Capital and Risk Management 2023

Alisa Bank Plc

Pillar III - Capital and risk management report 2023

INTRODUCTION

Alisa Bank focuses on retail banking, offering selected banking services to personal and business customers. Alisa Bank's offering includes current, savings and deposit accounts, lending to personal and business customers, and online purchase payment products. Thorough and adequately resourced risk management is an integral part of the company's daily business management. The key types of risks in Alisa Bank are credit risk, liquidity risk, operational and market risk. Considering the nature of Alisa Bank's business operations, credit and liquidity risks are the primary risks.

Disclosure of Pilar III information

This report presents comprehensive information on the risks, risk management and capital adequacy required by applicable regulation. EU Capital Requirements Regulation 575/2013 (CRR), Part 8, sets requirements for the disclosure obligation of institutions and the disclosure of information concerning banks' risks, their management and capital adequacy. Additionally, for example, the European Banking Authority (EBA) has provided more detailed guidance on the disclosure obligations.

The company complies with its disclosure obligation by publishing comprehensive information on its capital adequacy and risk management (so-called Pillar III information) alongside its annual report. Pillar III report contains a qualitative and quantitative report. Pillar III report contains the information required from a small and non-complex institution and Alisa Bank falls into this category. The information in Pillar III is unaudited. Risk management, capital adequacy and other risk-related information are also described and disclosed as part of the Board of Directors' report and the financial statements. Other information required by the Pillar III requirements,

4 (36)

such as Corporate Governance Statement and Remuneration report are available on Alisa Bank's website.

Risk appetite

Alisa Bank defines its risk appetite as the level of risk by amount and type that the company is prepared to seek and accept. The board-level risk appetite is translated into business-level targets and limits. Targets and risk limits are set for each business unit and furthermore to all product categories. Ongoing monitoring and reporting of risk exposures against the risk limits are carried out by the business units and the Risk Control Unit to ensure that risk-taking activities remain within the risk appetite.

Risk management in Alisa Bank

The company's Board of Directors has the primary responsibility for risk management. The Board of Directors confirms the risk strategy, risk management principles and responsibilities, risk limits and other guidelines according to which risk management and internal control are organized. Alisa Bank's risk management strategy is based on the goals and business strategy confirmed by the Board. Alisa Bank focuses on retail banking and offers selected banking services to personal and business customers. The company does not have excessive customer or risk exposure concentrations. The company's Board of Directors sets the level of risk appetite by approving risk area- specific risk strategies and the necessary risk limits and monitoring limits. The implementation of the risk strategy is monitored regularly through the monitoring and reporting of risk limits, which is carried out independently of business operations.

requirement (10.5 %). The total capital requirement for banks consists of a minimum capital requirement of 8.0 % in accordance with Pillar I and an additional fixed capital requirement of 2.5 % in accordance with Act on the Credit Institutions.

At the end of the review period, the group's capital structure was strong and consisted of core capital (CET 1) and secondary capital (Tier 2). The group's own funds (TC) were EUR 22.3 million: primary capital (T1) EUR 17.7 million was entirely common equity Tier 1 ratio (CET1), and secondary capital (T2) EUR 4.6 million consisted of debenture loan.

Alisa Bank's leverage ratio was 5.8 % at the end of the review period.

RISK MANAGEMENT IN ALISA BANK

Objective of risk management

The Board of Directors of Alisa Bank have primary responsibility for the company's risk management. The Board confirms the principles and responsibilities of risk management, the company's risk limits and other general instructions according to which risk management and internal controls are organized.

The objectives of the risk management framework in Alisa Bank are:

• Making the management aware of the risks having financial significance in the short or long term.
• Ensuring rationality of business and risk management processes; creating a decision-making basis, proportional to company's risk-taking ability, for risk-taking and risk mitigation.
• Ensuring full commitment of the employees to continuous risk management work.
• Making risk management a part of normal daily management.

Three lines of defense

The strategies and processes to manage risk and to organize internal control in Alisa Bank are applied according to the three lines of defense. There are independent functions established in the company to ensure the implementation of effective and comprehensive internal controls. Independent functions are:

• Risk control function (second line of defense)
• Compliance function (second line of defense)
• Internal audit function (third line of defense)

Organization and principles of risk management Board of Directors

9 (36)

The Board approves the risk management policy including the principles concerning risk management and risk monitoring. The Board sets the risk appetite and the top-level limits. Within these limits Credit and Risk Committee and/or the Heads of the Business Units give restrictive guidelines. The Board also regularly assesses the stress testing framework and test results. The results of the stress tests are taken into consideration when defining or reviewing the business strategy, risk strategy and risk limits. The Board sets main principles and methods concerning risk measurement and valuation.

Credit and risk management committee

Credit and risk management committee is a supervisory and consultative body working under the mandate of the Board. Credit and risk management committee members are appointed by the Board. The committee's mandates and responsibilities are described in the working order of committee and include the following:

• Controlling the bank's credit, market, and liquidity risks.
• Controlling the banks' balance sheet usage and structure
• Preparation of decisions on risks and risk management to the Board (including risk limits)
• Expressing opinions on issues with significant impact on company's risk profile
• Deciding on matters where the Board has delegated decision making authority to Credit and risk management committee.
• Reporting to the CEO and the Board on the overall risk profile of the company
• Reporting and presenting an overview of its activities to the Board including reporting to the Board on decisions made under the authority delegated by the Board.
• Control the adequacy of operational risk management.

CEO

The CEO is responsible for organizing risk management in Alisa Bank. The organization and responsibilities are defined so that the tasks concerning risk management and control do not compromise the compliance of the Risk Management Policy principles. The CEO and other senior management regularly assess the results of stress tests. The results of the stress tests are taken into consideration when defining or reviewing the business strategy, risk strategy and risk limits. The CEO and Credit and risk management committee have a responsibility to maintain the risk limit system and define clear mandates on risk taking. The CEO is also responsible for implementing the internal control and monitoring systems regarding risk management. CEO and the Management team is responsible for making sure that the personnel know the key risk management and control principles in Alisa Bank and operate accordingly. Head of business units are responsible for managing business risk.

Group Risk Control

Group Risk Control (GRC) is an independent unit established to monitor and control risk-taking mandates. GRC provides the business units with detailed reports on risk taking and provides the Board, Management team and Credit and risk management committee with aggregate level risk reports. GRC supports line management in the creation of its own risk management. GRC unit oversees the implementation of the financial and the non-financial risk policies. GRC unit monitors and controls the Risk Management Framework and oversees that all risks that Alisa Bank is or could be exposed to, are identified, assessed, monitored, managed, and reported on. GRC is responsible for following, controlling, and quantifying the holistic risk profile of Alisa Bank. GRC aim is to ensure and supervise that the company's risk management is at a sufficient level in relation to the quality, scope, diversity and risks of the company's business, and that all new and

10 (36)

material, previously unidentified risks are included in the risk management of the company's business operations.

The GRC has several objectives:

• Analysing and reporting material risks to the management (daily) and the Board & Credit and risk management committee (monthly)
• Daily monitoring of financial risk positions both on unit and aggregate level and elevating limit breaches
• Reporting risks which are inconsistent with the risk appetite to the management.
• Suggesting and implementing changes to the risk management framework
• Act as an early warning centre
• Compliance with regulatory rules related to risk management
• Coordination of the risk assessment of new products or other material changes, such as new systems or outsourcing.

Compliance

Compliance risk is defined in Alisa Bank as the risk of legal or regulatory sanctions, material financial loss, fines or loss to reputation Alisa Bank may suffer because of its failure to comply with laws, regulations, rules, agreements, and standards applicable to its operations. The Board holds the ultimate responsibility for the management of compliance risk in the Alisa Bank. The Management at all levels of the company is responsible for effective management of Compliance Risk in Alisa Bank.

The purpose of the Compliance function is to ensure regulatory compliance within the company by supporting the executive management and business units in the application of legislation, regulations and internal guidelines. In addition, the Compliance