MONETARY BOARDCENTRAL BANK OF SRI LANKA16 June 2021BANKING ACT DIRECTIONSNo. 10 of 2021INVESTMENTS IN SRI LANKA INTERNATIONAL SOVEREIGN BONDS BY LICENSED COMMERCIAL BANKS AND NATIONAL SAVINGS BANKIssued in terms of the powers conferred by Sections 46(1) and 76(J)( 1) of the Banking Act No. 30 of 1988, as amended.1. The Central Bank of Sri Lanka (CBSL) hereby revokes the Banking Act Directions No. 06 of 2021 dated 23 April 2021 on Investments in Sri Lanka International Sovereign Bonds (ISBs) by Licensed Commercial Banks (LCBs) and National Savings Bank (NSB), subject to the conditions set out in this Direction.2. LCBs and NSB may purchase ISBs in the secondary market subject to the following conditions: (i) Source of funds to be limited to fresh borrowings from overseas and it should be established to the satisfaction of the CBSL. For this purpose, LCBs and NSB are required to provide documentation of the borrowings overseas as specified in Direction 9.1 of the Banking Act Directions No. 11 of 2018 on Foreign Currency Borrowings by Licensed Banks, to the Director of Bank Supervision (DBS).(ii) Investment of funds sourced as per 2 (i) above in Sri Lanka Development Bonds (SLDBs) and ISBs in the proportion of 50 per cent each, and LCBs and NSB shall submit the following information on their investments in ISBs and SLDBs to DBS and the Superintendent, Public Debt Department.a. Date of investmentb. International Securities Identification Number (ISIN)c. Amount invested in ISBs and SLDBs(iii) LCBs and NSB to adopt risk mitigation measures to prevent maturity mismatches between the borrowings and the ISB/SLDB investments, adopting appropriate risk mitigation arrangements to bridge any short-term maturity mismatches that may occur, in addition to other risk mitigation measures already prescribed/followed.Chairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


No. 11 of 202113 July 2021MONETARY BOARDCENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONSRESTRICTIONS ON DISCRETIONARY PAYMENTS OF LICENSED BANKSThe Monetary Board of the Central Bank of Sri Lanka (CBSL), having considered the possible adverse impact on liquidity and other key performance indicators of licensed commercial banks and licensed specialised banks (hereinafter referred to as licensed banks) due to the COVID-19 outbreak and the importance of maintaining appropriate levels of liquidity and capital buffers in licensed banks, hereby issues these Directions on restrictions on discretionary payments of licensed banks.1. Empowerment1.1 In terms of Section 46(1) of the Banking Act, in order to ensure the soundness of the banking system, the Monetary Board is empowered to issue Directions to all licensed commercial banks, regarding the manner in which any aspect of the business of such bank or banks is to be conducted.1.2 In terms of Section 76J(1) of the Banking Act, the Monetary Board is empowered to give Directions to licensed specialised banks or to any category of licensed specialised banks, regarding the manner in which any aspect of the business of such banks is to be conducted.2. Scope ofApplication2.1 These Directions shall be applicable to every licensed bank incorporated in Sri Lanka and every licensed bank, which is a branch of a bank incorporated or established outside Sri Lanka, on a standalone basis.3. Restrictions on3.1 Every licensed bank incorporated or established in Sri Lanka shallDiscretionaryPaymentsdefer payment of cash dividend until the financial statements/interim financial statements for 2021 are finalised and audited by its External Auditor.1


13 Julv2021
4. Effective DateMONETARY BOARDCENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONSNo. 11 of 20213.2 Every licensed commercial bank incorporated outside Sri Lanka shall refrain from repatriation of profits not already declared for financial years 2020 and 2021 until the financial statements/interim financial statements for 2021 are finalised andaudited by its External Auditor.3.3 Licensed banks shall give due consideration to the requirements of the Banking Act Directions No. 01 of 2016 on Capital Requirements under Basel 111 for Licensed Banks, expected assets growth, business expansion and the potential impact of the COVID-19 pandemic and prevailing market conditions when deciding on payments of cash dividends and profit repatriation.3.4 Licensed banks shall adhere to the following until 31 December 2021.(a) Refrain from buying-back of its own shares;(b) Refrain from increasing management allowances and payments to Board of Directors;(c) Exercise prudence and refrain to the extent possible from incurring non-essential expenditure such as advertising, business promotions, gift schemes, entertainment, sponsorships, travelling and training etc.; and(d) Exercise extreme due diligence and prudence when incurring capital expenditure, if any.4.1 These Directions shall be in effect from 01 July 2021.Prof. W D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka2


MONETARY BOARDCENTRAL BANK OF SRI LANKA08 September 2021__________ BANKING ACT DIRECTIONS________________ No. 12 of 2021MARGIN REQUIREMENTS AGAINST IMPORTSIssued in terms of the powers conferred by Sections 46(1) and 76(J)(1) of the Banking Act No. 30 of 1988, as amended.The Central Bank of Sri Lanka, with a view to preserving the stability of the exchange rate and foreign currency liquidity in the banking system, requires licensed commercial banks (LCBs) and National Savings Bank (NSB) to adopt the following measures on imports of certain non- essential and non-urgent goods, with immediate effect until further notice.1. A 100 per cent non-interest bearing cash margin shall be kept on the invoiced value of imports specified in Schedule A, made under Documents against Acceptance (DA) terms.2. In the case of NSB, the margin requirements specified in Directions 1 above, shall be applicable for such imports made under Letter of Credit (LC) terms.3. In the case of existing DAs covering the importation of goods covered by this Direction, no increase in the value of such DAs shall be permitted by LCBs and NSB unless such increase is covered by the cash margin deposits as required in Directions 1 above.4. Such non-interest bearing cash margin shall be placed by the importer with the bank that releases documents, at the time of acceptance of documents by the importer.5. Such non-interest bearing cash margin requirement shall be on the total value of the invoice, regardless that the same invoice includes goods that are not covered under this Directions.6. LCBs and NSB shall endorse the invoice to the effect that the margin deposit has been obtained.7. The margin deposit shall be released on providing documentary evidence on payments through the banking channels in Sri Lanka and customs documents relating to clearance of imports.8. LCBs and NSB shall not grant any loan facilities to enable importers to place the margin deposits in respect of these imports.9. The provisions of


to enable importers to place the margin deposits in respect of these imports.9. The provisions of this Directions shall have effect in addition to any requirement in force for the time being and such other requirements that may be introduced in terms of any law in respect of importation of goods. .Prof. W D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021BANKING ACT DIRECTIONSNo. 13 of 2021CLASSIFICATION, RECOGNITION AND MEASUREMENT OF CREDIT FACILITIES IN LICENSED BANKSIn the exercise of the powers conferred by Sections 46A, 46(1) and 76(J)(1) of the Banking Act, No. 30 of 1988, as amended, the Monetary Board of the Central Bank of Sri Lanka (CBSL) hereby issues the following Directions on Classification, Recognition and Measurement of credit facilities in licensed commercial banks and licensed specialised banks, hereinafter referred to as licensed banks, with a view to further strengthening and harmonising the regulatory framework on classification, recognition and measurement of credit facilities in licensed banks with the Sri Lanka Accounting Standard, ‘SLFRS 9: Financial Instruments’ (hereinafter referred to as SLFRS 9) and establishing consistent and prudent practices in the banking industry.L Empowerment1.1 In terms of Section 46(1) of the Banking Act, in order to ensure the soundness of the banking system, the Monetary Board is empowered to issue Directions to all licensed commercial banks, regarding the manner in which any aspect of the business of such bank or banks is to be conducted.1.2 In terms of Section 76J (1) of the Banking Act, the Monetary Board is empowered to give Directions to licensed specialised banks or to any category of licensed specialised banks, regarding the manner in which any aspect of the business of such banks is to be conducted.2. Scope and Applicability2.1 All requirements in these Directions shall be applicable to licensed banks in addition to the requirements of the Sri Lanka Accounting Standards.3. Definitions3.1 The following definitions shall be applicable for purposes of these Directions.3.1.1 Credit facilities shall mean:a. On balance sheet loans and advances which are measured under amortized cost or fair value through other1


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 2021comprehensive income and net investment in lease receivables; andb. Off-balance sheet assets including commitment to accept contingent liabilities, and include guarantees, bonds, letters of credit, acceptances and undrawn commitment component of credit facilities such as credit cards and overdraft facilities etc.3.1.2 Borrower shall include individuals, companies, the Government of Sri Lanka, public corporations, statutory bodies, firms, state owned entities (SOEs), associations of persons and any other entity.3.1.3 Board of Directors shall mean the Board of Directors of locally incorporated licensed banks and in the case of foreign banks, the Head Office/ Regional Monitoring Office.3.1.4 Chief Executive Officer (CEO) and Key Management Personnel (KMPs) shall mean CEO and Officers Performing Executive Functions of licensed banks as determined under the Banking Act.4. Governance 4.1 The Board of Directors, CEO and the respective KMPs are responsible Framework for for ensurjng that the licensed bank has robust credit risk management Credit Facilitiespolicies and practices, including an effective system of internal controls, to manage the credit risk in the licensed bank in accordance with the policies and procedures, applicable Sri Lanka Accounting Standards and relevant regulatory and supervisory guidance.4.2 The Board of Directors shall ensure that the credit policy of the licensed bank includes the following at a minimum in addition to requirements stipulated in Banking Act Directions on Integrated Risk Management Framework for licensed banks:4.2.1 A policy on classification, measurement and recognition of credit facilities;4.2.2 Adequate credit risk management policies and processes to identify, measure, monitor, report and mitigate credit risk on a2


14 September 2021MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 13 of 2021timely basis covering the full credit life cycle. Such process shall be documented, while adhering to sound methodologies, procedures and controls for assessing and measuring the credit risk of loans and advances;4.2.3 Adequate policies and processes in place for the timely identification of credit facilities and management of under- performing/non-performing assets and determining an adequate impairment allowance, and to strengthen the credit risk management process in accordance with the Sri Lanka Accounting Standards and the regulatory framework;4.2.4 Ensure that clear guidelines are provided on;(a) Staging of loans, including how to differentiate stage 2 and 3 loans based on potential risk criteria;(b) Methodologies for determining the Probability of Default (PD), Loss Given Default (LGD), Economic Factor Adjustment etc. for impairment purposes ;(c) Assessment thresholds and borrower-wise coverage of credit facilities to be assessed individually for impairment;(d) Collateral to be considered for impairment along with valuation requirements on such collateral and specification of techniques and data to be used for such valuations in line with Direction 12 below;(e) Use of overlays to impairment models to ensure expected loss computations reflect potential economic shocks, which are not captured otherwise; and(f) On upgrading of credit facilities in line with Direction 11 below4.2.5 A comprehensive validation policy in respect of models used for classification, recognition and measurement of credit facilities in the licensed bank including clear roles & responsibilities,3


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 2021validation frequency and procedures & methodologies to be used by the bank;4.2.6 Establish a mechanism to segregate non-performing credit facilities from other credit facilities to ensure close follow-up action and to monitor and streamline the recovery process;4.2.7 A well-designed write-off/write down policy established by the Board of Directors delineating the approach, authority, accountability for negligence and inappropriate follow-up, independent review and audit, continuous monitoring, reporting, etc. Such policy shall also aim to recover the maximum salvage value through enforcement of collateral / guarantees, etc; and4.2.8 Ensure transparency and comparability by establishing mechanisms to provide timely, relevant, accurate and useful information of the licensed bank through public disclosures and maintaining adequate data/records and systems to identify, reconcile and report the requirements under the Sri Lanka Accounting Standards and the existing regulatory framework.4.3 CEO and KMPs of the licensed bank shall ensure that Board approved policies, procedures and processes on credit facilities are implemented as intended, and adequate internal controls and validation processes are established to ensure same.4.4 Licensed Bank shall not fund the recovery of any credit facility provided to any borrower by the same bank.5. Classification of 5.1Credit FacilitiesLicensed bank shall classify all credit facilities for the purpose of impairment assessment, risk mitigation and monitoring into performing and non-performing loans and advances as follows:5.1.1 Performing credit facilities shall mean:(a) All the credit facilities classified as Stage 1 under SLFRS 9; and4


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 2021(b) All credit facilities identified as significantly increased credit risk facilities and classified as Stage 2 under SLFRS 9 (under- performing credit facilities).5.1.2 Non-performing credit facilities (NPCF) shall mean all credit facilities where contractual payments of a customer are past due for more than 90 days (the number of days past due shall be calculated starting from the contractual due date of the payment) or has remained in excess of the sanctioned limit for more than 90 days, and any other credit facilities classified as Stage 3 credit facility under SLFRS 9 (facilities classified as NPCF based on potential risk and impaired assets at origination).5.2 A licensed bank shall not consider the value and type of security obtained by the bank against their credit facilities when determining the classification status of a credit facility.5.3 In cases where a borrower has several current accounts with overdraft limits with the bank, the aggregate sanctioned limit and the daily outstanding aggregate balance on all such accounts shall be considered for the purposes of classification of Overdrafts.6. Sub-Categorisation of non- performing Credit Facilities6.1 Licensed bank shall sub-categorise NPCF into the following categories based on the criteria mentioned below:6.1.1 Special mention(a) Based on days past due: All credit facilities where contractual payments are past due or have remained in excess of the sanctioned limit for more than 90 days but less than or equal to 180 days.(b) Based on potential risk: All credit facilities that exhibit potential weaknesses where, if not corrected in a timely manner, may adversely affect repayment by the borrower at a future date, and those that warrant close attention by the licensed bank.5


14 September 2021MONETARY BOARDCENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONS No. 13 of 20216.1.2 Substandard(a) Based on days past due: All credit facilities where contractual payments are past due or have remained in excess of the sanctioned limit for more than 180 days but less than or equal to 270 days.(b) Based on potential risk: All credit facilities that exhibit definable weaknesses, either in respect of the business, cash flow or financial position of the borrower, that may jeopardise repayment on existing terms and where there is uncertainty that part or the entire facility will be repaid and involves more than normal risk of loss due to unsatisfactory debt servicing record/financial condition of the borrower, insufficiency of collateral or any other factors which give rise to some doubts as to the ability of the borrower to comply with the present repayment terms.6.1.3 Doubtful(a) Based on days past due: All credit facilities where contractual payments are past due or have remained in excess of the sanctioned limit for more than 270 days but less than or equal to 360 days.(b) Based on potential risk: All credit facilities that exhibit a high risk of partial default or where full collection is improbable and there is a high risk of default and where the outstanding credit facility exhibits more severe weaknesses than those in a substandard category.6.1.4 Loss(a) Based on days past due: All credit facilities where contractual payments are past due or have remained in excess of the sanctioned limit for more than 360 days.(b) Based on potential risk: All credit facilities that are deemed to be uncollectable or are almost certain that such will not be repaid and which are categorised as NPCF but not included under special mention, substandard and doubtful categories6


14 September 2021MONETARY BOARDCENTRAL BANK OF SRI LANKA BANKING ACT DIRECTIONS No. 13 of 20217. Significant Increase in Credit Risk / Default Facilities7.1 For the purpose of calculating life-time expected losses under SLFRS 9, at a minimum, if one or more of the following factors/conditions are met, it shall be considered as significant increase in credit risk or as defaulted facilities.7.1.1 Contractual payments of a borrower are past due for more than 30 days (subject to the rebuttable presumption under SLFRS 9).7.1.2 Credit rating of a borrower has been subsequently downgraded to B+ or below under the Sri Lankan National Rating Scale by an External Credit Assessment Institution (ECAI).7.1.3 A two-notch downgrade under the internal rating of the licensed bank. Licensed banks are required to map their internal credit risk ratings with the ratings issued by ECAL For this purpose, licensed banks are required to refer the mapping of external credit ratings given in Banking Act Directions on capital requirements;7.1.4 Reasonable and supportable forecasts of future economic conditions show a direct negative impact on the performance of a customer/group of customers;7.1.5 A significant change in the geographical locations or natural catastrophes that directly impact the performance of a customer/group of customers;7.1.6 The value of collateral is significantly reduced and/or realisability of collateral is doubtful. Licensed banks shall define relevant thresholds/limits and document the same;7.1.7 The borrower is subject to litigation that significantly affects the performance of the credit facility;7.1.8 Frequent changes in the Board of Directors and Senior Management of an institutional customer;7.1.9 Delay in commencement of business operations/projects by more than two years from the originally agreed date;7


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 20217.1.10 Modification of terms resulting in concessions, including extensions, deferment of payments, waiver of covenants etc.;7.1.11 The borrower is deceased/insolvent;7.1. 12 Licensed bank is unable to contact or find the borrower; and7.1.13 A fall of 50% or more in the turnover and/or profit before tax of the borrower when compared to the previous year for two consecutive years and/or erosion of net-worth of the borrower by more than 25% (other than due to changes in equity structure and dividend policy) when compared to the previous financial year.7.1.14 Restructure and rescheduled credit facilities as per guidance provided in Direction 10 below.7.2 Licensed banks may rebut one or more criteria listed from 7.1.2 to 7.1.14 when determining significant increase of credit risk, subject to the following:7.1.1 The KMP heading the Risk Management Function shall recommend such rebuttal criteria to the Board of Directors providing valid rationale and justifications to ensure that such criteria do not result in significant increase of credit risk to the bank, and Board of Directors shall grant approval or reject the proposal after considering the information provided.7.1.2 Disclose the rebutted criteria if any and the estimated impact of such rebuttal on the respective bank’s impairment provisions and profitability in their audited annual financial statements.8. Impairment 8.1 Licensed banks shall measure the impairment charges for credit Charges for facilities as per the Sri Lanka Accounting Standards andCredit FacilitiesDirections/Guidelines issued by CBSL in this regard from time to time.8.2 The measurement of impairment charges should build upon robust methodologies and result in the appropriate and timely recognition of expected credit losses in accordance with the applicable Sri Lanka Accounting Standards.8


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 20218.3 At each reporting date, licensed banks shall measure the loss allowance for credit facilities at an amount equal to life-time expected losses, if the credit risk of loans and advances has increased significantly since initial recognition (except for the credit facilities purchased and/or originated as credit-impaired credit facilities).8.4 In respect of purchased or originated credit impaired credit facilities, lifetime expected credit losses shall be measured unless upgraded in line with Direction 11 below.8.5 In principle, lifetime expected credit losses and/or credit impaired credit facilities shall be assessed on an individual basis. However, the licensed bank may perform the assessment on appropriate groups or portfolios on a collective basis for their portfolios.8.6 The aggregate amount of impairment allowances of the licensed bank, regardless of whether such allowancesare determined on a collective or an individual basis, should be adequate and consistent with the objectives of the applicable Sri Lanka Accounting Standards.8.7 Impairment of Stage 1 credit facilities8.7.1 From 01.01.2022, licensed banks shall maintain a minimum Stage1 impairment ratio of 0.5% as a percentage of total Stage 1 credit facilities i.e., Stage 1 Impairment / Stage 1 credit facilities.8.7.2 In instances where a licensed bank does not maintain a minimum Stage 1 impairment ratio of 0.5% as a percentage of total Stage 1 credit facilities such deficit shall be required to be maintained in a special reserve account against equity.8.7.3 Such reserve shall not be used to declare dividends by licensed banks.8.7.4 However, this shall only be used as a minimum value for Stage 1 impairment and licensed banks shall ensure the adequacy of Stage 1 impairment as per the relevant Sri Lanka Accounting Standards and internal policies.9


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No, 13 of 20218.8 Further Directions on impairment of credit facilities in licensed banks are provided in Annex I.9. Models for 9.1 The CEO and relevant KMPs of the licensed bank under the guidance Calculation of provided by the Board of Directors, shall ensure that the licensed bank: Impairment9.1.1 Develops robust models to determine expected credit losses as per the Sri Lanka Accounting Standards, which should be in line with the licensed bank’s business model and risk profile;9.1.2 Considers all available and relevant internal and external data when estimating expected credit losses, ensuring that the estimates are robust, unbiased and reflective of current exposures;9.1.3 Consists relevant officers who are well trained, competent and have a thorough understanding of the models adopted by the bank;9.1.4 Adheres to rigorous governance and internal control procedures, when obtaining support from external vendors/consultants in respect of model development.9.1.5 Documents the reasons for selecting a specific model as the appropriate mode, if different models are used for different portfolios and instruments and ensure that all credit models are reviewed at least annually;9.1.6 Establishes an effective model validation process to ensure that the credit risk assessment and measurement methods are capable of generating accurate, consistent and unbiased predictive estimates on an ongoing basis; and9.1.7 Desists from making changes in the parameters, inputs and assumptions used for the purpose of profit smoothening. However, if any changes in the credit models are required, the rationale and justification for such change shall be evaluated by the Chief Risk Officer, Integrated Risk Management Committee and approved by the Board of Directors.10


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 20219.2 In cases where licensed banks incorporated outside Sri Lanka use models developed by their head office or regional offices, such licensed banks shall assess the appropriateness of the credit models in the Sri Lankan context and a local team headed by a KMP shall carry out appropriate validation procedures.10. Re-structured 10.1 Restructured credit facilitiesand Re- 10.1.1 Restructured credit facilities are where the original repaymentscheduledCredit terms have been amended due to a deterioration in credit quality,Facilities while the respective credit facilities remain as performingfacilities as defined under Direction 5.1.1 above.10.1.2 Credit facilities which are restructured up to two times other than upgraded credit facilities as defined under Direction 11 below, shall be classified as Stage 2 credit facilities under SLFRS 9.10.1.3 Credit facilities restructured more than two times other than upgraded credit facilities as defined under Direction 11 below, shall be considered as Stage 3 credit facilities under SLFRS 9.10.2 Rescheduled credit facilities10.2.1 Rescheduled credit facilities are where the original repayment terms have been amended while the respective credit facilities remain as NPCFs as defined under Direction 5.1.2 above.10.2.2 All rescheduled credit facilities, other than upgraded credit facilities as defined under Direction 11 below, shall be considered as Stage 3 credit facilities under SLFRS 9.10.3 Licensed banks shall consider the factors listed under Direction 7.1 above in assessing any deterioration in credit quality. However, such assessment shall not be limited to factors specified in Direction 7.1 and shall ensure adequate provisions are made in respect of restructured and rescheduled credit facilities to commensurate with the significant increase in the credit risk.11


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 202110.4 Licensed banks shall not grant new credit facilities for repayment of NPCF to the same borrower unless the new credit facility is also classified as NPCF.11. Upgrading of 11.1 Licensed banks may upgrade credit facilities from a higher stage (StageCredit 3 or 2) to a lower stage (Stage 2 or 1) subject to the following:Facilities11.1.1 Upgrading of credit facilities shall be in accordance with a policy approved by the Board of Directors, and the rationale for such upgrading shall be properly documented. Such policy at a minimum shall ensure the following:(a) Settlement of the due payment(i) Credit facilities other than the restructured credit facilities in stage 3 and rescheduled credit facilities shall be upgraded, if due payments are fully settled by the customer and bank is satisfied that the customer is able to service debt service obligations up to a foreseeable future:(b) Restructured credit facilities upgrading from stage 3 and rescheduled credit facilities(i) Licensed bank exercises prudence in upgrading NPCFs/ under-performing credit facilities; and(ii) Upgraded credit facility has exhibited a sustained trend/status/ of improvement to justify the improved classification status.11.1.2 Upgrading of re-scheduled and re-structured credit facilities shall only be carried out by the Risk Management Department and shall be independent from the credit facility review mechanism.12


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021BANKING ACT DIRECTIONS No. 13 of 202112. Valuation of 12.1 Collateral for Impairment PurposesLicensed bank shall consider the valuation of assets in a prudent manner considering the available reliable market valuations in assessing LGD / cash flow. Such valuations shall appropriately reflect the inherent uncertainty associated with distressed property liquidation (including the time taken for such realisation).12.2 Licensed bank shall substantiate any increase in the valuation with appropriate evidence that such increases are sustainable.12.3Licensed bank shall estimate the net realisable value of the credit risk mitigants or use the forced sale value of the collateral to provide more realistic estimates. Impairment charges shall take into account the updated and realistic valuations of such credit risk mitigants.12.4Assets that can be considered as collateral shall be limited to cash, deposits, property mortgage, guarantees by the Government, CBSL and licensed banks, assignment of life insurance policies, gold articles, assignment of shares, mortgage over motor vehicles, plant, machinery and equipment, debt mortgages quoted debentures, equity shares and any other types of security as specifically approved by the Director of Bank Supervision on a case-by-case basis.12.5Licensed bank shall comply with the following in relation to valuation of collateral:12.5.1 Banking Act Directions issued by CBSL from time to time, on Regulatory Framework on Valuation of Immovable Properties of Licensed Banks.12.5.2 Guidelines issued by the CA Sri Lanka on Valuation of Property, Plant and Equipment, Investment Property and Biological Assets for the purpose of Financial Reporting.13. Recognition 13.1 of Interest IncomeLicensed bank shall recognise the interest income for credit facilities based on the Sri Lanka Accounting Standards.13


MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 13 of 202114 September 202114. Role ofInternal Audit14.1 The Internal audit function shall independently evaluate the effectiveness of the credit risk assessment, measurement systems and processes of the licensed bank and shall ensure the acceptability of credit judgments.14,2 The Internal audit function shall at least annually, validate and evaluate all credit risk assessment models, inputs and assumptions used along with data smoothening, if any.14.3 The Internal audit function shall provide an assurance on the adequacy and effectiveness of back testing in order to ensure that the key drivers have been captured and calibrated accurately.15. Regulatory Reporting15.1 Licensed bank are required to submit the statutory returns introduced for these Directions, as stipulated below, or as stipulated otherwise by the Director of Bank Supervision15.1.1 Monthly Returns - on or before the 15 th day of the following month.15.1.2 Quarterly Returns - on or before the 15th day from the end of a quarter.15.2 Licensed bank shall publish the following Key Performance Indicators based on SLFRS information in quarterly and annual financial statements.15.2.1 Stage 3 Loans (net of Stage 3 impairment) to Total Loans15.2.2 Stage 3 Impairment to Stage 3 Loans.16. Effective Date16.1 These Directions shall be in effect from 01 January 2022.17. Revocation of Directions17.1 The following Directions/Circulars will be revoked from 01 January2022:14


MONETARY BOARDCENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 202117.1.1 Banking Act Direction Nos. 3 and 4 of 2008 on Classification of Loans and Advances, Income Recognition and Provisioning dated 08 May 2008.17.1.2 Banking Act Direction Nos. 3 and 4 of 2010 - Amendments to Directions on Classification of Loans and Advances, Income Recognition and Provisioning dated 27 September 2010.17.1.3 Circular No. 04 of 2018 - Guidelines to Licensed Banks on Adoption of Sri Lanka Accounting Standard - SLFRS 9: Financial Instruments dated 31 December 2018. The one-time permission to stagger first day audited additional credit loss provisions from adoption of SLFRS 9, net of any other adjustment on first day impact to retained earnings and net of tax effects, will continue to be in effect until 31 December2021.17.1.4 Circular No. 06 of 2019 - Supplement to Circular No. 04 of 2018 on the Adoption of Sri Lanka Accounting Standards - SLFRS 9: Financial Instruments in Licensed Banks dated 26 April 2019.Chairman of the Monetary Board andGovernor of the Central Bank of Sri Lanka
15


©MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 13 of 2021Annex IGuidance on Impairment Computation for Licensed Banks1. Computation of the Probability of Default (PD) and Loss Given Default (LGD)(i) Licensed bank shall, at a minimum, use five years of data, unless a shorter time horizon provides better estimations and is better suited when calculating PDs and LGDs. Any smoothening of data or inputs must be validated by the Risk Management Department.(ii) Licensed bank shall not use proxies to compute PDs and LGDs, unless the bank is a newly incorporated bank, or the product category was newly introduced by the bank and has a credit history of less than 5 years.(iii) When the licensed bank are unable to compute LGDs due to lack of data or inputs, licensed banks shall use a minimum LGD of 45 per cent for such exposures.(iv) When required to calculate LGD for exposures guaranteed by the Government of Sri Lanka:(a) An LGD of zero may be applied to exposures with a guarantee of the Government provided that the guarantee fully covers the principal and interest and is reported as a liability of the Government.(b) LGD for any other form of assurance provided by the Government other than in item (a) above, shall be computed instead of using an LGD of zero percent.(c) A minimum LGD of 20 per cent shall be applied for Government guarantees denominated in foreign currency.2. Economic Factor Adjustment(i) Licensed bank shall use forecasts and projections published by CBSL when adjusting credit provisioning models to reflect the economic conditions and forecasts, on a consistent basis.(ii) If CBSL forecasts are not available, licensed bank shall use credible alternative sources on a consistent basis and shall maintain relevant documentary evidence.(iii) Board approved policies shall specify the sources to be used and licensed bank shall not cherry pick sources in their favor.16


14 September 2021MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 13 of 20213. Use of Banks Internal Credit Rating (ICR) for Impairment Computation(i) A licensed bank may use ICR information as the main basis for expected credit loss calculations only if they comply with the following requirements:(a) Pricing mechanism and operational decision-making process shall be mapped with ICR information;(b) Shall have at least five years of ICR based historical data subject to (i) (a) above; and(c) Board of Directors approved policies shall be in place and ICR inputs and models shall be reviewed and endorsed annually by the Risk Management Department and/or an independent 3rd party.4. Off-Balance Sheet Exposures(i) When converting off-balance sheet exposures for expected credit loss calculations, if historical data is not available, licensed bank shall use the values as per the credit conversion factors specified in the Banking Act Direction on Capital Requirements.
17


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021CLASSIFICATION, RECOGNITION AND MEASUREMENT OF FINANCIAL ASSETSOTHER THAN CREDIT FACILITIES IN LICENSED BANKSIn the exercise of the powers conferred by Sections 46(1) and 76(J)(1) of the Banking Act No. 30 of 1988, as amended, the Monetary Board of the Central Bank of Sri Lanka (CBSL) hereby issues the following Directions on Classification, Recognition and Measurement of financial assets other than credit facilities in licensed commercial banks and licensed specialised banks, hereinafter referred to as licensed banks, with a view to further strengthening and harmonising the regulatory framework on classification, recognition and measurement of financial assets other than credit facilities in licensed banks with the Sri Lanka Accounting Standard, ‘SLFRS 9: Financial Instruments’ (hereinafter referred to as SLFRS 9) and establishing consistent and prudent practices in the banking industry.1. Empowerment1.1 In terms of Section 46(1) of the Banking Act, in order to ensure the soundness of the banking system, the Monetary Board is empowered to issue Directions to all licensed commercial banks, regarding the manner in which any aspect of the business of such bank or banks is to be conducted.1.2 In terms of Section 76J (1) of the Banking Act, the Monetary Board is empowered to give Directions to licensed specialised banks or to any category of licensed specialised banks, regarding the manner in which any aspect of the business of such banks is to be conducted.2. Scope and Applicability2.1 All requirements in these Directions shall be applicable to licensed banks in addition to the requirements of the Sri Lanka Accounting Standards.3< Definitions3.1 The following definitions shall be applicable for purposes of these Directions.3.1.1 Financial assets covered by these Directions shall mean all financial assets covered under SLFRS 9, and excludes financial1


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021assets covered by the Banking Act Directions No 13 on Classification, Measurement and Recognition of Credit Facilities.3.1.2 Borrower shall include individuals, companies, the Government of Sri Lanka, public corporations, statutory bodies, firms, state owned entities (SOEs), associations of persons and any other entity.3.1.3 Board of Directors shall mean the Board of Directors of locally incorporated licensed banks and in the case of foreign banks, the Head Office/ Regional Monitoring Office.3.1.4 Chief Executive Officer (CEO) and Key Management Personnel (KMPs) shall mean CEO and Officers Performing Executive Functions of licensed banks as determined under the Banking Act.4. Governance Framework for Financial Assets Other than Credit Facilities4.1
4.2The Board of Directors, CEO and the respective KMPs are responsible for ensuring that licensed banks have an approved business model and policy in place at a minimum in addition to requirements stipulated in Banking Act Directions on Integrated Risk Management Frameworks for licensed banks to facilitate classification, recognition and measurement of financial assets in accordance with the applicable Sri Lanka Accounting Standards and relevant regulatory and supervisory guidance.Such policy at a minimum shall:4.2.14.2.2Identify objectives, definitions, characteristics, criteria and operating policies along with adequate procedures and systems for assessing the business models of financial assets on an on-going basis;The decision-making authorities for business model decisions, level of sales to be considered as infrequent and insignificant, time period for near term selling to be considered for trading2


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021purposes, election of fair value option for instruments through profit or loss and through other comprehensive income; and4.2.3 Document and maintain standardised processes, detailed checklists and decision trees in order to assess and identify Solely Payments of Principal and Interest (SPPI) test (contractual cash flows to meet SPPI) features of their products and contracts.4.3 Board of Directors shall ensure transparency and comparability establishing a mechanisms to provide timely, relevant, and useful information of the licensed bank through relevant disclosures and maintaining adequate data/records and systems to identify, reconcile and report requirements under the Sri Lanka Accounting Standards and the existing regulatory framework.4.4 The Board of Directors shall establish a comprehensive validation policy in respect of models used for classification, recognition and measurement of financial assets other than credit facilities in licensed banks including clear roles & responsibilities, validation frequency and procedures & methodologies to be used by the bank;4.5 A Board approved policy shall include clear guidelines on:4.5.1 Staging of Investments (including how to differentiate stage 2 and 3 loans based potential risk criteria);4.5.2 Methodologies for determining the Probability of Default (PD), Loss Given Default (LGD), economic factor adjustment etc. for impairment purposes;4.5.3 Collateral to be considered for impairment along with valuation requirements on such collateral and specification of techniques and data to be used for such valuations;4.5.4 A comprehensive model validation policy including clear roles & responsibilities, validation frequency and procedures & methodologies to be used by the bank;3


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 20214.5.5 Use of overlays to impairments models to ensure expected loss computations do reflect potential economic shocks, which are not captured otherwise; and4.5.6 Guidance on upgrading of Investments in line with Direction 9 below.4.6 CEO and KMPs of the licensed bank shall ensure that Board approved policies and guidelines on Financial Assets are implemented as intended, and adequate internal controls and validation processes are established to ensure the same.5. Classification of Financial Assets (Other than Credit Facilities) and Financial Liabilities
6. Significant Increase in Credit Risk/ Default of Financial Assets other than Credit Facilities5.1 Licensed banks shall classify Financial Assets (Other than Credit Facilities), and Financial Liabilities as per the Sri Lanka Accounting Standards. A broad summary of classification and subsequent measurement of Financial Assets and Liabilities is given in Annex 1.5.2 If a licensed bank is accounting for its financial liabilities as designated through profit or loss, the licensed bank shall assess and account the changes in value of financial liabilities due to changes in its own credit risk, through other comprehensive income. The licensed bank shall formulate Board approved internal guidelines for this purpose.6.1 For the purpose of calculating life-time expected losses under SLFRS 9, at a minimum, if one or more of the following factors/conditions are met, it shall be considered as a significant increase in credit risk or as defaulted facilities.6.1.1 Contractually obligated payments of a financial asset are past due for more than 30 days (subject to the rebuttable presumption under SLFRS 9);6.1.2 Credit rating of an instrument has been subsequently downgraded to B+ or below under the Sri Lankan National Rating Scale by an External Credit Assessment Institution (ECAI).4


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 20216.1.3 A two-notch downgrade under the internal rating of the licensed bank (if available). Licensed banks are required to map their internal investment ratings with the ratings issued by ECAI. For this purpose, licensed banks are required to refer the mapping of external credit ratings given in Banking Act Directions on capital requirements;6.1.4 Reasonable and supportable forecasts of future economic conditions show a direct negative impact on the performance of portfolios or instruments;6.1.5 A significant change in the geographical locations or natural catastrophes that directly impact the instrument;6.1.6 Frequent changes in the Board of Directors and Senior Management and any Going Concern issues of the issuer;6.1.7 A fall of 50% or more in the turnover and/or profit before tax of the borrower when compared to the previous year for two consecutive years and/or erosion of net-worth of the borrower by more than 25% (other than due to changes in equity structure and dividend policy) when compared to the previous financial year.6.1.8 The issuer is deceased/insolvent;6.1.9 Non-receipt of dividends/returns for a consecutive period of three years (along with a cumulative decline in net asset value of 30 per cent or more); and6.1.10 A continuously declining trend in market prices, with the investment value being below cost for over three years.6.2 Licensed banks may request to rebut one or more criteria listed from 6.1.2 to 6.1.10 when determining significant increase of credit risk, subject to the following:6.2.1 The KMP heading the Risk Management Function shall recommend such rebuttal to the Board of Directors providing valid rationale and justifications to ensure that such criteria do not5


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021result in significant increase of credit risk to the bank, and Board of Directors shall grant approval or reject the proposal after considering the information provided.6.2.2 Disclose the rebutted criteria if any and the estimated impact of such rebuttal on the respective bank’s impairment provisions and profitability in their audited annual financial statements.7. Impairment 7.1 Licensed banks shall compute the impairment charges for credit Charges for facilities as per the Sri Lanka Accounting Standards andFinancial Assets.. Directions/Guidelines issued by CBSL from time to time.Other than 7Credit Facilities 7.2 The measurement of impairment allowances should build upon robust methodologies and result in the appropriate and timely recognition of expected credit losses in accordance with the applicable Sri Lanka Accounting Standards.7.3 The aggregate amount of impairment allowances of licensed banks, regardless of whether allowance components are determined on a collective or an individual basis, should be adequate and consistent with the objectives of the applicable Sri Lanka Accounting Standards.7.4 Additional guidance on impairment of licensed banks is provided in Annex IL8. Models for Calculation of Impairment for Financial Assets other than Credit Facilities8.1 The CEO and other relevant KMPs of the licensed bank under the guidance provided by the Board of Directors, shall ensure that the licensed bank:8.1.1 Develops robust models to determine expected credit losses as per the Sri Lanka Accounting Standards, which should be in line withthe licensed bank’s business model and risk profile;8.1.2 Considers all available and relevant internal and external datawhen estimating expected credit losses, ensuring that the estimates are robust, unbiased and reflective of current exposures;6


9. Reclassification of Financial Assets Other than Credit FacilitiesMONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 20218.1.3 Consist of officers who are well trained, competent and have a thorough understanding of the models adopted by the bank;8.1.4 Adheres to rigorous governance and internal control processes, when obtaining support from external vendors/consultants in respect of model development.8.1.5 Documents the reasons for selecting a specific model as the appropriate mode, if different models are used for different portfolios and instruments and ensure that all credit models are reviewed at least annually;8.1.6 Establishes an effective model validation process to ensure that the credit risk assessment and measurement methods are capable of generating accurate, consistent and unbiased predictive estimates on an ongoing basis; and8.1.7 Desists from making changes in the parameters, inputs and assumptions used for the purpose of profit smoothening. However, if any changes in the credit models are required, the rationale and justification for such change shall be evaluated by the Chief Risk Officer, Integrated Risk Management Committee and approved by the Board of Directors.8.2 In cases where licensed banks incorporated outside Sri Lanka use models developed by their head office or regional office, such licensed banks shall assess the appropriateness of the credit models in the Sri Lankan context and a local team headed by a KMP shall carry out appropriate validation procedures.9.1 Licensed banks may reclassify financial assets under the provisions of the Sri Lanka Accounting Standards, provided the objective of the business model of the licensed bank for its financial assets has changed and its previous model assessment would no longer apply.7


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021BANKING ACT DIRECTIONS No. 14 of 20219.2In line with the requirements under the Sri Lanka Accounting Standards, such changes in business models and reclassifications shall be approved by the Board of Directors and shall be notified to the Director of Bank Supervision within 7 working days of the date of such approval.10 Upgrading of 10.1Financial Assets other than Credit Facilities10.2Licensed banks shall upgrade Financial Assets from a higher stage in accordance with a policy approved by the Board of Directors, and the rationale for such upgrading shall be properly documented.Licensed banks shall exercise prudence in upgrading Financial Assets and shall ensure that the upgraded asset has exhibited a sustained trend/status of improvement to justify the improved classification status.11 Fair Value 11.1Measurement of Financial Assets other than Credit FacilitiesLicensed banks shall comply with the requirements given in ‘Sri Lanka Accounting Standard - SLFRS 13: Fair Value Measurement’ when financial instruments are subsequently measured at fair value, and are required to:11.1.1 Use an appropriate valuation technique for which sufficient data is available;11.1.2 Apply the selected valuation techniques consistently (exercising prudence);11.1.3 Maximise the use of relevant observable inputs. In exceptional circumstances, unobservable inputs may be used; and11.1.4 Obtain confirmation from the Chief Risk Officer, with regard to the appropriateness and reliability of inputs under level 3 hierarchy, if such inputs are used in the respective valuation technique.12 Role of 12.1Internal AuditThe Internal audit function shall independently evaluate the effectiveness of the credit risk assessment, measurement systems and8


14 September 202112.212.313 Regulatory Reporting13.1
14Effective Date15Revocation ofDirectionsMONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 14 of 2021processes of the licensed bank and shall ensure the acceptability of credit judgments.The Internal Audit function shall at least annually, validate and evaluate all credit risk assessment models, inputs and assumptions used along with data smoothening, if any.The Internal audit function shall provide an assurance on the adequacy and effectiveness of back testing in order to ensure that the key drivers have been captured and calibrated accurately.Licensed banks are required to submit the statutory returns introduced for these Directions, as stipulated below, or as stipulated otherwise by the Director of Bank Supervision.13.1.1 Monthly Submission - on or before the 15th day of the following month13.1.2 Quarterly Submission - on or before the 15th day from the end of a quarter.14.1 These Directions shall be in effect from 01 January 2022.15.1 The following Directions will be revoked from 01 January 2022:15.1.1 Banking Act Directions on Prudential Norms for Classification, Valuation and Operation of the Bank’s Investment Portfolio dated 01.03.2006 issued to licensedcommercial banks and licensed specialised banks.Prof. W D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka9


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021Annex I Classification and Measurement of Financial Assets and Financial Liabilities other thanCredit FacilitiesTable 1 - Classification and Measurement of Financial AssetsBusiness ModelKey CharacteristicsClassification & Subsequent MeasurementDebt Instruments1Held-to-collect- Hold assets to collect contractual cash flows- Meet SPPI test- Infrequent and insignificant salesAmortised CostBoth held to collect and for sale- Both collecting contractual cash flows and sales- More frequent and significant salesFair value through other comprehensive incomeOther business models, including;- Trading- Managing assets on a fair value basis- Maximising cash flows through sale- Neither 6held-to-collecf nor ‘held to collect and for sale’- Collection of contractual cash flows is incidentalFair value through profit or loss
Equity and Derivative InstrumentsEquity Instruments- Held for tradingFair value through profit or loss- Not for trading and not elected the irrevocable OCI optionFair value through profit or loss- Not for trading and elected the irrevocable OCI optionFair value through other comprehensive incomeDerivative InstrumentsFair value through profit or loss1 In addition to these key characteristic’s other features of the product such as management compensation, risk management aspects, frequency and significance of sales, etc. must also be considered.10


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 2021Table 2 - Classification and Subsequent Measurement of Financial LiabilitiesClassification of Financial LiabilitiesSubsequent MeasurementAccounting for Fair Value GainFinancial liabilities held for tradingFair valueThrough profit or lossFinancial liabilities designated at fair valueFair valueThe amount of change in fair value attributable to changes in credit risk in liability presented in other comprehensive income2 and remaining amount shall be presented in income statement.Other financial liabilities at amortised costAmortised Cost-
2 If that treatment creates or enlarges an accounting mismatch in profit or loss, an entity shall present all gains or losses on that liability (including the effects of changes in the credit risk of that liability) in profit or loss.11


14 September 2021MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 14 of 2021Annex IIGuidance on Impairment Computation for Licensed Banks1. Computation of the Probability of Default (PD) and Loss Given Default (LGD)(i) Licensed banks shall, at a minimum, use five years of data, unless a shorter time horizon provides better estimations and is better suited when calculating PDs and LGDs. Any smoothing of data or inputs must be validated by the Risk Management Department.(ii) Licensed banks shall not use proxies to compute PDs and LGDs, unless the bank is a newly incorporated bank or the product category was newly introduced by the bank and has a credit history of less than 5 years.(iii) When the licensed banks are unable to compute LGDs due to lack of data or inputs, licensed banks shall use a minimum LGD of 45 per cent for such exposures.(iv) When required to calculate impairment with respect to exposures denominated in foreign currencies issued by the sovereigns, following shall be considered:(a) Licensed banks shall compute respective Sovereign PD, appropriately linking to an external credit rating scale.(b) A minimum LGD of 20 per cent shall be applied for exposures denominated in foreign currencies issued by the sovereigns.(v) When required to calculate LGD for exposures guaranteed by the Government of Sri Lanka:(a) An LGD of zero may be applied to exposures with a guarantee of the Government provided that the guarantee fully covers the principle and interest and is reported as a liability of the Government.(b) LGD for any other form of assurance provided by the Government other than in item (a) above, shall be computed instead of using an LGD of zero percent.(c) A minimum LGD of 20 per cent shall be applied for Government guarantees denominated in foreign currency.
12


MONETARY BOARD CENTRAL BANK OF SRI LANKA14 September 2021 BANKING ACT DIRECTIONS No. 14 of 20212. Economic Factor Adjustment(i) Licensed banks shall use forecasts and projections published by the CBSL when adjusting credit provisioning models to reflect the economic conditions and forecasts, on a consistent basis.(ii) If CBSL forecasts arc not available, licensed banks shall use credible alternative sources on a consistent basis and shall maintain relevant documentary evidence.(iii) Board approved policies shall specify the sources to be used and licensed banks shall not cherry pick sources in their favor.
13


01 October 2021MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT DIRECTIONSNo. 15 of 2021MARGIN REQUIREMENTS AGAINST IMPORTSIssued in terms of the powers conferred by Sections 46(1) and 76(J)(1) of the Ranking Act No. 30 of 1988, as amended.Banking Act Directions No. 12 of 2021 dated 08 September 2021 on Margin Requirements Against Imports are hereby revoked.Nivard Ajith Leslie CabraalChairman of the Monetary Board andGovernor of the Central Bank of Sri Lanka


09 December 2021€
MONETARY BOARD
CENTRAL BANK OF SRI LANKA
BANKING ACT DIRECTIONS No. 16 of 2021
Regulatory Framework on Technology Risk Management and Resilience
for Licensed Banks
In the exercise of the powers conferred by Sections a6(l) and 76(J)(1) of the Banking Act, No. 30
of 1988, as amended, the Monetary Board hereby issues the following Directions on Regulatory
Framework on Technology Risk Management and Resilience for licensedtommercial banks and
licensed specialised banks, hereinafter referred to as licensed banks, with a view to further
strengthening the technology risk managernent and resilience in licensed banks.
1. Empowerment 1.1 In terms of Section a6(1) of the Banking Act, in order to ensure the
soundness of the banking system, the Monetary Board is empowered
to issue Directions to all licensed commercial banks, regarding the
manner in which any aspect of the business of such bank or banks is
to be conducted.
1.2 lnterms of Section 76(J)(1) of the Banking Act, the Monetary Board
is empowered to give Directions to licensed specialised banks or to
any category of licensed specialised banks, regarding the manner in
which any aspect of the business of such banks is to be conducted.
2. Scope and
AppHcability
3. Regulatory
Framework on
Technology
Risk
Management
and Resilience
4. Responsibilities
of the Board2.1 These Directions shall be applicable to all licensed banks including
operations conducted through agents and third-party service
providers.
All licensed banks shall ensure compliance with the requirements
imposed by the regulatory framework on technology risk
management and resilience in the Schedule I to these Directions
(hereinafter referred to as regulatory framework).
Requirements in the regulatory framework shall be applicable to the
entire operations of licensed banks including operations conducted
through agents and third-party service providers.
The Board of Directors of licensed banks shall establish adequate


The Board of Directors of licensed banks shall establish adequate
oversight measures to ensure implementation of the technology risk
management and resilience requirements specified in the regulatory
framework by the licensed banks.3.1
3.2
4.1


09 December 2021MONETARY BOARI)
CENTRAL BANK OF SRI LANKA
BANKING ACT DIRECTIONS No.16 of202l
5. Governance
Framework
6. Assessment of
Technology
Risk under
Supervisory
Review Process
7. Role of the
Internal Audit
8. Steps to Secure
Compliance8.15.1 Licensed banks shall establish an effective governance framework
approved by the Board of Directors of the licensed bank in
compliance with the requirernents specified in Section 4 of the
regulatory framework, to ensure prudent management of technology
risks.
6.1 Licensed banks shall ensure technology risk is assessed as a part of
the comprehensive assessment of risks in the bank's Internal Capital
Adequacy Assessment Process (ICAAP) and adequate level of
capital is held to meet any potential technology risk.
7.1 The internal audit function of the licensed banks shall ensure that
compliance with regulatory requirements on technology risk
management is assessed and reported to the Board of Directors of
the licensed bank through the Board Audit Committee, at least
annually.
Licensed banks shall ensure all new technology initiatives comply
with Section 9 of the regulatory framework on requirements based
on information system infrastructure ownership, management, and
location from the date of these Directions.
Licensed banks shall ensure compliance with all other requirements
of the regulatory framework as per the timelines set out in Section
l0 of the regulatory frarnework on implementation and transitional
arrangements.
Licensed banks designated as Domestic Systemically Important
Banks (D-SIBs) shall ensure compliance with the requirernents
specifically applicable to D-SIBs within 12 months from the date of
notification of being designated as a D-SIB or as per Section 10 of
the regulatory framework, whichever falls later.
fi,* i*) U-
Nivard Ajith Leslie Cabraal
Chairman of the Monetary Board and
Governor of the Central Bank of Sri Lankn8.2
8.3


3

Banking Act Directions No. 16 of 2021
Regulatory Framework on Technology Risk Management and Resilience
for Licensed Banks

SCHEDULE I


4
 Regulatory Framework on Technology Risk Management and Resilience
for Licensed Banks

1. Objective
This framework intends to set minimum regulatory requirements on technology risk
management and resilience for licensed banks in general as well as based on sensitivity
of data, criticality of information systems, and type of information system infrastructure
used.

2. Applicability
2.1 Requirements in this framework  shall be applicable to entire operations of licensed
banks including operations conducted through  agents and third -party service providers .
2.2 All information systems and related infrastructure used by licensed banks including
primary, disaster recovery, and any other types shall comply with the requirements
specified in this framework .

3. Definitions
Followi ng definitions shall be applicable  for the purposes of this framework.

3.1 Data
3.1.1 Public data
Data that is freely available to everyone to use and republish without any restriction.
3.1.2 Customer data
Any non -public data relating to a past, existing , or potential customer . However, de -
identified customer data need not be considered as customer data.
3.1.3 De-identified c ustomer data
Intentionally altered  customer data that cannot be used alone or in combination with
any other data to identify the customer to whom the data was originally related to.
3.1.4 Confidential non -customer data
Any non -public data that do not fall within the definition of customer data a nd can cause
significant financial or reputational loss if used maliciously or leaked, including the
licensed bank’s  financial transactions , submissions to the B oard of Directors and
management, sensitive employee data, and any other data as determined by the licensed
bank.


5
 3.2 Critical information system
Any information system that is essential  to the functioning of the financial system of
the country and/or to the functioning of the licensed bank  as identified by the Board of
Directors of the licensed bank,  including information systems of the licensed bank and
relevant information systems of third -party  service providers and agents .
3.3 Third -party service provider
A service provider with whom the licensed bank has entered into an outsourcing
arrangement as defined in the Banking Act Direction No. 2 of 2012 on Outsourcing of
Business Operations of a Licensed Commercial Bank and a Licensed Specialised Bank,
or any succeeding Direction.
3.4 Agent
An agent or sub -agent as defined in the Banking Act Di rection No. 2 of 2018 on
Appointment of Agents of Licensed Banks, or any succeeding Direction.
3.5 Accredited certification body
A management system certification body accredited for the specified ISO standard by
the Sri Lanka Accreditation Board for Conformity Assessment (SLAB) or by an
accreditation body which is a member of International Accreditation Forum (IAF).
3.6 Domestic Systemically Important Bank (D -SIB)
Any licensed bank designated as a D -SIB as per the Banking Act Directions No. 10 of
2019 on Framework for Dealing with Domestic Systemically Important Banks , or any
succeeding Direction.
3.7 Board of Directors
For licensed banks incorporated in Sri Lanka, this shall mean the Board of Directors of
the bank . For licensed banks incorporated outside Sri Lanka, this shall mean the senior
most  management level committee in Sri Lanka together with the head office executive
responsible for Sri Lanka operations or any appropriate higher -level committee at the
head office.
3.8 Board Integrated Risk Management Commi ttee (BIRMC)
For licensed banks incorporated in Sri Lanka, this shall mean the integrated risk


For licensed banks incorporated in Sri Lanka, this shall mean the integrated risk
management committee of the Board of Directors of the bank. For licensed banks
incorporated outside Sri Lanka, this shall mean the local risk management committe e
or in the absence of such committee head of risk management,  together with the risk
management function in head office or any appropriate higher -level committee at the
head office .


6
 3.9 Board Audit Committee (BAC)
For licensed banks incorporated in Sri Lanka,  this shall mean the audit committee of
the Board of Directors of the bank. For licensed banks incorporated outside Sri Lanka,
this shall mean the head of internal audit in Sri Lanka together with the internal audit
function in head office or any appropria te higher -level committee at the head office .

4. Governance Framework

4.1 Information Security Committee (ISC)
4.1.1 Licensed banks shall establish an ISC as the apex management level body responsible
for information security and technology resilience of the bank. The Committee shall be
responsible for both strategic and operational aspects of information security  and
technology risk management .
4.1.2 ISC shall be chaired by the Chief Executive Officer (CEO) of the bank. The Board of
Directors of the licensed bank shall also appoint one or more deputy chairpersons to
chair the meetings of ISC when CEO is unable to attend.
4.1.3 The Chief Operating Officer/Head of Operations, Chief Information Security Officer
(CISO), Chief Information Officer (CIO)/ Head of Information Technology, and
Manager of Security Operations Center/Security Operations Center Coordinator shall
be the  other ex -officio members of ISC.  Head of Legal, Head of Human Resource
Management, and Head of Security shall be required to attend as co -opted members
whenever a matter relating to their areas  is to be discussed. They may be appointed as
permanent member s at the discretion of the Board of Directors.  Head of Risk
Management  and Compliance Officer shall be permanent invitees to ISC.  Head of
Internal Audit shall be invited to present internal audit findings on information security
at least on quarterly basis . Participation of any other officers from risk, compliance, or
internal audit functions of the bank shall be only on invitation .


internal audit functions of the bank shall be only on invitation .
4.1.4 Licensed banks incorporated outside Sri Lanka where  majority of technology related
decision s are made  at the head office  shall  appoint a suitable and sufficiently
empowered  officer from the head office  with seniority equal or higher than the country
head of Sri Lankan operations to chair the ISC with the country head as an ex -officio
member of ISC.


7
 4.1.5 Licensed banks incorporated ou tside Sri Lanka shall appoint the releva nt officer from
the head office  to the ISC when any of the officers named in Section  4.1.3 are not in
the organization structure of the Sri Lankan branch.
4.1.6 ISC shall report to the Board of Directors through BIRMC. ISC shall apprise the
BIRMC of its proceedings at least on quarterly basis.
4.1.7 ISC shall meet at least once in every two months and shall  have a quorum and terms of
reference approved  by the Board of Dire ctors.

4.2 Chief Information Security Officer (CISO)
4.2.1 Licensed banks shall appoint a CISO as the executive officer responsible for the
licensed bank’s information security.
4.2.2 CISO shall be a member of the bank’s senior management  team  and shall be within the
immediate two layers below the level of CEO in the organizational structure of the
licensed bank .
4.2.3 CISO shall report to the Chief Executive Officer, or Chief Operating Officer (COO)
when COO has the overall responsibility for the operational activities of th e licensed
bank, or to a corporate management member who has a role similar to the role of COO
as mentioned above.
4.2.4 D-SIBs shall appoint a dedicated CISO.
4.2.5 As a transitional arrangement for the requirement in 4.2. 4, D-SIBs may appoint an
officer from the b ank’s existing senior management team to simultaneously function as
the CISO in compliance with the requirements in 4.2.6 up to a period of 2 years.
4.2.6 Licensed banks that are not D -SIBs may appoint an officer from the bank’s existing
senior management team to simultaneously function as the CISO, provided that the
Board of Directors resolve that the magnitude of technology and information security
risks faced by the licensed bank does not necessitate a dedicated CISO. However, s uch
an officer shall not be Hea d of Information Technology, Head of Internal Audit, Head


an officer shall not be Hea d of Information Technology, Head of Internal Audit, Head
of Risk Management , Compliance Officer, or one of their subordinates.
4.2.7 CISO shall be experienced and shall be among the senior most in the licensed bank’s
organizational hierarchy  to ensure effective  implementation of information security
policies and procedures across the licensed bank  and to provide leadership t o
information security function .
4.2.8 CISO shall possess  or acquire  eligible qualifications as per requirements in Section  7,
within the timelin es stipulated under  transitional arrangements in Section  10.


8
 4.2.9 Licensed banks incorporated outside Sri Lanka and having information security related
decision making handled outside of Sri Lanka , shall designate a sufficiently empower ed
officer from the head office  as the CISO for Sri Lankan operations. Such an officer is
exempted from the requirement to possess eligible qualifications as per 4.2. 8, but shall
possess adequate qualifications in information security as determined by the Head of
Human Resources o f the bank’s  head office .
4.2.10  The Board of Directors of licensed bank shall establish appropriate arrangements to
fulfill the responsibilities assigned to CISO until a CISO is appointed in accordance
with transitional arrangements in Section 10.

4.3 Identification of critical information systems
4.3.1 Board of Directors shall identify information systems falling within the definition of
critical information system  provided in 3.2 , in accordance with requirements in 4.3.2
and 4.3.3.
4.3.2 Critical information sys tems shall normally include the t ransaction processing systems,
general ledger  systems , payment and settlement related systems, delivery channels ,
systems used for Anti-Money Laundering (AML)/ Know Your Customer (KYC)
procedures, and any other system that is required to ensure uninterrupted conduct of
banking business .
4.3.3 The Board of Directors of a licensed bank may exclude any of the information systems
mentioned in 4.3.2 other than transaction processing systems , general ledger systems ,
and information  systems connected to LankaSettle System or are required to fulfill the
bank’s obligations in the LankaSettle  system  from  being identified as critical , if the
concerned information system does not fall within the definition of critical information
system i n the opinion of the Board of Directors. Such exclusion shall be based on an
internally established rational methodology. All such exclusions shall be reviewed at


internally established rational methodology. All such exclusions shall be reviewed at
least once every two years and documented in sufficient detail explaining  the rationale
behin d the exclusion.
4.3.4 Licensed banks shall maintain a register recording all the information systems used,
including relevant information systems with third -party service providers  and agents,
clearly identifying whether the information system is a critical inf ormation system or
not and the type of data the information system is exposed to. Licensed banks  may use
any existing register/inventory of information systems for this purpose.


9
 4.4 Fair and ethical use of customer data
Licensed bank s shall ensure that custom er data would only be used in ways the
customers would reasonably expect the bank to use such data. The Board of Directors
shall put in place effective policies and procedures to ensure fair and ethical use of
customer data at all times. Further, licensed banks shall not disclose such data except
for as has been provided by law.

4.5 Reporting to Board of Directors
Licensed banks shall establish procedures to regularly report information security and
technology risk profile of the bank  together with any information security incidents to
the Board of Directors through BIRMC using both standard risk  indicators and ad -hoc
reports.

4.6 Technology risk management  function
4.6.1 Licensed banks shall ensure that the bank’s risk management function possess a level
of maturity in technology risk management that commensurate  with the magnitude of
technology risk faced by the bank. The level of staff and other resources allocated to
the risk management function  for technology risk management shall be decided by
BIRMC in consultation with the head of risk management.
4.6.2 The Board of Directors shall ensure technology risk appetite is defined through a
framework of clearly delineated and meas urable technology risk indicators with
approved risk tolerance levels.
4.6.3 Licensed banks shall assess technology risk as a part of the comprehensive assessment
of risks in the bank’s Internal Capital Adequacy Assessment Process (ICAAP).
4.6.4 Licensed banks shall e nsure stringent product approval process approved by the Board
of Directors and focused on software quality assurance, internal controls, and risk
management measures are adhered to, when a new technology driven product or service
is introduced or when a c hange is made to such product or service.
4.6.5 Licensed banks shall ensure that business units responsible for technology driven


4.6.5 Licensed banks shall ensure that business units responsible for technology driven
banking products and services such as payment cards and electronic banking, and
information technology and information security rela ted service delivery functions are
subjected to quarterly Risk and Control Self-Assessment (RCSA) process implemented
and monitored by the risk management function.


10
 4.6.6 Licensed banks shall implement adequate technology risk management and monitoring
measures  including RCSA processes for third -party service providers and agents that
commensurate with the criticality and sensitivity of services carried out by such third -
party service providers and agents as approved by BIRMC of the licensed bank.

4.7 Internal audi t
4.7.1 Licensed banks shall ensure that c ompliance with the requirements in this regulatory
framework and other CBSL Regulations  relating to information security and
technology risk management  is subjected to an internal audit at least annually.
4.7.2 BAC shall ensure that the licensed bank is complying with the requirement in 4.7.1
even when the internal audit function of the licensed bank is outsourced.

5. Information Security
5.1 Information security training and certification
5.1.1 Training and awareness to Board of Directors
(i) Licensed banks shall implement a comprehensive  annual training and
awareness  program  on information security and technology risk management
for Board of Directors , in accorda nce with below requirements .
(ii) The objective of such program shall be to enable the Board of Directors to have
effective oversight on the adequacy and effectiveness of information security
and technology risk management policies and procedures of the licen sed bank.
(iii) Responsibilities of Board of Directors  and Board committees in terms of
requirements in this regulatory framework and other applicable Laws and
Regulations relating to information security and technology risk management
shall also be covered thro ugh such programs.
(iv) Such training shall consist of at least one annual structured training program and
one or more awareness sessions by information security and technology risk
management experts every year.
(v) The Board Secretary of the licensed bank shall e nsure compliance with the


(v) The Board Secretary of the licensed bank shall e nsure compliance with the
above requirements on training and awareness to Board of Directors.
5.1.2 Information security awareness training and certification requirement for staff
(i) Licensed banks shall ensure that the s taff of the licensed bank, agents, and third -
party  service providers exposed to or can potentially be exposed to critical
information systems, customer data , or confidential non -customer data are


11
 trained and certified on information security, in accordance with following
requirements:
(a) Required pers ons shall complete an information security awareness
training program based on the information security policies and
procedures of the licensed bank;
(b) Such program as per 5.1.2(i)(a) shall commensurate with the
information security responsibilities of the trainee and shall be updated
regularly and whenever the bank’s information security policies are
updated; and
(c) Required persons shall complete an internal certification test, based on
the information security awareness training, at least annually.
(ii) The Board of Directors of a licensed bank may exclude staff of agents and third -
party service providers from the requirements in 5.1.2(i), if adequate  and
comparable information security awareness measures have been implemented
by such agents and third -party s ervice providers.

5.2 User access management
5.2.1 Scope
(i) Requirements in 5.2.2 and 5.2.3 on user access management shall be applicable
to critical information systems and information systems exposed to customer
data.
(ii) Board of Directors shall decide on the need to a pply the requirements imposed
by 5.2.2 and 5.2.3 for non -critical information systems exposed to confidential
non-customer data in consultation with BIRMC and ISC.
(iii) Requirements in 5.2.4 shall be applicable to all information systems as
specified.
5.2.2 User acce ss and identity management system
(i) Licensed bank s shall implement an industry standard user access and identity
management system(s) to manage all users including privileged users.
(ii) Licensed bank s may deviate from the requirement in 5.2.2(i ) and implement
suitable compensating controls, for any existing information system when
implementation of industry standard user access and identity management
system  is not feasible. All such information systems shall be subjected to user


system  is not feasible. All such information systems shall be subjected to user
access privileg e reviews as per the frequency specified in 5.2.4.(i)(a).


12
 5.2.3 Privileged users
Privileged user access shall be provided only on “need -to-have” basis and highest level
of access shall only be provided for a limited time when such access is required.
5.2.4 User access  privilege reviews
(i) Licensed banks shall conduct user access privilege reviews as follows:
(a) At least on monthly basis for critical information systems.
(b) At least on quarterly basis for non -critical information systems exposed
to customer data and confidential  non-customer data.
(c) At least on annual basis for customers and their authorized
representatives registered to use any information system of the bank
including electronic delivery channels, using an appropriate
methodology in accordance with the operating i nstructions of the linked
accounts.
(d) At least on annual basis for all other information systems.
(ii) The objective of user access privilege reviews shall be to establish that all users
and their user profiles in an information system are having a valid authoris ation
for the privileges and status assigned.
(iii) Licensed banks shall adopt appropriate methodologies to conduct user access
privilege reviews as approved by ISC.
(iv) User access privilege reviews shall be conducted independently from the user
access management function responsible for the creation, alteration, and
deletion of user access in information systems.
(v) Risk management department shall conduct a root -cause analysis on
discrepancies identified during u ser access privilege reviews  and suggest
appropriate internal control enhancements to ISC at least on annual basis.

5.3 Computer security and u ser activity log management
5.3.1 Licensed banks shall implement a computer security and user activity  log management
policy adhering to the requirements in 5.3.2 to 5.3.7, to manage computer security and
user activity logs of critical information systems and information systems exposed to


user activity logs of critical information systems and information systems exposed to
customer data. Such policy may be extended to other information systems at the
discretion of the bank’s Board of Directors.


13
 5.3.2 The policy shall include types of logs to be maintained, retention period, frequency of
review, method of review and tools to be used, event identification and response, and
responsibilities for the maintenance and review  of logs.
5.3.3 Computer security logs shall include logs generated by security software, operating
systems, and applications.
5.3.4 Computer security logs maintained shall be adequate to successfully identify and
investigate information security incidents.
5.3.5 User act ivity logs maintained shall be adequate to establish accountability without
repudiation for any access or modification to customer data or critical information
systems.
5.3.6 Logs of privileged users shall be given a higher importance and reviewed on near real
time basis using appropriate tools and methods.
5.3.7 The policy shall be approved by the Board of Directors based on the recommendations
of BIRMC and ISC.

5.4 Information classification and labelling
5.4.1 All electronically maintained data shall be classified based on i nformation security
sensitivity and labelled  with assigned classification, as per an information classification
policy approved by the Board of Directors.
5.4.2 Licensed banks shall establish an appropriate mechanism to effectively determine the
data category to  which any piece of data will belong to as per definitions given in 3.1.

5.5 Data encryption
5.5.1 Customer data encryption
(i) Customer data shall normally be protected using encryption as recommended in
5.5.1(ii). This requirement shall be applicable to customer data maintained with
the licensed bank, agents, and third -party service providers. However, licensed
banks may use alternative controls to protect customer data in accordance with
5.5.1(iv) when encryption is not feasible or appropriate.
(ii) Recommended levels of encryption
(a) Data -at-rest encryption
  Customer data shall be subjected to database encryption or file level


Customer data shall be subjected to database encryption or file level
encryption at rest.


14
 (b) Data -in-transit encryption
  Data -in-transit encryption shall be implemented for customer dat a.
Further, whenever a file containing such data is transmitted it shall
remain encrypted at file level.
(c) Full disk encryption for endpoint devices and removable media
  Endpoint devices and removable media that store customer data of the
licensed ban k, either permanently or temporarily, including such devices
of third -party service providers and agents shall be subject to full disk
encryption. The licensed bank may exclude any end point device that is
usually non-movable  and the risk of data leakage is negl igible, from this
requirement based on an exclusion criterion approved by the Board of
Directors of the licensed bank.
(iii) Types of encryption to be used
Licensed bank shall use industry standard encryption methods. Selection of such
methods shall be subjected  to the approval of the licensed bank’s Board of
Directors on the recommendation of BIRMC and ISC.
(iv) Deviations from customer data encryption requirement
(a) Licensed banks  may decide to deviate from customer data encryption
requirements mentioned in 5.5.1 (ii) for specific scenarios at the
discretion of the bank’s Board of Directors, when it is not feasible or
appropriate to protect customer data using encryption in the given
scenario.
(b) The Board of Directors shall ensure adequate compensating controls and
monitoring measures are enforced to minimise the risks arising due to
customer data not being encrypted , whenever a deviation is approved as
per 5.5.1(iv)(a).
(c) All deviations as per Section 5.5.1(iv)(a) together  with compensating
controls shall be recommende d by the ISC through BIRMC for the
approval by Board of Directors.
(d) All deviations approved as per 5.5.1(iv)(a)  together with associated
compensating controls and monitoring measures shall be reviewed at
least once in every two years to determine whether data can now be


least once in every two years to determine whether data can now be
protected with encryption or better compensating controls and
monitoring mechanisms can be introd uced.


15
 5.5.2 Confidential non -customer data encryption
Encryption requirements for customer data specified in 5.5.1  shall be applicable  to
confidential non -customer data as well, except with respect to categories of confidential
non-customer data that will onl y pose negligible adverse impact to the licensed bank if
subjected to a data leakage or any other  adverse information security incident  that could
have been prevented with encryption as determined by the Board of Directors of the
licensed bank.

5.6 Security Operations Center (SOC)
5.6.1 Applicability
All licensed commercial banks, licensed specialised banks that are D -SIBs, and other
licensed specialised banks offering electronic delivery channels other than automated
teller machines (e.g. , internet banking, mobile  apps, customer/third -party integrations,
etc.) shall implement a SOC as per the requirements in this regulatory framework.
Implementation of a Data Loss Prevention (DLP) tool as per 5.6.7(iii) is mandatory for
all licensed  banks.
5.6.2 Responsibilities
SOC sh all be responsible for the prevention, monitoring and detection, incident
response, forensics, incident reporting, and knowledge sharing of day-to-day
information security threats and incidents.
5.6.3 Reporting line
The Board of Directors of the licensed bank shall establish an appropriate line of
reporting for the SOC. Such a reporting line shall ensure both the bank’s CIO/ Head of
Information Technology and CISO has adequate oversight over the operations of SOC
to carry out their responsibilities effectiv ely, while clearly specifying who has the
primary responsibility for the operations of SOC.
5.6.4 Operating hours
SOC shall be operational on 24 X 7 basis. Licensed banks shall decide on staffing levels
at different times of the day/week based on activity levels and threat profile.
5.6.5 Human resources , artificial intelligence, and automation


5.6.5 Human resources , artificial intelligence, and automation
(i) Staff roles in SOC shall  at least include  security analysts (tier 1), incident
responders (tier 2), security experts/threat hunters (tier 3), and SOC manager.


16
 (ii) Licensed banks shall rationally decide on the exact staffing level required at
each level and on any other types of staff req uired in the SOC.
(iii) Licensed banks  may use artificial intelligence or other automation technologies
instead of humans for any of the above roles, except for the role of SOC
manager.
5.6.6 Processes
(i) Clearly defined and documented processes
SOC shall have clearly d efined and documented processes for event
classification and prioritisation, analysis, remediation and recovery, post
incident assessment, and forensics. Such processes shall clearly identify the
steps to be followed and responsible people for each step.
(ii) Defined baseline activity level
SOC shall have defined and updated baseline activity levels for users,
applications, and all infrastructure components to enable effective monitoring
and detection of suspicious and unusual activities. Baseline activity level s shall
be used by SOC to effectively segregate suspicious activity from normal
activity.
5.6.7 Tools
(i) Monitoring and detection tools
SOC shall be equipped with monitoring and detection tools that commensurate
the magnitude and complexity of the licensed bank’s technology usage. At
minimum a SOC shall have tools for automated asset discovery, database
activity monitoring, vulnerability a ssessment, and intrusion detection.
(ii) Security Information and Event Management (SIEM) tool s
Licensed banks shall equip SOC with industry standard SIEM tools and
supportive systems capable of log consolidation, event correlation, incident
management, forensi cs analysis, and management reporting.
(iii) Data Loss Prevention (DLP) tool s
(a) Licensed banks shall implement industry standard DLP tools to
minimise the risk of data leakages. Scope of implementation shall cover
the entire bank, and any third -party service provi ders and agents exposed
to customer data.


the entire bank, and any third -party service provi ders and agents exposed
to customer data.
(b) In case of third -party service providers and agents, licensed banks may
allow them to implement DLP tools as per minimum requirements


17
 specified by the licensed bank. Licensed banks shall conduct at least
annual re views of such implementations by third -party service providers
and agents to ensure adequate data loss prevention measures are in place.
(c) Licensed banks may exempt third -party service providers from the
requirement to implement a DLP tool, if there is no da ta leakage risk due
to the control measures in place when sharing data with the third -party
service provider. Such exemption shall be approved by the Board of
Directors of the licensed bank based on independent assessments
provided by the head of relevant business/operational function,
CIO/ Head of Information Technology, CISO and Head of Risk
Management. All such exemptions shall be reviewed by the Board of
Directors at least once in every two years.
5.6.8 Threat information and intelligence
Licensed banks shall implement mechanisms to obtain threat information and threat
intelligence from relevant sources. The SOC’s staff, processes, and tools shall be
capable of aggregating, analysing, and operationalising threat information and threat
intelligence receive d.
5.6.9 Outsourcing  of SOC
(i) The Board of D irectors of a licensed bank may decide to outsource any function
of a SOC to a third -party service provider.
(ii) All decisions to outsource SOC functions shall be made after the Board of
Directors evaluating the informa tion security threats posed by such outsourcing ,
including threats/vulnerabilities that could arise due to any other products or
services provided by the SOC service provider to the licensed bank . Such
evaluations shal l be based on independent assessments submitted to the Board
of Directors by CIO/Head of Information Technology, CISO, Head of Legal,
and Head of Risk Management.
(iii) Licensed banks shall ensure that t hird party service providers of SOC services
to whom the bank’s  non-public data may be exposed possess a certification for


to whom the bank’s  non-public data may be exposed possess a certification for
the latest edition of ISO 27001 - Information security management systems,
from an accredited certification body , for the SOC services provided to the
licensed bank.


18
 (iv) Licensed bank shall have a non-disclosure agreement approved by the Board of
Directors of the bank with the third -party service provider of the SOC.
(v) All staff allocated by the third -party service providers of SOC to whom the
bank’s non -public data may be exposed shall be subjected t o enhanced
background checks by the bank or by the third -party service provider of the
SOC through a specialized background checking service acceptable to the bank.
(vi) The rights of the CBSL to examine third party SOCs and their staff as if it is a
licensed b ank’s internal SOC shall be ensured through contractual agreements
between the licensed bank and the SOC service provider.
(vii) The rights of the Sri Lankan judiciary to request and obtain any information or
data relating to the services provided to the license d bank by any SOC service
provider located outside Sri Lanka shall be ensured through contractual
agreements between the licensed bank and the SOC service provider.
(viii) Licensed banks shall appoint an officer with sufficient seniority and authority
as the SOC  Coordinator to coordinate between the licensed bank and the
outsourced SOC.
5.6.10  SOC coverage for information systems operated by agents and third -party service
providers
Licensed banks shall ensure any critical information systems operated by agents or
third -party service providers are covered by a SOC in compliance with the above
requirements. In such scenarios the licensed bank shall require the respective agent or
third -party service provider to have their own SOC, or subscribe to a third party SOC
that fulf ills the applicable requirements specified in 5.6.9, or be covered by the bank’s
SOC as appropriate. Further, licensed banks shall decide the need for coverage  of SOC
for all non -critical information systems operated by agents and third -party service
provi ders based on an internal risk assessment.


provi ders based on an internal risk assessment.

5.7 Information security incident response and recovery
5.7.1 Incident Response Plan (IRP)
Licensed banks shall have an up to date and Board of Directors approved IRP, detailing
procedures for incident escalation, remedia tion, recovery, and communication with
internal and external stakeholders. IRP shall include specific procedures to deal with
commonly known types of information security incidents, including but not limited to
cyber security incidents.


19
 5.7.2 Incident response and recovery testing
Incident response and recovery capabilities shall be tested at least annually using
scenarios close to real life as much as possible to determine the licensed bank’s incident
response readiness. Results of the test shall be re ported to the Board of Directors
through BIRMC by ISC.

5.8 Information security testing
5.8.1 Pre-implementation information security testing
(i) Scope
(a) Critical information systems and information systems exposed to
customer data shall be subjected to  pre-implementation information
security tests. Any other information system that could potentially make
any c ritical information system or any information system  exposed to
customer data vulnerable shall also be subjected to pre -implementation
information  security tests.
(b) Board of Directors shall decide on the need to conduct pre -
implementation information security testing for non -critical information
systems exposed to confidential non -customer data in consultation with
BIRMC and ISC, based on the importa nce of each such information
system.
(c) Pre-implementation information security tests shall be conducted prior
to initial implementation and prior to implementation of modifications.
Minor modifications could be excluded from pre -implementation
information se curity tests based on an exclusion policy approved by the
Board of Directors and approval of ISC at the time of implementation  of
the specific  minor  modification  that need  to be excluded.
(ii) Following types of pre -implementation tests shall be carried out as applicable
to the given implementation:
(a) Static Application Security Testing (SAST) or source code reviews to
detect any malicious or unsafe code;
(b) Dynamic Application Security Testing (DAST) to detect application
level vulnerabilities an attacker could ex ploit;


20
 (c) Quality assurance testing on computing and networking infrastructure
hardening to ensure compliance with internal hardening policies; and
(d) Infrastructure vulnerability assessments to identify vulnerabilities in
computing and networking infrastructure.
(iii) Pre-implementation tests shall be conducted by a team independent of the team
responsible for the development and/or implementation of the information
system. Licensed banks shall ensure that qualifying information systems
operated by agent s or third -party service providers are subjected to pre -
implementation tests by a suitable internal team of the agent/third -party service
or by an external service provider acceptable to the licensed bank.
(iv) Licensed banks may adopt suitable alternative secu rity evaluation
methodologies when procuring off -the-shelf software if conducting pre -
implementation tests as per 5.8.1(ii) is not possible.
(v) Licensed banks may rely on an assurance provided by an independent third -
party , mutually acceptable to both the lic ensed bank and the information system
provider , as an alternative to 5.8.1(ii)(a)  in case of information systems provided
by external vendors.
(vi) Licensed banks shall implement industry standard controls to ensure malicious
code will not be injected when sour ce code is moved to production environment
after completion of relevant pre -implementation tests.
5.8.2 Vulnerability assessments
(i) Critical information systems  and information systems exposed to customer data
shall be subject to vulnerability assessments at least quarterly.
(ii) Vulnerability assessments  shall focus on both infrastructure vulnerabilities and
application vulnerabilities.
(iii) Vulnerability assessments  shall be performed on production environments.
(iv) Vulner ability assessments can be performed by the licensed bank’s internal
information security staff or external experts.