definitions of Liquid Assets  156
 4.2 Monthly Statement of Liquid Assets  163
 4.3 Monthly Statement of Liquid Assets for the Domestic Banking Unit and the
Off-Shore Banking Unit  166
 4.4 Monthly Statement of Liquid Assets for the Off-Shore Banking Unit  167
 Determinations
 4.5 Application of Prudential Regulations on Of f-Shore Banking Units  169
 4.6 Liquid Assets  93
5. Market Risk Management
 Directions
 5.1 Prudential Norms for Classification, Valuation and Operation of
  the Bank’ s Investment Portfolio  170


the Bank’ s Investment Portfolio  170
 5.2 Direction No. 03 of 2009 – Risk Management Relating to Foreign Exchange Business  173


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  vii
 5.3 Direction No. 01 of 2012 – Foreign Exchange Trading Activities of
Licensed Commercial Banks in Sri Lanka  182
 Circulars
 5.4 Adoption of the ACI Model Code by Sri Lanka  188
 5.5 Declaration to be Submitted by Persons Engaged in Foreign Exchange Business  189
 5.6 Forward Sales and Purchases of Foreign Exchange  192
 Explatory Notes
 5.7 Explanatory Note 2/2012
Direction No. 01 of 2012 Foreign Exchange Trading Activities / FAQ  199
6. Operational Risk Management
 Directions
 6.1 Direction No. 02 of 2012 – Outsourcing of Business Operations of a
Licensed Commercial Bank and Licensed Specialised Bank  201
 Circulars
 6.2 Use of Banking System by Institutions and Persons not Authorised to Accept Deposits  207
 6.3 Regulations made under the Public Security Ordinance Proscription of
  T amil Rehabilitation Organization  208
 6.4 Acceptance of Certificates of Deposit  211
 6.5 Scheme of Certificates of Deposit with Maturity Periods of not less than Four Years 214
 6.6 Conduct of Non-Government Or ganizations (NGO) Accounts by Licensed Banks  215
 6.7 Customer Due Diligence – “Know Your Customer” Procedures  219
 6.8 Dishonoured Cheques  223
 6.9 Internal Audit Function  224
 6.10 Prevention of Frauds Using Electronic Cards  225
 6.1 1  Reporting of Post-T sunami Remittances Received through
  NGOs and Non-NGOs to the Central Bank of Sri Lanka  227
7. Corporate Governance for  Banks
 Directions
 7.1 Direction No.1 1 of 2007 – Corporate Governance  229
 7.2 Direction No. 05 of 2008 – Amendments to Directions on Corporate Governance  245
 7.3 Direction No. 07 of 2008 – Amendments to Directions on Corporate Governance  246
 7.4 Direction No. 03 of 2013 – Amendments to Direction on
Corporate Governance Issued to Licensed Commercial Banks in Sri Lanka  247
 7.5 Direction No. 07 of 201 1 – Integrated Risk Management Framework  248
 Determinatio ns


7.5 Direction No. 07 of 201 1 – Integrated Risk Management Framework  248
 Determinatio ns
 7.6 Determination No. 03 of 2010 – Assessment of Fitness and Propriety of
Officers Performing Executive Functions  277


viii Directions, Determinations, and Circulars issued to Licensed Commercial Banks
 Circulars
 7.7 Special Payments / Benefits to Directors at their Retirement  284
 7.8 Disclosures in Annual Reports  285
 7.9 Appointment of Directors of Banks   286
 7.10 Disclosures in Terms of the Direction on Corporate Governance  300
 7.1 1  Requirements Under the Corporate Governance Direction   301
 7.12 Assessment of Fitness and Propriety of Chief Executive Officers   302
 Explanatory Notes
 7.13 Explanatory Note 1/2012 – Authority of the Monetary Board to Issue Directions to
Licensed Banks Reaffirmed by the Court of Appeal  311
8. Off-Shor e Banking Business
 Circulars
 8.1 Permitting Licensed Commercial Banks to Trade in the International Sovereign Bonds
  Issued in 2007 by the Government of Sri Lanka  312
 Orders
 8.2 Amendment to Banking Act Order No. 02 of 2011 – Banking (Off-shore Banking
Business Scheme) Order  313
 8.3 Banking Act Order No. 1 of 2011 – Banking (Off-shore Banking Business Scheme)
Order  315
 8.4 Banking Act Order No. 1 of 2008 – Banking (Off-Shore Banking Business Scheme) Order   317
 8.5 Banking Act Order No. 1 of 2009 – Banking (Off-Shore Banking Business Scheme) Order   319
 8.6 Banking (Of f-Shore Banking Scheme) Order 2000  321
 8.7 Of f-Shore Banking Business  324
9. Abandoned Pr operty
 Directions
 9.1 Direction No. 05 of 2009 – Identifying, Reporting, Transferring and Maintaining
  Abandoned Property  326
 Guidelines
 9.2 Implementation of the Provisions of Part IX (Sections 72 to 76) of the Banking Act on
Abandoned Property  334
10. Disclosures
 Circulars
 10.1 Implementation of Part V of the Banking Act  340
 10.2 List of Qualified Auditors  341
 10.3 Preparation, Presentation and Publication of Annual Audited Accounts of Banks  343
 10.4 Display of Interest Rates, Exchange Rates, Service Char ges, Fees & Commissions  380
 10.5 Inadequate / Incorrect Disclosures / Press Statements by Banks  385


10.5 Inadequate / Incorrect Disclosures / Press Statements by Banks  385
 10.6 Publication of Audited Financial Statements of Banks in the Press  386
 10.7 Public Disclosure by Publication of Quarterly Financial Statements of Banks in Press  387
 10.8 Public Disclosure by Publication of Bank Accounts in the Press  401


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  ix
 10.9 Publication of Capital Adequacy Statement in the Annual Report  402
 10.10  Submission of Audited Financial Statements by Banks  403
 10.1 1  Publication of Financial Statements and other Disclosures on the Websites  404
 Guidelines
 10.12  Guidelines for External Auditors Relating to their Statutory Duties  405
11. Reporting of Data to Central Bank
 Circulars
 1 1.1  Submission of Statutory Returns  415
 1 1.2  Implementation of the New Web-based Off-Site Surveillance System  417
 1 1.3  Submission of the Monthly & Quarterly Compliance Reports  423
12. General Banking Practices
 Directions
 12.1 Licensed Commercial Banks (Pawning) Conditions 1998  424
 12.2 Secrecy of Banking Transactions  434
 12.3 Direction No. 08 of 201 1 – Customer Charter of Licensed Banks  435
 Circulars
 12.4 Cap on Penal Interest Rates Char ged by Licensed Banks on Loans and Advances  440
 12.5 Interest Rates on Credit Cards and other Loans and Advances  441
 12.6 Interest Rates on Credit Cards and Housing Loans  442
 12.7 Extending / Restricting of Banking Hours by the Banks  443
 12.8 Incentive Schemes for Mobilising Demand Deposit Accounts  444
 12.9 Introduction of Products Based on Islamic Principles  445
 12.10  Withdrawals on Savings Accounts  446
 12.1 1  Withdrawals on Savings Accounts and 7 Day Call Deposit Accounts  447
 12.12  Threshold Age of Senior Citizens for Transactions with Licensed Banks  448
13. Sri Lanka Deposit Insurance Scheme
 Directions
 13.1 Direction No. 05 of 2010 – Insurance of Deposit Liabilities  449
 Gazette Notifications
 13.2 Amendment to the Sri Lanka Deposit Insurance Scheme Regulation, No. 02 of 201 1 450
 13.3 Amendment to the Sri Lanka Deposit Insurance Scheme Regulation, No. 01 of 201 1 451
 13.4 Sri Lanka Deposit Insurance Scheme Regulation, No. 01 of 2010  452
 Circulars


13.4 Sri Lanka Deposit Insurance Scheme Regulation, No. 01 of 2010  452
 Circulars
 13.5 Sri Lanka Deposit Insurance Scheme – Operating Instruction, No. 01 of 201 1 457
 13.6 Sri Lanka Deposit Insurance Scheme – Operating Instruction, No. 02 of 2010  458
 13.7 Sri Lanka Deposit Insurance Scheme – Premium to be Levied on Insured Deposits,
  No. 01 of 2010  460


x Directions, Determinations, and Circulars issued to Licensed Commercial Banks
14. Other  Determinations, Circulars and Guidelines
 Determinations
 14.1 Limits on Purchase of Immovable Property  462
 14.2 Definition of Intangible Assets  93
 Circulars
 14.3 Exempting Foreign Borrowings of Licensed Commercial Banks from Regulatory
Limits  463
 14.4 Decision of the Cabinet of Ministers on Reservation of Government Sector
Import Cargo for the Ceylon Shipping Corporation Ltd.  464
 14.5 Stimulus Package Approved by the Government for the Finance and Leasing Industry  465
 14.6 Appointment of Compliance Officers  466
 14.7 Enhancing Lending to Agriculture Sector  468
 14.8 Mandatory Lending to Agriculture Sector  469
 14.9 Payment of Taxes by the Banking and Financial Sector  475
 14.10  Misleading and Unethical Advertisements  476
 14.11  Registration of Secured Interest over Movable Properties with the
  Secured T ransaction Registry  478
 Guidelines
 14.12  Guidelines for Employment of Expatriate Staf f in Banks  479
 14.13  Guidelines on Credit Rating of Banking Institutions  482
 14.14  Amendments to Guidelines on the Operation of the Investment Fund Account  483
 14.15  Guidelines on the Operations of the Investment Fund Account  485


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  1
Annual licence
fee for the period
2012 – 2014.Determinations made by the Monetary Board of the Central Bank of Sri Lanka under Section 8 of the
Banking Act, No. 30 of 1988, as amended.
Nivard Ajith Leslie Cabraal
Chairman of the Monetary Board and
Governor of the Central Bank of Sri Lanka
Colombo
29 September 2011
BANKING ACT DETERMINATION NO.1 OF 2011
ANNUAL LICENCE FEE OF LICENSED COMMERCIAL BANKS
1. In terms of Section 8(1) of the Banking Act, the Monetary Board has determined
that the licence fee that shall be paid by a licensed commercial bank for the
period 2012 to 2014 shall be based on the total assets as follows:
Total assets as at end of the previous year Licence fee
Above Rs. 200 bn Rs. 20 mn
Rs. 125 bn to Rs. 200 bn Rs. 15 mn
Rs. 75 bn to Rs. 125 bn Rs. 10 mn
Rs. 25 bn to Rs. 75 bn Rs.  5 mn
Less than Rs. 25 bn Rs.  2 mn
2. Every licensed commercial bank shall pay the licence fee to the Central Bank of
Sri Lanka on or before 31st day of January of the respective year.
3. Licence fee shall be paid on calendar year basis.Payment of
licence fee.


2 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
Bank Supervision Department
26 May 2008
To :  CEOs of Licensed Commer cial Banks and
   CEOs of Licensed Specialised Banks
Dear Sir/Madam,
ESTABLISHMENT OF BANK BRANCHES
The Central Bank currently approves the opening of bank branches and other outlets by licensed
banks considering the feasibility and suitability of the proposed expansion. At present, nearly 40 per
cent of the bank branches in the country are concentrated in the Western Province resulting in a banking
density (bank branches for 100,000 persons) of 11.9 in the Western Province as against a range of 5.3 to
8.4 in the other provinces.
There is a need to accelerate economic development in areas of the country outside the Western
Province to achieve balance regional development in the country.  Establishing more branches and
banking outlets outside the Western Province is expected to enhance access to finance and promote the
savings habits, thereby increasing economic activity in those regions.
To facilitate this, the Monetary Board has decided that banks shall establish a minimum of two
branches outside the Western Province for each new branch established in the Western Province. This
new criteria will be applicable for all future requests made to the Central Bank for opening of branches.
Yours faithfully,
Sgd. B.D.W.A. Silva
Director of Bank Supervision


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  3
Our Ref. : 02  / 17 / 500 / 0554  / 001
Bank Supervision Department
29 November 2012
To : CEOs of all Licensed Commercial Banks and
       Licensed Specialised Banks
Dear Sir / Madam,
CLASSIFICATION OF BANKING OUTLETS
As intimated to you at the periodic meeting of the CEOs of licensed banks held on 26th January
2012, the current classification of banking outlets system for licensed banks has been reviewed with a
view to streamline and rationalize the branch approval procedures.
2. Accordingly , the Monetary Board has granted approval for licensed banks to:
a. reclassify the banking outlets into two categories, namely branches and student savings units
and seek future approvals under these two outlet categories ;
b. upgrade all existing banking outlets except student savings units to branches with effect from
01.01.2013 ; and
c. conspicuously display the list of activities for the information of the customers in the premises
of a branch when such branch is extending only selected banking services.
3. Circular issued under Ref. No. 02/08/005/0002/002 dated May 03, 2006 on the above subject is
hereby rescinded.
Yours faithfully,
(Mrs.) T M J Y P Fernando
Director of Bank Supervision


4 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
Bank Supervision Department
26 December 2007
To : The CEOs of all Licensed Commer cial Banks and
 Licensed Specialised Banks
Dear Sir  / Madam,
THE ADOPTION OF BASEL II CAPITAL ADEQUACY FRAMEWORK
BEGINNING 2008
As announced in the “Road Map: Monetary and Financial Sector Policies for 2007 and beyond”,
released by the Central Bank on January 2, 2007, the Monetary Board of the Central Bank of Sri Lanka
has issued the Directions on the maintenance of capital adequacy ratios under the BASEL II for Licensed
Commercial Banks (LCBs) and Licensed Specialised Banks (LSBs), in terms of the provisions under
Section 46(1) and 76 J(1), of the Banking Act, No. 30 of 1988, respectively , which will be effective from
January 1, 2008. These Directions have been prepared on the basis of the “International Convergence of
Capital Measurement and Capital Standards – a Revised Framework”, widely known as Basel II, issued
by the Basel Committee on Banking Supervision of the Bank for International Settlements (BIS) in
June 2004 and revised thereafter in June 2006.
2. The Adoption of the Basel II
As you are aware, Basel II provides a  “three pillar”  approach, i.e., (1) Minimum Capital Requirements;
(2) Supervisory Review Process; and (3) Market Discipline, for the implementation of this
framework. However, as announced at the Bank Managers’ Meeting held on November 22, 2007,
the Central Bank has decided to adopt Pillar I, i.e., “Minimum Capital Requirements” effective from
01 January 2008 and to adopt the other two pillars in the medium term. The approach for adoption
of Basel II is as follows.
 2.1 The Adoption of Pillar I: Minimum Capital Requirements
The Basel II framework provides several options for the implementation of the Pillar I, based
on the level of sophistication and development of the banking system. Accordingly, all LCBs


on the level of sophistication and development of the banking system. Accordingly, all LCBs
and all LSBs are required to apply the Standardised Approach for credit risk, the Standardised
Measurement Method for market risk and the Basic Indicator Approach for operational risk,
in computing the capital requirements, commencing January 1, 2008. For this purpose, the
following documents are attached herewith.
 i. Banking Act, Directions No.9 (for LCBs) and No.10 (for LSBs) dated 26.12.2007 issued
by the Monetary Board.
 ii. Guidelines on computation of capital adequacy ratio (Schedule I).*
 iii. Return to be submitted on capital adequacy ratio (Schedule II).*
 2.2  Migration to Advanced Approaches
The central Bank has decided to move to adopting the internal ratings based (IRB) advanced
approaches beginning 2013. Once the Central Bank is satisfied that the banks have the
appropriate models and risk management systems capacities, permission will be granted for


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  5
them to proceed with the IRB approaches. Separate guidelines in this regard will be issued later,
specifying the pre-requisites and procedures for seeking the Central Bank’s prior approval for
such migration.
 2.3 Resour ce Requirements: Data, IT Needs and Training
Data and IT Needs:  Banks should begin preparing a comprehensive data capturing system
to identify, measure and report all material risks and to assess and allocate capital against
these risks in a systematic and objective manner to meet the requirements under the simplified
approaches and to move to advanced approaches in the future. Accordingly, banks are required
to implement changes, especially plan for systems integration, modifications to internal systems
and use of new software for appropriate data collection, to move to the advanced approaches.
In this regard, Banks are expected to have in place, or be actively developing, a data “warehouse”,
that is, a process that enables a bank to collect, store and draw upon loss statistics in an efficient
manner over time. Guidelines in this regard are given in Annex I.*
Training: Upgrading skills in the areas of credit risk models and capital assessment strategies,
credit risk mitigation techniques and measuring market and operational risks will be critical to
the successful implementation of Basel II.
 2.4 Adoption of the other  two Pillars
 2.4.1  The Pillar  II: Supervisory Review Process (SRP)
The objective of SRP is to ensure that banks have adequate capital to support all
material risks in their business and also encourage them to adopt more sophisticated risk
management techniques for monitoring and managing all risks. For this purpose, banks
are required to establish well-defined internal assessment processes within themselves
in order to determine the additional capital requirement for all material risks, internally,


in order to determine the additional capital requirement for all material risks, internally,
and which would also be able to assure the Central Bank that adequate capital is actually
held towards all their material risk exposures. However, considering the current level of
internal systems of the banks, it has been decided to adopt the Pillar II from 2010.
 2.4.2  The Pillar  III: Market Discipline
The introduction of disclosure requirements for banks, based on the revised framework,
will be initiated along with the adoption of new international accounting standards,
i.e., the International Financial Reporting Standards (IFRS 7). Accordingly, banks are
advised to continue with the current disclosure requirements until the adoption of the
Pillar III.
Yours faithfully,
Sgd, B D W A Silva
Actg. Director of Bank Supervision
Copy To : Secretary General / SLBA
* The schedule I and II and Annex I are available at www.cbsl.gov.lk


6 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
Directions issued by the Monetary Board of the Central Bank of SriLanka under Section 46(1) of
the Banking Act, No.30 of 1988, as amended.
Sgd. Nivard Ajith Leslie Cabraal
Governor
Colombo
26th December 2007
DIRECTIONS
BANKING ACT DIRECTIONS NO. 9 OF 2007
MAINTENANCE OF CAPITAL ADEQUACY RATIO
WHEREAS in terms of the powers conferred by Section 19(7)(a) of the Banking Act, No.30 of 1988
as amended, the Monetary Board has arrived at a determination in respect of the maintenance of capital
adequacy ratio of licensed commercial banks having regard to the guidelines for capital adequacy set out
by the Bank for International Settlements in Basle; and
WHEREAS in the exercise of powers conferred by Section 46(1) of the Banking Act, No.30 of 1988 as
amended, the Monetary Board hereby issues the following directions.
Minimum Capital
Adequacy Ratio.1(1) Commencing from 01 January 2008, all licensed commercial banks shall, at
all times, maintain a capital adequacy ratio of not less than 10% in relation
to total risk weighted assets with core capital constituting not less than 5%
in relation to total risk weighted assets.
1(2) T he capital adequacy ratios referred to in Direction 1(1) above shall
be computed as per guidelines given in Schedule I hereto prepared in
accordance with the Basel II Capital Accord “International Convergence
of Capital Measurement and Capital Standards - A Revised Framework”
recommended by the Basle Committee on Banking Supervision at the Bank
for International Settlements.
2 Licensed commercial banks shall use the format at Schedule II attached hereto
for reporting of capital adequacy ratios on a periodic basis as specified in
Schedule  I.
3 Where a licensed commer cial bank has failed to comply with these Directions,
such licensed commercial bank shall not pay dividends or repatriate profits until


such licensed commercial bank shall not pay dividends or repatriate profits until
such compliance is effected and confirmed by the Director of Bank Supervision.
4(1) Al l previous Determinations, Directions and Guidelines that have been
issued to licensed commercial banks by the Monetary Board in relation to
maintenance of capital adequacy ratio in terms of Section 19(7) or 46(1) of
the Banking Act are hereby revoked.
4(2) Notwithstanding the revocation referred to in Direction 4(1) above, licensed
commercial banks granted time by the Monetary Board in terms of Section
19(7)(b) of the Banking Act shall comply with the requirements contained
in such previous Determinations, Directions and Guidelines until the
expiration of the time so granted.Reporting Format.
Steps to secure
compliance with
Directions.
Revocation
of previous
Determinations.


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  7
Schedule I
Guidelines
on
Computation of Capital Adequacy Ratio
(Revised Framework – Basel II)
CONTENTS
1. Introduction
 1.1 Approaches to Implementation of the Basel II Framework
 1.2 An initial step towards adopting Basel II
2. Scope of Application
3. Minimum Capital Ratio
4. Reporting Format
5. Submission dates
6. Instructions for  Completion the Return
 6.1 Part I – Computation of Capital Adequacy Ratio
 6.2 Part II ( a) – Computation of Total Capital Base (Regulatory Capital)
 6.3 Part II ( b) – Computation of Eligible Tier III for Market Risk
 6.4 Part III ( a) – Computation of Risk-weighted Amount for Credit Risk
 6.5 Part III ( b) – Computation of Credit Equivalent Amount of Off-Balance Sheet Items
 6.6 Part III ( c) – Exposures Recognized under Credit Risk Mitigation (CRM)
 6.7 Part IV  – Computation of Risk-weighted Amount for Market Risk
 6.8 Part V – Computation of Risk-weighted Amount for Operational Risk


8 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
Abbreviations
AMA  – Advanced Measurement Approaches
BIA – Basic Indicator Approach
BIS – Bank for International Settlements
BCBS  – Basel Committee on Banking Supervision
CAR  – Capital Adequacy Ratio
CBSL  – Central Bank of Sri Lanka
CCR  – Counterparty Credit Risk
CIPC  – Cash Items in the Process of Collection
CRM  – Credit Risk Mitigation
ECAI  – External Credit Assessment Institution
GOSL  – Government of Sri Lanka
IMF  – International Monetary Fund
LKR  – Sri Lanka Rupee
MDB  – Multilateral Development Bank
NPA  – Non Performing Aassets
PSE – Public Sector Entities
SA – Standardised Approach
SLECIC  – Sri Lanka Export Credit Insurance Corporation
SME  – Small and Medium Enterprise
SMM  – Standardised Measurement Method
LCB  – Licensed Commercial Bank
LSB  – Licensed Specialised Bank


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  9
1. Introduction
1.1 Appr oach to Implementation of the Basel II Framework:  As announced by the Central Bank
of Sri Lanka (CBSL) in March 2006, the “International Convergence of Capital Measurement
and Capital Standards – a Revised Framework”, widely known as Basel II, issued by the Basel
Committee on Banking Supervision of the Bank for International Settlements in June 2004 and
as amended to framework in June 2006, will be the basis for the computation of the Capital
Adequacy Ratio effective from 1st January 2008.
1.2 As an initial step towards adopting Basel II, all licensed commercial banks (LCBs) and licensed
specialized banks (LSBs) are required to apply the following approaches in computing the
capital adequacy ratio.
1.2.1  The Standardised Approach for credit risk
1.2.2  The Standardised Measurement Method for market risk
1.2.3  The Basic Indicator Approach for operational risk .
2. Scope of Application
2.1 The revised capital adequacy norms will be applicable, in the case of all LCBs and LSBs
incorporated in Sri Lanka:
2.1.1  on the solo basis - All positions of the bank and its local and overseas branches/offices.
2.1.2  on the consolidated basis – All position of the bank (including its local and overseas
branches/ offices) and its subsidiary companies.
2.2 In the case of LCBs incorporated outside Sri Lanka, the revised capital adequacy norms will
be applicable to the branch operations in Sri Lanka and subsidiaries in Sri Lanka, established
with the assigned capital of the branch, if any.
2.3 All LCBs and LSBs are required to use the attached reporting format (Schedule II) for reporting
capital adequacy, commencing 2008.
3. Minimum Capital Ratio
 All LCBs and LSBs shall at all times maintain the capital adequacy ratios determined by the
Monetary Board in term of Sections 19(7)( a) and 76J(1)( a) of the Banking Act, commencing
from 01 January 2008.


from 01 January 2008.
4. Reporting Format
4.1 The attached reporting format (Schedule II) collects information on the capital adequacy
position of licensed banks. The return comprises 5 major parts.
4.1.1  Part 1  –   Computation of capital adequacy ratio.
4.1.2  Part 1I  – (a)  Computation of total capital base.
   (b)  Computation of eligible Tier III capital for market risk.
4.1.3  Part III  –  (a)  Computation of risk-weighted amount for credit risk.
   (b)  Credit equivalent of off-balance sheet items.
   (c)  Exposures recognized under credit risk mitigation (CRM).
4.1.4  Part IV  –   Computation of risk-weighted amount for market risk.
4.1.5  Part V  –   Computation of risk-weighted amount for operational risk.


10 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
5. Submission dates
5.1 The return should show the position as at the last calendar day of each quarter/each financial
year, and should be submitted through the web-based system as follows. Regional Developments
Banks are required to submit the attached return (Schedule II) in the manual form.
5.1.1  Quarterly return/s – within 1 month after the end of each quarter .
5.1.2  An nual audited return/s – within 6 months after the end of the financial year of the
respective bank.
5.1.3  If the submission deadline falls on a bank holiday , it will be deferred to the next working
day.
5.2 T he Statement of Certification on the information submitted in the above return/s and the
capital adequacy ratio should be forwarded to Bank Supervision Department in manual form.
For this purpose, banks may use the existing format (copy attached), which was issued under
the implementation of the new web-based returns in July 2006.
6. Instructions for  Completion the Return
 The instructions for completion of the capital adequacy return are divided into eight parts. The
details/definitions of each element in these eight parts are described with the web-based return
code (WBRC).
6.1 Part 1 – Computation of Capital Adequacy Ratio
 The values of the items in this form are updated automatically on the web-based return.
6.1.1  Eligible Cor e Capital (Eligible Tier I)
 (WBRC 1 1.1.1.0.0.0)
 The amount must agree with item 6.2.2.1 of Part II ( a) Computation of total capital base
below.
  [= WBRC 11.2.1.1.0.0 of Part II ( a)]
6.1.2  Capital Base (Regulatory Capital)
 (WBRC 1 1.1.2.0.0.0)
 The amount must agree with item 6.2.2.9 of Part II ( a) Computation of total capital base
below.
 [= WBRC 11.2.1.5.0.0 of Part II ( a)]
6.1.3  T otal Risk-Weighted Amount
 (WBRC 1 1.1.3.0.0.0)
 T otal risk-weighted assets are determined by adding the resulting figures to the sum of


T otal risk-weighted assets are determined by adding the resulting figures to the sum of
risk-weighted assets for credit risk, market risk and operational risk.
 T otal of risk-weighted amount for credit risk (6.1.3.1), market risk (6.1.3.2) and
operational risk (6.1.3.3).
 (WBRC 1 1.1.3.1.0.0 + 11.1.3.2.0.0 + 11.1.3.3.0.0)
6.1.3.1  Risk-W eighted Amount for Credit Risk
 (WBRC 1 1.1.3.1.0.0)
 The amount must agree with item 6.4.3.1 of Part III ( a) Computation of risk-
weighted amount for credit risk below.
 [=WBRC1 1.3.1.0.0.0 of Part III ( a)]


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  11
6.1.3.2  Risk-W eighted Amount for Market Risk
 (WBRC 1 1.1.3.2.0.0)
 T he amount must agree with item 6.7.8.2 of Part IV Computation of risk-
weighted amount for market risk below.
 [= WBRC 11.4.2.0.0.0 of Part IV]
6.1.3.3  Risk-W eighted Amount for Operational Risk
 (WBRC 1 1.1.3.3.0.0)
 The amount must agree with item 6.8.2.3 of Part III ( a) Computation of risk-
weighted amount for operational risk below.
 [= WBRC 11.5.3.0.0.0 of Part V]
6.1.4  Cor e Capital (Tier I) Ratio, %
 (WBRC 1 1.1.4.0.0.0)
 Eligible core capital (6.1.1) divided by Total risk-weighted amount (6.1.3)
 (WBRC 1 1.1.1.0.0.0/11.1.3.0.0.0)*100
6.1.5  T otal Capital Ratio, %
 (WBRC 1 1.1.5.0.0.0)
 T otal capital base (6.1.2) divided by Total risk-weighted amount (6.1.3)
 (WBRC 1 1.1.2.0.0.0/11.1.3.0.0.0)*100
6.2 Part II ( a) – Computation of Total Capital Base (Regulatory Capital)
6.2.1  Constituents of Capital Base
 Capital base consists of eligible core capital (Tier I), eligible supplementary capital (Tier
II) and eligible short term subordinated debt covering market risk (Tier III).
6.2.2  Specific instructions for  elements of Capital
6.2.2.1  Eligible Cor e Capital (Eligible Tier I)
 (WBRC 1 1.2.1.1.0.0)
 The Eligible Core Capital shall be the total core capital less total amount of deductions/
adjustments to core capital. Total eligible core capital should represent at least half of
total capital base, i.e., the sum total of eligible supplementary capital plus eligible
Tier III capital should not exceed total eligible core capital.
 The amount must agree with core capital (6.2.2.2) less Tier I adjustments
(6.2.2.3).
 (WBRC 1 1.2.1.1.1.0 - 11.2.1.1.2.0)
6.2.2.2  Cor e Capital (Tier I)
 (WBRC 1 1.2.1.1.1.0)
 Core capital includes only permanent shareholders’ equity (issued and fully paid
ordinary shares/common stock and perpetual non-cumulative preference shares),


ordinary shares/common stock and perpetual non-cumulative preference shares),
assigned capital and disclosed reserves (created or increased by appropriations
of retained earnings or other surplus, e.g.,  share premiums, retained profit,
general reserves and statutory reserves).
 The amount must agree with the sum of the following elements from 6.2.2.2.1 to
6.2.2.2.10
 (WBRC 1 1.2.1.1.1.1 to 11.2.1.1.1.10)


12 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
6.2.2.2.1  Paid-up Ordinary Shar es/Assigned Capital
 (WBRC 1 1.2.1.1.1.1)
 In the case of LCBs and LSBs incorporated in Sri Lanka:  Issued
and fully paid ordinary shares in terms of the Banking Act. For the
computation only the paid up portion of partly paid shares should be
counted as capital (will be revised in terms of the Companies Act,
No.7 of 2007).
 LCB incorporated or established outside Sri Lanka:  Equity capital
that shall be assigned by the Head Office of a LCB incorporated or
established outside Sri Lanka.
6.2.2.2.2  Non-cumulative, Non-r edeemable Preference Shares
 (WBRC 1 1.2.1.1.1.2)
 Issued and fully paid non-cumulative, non-redeemable preference
shares where the payment of dividend could be reduced or waived
permanently in the event of profitability being inadequate to support
such payment in part or full.
6.2.2.2.3  Shar e Premium
 (WBRC 1 1.2.1.1.1.3)
 The excess of issue price over the par value of the ordinary shares or
common stock or non-cumulative, non-redeemable preference shares
(will be revised in terms of the Companies Act, No.7 of 2007).
6.2.2.2.4  Statutory Reserve Fund
 (WBRC 1 1.2.1.1.1.4 )
 Balance in the Reserve Fund as per last audited statement of accounts
and set up by banks in terms of the Banking Act.
6.2.2.2.5  Published Retained Pr ofits/(Accumulated Losses)
 (WBRC 1 1.2.1.1.1.5)
 Balance in the profit and loss acc ount brought forward from the
previous financial years and as reported in the last audited statement
of accounts. Accumulated losses should be reported in parenthesis and
deducted from the other capital constituents.
6.2.2.2.6  General and Other  Reserves
 (WBRC 1 1.2.1.1.1.6)
 Disclosed reserves in the form of general or other reserves created
or increased by appropriation of retained earnings, share premium or
other surplus as per last audited financial statements.


other surplus as per last audited financial statements.
6.2.2.2.7  Gain/(Loss) After Tax Arising from the Sale of Fixed and Long-
term Investments
 (WBRC 1 1.2.1.1.1.7)
 Any ga in/(loss) after tax arising from the sale of fixed and long-
term investments since the closing date of the last audited accounts.
Net loss arising from the sale of fixed and long-term investments
should be reported in parenthesis and deducted from the other capital
constituents.


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  13
6.2.2.2.8  Unpublished Curr ent Year’s Profit/(Loss)
 (WBRC 1 1.2.1.1.1.8)
 Current year profit (excluding any profit/ (loss) after tax arising from
the sale of fixed and long term investments) earned/incurred since the
closing date of the last audited accounts and subject to certification by
the institution’s external auditor. Current year loss should be reported
in parenthesis and deducted from the other capital constituents. For
this purpose, the banks are required obtain the audit certificate based
on the Sri Lanka Auditing Practice Statements 1 (SLAPs 1) “The
Auditor’s Report on Special Purpose Audit Engagements”
6.2.2.2.9  Minority Inter ests (consistent with the above capital constituents)
 (WBRC 1 1.2.1.1.1.9)
 Minority interests on consolidation of capital items.
6.2.2.2.10  Perpetual Debt Capital Instruments
 (WBRC 1 1.2.1.1.1.10)
 Perpetual debt capital instruments that satisfy the following conditions:
 (i) Prior written approval of the CBSL  has been obtained.
 (ii) Such instruments shall have no maturity .
 (iii) Unsecured, fully paid up and subordinated to the interests of
creditors
 (iv) The perpetual debt capital instruments should contain a clause
that the issuing bank shall not be liable to pay interest, if:
 a. T he bank’s CAR is below the minimum regulatory
requirement in terms of the Direction on CAR, or
 b. The impact of such payment results in the bank’s CAR
falling below the minimum CAR, and
 c. Such interest not paid shall not be cumulative or accrued for
payment in the future.
 (v) Such instruments may contain a call option, which may be
exercised in 10 years from the date of issue, provided that the
prior approval of CBSL has been obtained to exercise such
option.
 (vi) T otal perpetual debt approved as core capital shall not exceed 15
per cent of the total non-innovative core capital after adjustments
and deductions.


per cent of the total non-innovative core capital after adjustments
and deductions.
 (vii) Any other conditions stipulated by CBSL  on prudential grounds.
6.2.2.3  Deductions/Adjustments – Cor e Capital (Tier I)
 (WBRC 1 1.2.1.1.2.0)
 The amount must agree with the sum of the following items from 6.2.2.3.1 to
6.2.2.3.9
 (WBRC 1 1.2.1.1.2.1 to 11.2.1.1.2.9)
6.2.2.3.1  Goodwill
 (WBRC 1 1.2.1.1.2.1)
 Report the amount of goodwill as shown in the balance sheet.


14 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
6.2.2.3.2  Net Deferred Tax
 (WBRC 1 1.2.1.1.2.2 )
 Net debit balance of deferred tax.
6.2.2.3.3  Other  Intangible Assets
 (WBRC 1 1.2.1.1.2.3)
 Intangible assets and losses in the current period and those brought
forward from previous periods should be deducted from core capital.
6.2.2.3.4  Advances granted to employees of the bank for  the purchase of
shares of the bank under a share ownership plan.
 (WBRC 1 1.2.1.1.2.4)
6.2.2.3.5  Amount due fr om head office & branches outside Sri Lanka in Sri
Lanka Rupees (applicable only to branches of foreign banks).
 (WBRC 11.2.1.1.2.5)
 Debit balances in VOSTRO current accounts in Sri Lanka Rupees held
by Head Office and branches outside Sri Lanka in Sri Lanka Rupees.
6.2.2.3.6  Amount due to head office & branches outside Sri Lanka in Sri
Lanka Rupees (-)  (applicable only to branches of foreign banks)
 (WBRC 11.2.1.1.2.6)
 Credit balances in VOSTRO current accounts in Sri Lanka Rupees
held by Head Office and branches outside Sri Lanka in Sri Lanka
Rupees. Report with negative (-) sign.
6.2.2.3.7  Amount due fr om head office & branches outside Sri Lanka in
Foreign Currency (net)  (applicable only to branches of foreign
banks)
 (WBRC 11.2.1.1.2.7)
 Net Debit balances (after netting of credit balances) in NOSTRO
current accounts in foreign currency held with Head Office and
branches outside Sri Lanka and the net amount of fixed and other
deposits placed with and amounts lent to Head Office and branches
outside Sri Lanka (after netting of fixed and other deposits and
amounts borrowed from Head Office and branches outside Sri Lanka)
in foreign currency. Ignore any net credit balance.
6.2.2.3.8  50 per  cent of Investments in Unconsolidated Banking and
Financial Subsidiary Companies
 (WBRC 1 1.2.1.1.2.8)
 50 per cent of investments in capital by way of shares, perpetual/


(WBRC 1 1.2.1.1.2.8)
 50 per cent of investments in capital by way of shares, perpetual/
hybrid capital instruments or subordinated term debt in unconsolidated
banking and financial subsidiary companies.
6.2.2.3.9  50 per  cent of Investments in the Capital of Other Banks and
Financial Institutions
 (WBRC 1 1.2.1.1.2.9)
 50 per cent of investments in capital by way of shares, perpetual/
hybrid capital instruments or subordinated term debt in other banks
and financial institutions.


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  15
6.2.2.4  Supplementary Capital (T ier II)
 (WBRC 1 1.2.1.2.1.0)
 The amount must agree to sum of following items from 6.2.2.4.1 to 6.2.2.4.5
 (WBRC 1 1.2.1.2.1.1 to 11.2.1.2.1.5)
6.2.2.4.1  Revaluation Reserves (appr oved by CBSL)
 (WBRC 1 1.2.1.2.1.1)
 Revaluation reserves may be included within Tier II Supplementary
Capital provided that such revaluation is prudently valued reflecting
fully the possibility of price fluctuations and forced sale, with prior
approval of CBSL, subject to a discount of 50 per cent. Revaluation
surplus may be included in Tier II capital not more than once in 7
years.
6.2.2.4.2  General Pr ovisions
 (WBRC 1 1.2.1.2.1.2)
 General provisions or general loan loss reserves created against the
possibility of future losses. Where they are not ascribed to particular
assets and do not reflect deduction in the valuation of particular assets,
they qualify for inclusion in Supplementary Capital (Tier II). General
provisions should not exceed 1.25 per cent of the sum of risk-weighted
assets.
6.2.2.4.3  Hybrid Capital Instruments (Debt/Equity)
 (WBRC 1 1.2.1.2.1.3)
 Capital instruments which combine certain characteristics of equity
capital and debt. i.e., cumulative redeemable preference shares, etc.
and satisfy the following characteristics :
 (i) Prior written approval of CBSL  has been obtained for inclusion of
such items in the capital.
 (ii) Unsecured, fully paid up and subordinated to the interests of
creditors.
 (iii) Not redeemable in less than 5 years or without the prior approval
of CBSL.
 (iv) A vailable to participate in losses without the Bank being
obliged to cease trading.
 (v) Obligation to pay interest can be deferred where the profitability
of the Bank would not support such payment.
 (vi) Any other condition stipulated by CBSL  on prudential grounds.
6.2.2.4.4  Minority Inter ests arising from Preference Shares


6.2.2.4.4  Minority Inter ests arising from Preference Shares
 (WBRC 1 1.2.1.2.1.4)
 Minority interests arising from the consolidation of preference shares.
6.2.2.4.5  Appr oved Subordinated Term Debt
 (WBRC 1 1.2.1.2.1.5)
 Subordinated term debt that satisfies the following conditions:
 (i) T he prior written approval of CBSL has been obtained for
inclusion as Tier II capital.


16 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
 (ii) Unsecured and subordinated to the interests of creditors, at fully
paid up value in the case of coupon bonds or paid up value plus
accrued interest in the case of zero coupon bonds.
 (iii) A  minimum original maturity of 5 years.
 (iv) Early repayment or redemption shall not be made without the
prior consent of CBSL.
 (v) The amount counted as capital should be discounted by 1/5th
each year during the four years preceding maturity.
 (vi) The total approved subordinated term debt should not exceed 50
per cent of total Tier 1 capital .
 (vii) Any other conditions stipulated by CBSL on prudential grounds.
6.2.2.4.6  Actual Amount of Approved Subordinated Term Debts
 (WBRC 0.0.0.0.0.0)
 Report total actual amount of approved subordinated term debts.
6.2.2.5  Deductions – Tier II
 (WBRC 1 1.2.1.2.2.0)
 The amount must agree to sum of following items from 6.2.2.5.1 to 6.2.2.5.2
 (WBRC 1 1.2.1.2.2.1 to 11.2.1.2.2.2)
6.2.2.5.1  50 per  cent of Investments in Unconsolidated Banking and
Financial Subsidiary Companies
 (WBRC 1 1.2.1.2.2.1)
 50 per cent of investments in capital by way of shares, perpetual/
hybrid capital instruments or subordinated term debt in unconsolidated
banking and financial subsidiary companies.
6.2.2.5.2  50 per  cent of Investments in the Capital of Other Banks and
Financial Institutions
 (WBRC 1 1.2.1.2.2.2)
 50 per cent of investments in capital by way of shares, perpetual/
hybrid capital instruments or subordinated term debt in other banks
and financial institutions.
6.2.2.6  T otal Supplementary Capital
 (WBRC 1 1.2.1.2.0.0)
 The amount must agree to Supplementary Capital (Tier II)  (6.2.2.4) less Tier
II deductions (6.2.2.5).
 (1 1.2.1.2.1.0 - 11.2.1.2.2.0)
6.2.2.7  Eligible Supplementary Capital
 (WBRC 1 1.2.1.3.0.0)
 Eligible supplementary capital (Eligible Tier II) will be restricted to 100 per cent


Eligible supplementary capital (Eligible Tier II) will be restricted to 100 per cent
of Total Core Capital (6.2.2.1) (After deductions/adjustments).
6.2.2.8  Short Term Subordinated Debt (Tier III)
 (WBRC 1 1.2.1.4.0.0)
 Short term subordinated debt may be used for the sole purpose of meeting a
proportion of the capital requirements for market risk. For short-term subordinated


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  17
debt to be eligible as supplementary capital, it needs, if circumstances demand, to
be capable of becoming part of a bank's permanent capital and thus be available
to absorb losses in the event of insolvency. It must, therefore, at a minimum:
 (i) be unsecured, subordinated and fully paid up
 (ii) have an original maturity of at least two years
 (iii) not be repayable before the agreed repayment date unless the prior consent
of CBSL is obtained
 (iv) be subject to a lock-in clause which stipulates that neither interest nor
principal may be paid (even at maturity) if such payment means that the
bank falls below or remains below its minimum capital requirement.
6.2.2.8.1  Appr oved Short Term Subordinated Debt
 (WBRC 1 1.2.1.4.1.0)
 T otal amount of approved short-term subordinated debts under above
conditions.
6.2.2.8.2  Eligible Supplementary Capital (Eligible Tier III) - Utilised
 (WBRC 1 1.2.1.4.2.0)
 The amount must agree with item 6.3.3.6.1 of Part II ( b) subject to the
following conditions.
 [=WBRC 1 1.2.2.6.1.0 of Part II ( b)]
 (i) A  minimum of about 28½ per cent of market risk needs to be
supported by eligible core capital that is available to support
market risk.
 (ii) T ier III capital will be limited to 250 per cent of a bank’s
eligible core capital that is available to support market risk after
meeting credit risk and operational risk.
6.2.2.9  Capital Base
 (WBRC 1 1.2.1.5.0.0)
 The amount must agree with the sum of items of eligible core capital (6.2.2.1),
eligible supplementary capital (6.2.2.7) and eligible tier III capital (6.2.2.8.2).
 (WBRC 1 1.2.1.1.0.0 + 11.2.1.3.0.0 + 11.2.1.4.2.0)
6.2.3  An indicative list of institutions which may be deemed to be financial subsidiaries/
institutions for the purposes of items 6.2.2.3.8, 6.2.2.3.9, 6.2.2.5.1 and 6.2.2.5.2 above
is as under:
 (WBRC 1 1.2.1.1.2.8, 11.2.1.1.2.9, 11.2.1.2.2.1 and 11.2.1.2.2.2)


is as under:
 (WBRC 1 1.2.1.1.2.8, 11.2.1.1.2.9, 11.2.1.2.2.1 and 11.2.1.2.2.2)
 (i) LCBs and LSBs,
 (ii) Insurance Companies,
 (iii) Registered Finance Companies,
 (iv) Specialised Leasing Companies,
 (v) Merchant Banks,
 (vi) Primary Dealers.
6.2.4  Subsidiary companies referred to in items 6.2.2.3.8, 6.2.2.3.9, 6.2.2.5.1 and 6.2.2.5.2
above will be as defined in the Banking Act.


18 Directions, Determinations, and Circulars issued to Licensed Commercial Banks
6.3 Part II ( b) - Computation of Eligible Tier III for Market Risk
6.3.1  Rule of Short-T erm Subordinated Debt Covering Market Risk (Tier III Capital)
 Fo r short-term subordinated debt to be eligible as Tier III capital, it needs, if
circumstances demand, to be capable of becoming part of a bank's permanent capital and
thus be available to absorb losses in the event of insolvency. Short-term subordinated
debt may be used for the sole purpose of meeting a proportion of the capital requirements
for market risk. It must, therefore, at a minimum:
 (i) be unsecured, subordinated and fully paid up
 (ii) have an original maturity of at least two years
 (iii) not be repayable before the agreed repayment date unless the prior consent of CBSL
is obtained
 (iv) be subject to a lock-in clause which stipulates that neither interest nor principal
may be paid (even at maturity) if such payment means that the bank falls below or
remains below its minimum capital requirement.
6.3.2  Eligible Tier III capital
 (i) T ier III capital will be limited to 250 per cent of a bank’s eligible core capital that
is available to support market risk after meeting credit risk and operational risk.
 (ii) The minimum of about 28½ per cent of market risk needs to be supported by
eligible core capital that is available to support market risk.
 (iii) T ier 2 elements may be substituted for Tier III up to the same limit of 250 per
cent so far as the overall limits stated in paragraphs 6.2.2.4.5 and 6.2.2.7 are not
breached, i.e., eligible supplementary capital may not exceed eligible core capital,
and long-term subordinated debt may not exceed 50 per cent of core capital.
 (iv) In addition, eligible core capital should represent at least half of total capital base,
i.e., the sum total of supplementary capital plus Tier III capital should not exceed
eligible core capital.


eligible core capital.
 (v) In determining the level of eligible core capital for the purposes of determining
eligible Tier III capital, all adjustments required in arriving at the total capital base
(as stated in 6.2.2.3 and 6.2.2.5) should be taken into consideration.
6.3.3  Specific instructions for  Computation of eligible Tier III for market risk
 The values of the items in this form are updated automatically, except item 6.3.3.5.1
below.
 (WBRC 1 1.2.2.5.1.0)
6.3.3.1  T otal Risk Weighted Assets (RWA)
 (WBRC 1 1.2.2.1.0.0)
 The amount must agree with the sum of the following items from 6.3.3.1.1 to
6.3.3.1.2
 (WBRC 1 1.2.2.1.1.0 to 11.2.2.1.2.0)
6.3.3.1.1  T otal Risk Weighted Assets for Credit and Operational Risks
 (WBRC 1 1.2.2.1.1.0)
 The amount must agree with the sum of item 6.4.3.1 of Part III ( a)
Computation of risk-weighted amount for credit risk and item 6.8.2.3 of


Directions, Determinations, and Circulars issued to Licensed Commercial Banks  19
Part V Computation of risk-weighted amount for operational risk
below.
 (WBRC 1 1.3.1.0.0.0 of Part III ( a) and 1.5.3.0.0.0 of Part V)
6.3.3.1.2  T otal Risk Weighted Assets for Market Risk
 (WBRC 1 1.2.2.1.2.0)
 The amount mus t agree to item 6.7.8.2 of Part IV Computation of
risk-weighted amount for market risk.
 (WBRC 1 1.4.2.0.0.0 of Part IV)
6.3.3.2  Minimum Capital Charge
 (WBRC 1 1.2.2.2.0.0)
 The amount must agree with the sum of the following items from 6.3.3.2.1 to
6.3.3.2.2 (WBRC 11.2.2.2.1.0 to 11.2.2.2.2.0)
6.3.3.2.1  Capital charge for  Credit and Operational Risk
 (WBRC 1 1.2.2.2.1.0 )
 The amount must agree with 10 per cent of the total risk weighted
assets for credit and operational risks item 6.3.3.1.1 above.
 (10% of WBRC11.2.2.1.1.0)
6.3.3.2.2  Capital Charge for  Market Risk
 (WBRC 1 1.2.2.2.2.0)
 The amount must agree with 10 per cent of total risk weighted assets
for market risk item 6.3.3.1.2
 (10% WBRC 11.2.2.1.2.0)
6.3.3.3  T otal Capital Available to Meet the Capital Charge for Credit and
Operational Risks
 (WBRC 1 1.2.2.3.0.0)
 The amount must agree with the sum of total core capital (6.2.2.1) and eligible
supplementary capital (6.2.2.7) of Part II (a) Computation of total capital base
above.
 [WBRC1 1.2.1.1.0.0 and 11.2.1.3.0.0 of Part II ( a)]
6.3.3.4  T otal Capital Base Available to meet Market Risk
 (WBRC 1 1.2.2.4.0.0)
 T otal capital available to meet the capital charge for credit and operational risks
(6.3.3.3) less capital charge for credit and operational risks (6.3.3.2.1)
 (WBRC 1 1.2.2.3.0.0 - 11.2.2.2.1.0)
6.3.3.5  T otal Available Tier III Capital
 (WBRC 1 1.2.2.5.0.0)
6.3.3.5.1  Appr oved Short-term Subordinated Debt
 (WBRC 1 1.2.2.5.1.0)
 Report total amount of approved short-term subordinated debts under
the conditions are stated at item 6.2.2.8.
 (as per WBRC 11.2.1.4.0.0)